I fail to see how this is different from today's situation. What's stopping targetted attacks via custom modifications of ARM or x86 chips?
Nothing, if you have power over the manufacturers. (Usually governments)
But now, with RISC-V, anybody with deep enough pockets to spare a few million can create fake silicon, where you'd need an electron microscope to prove, that you got an "enhanced by TAO" chip.
Which for all intents is ... governments.
So no real difference.
Most people will keep using closed systems because they don't care about computer architecture, but us hackers will finally have a chance at having a (small) portion of the market. A small industry of open hardware.
True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? So, (imo) in theory, you are right, but in practice, (successful) companies will use the technology to create "even more closed" system, and worse: Make systems, where the user can't even tell, if he got an "open" system.
> A small industry of open hardware
That you will only be able to use in a lab/isolated_env, or illegally, because mandatory signing of FWs/BLs/OSs/APPs is just around the corner for consumer devices capable of speaking to the internet.
I'd say that the early era of personal computers proved it. The Apple II and IBM PC were very open platforms-- thoroughly documented, developer friendly and made with very few parts you couldn't buy out of your favourite electronics distributor catalogue.
They were riotous successes in large part because the open platform meant they didn't have to guess or corral the entire market. Remember that most of the killer apps of the era (VisiCalc, WordPerfect, dBase, 1-2-3, etc.) were third party, and it was largely aftermarket firms selling "six-in-one" cards, Sound Blasters, and Hercules graphics cards that patched the gaping holes in the PC's hardware design.
Conversely, look at a machine like the TI-99/4 series: while on paper a decent machine for the time, it was as "closed" as a machine of the era could be: an unusually limited built-in development platform, and many of the desirable upgrades involved buying a very expensive expansion chassis.
It's interesting to consider what the business tradeoffs of today's walled garden model are. Apple could choose to do a "pure hardware" play, or emulate the early 1980s IBM, where they offered some popular software via their own product line as a trusted source. The result would probably be a marginally larger total addressable market, as it would bring some customers and developers to the platform who needed something that could never clear the App Store before. But would the growth in market size compensate for the reduction in the average cut they can command from the market?
What about the whole debacle around the IBM BIOS?
You could argue it was imperfect (not exposing every feature it could, and having performance costs, sent a lot of software to bypass it and pound hardware registers directly, creating that weird world of early clones that would run MS-DOS but not 1-2-3 or Flight Simulator) but it doesn't seem like a hostile gesture to external developers.
Now it was definitely a legal hurdle if you wanted to make an outright clone, but by 1984 or so, Compaq and Phoenix had solved that problem.
And I have not reason not to believe, that somebody somewhere is waiting for a pre-text to implement full vertical stack control in law for his (region/country/domain). Perhaps "so that we can ensure, that the contact-tracing app gets installed everywhere, otherwise we'll all die!!11!". Or protecting us from Terrorism; that usually does the trick. This argument also works surprisingly well to argue against backdoor-less encryption protocols. See e.g. Australia (iirc)
Do you not perceive a similar evolution?
Note, TP,SB,ME could in theory be used to build "secure" systems, but currently they are (also) used to secure the PC against you, the buyer/user.
See India's Shakti
https://www.economist.com/asia/2019/10/03/india-is-trying-to...
... where they will fab their own cpu chips for, eg, military use starting from inspectable, verifiable open source Risc-V HDL.
If you have the time/money/infrastructure/knowledge/trusted_personnel to design/make/test/etc entire processors, then now with RISC-V you can in theory make secure systems.
Also remember, that your effort needs to already start at the level of tool-chain, and other tooling, all the way down to the transistor. Otherwise you'll have a trust problem with regards to your compilers/synthesizers/etc.
But that is quite a high barrier for entry for anybody smaller than a decent sized country.
What you wrote, quoted above, has it completely backwards.
You seem to care, and claim to be wise, so please, do enlighten me, where I'm wrong. We may be misinterpreting, what the other one is trying to say.
I'll try to re-word what I mean: If your "system" uses standard off-the-shelf parts (CPU/SOC/Mem/...), then the fact, that you can go out to the shop, and buy standard replacements, means that you can be reasonably sure to be able to thwart/detect a targeted attack on your supply-chain easier, than if your device contains a e.g. custom, specific CPU for that device, that could contain god knows what extensions to the instruction set, and that you can only get a replacement for from that one specific vendor.
Or where do I have dent in my logic?
ARM is a "known" situation. They have TrustZone, we know it exists, but buyers/end-users do not get full control of it (outside of some niche products, or dev-boards). That situation will not change. With ARM, get already got used to the idea, that you'll never "own" the machine, you are merely allowed to execute some code in a walled-off area of your Telescreen.
So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more.