41–50 of 61 posts
What is the end-goal here? Vendor locking?
Make sure that someone doesn't tamper with your device. No, it's not infallible. Yes, it's better than nothing.
It's not a powerful device for hosting databases, it's not really used for storage, only for small things like a Kodi server and even that lags.
Earlier quoted context omitted.
Make sure that someone doesn't tamper with your device. No, it's not infallible. Yes, it's better than nothing.
Why would someone tamper a RPI? Usually most people don't really store anything important on a RPI, other than services like searx or whatever. It's not a powerful device for hosting databases, it's not really used for storage, only for small things like a Kodi server and even that lags.
[1]: https://www.kernel.org/doc/html/latest/gpu/v3d.html
[2]: https://wiki.debian.org/RaspberryPi4#Using_EFI_Firmware_and_...
Earlier quoted context omitted.
Yep. I wish OTP memory, eFuses, etc. were all illegal due to unnecessarily creating e-waste. In places where OTP is actually required for some technical reason, it should have to be on an easily replaceable socketed chip with no other functionality.
That kind of defeats how secure boot works.
When are Raspberry Pi's going to be easily found online again for purchase? I've eyed them every few months for the past year and have seen in stock 0 times.
When are Raspberry Pi's going to be easily found online again for purchase? I've eyed them every few months for the past year and have seen in stock 0 times.
It's back up to $99 now (I got it discounted). It works fine.
https://www.amazon.com/dp/B0BHP34TH1?ref=ppx_yo2ov_dt_b_prod...
Earlier quoted context omitted.
That kind of defeats how secure boot works.
No. You'd still lose access to the encryption keys so the data would still be safe. But it would allow you to start over without throwing the entire device in the trash and buying a new one.
I'm probably just missing it, but I'm not seeing a step where the firmware itself is locking itself to an individual RPi, which would mean you can simply change out the USB drive itself and boot whatever you want. Does it do that transparently, maybe when the keys are enrolled?
The idea is that then bootloader verifies the rest; then your kernel would need to verify everything it runs.
The Pi4 has true hardware support for secure boot. If set up correctly, you won't be able to boot anything not properly signed. An incomplete overview of how this works is: * Instead of having all boot related files (start4.elf, kernel.img, ...) on the first partition of the SD card, you instead have a single boot.img FAT image containing those files instead. * You sign that file with your own RSA 2048 key and place…
The Pi4 has true hardware support for secure boot. If set up correctly, you won't be able to boot anything not properly signed. An incomplete overview of how this works is: * Instead of having all boot related files (start4.elf, kernel.img, ...) on the first partition of the SD card, you instead have a single boot.img FAT image containing those files instead. * You sign that file with your own RSA 2048 key and place…
So these things don't run a BIOS like a 'normal' computer? Because I can just enroll a key in my BIOS that I trust.