Shared publicly  - 
 
If you don't have full source to your firmware you don't have a system you can trust. Given most BIOS firmware isn't written in the USA I doubt #nsa are the only ones at it

104
21
Brett Johnson's profile photoMatthew Curry's profile photoAdrian Flanagan's profile photoZen Floater's profile photo
27 comments
 
Even if the main firmware is open, such as coreboot, Intel ships a huge binary blob that contains god knows what that is needed for memory training and other things. :(
 
That's right Alan.. People who trust the United States are idiots.
Proven! 
 
I can't advocate enough for Coreboot.org Maybe these issues will help raise awareness.
 
I would worry as much about modem firmware, wireless firmware etc... maybe more so because they can tslk directly to the wires
 
+Zen Floater people who trust governments and big business are idiots, or extremely gullible.
 
Time to build that fpga pdp-11 
 
+Alan Cox Even if you think you have the source for all your firmware, you have no way of knowing if you really do.
Even if you build each one from source, upload each one to each device - how do you know if it's running only the firmware you give it?
 
When my laptop  was compromised this autumn, they replaced the 3G firmware with something that appeared as a  keyboard (HID input device, actually) after suspend, before re-toggling and showing up as a serial modem.

Replacing firmware in compromised devices isn't new.  Firmware blobs per-se aren't that bad, but any persistent firmware blobs are to be mistrusted.
( If the blob can (only) be loaded runtime, it's at least possible to verify integrity/non-difference status beforehand. )
 
Obama was told by a federal judge, you're breaking the Constitution. And still, this sick bastard wants Snowden in jail...
 
U.S.S.A. Alan was right. G.B. break away from U.S.S.A.... today!!!
 
+Zen Floater I'm having a hard time reconciling advocacy for transparent hardware, open firmware, open-source with comparisons between the USA and Russia.

Is Obama an easier target for you than Putin? Criticism of the later is a far more dangerous game. 
 
If we didn't have utterly disgusting people like Bush or Uncle Tom at the helm,,, we wouldn't be having this duscussion. Look! What idiot would be told FLAT OUT what your doing is UNCOSTITUTIONAL and yet keep on doing it. This should be a clear warning to the people of the world. ..
 
+Alan Cox Even if you have the full firmware source and the source for the tool chain to build it, unless you also have all the HDL and the analogue schematics of the wireless chip you still won't be sure. And even then some behaviour will be unclear even to the designers because the EDA tools used are buggy. 
 
if you don't have full hardware schematics and source for the microcode, then you don't have a system you can trust, irrespective of bios.  also, depends what compiler was used...
 
For Intel x86, a lot of the setup and magic bits are only available under the strictest NDA.
 
Simply put, the moment you are plugged on to Internet you are under surveillance.
 
Even with sourcecode, you can't be sure that the hardware only does what it is purported to do.
 
What can you use for persistent storage? Both hard disks and flash based memory have embedded processors that run closed code.
Add a comment...