61–70 of 282 posts
It's sold as way to protect your secrets from malware. But it more likely will be used to run DRM code on the user's computer while treating the user as a hostile entity.
ARM architectures also suffer from this. You'll be hard pressed to find a board that doesn't require a propriety board support package somewhere in the stack. Ironically, it is usually the bootloader that is/requires a blob or it is the DTB. I remember being in middle school and reading Stallman's articles on the dangers of a TPM-oriented push by manufacturers. As cliche as it is, Stallman was right. The push for pla…
ARM architectures also suffer from this. You'll be hard pressed to find a board that doesn't require a propriety board support package somewhere in the stack. Ironically, it is usually the bootloader that is/requires a blob or it is the DTB. I remember being in middle school and reading Stallman's articles on the dangers of a TPM-oriented push by manufacturers. As cliche as it is, Stallman was right. The push for pla…
1) "...these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras..."
This seems basically impossible to actually achieve in reality though, because there will still associated network traffic that can be sniffed, and will have been by now, right? I mean, it is plausible that somehow we all just failed to notice that our computers are sending video traffic to the NSA without our noticing it?
I can imagine this happening on phones, where the baseband chip is much harder to actually sniff. But through my LAN? I doubt that.
2) Let's imagine that this post is entirely true. Why do Intel and AMD do this? If it's not part of a grand conspiracy, then why? Clearly there are far easier and cheaper ways to achieve what they view as security that don't require such a crippling approach. What's the upside to them?
Check libreboot.org On their FAQ page: https://libreboot.org/faq , you can see the question "Why is the latest{Intel,AMD} hw unsupported?" They go into more detail than the provided link. Also, dropped supports starts in 2008 for Intel, 2013 for amd. The truth is: we need something like this to protect the whole boot process. But unless we can put our keys/sw in there, we will never be sure.
I was at FOSDEM this year (2016) and there was a talk from the leader of LibreBoot. Honestly, his talk on the state of the project was very bitter. He literally said that there is absolutely no hope that LibreBoot will ever be able to cope with ME, and that the fight is over since 2008. As much as I would absolutely love to be able to run a free firmware, unless there is a major change/outsider in the hardware manufa…
> Secure Boot [...] requires FOSS users to purchase a license from Microsoft Nope.
Requires purchase of a cerficate from one of the authorities Microsoft recognises (Verisign/Digicert/...) and then the signature of Microsoft on compiled bootloader code. Either way, you have to pay and you have to get Microsoft's permission.
https://mjg59.dreamwidth.org/20303.html
No additional money has to change hands between anyone, and no additional permission needs to be granted from Microsoft to anyone. (You have to get the permission of someone with physical access to the machine during boot, but if your goal here was FOSS users controlling their own computing, it's a good thing that that permission is required.)
It's great that these guys pushing POWER8 at least have a workable situation, but at least for me, throwing $3,700 at a motherboard (Alone!) just isn't feasible. I would love to be free of proprietary firmware, but it would seem that's only for people better off than myself.
You have to start with a single step. Costs could go down over time.
I wonder if Apple might do something about this. They don't care so much for the FOSS side of things, obviously, but I wonder if they might demand chips from Intel without the management engine, because it's a potential attack vector they can't control.
I suspect at some point they will simply drop Intel for their own (ARM) platform. I think moving will be easy once all app store submissions are in bitcode.
Joanna has proposed a model where we minimize the trust we put in x86 with a peripheral. Seems like a plausible path forward to me. http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
Hmm. OK, I have two questions - maybe somebody here has answers: 1) "...these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras..." This seems basically impossible to actually achieve in reality though, because there will still associated network traffic that can be sniffed, and will have been by now, right? I mean, it is plausible that somehow we all…