Hacker News Reader

Comment by fouc | Hacker News Reader

What are the chances that google will add their own hidden or proprietary circuitry to any open-source chips? They'll add all sorts of "Security" and "Tracking" features..

View on HN

Approximately zero. They have nothing to gain from doing so, and everything to lose. It isn't a website we're talking about, adding that kind of complexity to a chip would be highly obvious to the people who integrate it, who aren't from Google.

To a chip? Doesn't seem likely. Adding something like an Intel Management Engine is quite a task, and they'd look awful if they got caught trying it in secret. If they're just making the CPU, in isolation from the rest of the system, I imagine it would be just about impossible to do something like that.

As to whether such changes could be detected, given that the intended design is known, I'm not sure. Someone more knowledgeable than me might be able to comment on that.

If you hand them GDSII then fiddling with it is very time-consuming and difficult, but can be spotted by looking at the resulting chip under a microscope.

(Not entirely simple at 130nm as this is shorter than the wavelength of visible light!)

You don't need to look at the smallest features of a transistor to notice that the chip has 30% more transistors than your original design.

Also, adding something like that would be an incredible amount of work. Basically you would have to totally re-do the layout even if you're just adding a macro somewhere and totally re-design it if you're not going to end up causing a drastic decrease in max clock rate. That's for an management engine or tracking style thing. A backdoor that makes #5F0A40A3 equal to every other number for password bypass wouldn't be that invasive and might only slow things down by a little bit so I guess that's a possibility if a certain design becomes really popular?

The designs have to fit in 10mm² but the total chip will be 16mm² with the pads, a RISC-V and some interfaces supplied by Google. They could obviously fit some trick into their part, but given that it too will be open source you can inspect it if you don't trust them.

Reply on news.ycombinator.com