Ask HN: How do you trust that your personal machine is not compromised?

Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader.

Pixels have several protections in place:

- Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built.

- Cryptographic verification (verified boot) of all the bootloaders (IPL, SPL), the kernels (Linux and LittleKernel), and the device tree.

- Integrity verification (dm-verity) of the contents of the ROM (/system partition which contains privileged OEM software).

- File-based Encryption (fscrypt) of user data (/data partition where installed apps and data go) and adopted external storage (/sdcard); decrypted only with user credentials.

- Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM.

- Continued modularization of core ROM components so that they could be updated just like any other Android app, ie without having to update the entire OS.

- Heavily sandboxed userspace, where each app has very limited view of the rest of the system, typically gated by Android-enforced permissions, seccomp filters, selinux policies, posix ACLs, and linux capabilities.

- Private Compute Core for PII (personally identifiable information) workloads. And Trusty Execution Environment for high-trust workloads.

This is not to say Android is without exploits, but it seems it is most further ahead of the mainstream OSes. This is not a particularly high bar because of closed-source firmware and baseband, but this ties in generally with the need to trust the hardware vendors themselves (see point #1).

I try to limit attack surface in the following ways:

- I only use M1 Macs as desktops. This reduces attack service in various ways. M1 Macs do not have anything like UEFI firmware, it all starts from the iBoot ROM and the whole chain is verified with signatures. The OS is on a sealed system Volume that is read-only and signed. Altogether, this limit firmware/OS attacks.

- I use a U2F key and/or the Secure Enclave of the Mac for credentials (SSH keys, 2FA). They are set up to require user confirmation.

- When possible, I will install applications from the Mac App Store, since they are sandboxed by default.

- I use separate work and private Macs.

- I clean and factory restore my Macs every few months.

- I use some tools like Knock Knock to see if there is anything suspicious.

Compromise is obviously possible, but I try to push it into 'mostly state actor' territory, because I am not interesting to most state actors.

I distro hop chronically on most of my machines. Sometimes multiple OS reinstalls across machines per week. Some installs have lasted a few months but it's rare.

I try to stick to official repos when I do reinstall, so I'm outsourcing that trust to the distro maintainers.

If it's on the disk, it's gone except for a few important files I keep in a self-hosted Nextcloud sync folder.

I use LUKS encryption to ensure leaving the laptop on the bus is a non-event. If it was ever in somebody's possession for very long (border, police, lost and found) I'd just put it in the garage and never touch it again.

Firmware malware is pretty uncommon, still, so I'm just hoping for the best there.