5 ms·

You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you Wait, what? In most cases you 100% know who

You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you Wait, what? In most cases you 100% know who designed and manufactured it. Regarding "swapping out" a TPM, how do you do that for fTPMs or TPMs that are on the same die as the CPU? Come up with a perfect replica AMD CPU with a bugged TPM? Desolder the original CPU and put the replica in?

sidewndr46 3y ago
I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) include a complete lockset. I tell you that the lockset is totally secure. I offer you volumes of academic research and attestations that this is true. But there is no practical means by which you can establish the security of that lockset. Do you believe that no one else can open your front door?
- brookst 3y ago
  > It's painfully obvious nowadays that openssl was written by the NSA The problem is that your lack of context and perspective on this fairly simple, easily-falsified theory calls all of your opinions into question. A more nuanced conspiracy theorist would say "if you look at PR's to openssl that contributed later-discovered security issues, 70% were from first-time contributors who never went on to submit any other PR's". And I'd be like "wow, that's suggestive of a coordinated action", and we could dig into it. But "the NSA wrote openssl" is as factually, demonstrably wrong as saying "the NSA builds every door lock that's for sale at Home Depot". It's too big of a conspiracy, to inefficient for the supposed state goals, and too easy to falsify by just looking at a couple of examples.
  - sidewndr46 3y ago
    Or we could look at what history tells us and find out we don't need some convoluted theory of evidence with a bunch of 1st time contributors. You might for example, just outright buy out the cryptography solution providers: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG Money is a relatively simply mechanism to achieve an end goal. Much safer than for example, torturing someone or beating them with a wrench.
kaetemi 3y ago
The only one that would fit my mainboard I bought on Amazon, and I only got it to upgrade Windows. The indication on it is "made in China". As a consumer I also have no idea how these suspicious chips that I'm required to plug into my mainboard are supposedly trusted, and by whom, and what for. "Plug this chip that says made in China into your mainboard, for security reasons, to continue." is not really emitting trust or confidence in any way.
- ilyt 3y ago
  > "Plug this chip that says made in China into your mainboard, for security reasons, to continue." is not really emitting trust or confidence in any way. " I'm sure 30 other chips made in china on same board are entirely fine
  - kaetemi 3y ago
    Yeah, but from a user POV at least those are functional and not just for vaguely specified "security reasons".

sidewndr46 3y ago

I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) include a complete lockset. I tell you that the lockset is totally secure. I offer you volumes of academic research and attestations that this is true. But there is no practical means by which you can establish the security of that lockset. Do you believe that no one else can open your front door?

brookst 3y ago
> It's painfully obvious nowadays that openssl was written by the NSA The problem is that your lack of context and perspective on this fairly simple, easily-falsified theory calls all of your opinions into question. A more nuanced conspiracy theorist would say "if you look at PR's to openssl that contributed later-discovered security issues, 70% were from first-time contributors who never went on to submit any other PR's". And I'd be like "wow, that's suggestive of a coordinated action", and we could dig into it. But "the NSA wrote openssl" is as factually, demonstrably wrong as saying "the NSA builds every door lock that's for sale at Home Depot". It's too big of a conspiracy, to inefficient for the supposed state goals, and too easy to falsify by just looking at a couple of examples.
- sidewndr46 3y ago
  Or we could look at what history tells us and find out we don't need some convoluted theory of evidence with a bunch of 1st time contributors. You might for example, just outright buy out the cryptography solution providers: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG Money is a relatively simply mechanism to achieve an end goal. Much safer than for example, torturing someone or beating them with a wrench.

kaetemi 3y ago

The only one that would fit my mainboard I bought on Amazon, and I only got it to upgrade Windows. The indication on it is "made in China". As a consumer I also have no idea how these suspicious chips that I'm required to plug into my mainboard are supposedly trusted, and by whom, and what for. "Plug this chip that says made in China into your mainboard, for security reasons, to continue." is not really emitting trust or confidence in any way.

ilyt 3y ago
> "Plug this chip that says made in China into your mainboard, for security reasons, to continue." is not really emitting trust or confidence in any way. " I'm sure 30 other chips made in china on same board are entirely fine
- kaetemi 3y ago
  Yeah, but from a user POV at least those are functional and not just for vaguely specified "security reasons".