5 ms·

Even if you run Linux, how to you ensure that the SoC does not e.g. scan memory and send telemetry to Apple independently of the installed operating system?

hmottestad 5y ago
If you're worried about these sorts of situations then there aren't going to be very many choices for you. You can't choose Intel because they have their management engine, you can't choose AMD because they don't own their own fabs. You could go full air-gapped and get a machine without any network cards. Would still recommend a nice bunker deep inside a mountain just to be on the safe side.
- avhception 5y ago
  Well, there still is https://raptorcs.com/content/base/products.html https://raptorcs.com/content/base/products.html if you're not dependent on x86-64... You'd still be relying on other peoples fabs, of course. But it's a step up.
- markb139 5y ago
  I wonder if you could get around this by having a multi CPU machine setup (many vendors silicon) and have a "Generals problem" algorithm ?
- varispeed 5y ago
  Ok, so because other companies do that it should be acceptable? I don't understand your patronising tone. How is that helpful?
  - hmottestad 5y ago
    I don't think Apple does this.
  - nindalf 5y ago
    Your concerns mean theres no modern device you could possibly be using. So either you’re bringing up something that no one, including you, actually cares about. Or you’re commenting on Hacker news using the butterfly method on HN servers (https://xkcd.com/378/ https://xkcd.com/378/)
  - skinkestek 5y ago
    It is just that many of us are fed up with people who immediately move the goal posts every single time someone presents an alternative or an improvent. The implication (intentionally or not) being that we can just as well continue to run Chrome on Windows 11 on open WiFis because everything is broken all the time and if not any Three Letter Agency can always kidnap you or someone you care about and get their secrets that way. Encryption works and massively increases the workload for would be drag net operators! Having a choice of technology is good and also increases the workload for would be drag net operators. Competition is good and forces companies to get their act together. Trashing every good thing that happens because it isn't perfect is demotivating and I'm also absolutely fed up with it.
  - notafraudster 5y ago
    Assuming your question was sincere: You cannot ensure that the SoC isn't doing something secret that the OS doesn't know about in this environment. Every respondent so far assumed you knew this (because it's an unusually high-knowledge question to ask and an unusually obvious answer) and so assumed the actual purpose of your post was to declare that you personally wouldn't use an environment where you can't be sure the SoC isn't doing something nefarious. The people replying don't really find that declaration interesting. Your subsequent reply says that the choice to live with this particular risk is some sort of tacit acceptance, which implies you are not tacitly accepting it. Since no such environment exists, except for edge case hypotheticals like only powering an air gapped computer inside a faraday cage in a lead bunker, most people expect that you too are tacitly accepting it, which makes this particular complaint feel like a non sequitur and not an invitation to discuss the broader issue. If you have an actual real life use case about trying to harden a system to this degree, like you are responsible for nuclear safety or the unlock codes for the secret lunar base or something, I am sure people would like to read about it.
- d3nj4l 5y ago
  AMD processors also have an equivalent to the Intel Management Engine: https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...
jeroenhd 5y ago
Simply put: you don't. You'll have to design your own chip factories and design your own chips if you want to ensure that the SoC doesn't leak. There's a reason China and Russia build their own CPUs. There's nothing else you can do to ensure that nothing leaks. In practice, you could probably run the machine for a while hooked up to an ethernet cable and sniff the outgoing packets. I don't think the M1 will send Apple telemetry on its own (though it certainly could, if it wanted to).
- Someone 5y ago
  In theory, your photolithography machine could be back-doored, too. So better design that yourself, too, and/or take out your microscope (if digital, taking care that isn’t back-doored, either) I also guess more advanced adversaries will add stuff that only becomes active after a long time, and may use steganography to hide what it’s sending. So, bootstrap your system the way this guy does: http://paillard.claude.free.fr/video.mp4 http://paillard.claude.free.fr/video.mp4 (I don’t think he has gone past vacuum tubes)
  - mavhc 5y ago
    What if someone backdoors education and everyone's been learning the insecure way of programming?....
    - eddieroger 5y ago
      Why backdoor all of education when they could just attack Stack Overflow to greater effect?
- gpderetta 5y ago
  You also need to design your own software to design the chip, your own compiler, and the OS the compiler and design software run on...
  - jeroenhd 5y ago
    All of which require trusted hardware to run on! The bootstrapping problem is real. I wonder how the Chinese and Russians have validated custom chip designs. I don't think the compiler would be bugged specifically for chip design software, but there's no real way to tell...
tpxl 5y ago
Put a proxy between you and the internet and reject everything your OS didn't send (Assuming you're using nothing but wired ethernet).
- notafraudster 5y ago
  Assuming of course the M1 doesn't have SoC code to zero day your proxy server or zero day your OS and selectively allow itself to circumvent this. But if Apple were really clever they'd add a secret undocumented radio built into the SoC package that sends signals modulated in an unusual way over an unusual low-bandwidth but high signal frequency (probably sub-CB Radio) that no one is monitoring. Which now brings you to the scenario that you have to use a machine that not only never uses a network, but also exists in a physical place that no network signal could ever penetrate. And it goes without saying that having taken this level of caution, one should probably buy the computer with a fake name and all cash, ideally through a network of international proxy buyers, to be sure.
  - notafraudster 5y ago
    I omitted the word "reliability" in the phrase "high... signal" and didn't notice until after the edit window.
  - tpxl 5y ago
    > place that no network signal could ever penetrate. This is actually rather trivial to achieve, just put it in a faraday cage.
rowanG077 5y ago
You can't. But that worry is not Apple specific. Unless you fab your own chip this can always happen. And in fab your own chip I don't mean contract TSMC to do it. Literally do it yourself. TSMC could also place a trojan on the silicon.
japanuspus 5y ago
If you read the twitter thread, there is a lot of details on "macs are locked down" posted by OP and others below this comment: https://twitter.com/_Thaodan/status/1458581955688206340 https://twitter.com/_Thaodan/status/1458581955688206340
fulafel 5y ago
You could run black box experiments observing signals from the machine, or use some hw reverse engineering approaches, eg by analyzing the firmware.
marcan_42 5y ago
If you want to ensure the SoC is not backdoored, your only option is Precursor, which can make a fairly solid claim that silicon backdoors for FPGAs are infeasible in the general case. https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor If you're willing to trust that the silicon isn't secretly backdoored in some ridiculous invisible way, well, unlike Intel, the M1 does not have any hyper-privileged proprietary firmware by all indications, and that proprietary firmware which does exist is plaintext and analyzable (and not privileged to scan memory), so I have a much easier time trusting these machines than a random x86 PC (all-privileged SMM supervisor and ME/PSP) or Android phone (all-privileged TrustZone supervisor).

hmottestad 5y ago

If you're worried about these sorts of situations then there aren't going to be very many choices for you. You can't choose Intel because they have their management engine, you can't choose AMD because they don't own their own fabs. You could go full air-gapped and get a machine without any network cards. Would still recommend a nice bunker deep inside a mountain just to be on the safe side.

avhception 5y ago
Well, there still is https://raptorcs.com/content/base/products.html https://raptorcs.com/content/base/products.html if you're not dependent on x86-64... You'd still be relying on other peoples fabs, of course. But it's a step up.
markb139 5y ago
I wonder if you could get around this by having a multi CPU machine setup (many vendors silicon) and have a "Generals problem" algorithm ?
varispeed 5y ago
Ok, so because other companies do that it should be acceptable? I don't understand your patronising tone. How is that helpful?
- hmottestad 5y ago
  I don't think Apple does this.
- nindalf 5y ago
  Your concerns mean theres no modern device you could possibly be using. So either you’re bringing up something that no one, including you, actually cares about. Or you’re commenting on Hacker news using the butterfly method on HN servers (https://xkcd.com/378/ https://xkcd.com/378/)
- skinkestek 5y ago
  It is just that many of us are fed up with people who immediately move the goal posts every single time someone presents an alternative or an improvent. The implication (intentionally or not) being that we can just as well continue to run Chrome on Windows 11 on open WiFis because everything is broken all the time and if not any Three Letter Agency can always kidnap you or someone you care about and get their secrets that way. Encryption works and massively increases the workload for would be drag net operators! Having a choice of technology is good and also increases the workload for would be drag net operators. Competition is good and forces companies to get their act together. Trashing every good thing that happens because it isn't perfect is demotivating and I'm also absolutely fed up with it.
- notafraudster 5y ago
  Assuming your question was sincere: You cannot ensure that the SoC isn't doing something secret that the OS doesn't know about in this environment. Every respondent so far assumed you knew this (because it's an unusually high-knowledge question to ask and an unusually obvious answer) and so assumed the actual purpose of your post was to declare that you personally wouldn't use an environment where you can't be sure the SoC isn't doing something nefarious. The people replying don't really find that declaration interesting. Your subsequent reply says that the choice to live with this particular risk is some sort of tacit acceptance, which implies you are not tacitly accepting it. Since no such environment exists, except for edge case hypotheticals like only powering an air gapped computer inside a faraday cage in a lead bunker, most people expect that you too are tacitly accepting it, which makes this particular complaint feel like a non sequitur and not an invitation to discuss the broader issue. If you have an actual real life use case about trying to harden a system to this degree, like you are responsible for nuclear safety or the unlock codes for the secret lunar base or something, I am sure people would like to read about it.
d3nj4l 5y ago
AMD processors also have an equivalent to the Intel Management Engine: https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

jeroenhd 5y ago

Simply put: you don't. You'll have to design your own chip factories and design your own chips if you want to ensure that the SoC doesn't leak. There's a reason China and Russia build their own CPUs. There's nothing else you can do to ensure that nothing leaks. In practice, you could probably run the machine for a while hooked up to an ethernet cable and sniff the outgoing packets. I don't think the M1 will send Apple telemetry on its own (though it certainly could, if it wanted to).

Someone 5y ago
In theory, your photolithography machine could be back-doored, too. So better design that yourself, too, and/or take out your microscope (if digital, taking care that isn’t back-doored, either) I also guess more advanced adversaries will add stuff that only becomes active after a long time, and may use steganography to hide what it’s sending. So, bootstrap your system the way this guy does: http://paillard.claude.free.fr/video.mp4 http://paillard.claude.free.fr/video.mp4 (I don’t think he has gone past vacuum tubes)
- mavhc 5y ago
  What if someone backdoors education and everyone's been learning the insecure way of programming?....
  - eddieroger 5y ago
    Why backdoor all of education when they could just attack Stack Overflow to greater effect?
gpderetta 5y ago
You also need to design your own software to design the chip, your own compiler, and the OS the compiler and design software run on...
- jeroenhd 5y ago
  All of which require trusted hardware to run on! The bootstrapping problem is real. I wonder how the Chinese and Russians have validated custom chip designs. I don't think the compiler would be bugged specifically for chip design software, but there's no real way to tell...

tpxl 5y ago

Put a proxy between you and the internet and reject everything your OS didn't send (Assuming you're using nothing but wired ethernet).

notafraudster 5y ago
Assuming of course the M1 doesn't have SoC code to zero day your proxy server or zero day your OS and selectively allow itself to circumvent this. But if Apple were really clever they'd add a secret undocumented radio built into the SoC package that sends signals modulated in an unusual way over an unusual low-bandwidth but high signal frequency (probably sub-CB Radio) that no one is monitoring. Which now brings you to the scenario that you have to use a machine that not only never uses a network, but also exists in a physical place that no network signal could ever penetrate. And it goes without saying that having taken this level of caution, one should probably buy the computer with a fake name and all cash, ideally through a network of international proxy buyers, to be sure.
- notafraudster 5y ago
  I omitted the word "reliability" in the phrase "high... signal" and didn't notice until after the edit window.
- tpxl 5y ago
  > place that no network signal could ever penetrate. This is actually rather trivial to achieve, just put it in a faraday cage.

rowanG077 5y ago

You can't. But that worry is not Apple specific. Unless you fab your own chip this can always happen. And in fab your own chip I don't mean contract TSMC to do it. Literally do it yourself. TSMC could also place a trojan on the silicon.

japanuspus 5y ago

If you read the twitter thread, there is a lot of details on "macs are locked down" posted by OP and others below this comment: https://twitter.com/_Thaodan/status/1458581955688206340 https://twitter.com/_Thaodan/status/1458581955688206340

fulafel 5y ago

You could run black box experiments observing signals from the machine, or use some hw reverse engineering approaches, eg by analyzing the firmware.

marcan_42 5y ago

If you want to ensure the SoC is not backdoored, your only option is Precursor, which can make a fairly solid claim that silicon backdoors for FPGAs are infeasible in the general case. https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor If you're willing to trust that the silicon isn't secretly backdoored in some ridiculous invisible way, well, unlike Intel, the M1 does not have any hyper-privileged proprietary firmware by all indications, and that proprietary firmware which does exist is plaintext and analyzable (and not privileged to scan memory), so I have a much easier time trusting these machines than a random x86 PC (all-privileged SMM supervisor and ME/PSP) or Android phone (all-privileged TrustZone supervisor).