> what about the chips in your system?

We need a way to manufacture our own hardware. Just like we can already write our own software.

Currently manufacturing processors costs billions of dollars. Consequently, the power to create computers is centralized in very few hands. They are easy targets for government regulation and compromise.

What if we had technology that would let individual users fabricate their own hardware cheaply? That would give the power to create computers to everyone. We would then be able to create chips we could trust. Nobody would be able to interfere.

Just as it's impossible to build skyscrapers or bridges or ships or cars or pretty much any modern sophisticated structures or machines without specialized equipments and skilled people and organizations - mostly companies, you can't build chips without companies. Modern semiconductor fab are a marvel. It takes amazing concentration of equipments and specialized folks to get a fab working.

This "trust no one" is complete BS. A modern human society can not function without some trust.

And even if you fabricate your own hardware, you're still trusting the open source designs you download from the internet. Being able to audit them is much better than not being able to see them, but it's still very possible to have some incredibly subtle backdoor or vulnerability hiding in plain sight. This happens all the the time in complex systems. There is zero chance that you can design a functioning and useful chip and OS, from scratch without trusting something else along the way. That goes all the way to compilers, toolchains etc... And even if you could, chances are you've created hundreds of accidental security vulnerabilities that can be exploited. Zero trust is a fantasy.

> We need a way to manufacture our own hardware. Just like we can already write our own software.

We may write code but we didn't write the compiler which compiles the code. We didn't develop the runtimes, kernels, etc our software is dependent upon. The security, reliability and trustworthiness of the entire software world is dependent on trust.

You should read Ken Thompson's article on "Reflections on Trusting Trust"

https://dl.acm.org/doi/pdf/10.1145/358198.358210

It still can be detected if you have two identical compilers with and without the backdoor. So we should collect all versions.

Also, unless your compiler back door is functionally an AI, sufficiently large changes to the software will break its backdoor inserting routines.

There are hundreds if facilities which can produce computer chips, all over the world. The chips would be "old tech", though, e.g. 70 nm or even 120 nm.

From a practical stand point, you have written and read 0.0% of the software on your system. You do need to trust someone, otherwise you might as well just swear off using computers.

> We need a way to manufacture our own hardware. Just like we can already write our own software.

> Currently manufacturing processors costs billions of dollars.

> What if we had technology that would let individual users fabricate their own hardware cheaply? That would give the power to create computers to everyone. We would then be able to create chips we could trust. Nobody would be able to interfere.

Absolutely. I believe that today's Capitalist/Corporate production (in contrast to Commons-based peer production or communism) undermines human ingenuity. Most of today's industrial production processes are wasteful. The corporate products it creates are non-modular and bloated, and waste energy and resources (especially since barely any e-waste is recycled or re-used).

If all tech was open source and there were no monopolizing and artificial scarcity -generating systems

If all tech was free/libre open source, and if there were no monopolizing and artificial scarcity -generating systems that put artificial limits on digital information systems that allow for a near-zero marginal cost of reproduction (I'm referring to the Intellectual Property systems and the (inter)national courts that enforce these property laws), and if all the latest research and developments were also shared open source - and only a system for authorship claims to help identify successful inventions/discoveries to note who contributed to the experiments that succeeded (to guarantee they those people can continue to be involved and supported to continue to do this work), existed, then the world would be able to radically skill up (growing, over time, what Karl Marx called, the 'General Intellect': "the general social knowledge or collective intelligence of a society at a given historical period") - then we'd be able to more thoroughly tackle so many of the problems we're facing today in new innovative ways. Stated inversely: today we cannot tackle many challenges effectively (collectively) because of artificial limits placed on knowledge and important discoveries/mechanisms.

I believe that the biggest obstacle to successfully averting a fatal climate crisis has to do with how we see, and work with, 'intellectual property' - which is basically privatized knowledge. Today's Global North elite/bourgeois Intellectual Property systems and agreements are facilitating the biggest theft that is happening to the working classes. It could be argued that it is the most violent turn of Capitalism to date, in that it deprives many children the right to ask questions, and forcefully prohibits human curiosity in general. Or at best it puts an exorbitant rentier price on ‘education' (e.g. in the form of an academic degree) and other learning materials. Intellectual Property systems have pushed the privatization and commodification of immaterial Commons to the furthest edges, exploiting and oppressing the working classes; especially alienating, dominating and disenfranchising the working class in the Global South. [1],[2],[3]

I believe the key strategy for proletarians, together with bourgeois class traitors, is to move towards a new Commons/natural-resource stewardship system.

I'll try to further describe what I hope for. Today, Corporations carefully track their total available material resources within a corporation through what's called an Enterprise Resource Planning (ERP) software system. The folks at Valueflo.ws and Holo-REA (REA = Resource Event Agent) are using the open-source distributed data-integrity engine called Holochain to allow groups of people to mutually-'self-sovereignly' peer produce; using what their team, together with Sensorica, have come to call a Network Resource Planning (NRP) system, or software.

This NRP configuration/system replaces ERP systems and instead creates and enables a fractal Open Value Network, meaning that humans are now able to more accurately (+ accountably and transparently) coordinate, map and plan how we'd like to share mother earth's precious resources/Commons.

Most importantly, I believe that by moving away from today's means-of-exchange money system, we lose the need to use artificial scarcity creating systems that privatize knowledge:

"Let's just replace the unit of account with distributed ledgers, let go of transactional mindsets requiring a medium of exchange, recognise our planet's resources as the store of value and be done with it" — @pospigos [4]

Workers of the world, unite!

[1] Vijay Prashad, https://www.thetricontinental.org/the-rate-of-exploitation-t...

[2] Jakob Rigi, https://www.triple-c.at/index.php/tripleC/article/view/487/6...

[3] Wendy Liu, https://tribunemag.co.uk/2019/01/abolish-silicon-valley

[4] https://twitter.com/pospigos/status/1174863182214549504

> what about the chips in your system?

https://www.crowdsupply.com/sutajio-kosagi/precursor

RISC-V is just a specification, you could quite happily sneak stuff into the RTL if you beat the right hands with a pipe.

You still have to trust both the verification procedure and the specification i.e. Given how a modern CPU has to have features to manage itself, it's relatively trivial to design a system to do what VW did and recognize when the device is under test.

For example, if you've seen Christopher Domas's talk/s on finding undocumented features of CPUs, any backdoors in a modern CPU will be buried deep in the vendor-specific features or require an extremely esoteric combination of register values and the like.

> You still have to trust both

Yes, you can never 100% get rid of some trust, but it does not mean that you should give up and verify nothing. The more you (are able to) verify, the more secure you are.

The CPU architecture is open source for one, and the boards are designed in such a way as to make outside verification easier. Excited to get my hands on one!

The architecture isn't the chip itself.

So is a lot of malware, that doesn't mean the specification matches the final build. And even if you can verify the board, you can't verify the chip itself or any other IC.

zero trust means no computer devices around you... (including TVs, toasters, etc...)

You trust your can of baked beans? The entire society runs on the concept of trust. At some point, you're gonna have to trust someone.

The trick is to avoid trusting parties that have incentives to abuse that trust and means to do so. Free market working the way it does, sooner or later one of such entities will abuse that trust.

So, baked beans are probably OK in terms of SIGINT. Depending on how well food regulations are enforced in your area, I might or might not worry about the edibility of them, though. But on-line services are definitely suspect with respect to data handling. Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT - as that's already evidence of a business model built on abusive relationship.

> Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT

Hanlon's razor, "never attribute to malice that which is adequately explained by stupidity", does seem to apply to that particular one, though. But I'm no war historian or politician or something; while the security of these devices is stupidity to the point of criminal negligence, I find it hard to say for sure whether some of this might be on purpose.

I have my own razor[0], that I tend to call Hanlon's Handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice". I think it applies here more than Hanlon's Original.

Also, I wasn't thinking about security. I was thinking about intentional abuse of data, that starts with collecting and processing data that doesn't need to be done for a device to function.

--

[0] - Introduced in https://news.ycombinator.com/item?id=21691282, named after me in https://news.ycombinator.com/item?id=21691718 :).

You razor is also described here (and called "moloch"): https://slatestarcodex.com/2014/07/30/meditations-on-moloch/.

Yeah :). That's one of my favorite articles on the Internet and meditating on these meditations had a big role in shaping my current set of beliefs.

That's just something people repeat over and over again until it seems true. In reality it just provides cover for malicious actors/actions.

I agree.

The CIA, NSA, DHS, etc are all much, much smarter than me, and I would use IoT to compromise targets if it were my job. So there's that data point.

That's why we have regulations and regulatory agencies. You'll need to trust them to their job (just pegging the trust one more level up).

TeMPOraL does seem to be aware of the existence and enforcement of food regulations:

> baked beans are probably OK in terms of SIGINT. Depending on how well food regulations are enforced in your area

Unless you meant the IoT part, I'd love to see regulations, let alone enforcement, there.

Definitely, new technologies always had this issue though. Regulatory agencies move at a snails pace to adopt new changes - for good or for worse - that's up for debate. Good because new tech doesn't exploit consumers. Bad because haphazardly put together regulations can harm busineses and progress in general.

True. But I like to reinforce my trust with open and verifiable information.

Meaning, I would prefer the can of baked beans from a company that is open about where their beans come from and in what conditions. That would be possible today, and is already done to some extend but in early stages.

But getting your food from the local farmer, where you can actually visit the farm, it is much more easy to trust that it is good.

And regarding software, well - open source, preferably with a open community (or company) around it, where you can at least look through the actual dev logs and git submits to see if they sound solid and if you have the time and skills, jump into it to verify that they do as promised.

Then I can have trust. Otherwise the trust would have to be blind. And society has spoiled that for me, for various reasons.

Huh? That's why we have regulations. Every country has one, in the US it is the FDA.

Please don't try to shoehorn open source principles everywhere in life. It becomes a chore and a burden for a common citizen to verify the hazards of Baked Beans. Citizens offload this to a regulatory agency. You don't have the time to verify a fucking can of baked beans like a million other things in life.

If you buy a measuring tape, do you ask for a NIST certificate? Where does the chain of trust end? Somewhere at the measurement standards in the pyramid of trust. Your personal role in this chain ends at the brand name "STANLEY", because you trust them to make a measuring tape that measures within specified tolerance.

The whole movement around "I don't trust unless the information is freely available" is a pipe dream. It grinds the society to a halt.

I urge you to look around 99% things in life that you just blindly trust. We need better mechanisms for building trust than "Don't trust unless verified". It is applicable in high risk situations, but the society pays a huge price for such an inefficient way to live.

How do you know what things I trust blindly?

But I agree, it is not efficient to question everything. I do not want to question everything! But I do know enough, to question a lot of things.

Secrecy just allows bad things to stay hidden.

If the default would be openness, then people who do bad things would hesitate more, as it would be easier to detect those things, don't you think?

Whether it be government, food production or software.

I think one common theme we both can agree is that open available data only helps. It doesn't take away from anything. For those who want to verify, they can. They can look up FDA reports and inspection results.

Transparency builds trust overtime.

"Transparency builds trust overtime."

Yep. This is what I mean.

I come from east germany, a former post sowjet state. A state which was build on blind trust on the state and no way for the common person to verify anything (or even dare to question anything openly). And big surprise: lots of dark things happened regulary.

Now things are still far from perfect in my opinion, but much, much better. And I think they can still improve a lot with even more transparency, because there are still lots of dark things happening behind closed doors. We probably just disagree on the degree of those things.

> A state which was build on blind trust on the state

The former Soviet states and other USSR satellites were not built on trust, they were built on force. You had to act like you trusted the state to avoid the repressive force of the state.

But people did not trust the state at all, much more so than in today's world. Everyone assumed their telephones were listened to. Everyone assumed that the walls had ears. The lies of the state were often obvious, and often discussed with very close friends and close family, and anything that wasn't an obvious lie was thus considered a likely lie anyway.

Yeah well, sure. Thats one ofmthe reasons, why I am highly sceptical when I have to trust authority blindly. Which goes back to the main point. I cannot really trust a closed encryption source, when I assume they are infiltrated by (western) intelligence agencies. And those agencies I do not trust. And I believe with the open information about them, rightfully so, even if they are not (yet) on par with the Stasi or KGB.

Fear and trust are not the same.

They'll probably figure out a non-suspicious way to include a computer in a can of bean soon enough... maybe it will let you know if the beans are still edible... in exchange, it will record everything you say.

Coming soon: Juicero for Beans!

Watties FTW!

Well I often use G5 PowerPC