5 ms·

OSFC is not just boot security at all! For an example of past talks that do not hit on boot security at all, see (e.g.) [0] and [1]. [0] https://www.osfc.io/2

OSFC is not just boot security at all! For an example of past talks that do not hit on boot security at all, see (e.g.) [0] and [1]. [0] https://www.osfc.io/2021/talks/on-hubris-and-humility-developing-an-os-for-robustness-in-rust/ https://www.osfc.io/2021/talks/on-hubris-and-humility-develo... [1] https://www.osfc.io/2022/talks/i-have-come-to-bury-the-bios-not-to-open-it-the-need-for-holistic-systems/ https://www.osfc.io/2022/talks/i-have-come-to-bury-the-bios-...

trinsic2 3y ago
I'm sorry, this looks more about securing the boot for embedded devices and not really related to user control of firmware and preventing closed source code that takes away freedom/spy's on the user. The program of day one is below: Main Room OSFC 2022 Opening Event Christian Walter , Philipp Deppenwiese Open firmware on your infrastructure, not only for hyperscalers. Erwan Velu Talk details: Open firmware on your infrastructure, not only for hyperscalers. Introduction to VBE - Verified Boot for Embedded Simon Glass Talk details: Introduction to VBE - Verified Boot for Embedded Tillitis Key - A USB security key inspired by measured boot and DICE Fredrik Stromberg , Sasko Simonovski , Michael 'MC' Cardell Widerkrantz The “Thing” Around Your System Firmware Christian Walter , Subrata Banik Talk details: The “Thing” Around Your System Firmware Protecting TPM Commands from Active Interposers Jordan Hand Talk details: Protecting TPM Commands from Active Interposers FirmwareBleed: The industry failures to adopt SMM mitigations introduced years ago Alex Matrosov , Philipp Deppenwiese Talk details: FirmwareBleed: The industry failures to adopt SMM mitigations introduced years ago I have come to bury the BIOS, not to open it: The need for holistic systems Bryan Cantrill Talk details: I have come to bury the BIOS, not to open it: The need for holistic systems Linux as a UEFI bootloader and kexecing windows Trammell Hudson Talk details: Linux as a UEFI bootloader and kexecing windows How Min Platform led to Max coreboot; a case study ronald g. minnich Talk details: How Min Platform led to Max coreboot; a case study
- bcantrill 3y ago
  I'm not sure what exactly you're after, but much of firmware's responsibility is system initialization -- to be interested in open source firmware but be disinterested in booting is to not understand firmware's role in a system. And certainly there is nothing at OSFC about "preventing" closed firmware -- the only way to do that is to not purchase devices that have compute elements in them. (Good luck!) And finally, if there's something different you would like to see at OSFC, submit a talk for OSFC 2024!
  - trinsic2 3y ago
    My understanding of open firmware is making sure that the booting process is accessible to the user. Securing the boot process from intruders is secondary to that. It appears that these talks are more about securing the boot process, rather than talking about how to make the boot process more accessible. Secondly, these events looks like their geared toward the private sector, rather than enthusiasts. Why would I want to invest my time in contributing to a problem that is already made worse by commercial endeavors that seem to want to take control away from the user?
    - pgeorgi 3y ago
      The OSFC is a direct outgrowth of the coreboot hackathons/conferences between 2014-2017, opening up to wider open source firmware topics. All the fun "how to open things up" subjects* have been talked to death in that community, so the conferences are now about questions like "how to improve on the state of the art in firmware?" * https://ecc2017.com/schedule-location https://ecc2017.com/schedule-location has the list of 2017 with gems like: DDR3 on Sandy Bridge, reversing Mediatek MT8173, reversing x86 microcode. 2016, with video links: https://www.coreboot.org/Coreboot_conference_San_Francisco_2016 https://www.coreboot.org/Coreboot_conference_San_Francisco_2... 2014-2015 don't have video, I think.
      - trinsic2 3y ago
        No disrespect intended, and you probably have good motives. I looked at those links and it still seems like the focus is on boot security, focused around ChromeOS. Regardless of whether or not the issue of "opening things up" has been talked to death in the coreboot/hackathon community (which sounds like a tactic to marginalize the enthusiast community), This is a critical topic right now for me, and i'm sure many others. Not everything is about providing security for embedded devices. I know this is an important topic for the commercial sector, but this push toward more security in the boot process seems more about locking people out of customizing their systems instead of providing security. IMHO, that is a terrible path to take if it becomes a standard for all computing, which many things seem to be heading in that direction.

trinsic2 3y ago

I'm sorry, this looks more about securing the boot for embedded devices and not really related to user control of firmware and preventing closed source code that takes away freedom/spy's on the user. The program of day one is below: Main Room OSFC 2022 Opening Event Christian Walter , Philipp Deppenwiese Open firmware on your infrastructure, not only for hyperscalers. Erwan Velu Talk details: Open firmware on your infrastructure, not only for hyperscalers. Introduction to VBE - Verified Boot for Embedded Simon Glass Talk details: Introduction to VBE - Verified Boot for Embedded Tillitis Key - A USB security key inspired by measured boot and DICE Fredrik Stromberg , Sasko Simonovski , Michael 'MC' Cardell Widerkrantz The “Thing” Around Your System Firmware Christian Walter , Subrata Banik Talk details: The “Thing” Around Your System Firmware Protecting TPM Commands from Active Interposers Jordan Hand Talk details: Protecting TPM Commands from Active Interposers FirmwareBleed: The industry failures to adopt SMM mitigations introduced years ago Alex Matrosov , Philipp Deppenwiese Talk details: FirmwareBleed: The industry failures to adopt SMM mitigations introduced years ago I have come to bury the BIOS, not to open it: The need for holistic systems Bryan Cantrill Talk details: I have come to bury the BIOS, not to open it: The need for holistic systems Linux as a UEFI bootloader and kexecing windows Trammell Hudson Talk details: Linux as a UEFI bootloader and kexecing windows How Min Platform led to Max coreboot; a case study ronald g. minnich Talk details: How Min Platform led to Max coreboot; a case study

bcantrill 3y ago
I'm not sure what exactly you're after, but much of firmware's responsibility is system initialization -- to be interested in open source firmware but be disinterested in booting is to not understand firmware's role in a system. And certainly there is nothing at OSFC about "preventing" closed firmware -- the only way to do that is to not purchase devices that have compute elements in them. (Good luck!) And finally, if there's something different you would like to see at OSFC, submit a talk for OSFC 2024!
- trinsic2 3y ago
  My understanding of open firmware is making sure that the booting process is accessible to the user. Securing the boot process from intruders is secondary to that. It appears that these talks are more about securing the boot process, rather than talking about how to make the boot process more accessible. Secondly, these events looks like their geared toward the private sector, rather than enthusiasts. Why would I want to invest my time in contributing to a problem that is already made worse by commercial endeavors that seem to want to take control away from the user?
  - pgeorgi 3y ago
    The OSFC is a direct outgrowth of the coreboot hackathons/conferences between 2014-2017, opening up to wider open source firmware topics. All the fun "how to open things up" subjects* have been talked to death in that community, so the conferences are now about questions like "how to improve on the state of the art in firmware?" * https://ecc2017.com/schedule-location https://ecc2017.com/schedule-location has the list of 2017 with gems like: DDR3 on Sandy Bridge, reversing Mediatek MT8173, reversing x86 microcode. 2016, with video links: https://www.coreboot.org/Coreboot_conference_San_Francisco_2016 https://www.coreboot.org/Coreboot_conference_San_Francisco_2... 2014-2015 don't have video, I think.
    - trinsic2 3y ago
      No disrespect intended, and you probably have good motives. I looked at those links and it still seems like the focus is on boot security, focused around ChromeOS. Regardless of whether or not the issue of "opening things up" has been talked to death in the coreboot/hackathon community (which sounds like a tactic to marginalize the enthusiast community), This is a critical topic right now for me, and i'm sure many others. Not everything is about providing security for embedded devices. I know this is an important topic for the commercial sector, but this push toward more security in the boot process seems more about locking people out of customizing their systems instead of providing security. IMHO, that is a terrible path to take if it becomes a standard for all computing, which many things seem to be heading in that direction.