Hacker News Reader

Comment by fsflover | Hacker News Reader

My problem with Libreboot is not only that supported hardware is very old [0], but that all those devices are vulnerable to Meltdown/Spectre, so you cannot run any untrusted code (not even Javascript).

[0] https://libreboot.org/docs/hardware/#supported-hardware. It seems that the Chromebook is an exception?

View on HN

I have a Thinkpad X200 with libreboot, and with it, I install the intel-microcode and such so I have the updated protections on then.

I personally feel that is a practical solution, as I have the FOSS bootloader, and I don't think Intel has backdoors in their microcode, it would much more likely be in Intel ME.

Are you saying that you can update the microcode on Thinkpad X200? How did you do that? I thought Intel stopped supporting it.

Given the mention of 'intel-microcode', presumably the parent means the Intel CPU microcode that is loaded during Linux kernel boot.

But does it actually help against those vulnerabilities?

AFAIK it does yes.

Vcs-Browser: https://salsa.debian.org/hmh/intel-microcode

Yeah sorry, I should have been more specific, `interl-microcode` is a debian package that loads it on linux boot.

AFAIK it is supported:

https://wiki.debian.org/Microcode

The Core 2 line of processors has not received any microcode updates since 2015.

"Products not planned": https://www.intel.com/content/dam/www/public/us/en/documents...

Well that's disappointing....but I guess not unexpected.

Are there any x86 CPUs out there that are NOT vulnerable to Meltdown/Spectre at this time? AFAIK not, and we're all paying performance hit[1], have lower resolution timers in JS runtime, and such.

[1] https://news.ycombinator.com/item?id=22830330

Technically, yes -- but they're simple cores like some older Atoms, so their performance was pretty low already.

I think that's on purpose from the side of hardware manufacturers - newer systems make it impossible to use your own boot firmware. But I'm not sure - could someone confirm?

Yes. Both modern intel and AMD CPUs require a signed firmware on boot, and there's no way to adjust these keys. This basically kills any attempt to keep the boot process open (but doesn't completely stop attackers because the signed firmware is vulnerable to a variety of attacks).

Can you go the other way, OLD enough that the relevant CPU features simply don't exist?

Reply on news.ycombinator.com