5 ms·
It's great to see that more people are still working on this and that people have an interest. If you are interested in this kind of thing, then you'll also wa
by guerrilla 5y ago
It's great to see that more people are still working on this and that people have an interest.
If you are interested in this kind of thing, then you'll also want to check out LibreBoot[1] and Bootstrappable Builds[2]. The latter is working with stage0 [3] and mes [4] to bootstrap Guix (among other projects.) All of that is further down the chain, but we'll need it if we want to build trustworthy systems.
1. https://libreboot.org/ https://libreboot.org/
2. https://www.bootstrappable.org https://www.bootstrappable.org
3. https://github.com/oriansj/stage0/ https://github.com/oriansj/stage0/
4. https://www.gnu.org/software/mes/ https://www.gnu.org/software/mes/
- matheusmoreira 5y agoWish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
- tenebrisalietum 5y ago> Only way to be sure is to physically destroy the device. Or ... never write unencrypted data to the device.
- matheusmoreira 5y agoYeah, that was my solution as well. It's much easier to destroy a small secret key than terabytes of data.
- kragen 5y agoEspecially with N-of-M secret sharing.
- galcerte 5y agoI thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else? Would any snooping be possible through an input device if it only did HID?
- matheusmoreira 5y ago> PCs through a subset of the USB standard which only handles HID and nothing else? Yes. Is the device truly limited to doing just that, though? No way to know. I don't know enough electronics to tear it down and analyze its parts, much less dump firmware and reverse engineer it. >Would any snooping be possible through an input device if it only did HID? For all I know, it could be silently storing every keystroke in some small memory module hidden somewhere.
- roywiggins 5y agoWe had that problem with PS/2 keyboards too, you can buy hardware keyloggers for those.
- LargoLasskhyfv 5y agoAFAIK it wasn't possible for a PS/2 connected thing to suddenly present itself as some sort of drive, present a file on that, and then have that executed via autoload, or so.