3 ms·

While accepting the other replies, I do wonder how hardware trust is achieved. The security point about open source is peer review. For a dunce like me, I can p

by alan_cx 13y ago

While accepting the other replies, I do wonder how hardware trust is achieved. The security point about open source is peer review. For a dunce like me, I can pretty much rely on people much smarter than me to review open sourced code. In reasonable time, if there is a iffy routine buried in some bit of software, such people will out it. So, people like me can pretty much trust it, and even if something is missed but later found, again, we can be sure the discoverer will report it, while a commercial organisation might be motivated to hide it. But, how does that work with hardware? How do we trust all the chips? How do we know there isn't something iffy built in at manufacture? Then, how can those same cleverer than me people discover it? How do they inspect the encased silicone circuit? So, in that vein, I see the point you might have been making, and actually, I think its a worthwhile question. Because to me, it does look like what you describe, a sort of closed source hardware which runs all open source software. And I personally dont know that that is safe. Or is it?

xradionut 13y ago
Quote from the original linked article: "Our Novena Project is of course still vulnerable to techniques such as silicon poisoning, but at least it pushes openness and disclosure down a layer, which is tangible progress in the right direction." Many of the security flaws and known back doors are in the firmware, (see routers for example), which Bunny is resolving by making Open Source. It's probably impossible to eliminate all attack vectors, but by opening the processes up, you can eliminate most of the easier ones.
drone 13y ago
Open-source hardware and software are analogous in this sense: pre-built hardware is like pre-built software. You can only truly trust it if you built it yourself. However, unlike pre-built software, often you can visually determine if high-order modifications have been made, e.g. additional components, re-routed traces, etc. You can't really trust silicon, and this leads to a larger point about much of what has been called open-source hardware: many of the open-source boards out there which are really popular are little more than reference designs translated from a datasheet to a schematic capture program for a closed-source blob of silicon. However, this point doesn't escape many people in "the movement," the problem has just been that the technology that meets the users' expectation of performance and capability is out of their financial reach to duplicate. So, the users settle for "re-create" when they can, rather than "trust at all levels". In the majority of cases, absolute trust is not required, because a breech of that trust can result in practically nothing. ("Oh, this AVR chip is back-doored, allowing you to access its 32k of flash, but I haven't provided any means by which a 3rd party could access that via hardware.")

by alan_cx 13y ago

xradionut 13y ago

Quote from the original linked article: "Our Novena Project is of course still vulnerable to techniques such as silicon poisoning, but at least it pushes openness and disclosure down a layer, which is tangible progress in the right direction." Many of the security flaws and known back doors are in the firmware, (see routers for example), which Bunny is resolving by making Open Source. It's probably impossible to eliminate all attack vectors, but by opening the processes up, you can eliminate most of the easier ones.

drone 13y ago

Open-source hardware and software are analogous in this sense: pre-built hardware is like pre-built software. You can only truly trust it if you built it yourself. However, unlike pre-built software, often you can visually determine if high-order modifications have been made, e.g. additional components, re-routed traces, etc. You can't really trust silicon, and this leads to a larger point about much of what has been called open-source hardware: many of the open-source boards out there which are really popular are little more than reference designs translated from a datasheet to a schematic capture program for a closed-source blob of silicon. However, this point doesn't escape many people in "the movement," the problem has just been that the technology that meets the users' expectation of performance and capability is out of their financial reach to duplicate. So, the users settle for "re-create" when they can, rather than "trust at all levels". In the majority of cases, absolute trust is not required, because a breech of that trust can result in practically nothing. ("Oh, this AVR chip is back-doored, allowing you to access its 32k of flash, but I haven't provided any means by which a 3rd party could access that via hardware.")