Hacker News Reader

Comment by hyperion2010 | Hacker News Reader

hyperion2010

From [0] > Of course building everything yourself generally isn't practical.

I've been using gentoo for a decade and I'm sad to say that I still can't get to 100% built from source. There is always some useful program out there, or something that I don't want to maintain the build process for, that ends up being a binary that I know nothing about.

Getting to 90% is possible. 100% is extremely difficult requires making some hard choices about what software you are going to use.

0. http://sobersecurity.blogspot.co.uk/2016/05/trusting-trustin...

View on HN

It's all kind of moot anyway if you are running hardware with blobs (Intel ME, for example). Getting truly to 100% is pretty far away, as frustrating as that is.

The ME/AMT is the nastiest of them all. And those are not the only ones. FSP, the CPU microcode.

You can get rid of AMT if you're on older hardware, or your willing to buy a laptop from (US) http://www.libiquity.com/, (UK) https://minifree.org/ or (EU) https://tehnoetic.com/;

The future is bleak though, there's not much hope in sight freeing anything from Nehalem onwards. I have a Thinkpad X201, and flashing coreboot with blobs is the best I could for the moment.

I do remember though that I had Gentoo 100% from sources a few years back. But updates were too much of a pain in the ass, and after tweaking the compiler flags, I always ended up breaking my system. So I'd take reproducible builds over that.

With major effort, ME has been disabled on Lenovo X230 (Ivy Bridge).

Where do you get your information from? AFAIK, it's only has been stripped down to a bare minimum, putting it in some sort of recovery mode - but it can't be erased from the BIOS chip yet.

https://www.coreboot.org/pipermail/coreboot/2016-September/0...

I was thinking of this project - https://github.com/corna/me_cleaner This is the one that strips most of the ME (which seems to be Java applets, if I remember correctly Igor Skochinsky's presentation), but there's still the core "OS" in PCH, which loads and executes the applets - we don't know what nefarious things that part of ME might be up to - and it has DMA, and access to the network controller - that's how they remotely wipe HDD's, even without an OS being installed, even without the computer being turned on - that shit is straight out of Orwell's 1984. Telescreen, that's what it is.

Thanks for the info.

Is there security benefit in running on a desktop with non-Intel (e.g. Broadcom) add-on NICs and nothing connected to the integrated Intel NIC?

Yes. It seems this only works with Intel cards(wifi or ethernet); I don't know the reasons why, though - it might be some firmware support. Also, I find it odd that it can work with the wireless chip - shouldn't the laptop be associated with the AP? If somebody knows, I'd be happy to learn about it.

Source: https://software.intel.com/en-us/blogs/2013/08/07/intel-vpro...

"Getting to 90% is possible. 100% is extremely difficult requires making some hard choices about what software you are going to use."

That's what Roger Schell, one of INFOSEC's founders, used to say when pushing his GEMSOS security kernel (now at Aesec). He said you can get quite a bit there with review and hardening of these mainstream codebases. 90% maybe in best case. The last 10% might be impossible if it wasnt designed for high security and verifiability in mind from beginning with it baked into every aspect of it.

Reply on news.ycombinator.com