Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is the latest AMD hardware unsupported in libreboot?

libreboot.org

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Why is the latest AMD hardware unsupported in libreboot?

#31

Post by AnthonyMouse »

wmf wrote: post #24
tadfisher wrote: post #19

Earlier quoted context omitted.

Is it Libreboot who is being ridiculous, or Intel/AMD? Is it worth trusting OEMs with wholesale access to your data and your networks?

Is never-updated proprietary microcode somehow better than updated proprietary microcode?

In a significant sense it is. It means if it wasn't malicious from the factory then it can't be malicious now.

The best security design for software-in-hardware always starts with the software being burned into ROM. Then you can pick from one of two ways to do updates.

The first is the updates are received from the operating system during every boot, so removing power is a reset to factory. So if you throw the system disk in the trash and replace it with a clean one you know you have a clean system. This is in nearly every sense the best way to do it, except that you can't fix a firmware bug that exhibits before the OS boots.

The second is to have some flash memory on the hardware that can be used to install firmware updates, but have a jumper that determines if the system will look there or in ROM during boot. Then if you want clean updated firmware you set the jumper to ROM, boot and install the clean firmware to the flash and then set it back the other way.

The best solution is to support both and then ship the system with the jumper set to ROM. Then you can do 99% of updates automatically through the OS and in the event of a pre-boot firmware bug the affected user can still install the update manually if necessary.

Re: Why is the latest AMD hardware unsupported in libreboot?

#33

Post by jandrese »

yuhong wrote: post #7
jandrese wrote: post #5

Earlier quoted context omitted.

I was wondering this myself. I was wondering why they were focusing so much on AMD when all AMD did was copy Intel's horrible idea. It seems kind of pointless to continue the Libreboot project if they're not going to work on any modern hardware for the foreseeable future. Their recommended systems are all old and out of production. Fastest recommended laptop seems to be roughly a Core2Duo at 2.0Ghz.

They don't even do microcode updates, which is ridiculous when you are running non-free microcode to boot.

So if Intel discovers a bug in their chip that needs to be patched with a microcode update then Libreboot users are just SOL? That can't be right.

Re: Why is the latest AMD hardware unsupported in libreboot?

#34

Post by deno »

geofft wrote: post #25
moonbug wrote: post #23

I think I'd rather have a machine that has a verified chain of trust from boot than one that will happily run anything.

Yup. You don't get software freedom if not only you but everyone else also has the freedom to control what your machine runs. Giving everyone control of your machine is as much of a non-solution as giving only your hardware manufacturer control of your machine; it's simply that one is a better short-term compromise.

> everyone else also has the freedom to control what your machine runs.

> Giving everyone control of your machine

like... [citation needed]

Coreboot giving everyone access? The entire point of the project is so you know and can verify there’s no backdoor to your CPU. How do you turn it around 180°…? This is so dishonest.

Re: Why is the latest AMD hardware unsupported in libreboot?

#35

Post by deno »

moftz wrote: post #26

They promote freedom but specifically forbid the use of Windows. Not everyone has the choice to not use Windows at certain points in the day, VMs aren't perfect. Forbidding the bare-metal usage of Windows is ridiculous.

Windows is just unsupported. It’s not “forbidden.” Coreboot has SeaBIOS and UEFI implementation as payloads that are os-independent. So Windows might work. Or not.

You shouldn’t want to run Windows on a privacy sensitive workstation though. Compartmentalization and all that.

Re: Why is the latest AMD hardware unsupported in libreboot?

#36

Post by geofft »

deno wrote: post #34
geofft wrote: post #25

Earlier quoted context omitted.

Yup. You don't get software freedom if not only you but everyone else also has the freedom to control what your machine runs. Giving everyone control of your machine is as much of a non-solution as giving only your hardware manufacturer control of your machine; it's simply that one is a better short-term compromise.

> everyone else also has the freedom to control what your machine runs. > Giving everyone control of your machine like... [citation needed] Coreboot giving everyone access? The entire point of the project is so you know and can verify there’s no backdoor to your CPU. How do you turn it around 180°…? This is so dishonest.

You can ensure there's no backdoor in the machine as shipped from the manufacturer. That's extremely important and a good thing to have, and I'm not disputing that.

What you'd like to do is make sure that there are no further backdoors, via bootkits, evil maid attacks, whatever. If I can reflash the firmware or insert myself into the boot process, who else can?

Re: Why is the latest AMD hardware unsupported in libreboot?

#37

Post by nly »

geofft wrote: post #29
moftz wrote: post #26

They promote freedom but specifically forbid the use of Windows. Not everyone has the choice to not use Windows at certain points in the day, VMs aren't perfect. Forbidding the bare-metal usage of Windows is ridiculous.

I mean, they're promoting the freedom to use a bunch of 2006–2009-era ThinkPads and MacBooks, and if you use the git release, a couple of motherboards from the same time period and maybe one 2015 Chromebook if you're lucky. I appreciate that this work is being done (though I'm unclear on where the coreboot/libreboot line lies, but anyway), but calling it "freedom" is a stretch. It very much feels like the freedom to…

> It very much feels like the freedom to move to an abandoned island and not pay taxes or be subject to any government.

Except, unless I'm mistaken, US citizens don't even have that freedom. Unless you renounce your citizenship, you pay US taxes wherever you live, unless there's a tax treaty of some kind in place between the US and your country of residence.

Re: Why is the latest AMD hardware unsupported in libreboot?

#38

Post by zokier »

geofft wrote: post #29
moftz wrote: post #26

They promote freedom but specifically forbid the use of Windows. Not everyone has the choice to not use Windows at certain points in the day, VMs aren't perfect. Forbidding the bare-metal usage of Windows is ridiculous.

I mean, they're promoting the freedom to use a bunch of 2006–2009-era ThinkPads and MacBooks, and if you use the git release, a couple of motherboards from the same time period and maybe one 2015 Chromebook if you're lucky. I appreciate that this work is being done (though I'm unclear on where the coreboot/libreboot line lies, but anyway), but calling it "freedom" is a stretch. It very much feels like the freedom to…

> though I'm unclear on where the coreboot/libreboot line lies

afaik libreboot is "just" deblobbed coreboot

Re: Why is the latest AMD hardware unsupported in libreboot?

#39

Post by deno »

geofft wrote: post #36
deno wrote: post #34

Earlier quoted context omitted.

> everyone else also has the freedom to control what your machine runs. > Giving everyone control of your machine like... [citation needed] Coreboot giving everyone access? The entire point of the project is so you know and can verify there’s no backdoor to your CPU. How do you turn it around 180°…? This is so dishonest.

You can ensure there's no backdoor in the machine as shipped from the manufacturer. That's extremely important and a good thing to have, and I'm not disputing that. What you'd like to do is make sure that there are no further backdoors, via bootkits, evil maid attacks, whatever. If I can reflash the firmware or insert myself into the boot process, who else can?

There’s usually a jumper you can set on the motherboard that controls whether you can reflash firmware. So you can burn Coreboot and set it back.

Also if someone can flash your firmware your security (on the software or physical access side) is already busted and it’s game over anyway.

Re: Why is the latest AMD hardware unsupported in libreboot?

#40

Post by mtgx »

jandrese wrote: post #5
mikexstudios wrote: post #2

To be fair, see: https://libreboot.org/faq/#intel

I was wondering this myself. I was wondering why they were focusing so much on AMD when all AMD did was copy Intel's horrible idea. It seems kind of pointless to continue the Libreboot project if they're not going to work on any modern hardware for the foreseeable future. Their recommended systems are all old and out of production. Fastest recommended laptop seems to be roughly a Core2Duo at 2.0Ghz.

Or we could keep pressuring AMD and Intel to open up that proprietary code.
Post reply on HN