> since they only licence but don’t actual fab the chips

From the article: "It's one of the fundamental assumptions of the ARM business model that it can sell to everybody. The one saving grace about Softbank was that it wasn't a chip company, and retained ARM's neutrality. If it becomes part of Nvidia, most of the licensees are competitors of Nvidia, and will of course then look for an alternative to ARM."

Implying NVidia's competitors who use ARM would fear losing their license.

> Also what’s the difference between ARM and RISC-V. Why chose one over the other ?

They have technical differences, but TBH I don't know them and I'm not sure they matter. However, conceptually they have two big differences IMO : RISC-V is open (don't need to buy a license to use it) but ARM is way more mature and supported (RISC-V based computers are still very rare).

RISC-V sounds like a good idea, but (imo) could lead to a situation, where all/many device manufacturers make custom processors based of the liberally licensed code-base. At first, this sounds great, "Yah, no more reliance on Intel/ARM/, no more ME/Trustzone". But then you realize, that although you, the user/buyer, can build/run some custom code on there, you'll never be able to tell for sure, if you did not get a version/series with a gimped HWRND, or other (security-reducing) goodies. Targeted attacks will become very easy for anybody, who can pressure companies/engineers into adding something for (a subset of) the customers, or can reroute/intercept device shipments to you.

ARM is a "known" situation. They have TrustZone, we know it exists, but buyers/end-users do not get full control of it (outside of some niche products, or dev-boards). That situation will not change. With ARM, get already got used to the idea, that you'll never "own" the machine, you are merely allowed to execute some code in a walled-off area of your Telescreen.

So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more.

> But then you realize, that although you, the user/buyer, can build/run some custom code on there, you'll never be able to tell for sure, if you did not get a version/series with a gimped HWRND, or other (security-reducing) goodies. Targeted attacks will become very easy for anybody, who can pressure companies/engineers into adding something for (a subset of) the customers, or can reroute/intercept device shipments to you.

I fail to see how this is different from today's situation. What's stopping targetted attacks via custom modifications of ARM or x86 chips?

> What's stopping targeted attacks via custom modifications of ARM or x86 chips?

Nothing, if you have power over the manufacturers. (Usually governments)

But now, with RISC-V, anybody with deep enough pockets to spare a few million can create fake silicon, where you'd need an electron microscope to prove, that you got an "enhanced by TAO" chip.

> anybody with deep enough pockets to spare a few million

Which for all intents is ... governments.

So no real difference.

RISC-V allows companies to make closed systems, but it also allows them to make open systems, which wasn't viable before.

Most people will keep using closed systems because they don't care about computer architecture, but us hackers will finally have a chance at having a (small) portion of the market. A small industry of open hardware.

> RISC-V allows companies to make closed systems, but it also allows them to make open systems

True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? So, (imo) in theory, you are right, but in practice, (successful) companies will use the technology to create "even more closed" system, and worse: Make systems, where the user can't even tell, if he got an "open" system.

> A small industry of open hardware

That you will only be able to use in a lab/isolated_env, or illegally, because mandatory signing of FWs/BLs/OSs/APPs is just around the corner for consumer devices capable of speaking to the internet.

> True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable?

I'd say that the early era of personal computers proved it. The Apple II and IBM PC were very open platforms-- thoroughly documented, developer friendly and made with very few parts you couldn't buy out of your favourite electronics distributor catalogue.

They were riotous successes in large part because the open platform meant they didn't have to guess or corral the entire market. Remember that most of the killer apps of the era (VisiCalc, WordPerfect, dBase, 1-2-3, etc.) were third party, and it was largely aftermarket firms selling "six-in-one" cards, Sound Blasters, and Hercules graphics cards that patched the gaping holes in the PC's hardware design.

Conversely, look at a machine like the TI-99/4 series: while on paper a decent machine for the time, it was as "closed" as a machine of the era could be: an unusually limited built-in development platform, and many of the desirable upgrades involved buying a very expensive expansion chassis.

It's interesting to consider what the business tradeoffs of today's walled garden model are. Apple could choose to do a "pure hardware" play, or emulate the early 1980s IBM, where they offered some popular software via their own product line as a trusted source. The result would probably be a marginally larger total addressable market, as it would bring some customers and developers to the platform who needed something that could never clear the App Store before. But would the growth in market size compensate for the reduction in the average cut they can command from the market?

> IBM PC were very open platforms

What about the whole debacle around the IBM BIOS?

I think they made a commented disassembly available officially, and there were definitely aftermarket books with blow-by-blow analysis.

You could argue it was imperfect (not exposing every feature it could, and having performance costs, sent a lot of software to bypass it and pound hardware registers directly, creating that weird world of early clones that would run MS-DOS but not 1-2-3 or Flight Simulator) but it doesn't seem like a hostile gesture to external developers.

Now it was definitely a legal hurdle if you wanted to make an outright clone, but by 1984 or so, Compaq and Phoenix had solved that problem.

mandatory for whom?

I don't know, where you live, but in most of the world, certification/signing/encryption of RF-capable Devices/Firmware has been established rule for decades, with a few exceptions for dev-boards. TPM, ME, SB, the_recent_grub_fixes,etc are all steps putting in place a pervasive infrastructure, that will enable truly draconian control over our computing devices for the key-holders.

And I have not reason not to believe, that somebody somewhere is waiting for a pre-text to implement full vertical stack control in law for his (region/country/domain). Perhaps "so that we can ensure, that the contact-tracing app gets installed everywhere, otherwise we'll all die!!11!". Or protecting us from Terrorism; that usually does the trick. This argument also works surprisingly well to argue against backdoor-less encryption protocols. See e.g. Australia (iirc)

Do you not perceive a similar evolution?

Note, TP,SB,ME could in theory be used to build "secure" systems, but currently they are (also) used to secure the PC against you, the buyer/user.

If your device isn't hackable then it's not because of ARM imposed limitations - it's because of decisions made by the device maufacturer and there is no reason why that would change if they were using RISC-V instead.

This is completely backwards.

See India's Shakti

https://www.economist.com/asia/2019/10/03/india-is-trying-to...

... where they will fab their own cpu chips for, eg, military use starting from inspectable, verifiable open source Risc-V HDL.

If you re-read my post, you'll see, that we are not contradicting each-other.

If you have the time/money/infrastructure/knowledge/trusted_personnel to design/make/test/etc entire processors, then now with RISC-V you can in theory make secure systems.

Also remember, that your effort needs to already start at the level of tool-chain, and other tooling, all the way down to the transistor. Otherwise you'll have a trust problem with regards to your compilers/synthesizers/etc.

But that is quite a high barrier for entry for anybody smaller than a decent sized country.

> So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more.

What you wrote, quoted above, has it completely backwards.

If you haven't produced the processor, and the tooling, and the base components all by yourself?.

shrug someone is wrong on the internet... you have a choice to learn something, or keep trying to pretend to have been right... nobody cares...

I enjoy learning every day. And -generally- I'd like to know, where my knowledge has limits.

You seem to care, and claim to be wise, so please, do enlighten me, where I'm wrong. We may be misinterpreting, what the other one is trying to say.

I'll try to re-word what I mean: If your "system" uses standard off-the-shelf parts (CPU/SOC/Mem/...), then the fact, that you can go out to the shop, and buy standard replacements, means that you can be reasonably sure to be able to thwart/detect a targeted attack on your supply-chain easier, than if your device contains a e.g. custom, specific CPU for that device, that could contain god knows what extensions to the instruction set, and that you can only get a replacement for from that one specific vendor.

Or where do I have dent in my logic?

Neither Apple nor nvidia fabs their own chips.