Ask HN: How do you trust that your personal machine is not compromised?

Re:Ask HN: How do you trust that your personal machine is no... by oneplane on Sunday January 15, 2023 @09:58PM (#34396302)

I don't think you can trust any commercial baseband, period. They all have to adhere to complex radio standards, nobody wants to implement them because their design-by-committee stuff is boring/lame/hard/painful, so what you get is a few stacks that pass the tests and everyone builds on top of that. Same goes for any other RTOS-style firmware, it's really hard to get right, and because most of them are built by/for the 'device' world, they often have very long release cycles, slow development etc. just like say, head units in cars or painfully slow touch screens on devices that should just have buttons (like office style coffee machines, ATMs etc).

WiFi is in a similar position, but at least the diversity is a bit better causing integration tests to fail better when too many bad implementations try to talk to each other.

That leaves all the other chips, which I think are best trusted in a divide and conquer setup where they all have to independently verify their blobs, and not be allowed to mess with each others memory/internal state. It can make them more expensive, but it also compartmentalises them in a way that side-channel attacks within CPU cores are completely mitigated.

Only a very very very small amount of companies in the world will have the capital, expertise and manpower to make devices where enough of the stack can be trusted, and out of all of those, only some actually seem to try:

  - Google (mostly for UX, but also to make fat stacks of cash via ads) 
  - Apple (mostly for UX, but also to make fat stacks of cash via ecosystem)
  - Microsoft (console, ARM windows, mostly for DRM, but also UX)
  - Sony (console, mostly for DRM, but also UX)
  - Nintendo (console, mostly for DRM)

Besides the vertical integration they could make, there is the problem of their 'personalities' usually not being a good fit for people that want to go off the deep end in terms of security, privacy, control, feelings etc. But anyone and everyone else simply cannot do to silicon what needs to be done, even if just because of the lack of IP.

The more a company does _not_ want to get burned on their security/privacy positions and keeps iterating making better designs, the more you _could_ trust them. The only realistic alternative is going back to 80's computing, and nobody has time for that.

[ Parent | on HN ]

Re:Ask HN: How do you trust that your personal machine is no... by lumb63 on Sunday January 15, 2023 @11:57PM (#34396981)

I agree with your point about how the personality of (technology) companies doesn’t fit the security minded person well. As a software engineer, I feel I am in the small minority whenever I mention security or privacy concerns at work. I feel that most technology is evil at this point because of the immense ability of it to violate people’s privacy. It is sad to me that this is the state of the modern tech ecosystem.

[ Parent | on HN ]

Re:Ask HN: How do you trust that your personal machine is no... by speed_spread on Tuesday January 17, 2023 @08:06AM (#34411929)

It's just back to the worldview of the 1960's. The only computers were mainframes and were seen as the tools of "The Man", conspiring in the shadows against a free humanity. PCs were a liberating force, making computing accessible to the common man. Modern total reliance on global networks reversed the power balance back to central instances.

[ Parent | on HN ]