I hope the Coreboot people are extremely careful about this. Accepting code from a giant agency with the goal of making everyone less safe is very dangerous.
The problem is NSA really only knows their motives.
The other problem with the NSA is that they have two goals. One is to protect the US and US entities security and the other is subvert foreign entities. If they start publicy recommending coreboot for what they deem senstive installations then their intentions are obviously not malicous. Problem is the NSA may never publicy specify that its for senstive installtions and may only ever be an internal guideline.
The thing is, if there's no ill intent now, there shouldn't be any backdoor to allow them to have any sort of special knowledge later. Unless you mean familiarity with the codebase in general. If they however do insert a backdoor, even without using it for anything now, "just in case", than that in itself is ill intent.
How can you know that? If they actually did install a backdoor into coreboot, they'd obviously just patch it out of their own installations.
I imagine senators would not like finding that they've been subject to that.
One exception I make is defense contractors that take money from them to build OSS tech. In that case, one can just scrutinize the tech itself. Most of the positive contributions in this area come from Galois Inc. Cryptol language is an example. On proprietary side, Rockwell Collins SHADE toolkit and AAMP7G CPU were likely NSA-funded to large degree.
It's for the rest of the us to work out who is who though! Cryptographers seem to be suitably aware though.
The West? Really?
I think your overlooking the elephant in the room, who just happens to be Chinese and is concerned about his "social credit".
This is likely tacit recognition that UEFI is such a dumpster fire that it's not only vulnerable to them.
That's exactly what they do. How they rate and evaluate their high-security products (Type 1 or EAL6+) vs majority of market (EAL4 or less) under Common Criteria corroborates your claim. EAL4, which Linux and others top out at, says it's only trusted to stop "casual or inadvertant attempts to breach security." Anything prolonged or well-funded will breach it.
> Bruce Schneier observed that "It took the academic community two decades to figure out that the NSA 'tweaks' actually improved the security of DES."
> However, the NSA also ensured that the key size was drastically reduced such that they could break it by brute force attack.
https://www.miracl.com/press/backdoors-in-nist-elliptic-curv...
Their goals are at the very least nationalist.
As a non US citizen why should I trust them at all?
Their main directive errodes my privacy on most levels in most sense of the words.
You’re making an assumption that in order to gather signals intelligence, that they need to trick people into using compromised cryptography.
A fact that is not in dispute is that huge portions of the US federal government implement NSA recommendations and standards. For your assumption to be true, the NSA must be intentionally weakening federal systems. Nothing about that seems nationalistic to me.
(I know Coreboot has had at least a few people who seem to be activists or enthusiasts who are not potentially beholden to anyone, but people getting paid can afford to spend much more time on projects than volunteers can.)
But for the purpose of accuracy it should be pointed out that one of the two missions of the NSA is to safeguard American commerce, which they did for many decades prior (see: DES, selinux, etc.).