5 ms·

Well, I'm happy to see that for once, they understand that the single most important thing is that it's verifiable. So many crypto-related systems ask you to t

by tribaal 12y ago

Well, I'm happy to see that for once, they understand that the single most important thing is that it's verifiable. So many crypto-related systems ask you to trust the provider implicitly it's not even funny. I don't care who you are, if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system. You can provide additional guarantees and proofs, but showing me the source is item number 0. Sure, it's not perfect, but it's much closer to perfect than any alternatives.

gioele 12y ago
> You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.
- Taniwha 12y ago
  as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....
  - notthetup 12y ago
    One of the kickstarter rewards could be the ICSP programmer HW (i'm guessing that's what you're using) so who ever wants to program it could do it.
    - Taniwha 12y ago
      we use a home-grown programmer - it's cheap but the bed-of-nails cable costs as much as the board - we wont be making any money on them
- tribaal 12y ago
  Oh, I was considering that as part of the "build it myself" point, but yeah, totally.
PhantomGremlin 12y ago
> if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system Other have already linked to https://www.fourmilab.ch/hotbits/hardware3.html https://www.fourmilab.ch/hotbits/hardware3.html and if your biggest concern is verifying it, then what could be simpler than detecting radioactive decay events?

by tribaal 12y ago

gioele 12y ago

> You can provide additional guarantees and proofs, but showing me the source is item number 0. And item number 0.5 is allowing me to build the source and upload it to a pristine EEPROM chip.

Taniwha 12y ago
as part of our kickstarter we'll be offering programmers as an added reward - you can build the image from source and program your device - and we hope you do and share the results with the world You can't program it over the USB (although we could) we consider that that would be a security problem - and given recent security issues with programmable USB devices ....
- notthetup 12y ago
  One of the kickstarter rewards could be the ICSP programmer HW (i'm guessing that's what you're using) so who ever wants to program it could do it.
  - Taniwha 12y ago
    we use a home-grown programmer - it's cheap but the bed-of-nails cable costs as much as the board - we wont be making any money on them
tribaal 12y ago
Oh, I was considering that as part of the "build it myself" point, but yeah, totally.

PhantomGremlin 12y ago

> if I can't look at the source (all the way down) of your product and build it myself, it's not going to make the cut as a "secure" system Other have already linked to https://www.fourmilab.ch/hotbits/hardware3.html https://www.fourmilab.ch/hotbits/hardware3.html and if your biggest concern is verifying it, then what could be simpler than detecting radioactive decay events?