3 ms·

> RF laws ... There's no way out for device manufacturers other than a complete chain of trust ... You make the baseband processor physically separate from the

> RF laws ... There's no way out for device manufacturers other than a complete chain of trust ... You make the baseband processor physically separate from the app processor and run it off of firmware that the application processor can't reflash. All phones do this. Then it doesn't matter what boots up on the app processor, and only the baseband processor has to be certified. Nobody is trying to obey RF laws using Secure Boot on the application processor. There are other reasons for Secure Boot on the AP but this isn't one of them.

immibis 3y ago
There are more laws than RF laws, anyway. Why don't we trust application processors to obey RF laws, but we trust them to obey copyright laws and port scanning laws?
- electroly 3y ago
  RF laws have teeth and enforcement and the other laws don't. You get in actual trouble if your device violates FCC broadcast regulations, and you have to get your device certified before you're allowed to sell it. There's no law that gets you, the device manufacturer, in trouble if someone hacks your device and gets it to port scan or violate copyright, and no mandatory certification that those things are impossible on your device. Hell, you won't even get in trouble for doing the copyright infringement yourself (e.g. GPL violations). Ditto for literally shipping app-side malware from the factory (e.g. sketchy Chinese phones).
  - gary_0 3y ago
    Also, knowing whether copyright or the CFAA has been violated might require a lengthy court case between the accused and the purported legitimate owner. RF violations are an FCC guy with an antenna telling you to cut it out. Everything is explicitly licensed by the Feds ahead of time, copyright and computer access usually isn't.
mschuster91 3y ago
As soon as a manufacturer allows untrusted code to say "you're in country X" to the modem/wifi firmware, it's hard to keep up with the requirement of not exceeding emission limits.

immibis 3y ago

There are more laws than RF laws, anyway. Why don't we trust application processors to obey RF laws, but we trust them to obey copyright laws and port scanning laws?

electroly 3y ago
RF laws have teeth and enforcement and the other laws don't. You get in actual trouble if your device violates FCC broadcast regulations, and you have to get your device certified before you're allowed to sell it. There's no law that gets you, the device manufacturer, in trouble if someone hacks your device and gets it to port scan or violate copyright, and no mandatory certification that those things are impossible on your device. Hell, you won't even get in trouble for doing the copyright infringement yourself (e.g. GPL violations). Ditto for literally shipping app-side malware from the factory (e.g. sketchy Chinese phones).
- gary_0 3y ago
  Also, knowing whether copyright or the CFAA has been violated might require a lengthy court case between the accused and the purported legitimate owner. RF violations are an FCC guy with an antenna telling you to cut it out. Everything is explicitly licensed by the Feds ahead of time, copyright and computer access usually isn't.

mschuster91 3y ago

As soon as a manufacturer allows untrusted code to say "you're in country X" to the modem/wifi firmware, it's hard to keep up with the requirement of not exceeding emission limits.