5 ms·
Not to discredit this product, but I'm having a harder and harder time trusting products that feature high security. They seem like trojan horses. I think I'm p
by robotkilla 11y ago
Not to discredit this product, but I'm having a harder and harder time trusting products that feature high security. They seem like trojan horses. I think I'm probably just being paranoid - is there a trustworthy independent third-party of some sort that verifies just how private these types of products are?
Edit: to be clear this is most likely an awesome product put out by people who care about security and privacy. I'm not trying to call this product out specifically. Privacy / security are really bold claims and without any specific regulations in the area that I'm aware of I feel extra cautious around anything claiming to provide those things. Like I said, I'm probably just being paranoid, but I like to think strategically, and if i were to be a spy agency of any sort and thought I could get away with it, selling a not-so-private privacy product would definitely be a move of mine.
- walterbell 11y ago> without any specific regulations in the area What regulations, issued by which authority, would you trust? The Purism claims are relevatively small (e.g. camera/microphone hardware switch can be verified by a motherboard inspection) and are an incremental move in a positive direction. What we need are more competitors to Purism.
- robotkilla 11y agoNone actually. edit: something like the EFF perhaps but even then you're just trusting the skills of whoever volunteers for / gets paid by them.
- dandelion_lover 11y agoFor example, Free Software Foundation: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/resources/hw/endorsement/respects-your-f...
- robotkilla 11y agointeresting thanks for the link
- em3rgent0rdr 11y agoI'd recommend getting an old thinkpad or macbook compatible with libreboot (http://www.libreboot.org/ http://www.libreboot.org/) which is apporved by FSF and only runs free software in the bootloader/BIOS. Purism, on the other hand, uses a proprietary bootloader, as well as proprietary BIOS, as well as proprietary code for Intel FSP, Intel ME, Intel VBIOS, and Intel CPU microcode updates.
- walterbell 11y agoAt user request, the Intel i7 CPU in the Purism 15 was chosen to include VT-d support (needed for Qubes security, which isolates the GPU to a single driver VM) and to exclude support for the black box Intel ME hardware (vPro). In contrast, on virtually every mainstream laptop with VT-d, you are forced to use a CPU which includes Intel ME/vPro support. http://ark.intel.com/products/84993/Intel-Core-i7-5557U-Processor-4M-Cache-up-to-3_40-GHz http://ark.intel.com/products/84993/Intel-Core-i7-5557U-Proc...
- userbinator 11y agoME is in the chipset and not the CPU[1][2]. Chances are the silicon for it is there and working, but Intel doesn't officially "support" ME with that chipset+CPU combination and supplies firmware that doesn't use it. It doesn't necessarily mean there is no ME capability that could be exploited. IMHO "support" has become a bit of a weasel-word today, meaning everything from "it's physically impossible because the hardware doesn't even have the circuitry" to "it's all there and functional, but we just don't want you to use it". In between are things like disabled via undocumented hardware jumpers or software settings (remember how certain AMD CPUs could have extra cores "unlocked"? Same principle.) The older models without ME are the former, but I'm almost willing to bet that the latter is the case of the newer CPUs and chipsets. [1] https://ruxconbreakpoint.com/assets/2014/slides/bpx-Breakpoint%202014%20Skochinsky.pdf https://ruxconbreakpoint.com/assets/2014/slides/bpx-Breakpoi... [2] http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf http://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf
- walterbell 11y ago
- skolor 11y agoI'm pretty put off that I spent 5 minutes digging around on their site and couldn't find one of those claims. All I saw was "Everyone is trying to steal your private datas, but for a large markup we can make you secure."
- walterbell 11y agoThe crowdfunding pages are easier to read. https://www.crowdsupply.com/purism/librem-13 https://www.crowdsupply.com/purism/librem-13 https://www.crowdsupply.com/purism/librem-15 https://www.crowdsupply.com/purism/librem-15
- em3rgent0rdr 11y agoactually, those claims they made during crowdsupply phase have not been incorporated into final design. See http://www.reddit.com/r/linux/comments/3anjgm/on_the_librem_laptop_purism_doesnt_believe_in/ http://www.reddit.com/r/linux/comments/3anjgm/on_the_librem_...
- robotkilla 11y agoTo follow up: the crowdsourced page does indeed make a large number of claims which at least make this sound like a very secure and privacy ensuring device. When I mentioned regulations, I was thinking along the lines of ad companies in the US. For example, an ad for a sleeping pill wouldn't be allowed to outright claim to put you to sleep if the pill didn't work... unless that pill was labeled under homeopathic medicine, then all bets are off because homeopathic "medicine" is unregulated (or was the last time I checked). New (and also old) privacy focused companies remind me of homeopathic medicine.
- walterbell 11y agoThis old blog post has some info about BIOS and firmware, https://puri.sm/posts/bios-freedom-status/ https://puri.sm/posts/bios-freedom-status/ . We need more OEMs to publish similar lists and begin moving the incremental needle towards transparency, rather than claiming an opaque supply chain of black box components.
- vidstr 11y ago"is there a trustworthy independent third-party of some sort that verifies just how private these types of products are?" Internet?!
- username 11y agoIt certainly would be interesting if NSA started intercepting and implanting these products à la Cisco ;)