294 karma · joined April 9, 2017
The really funny part is that people think there is some metaphorical gun to developers heads to use this technology. There is a choice, there always has been.
See:
https://i.pinimg.com/originals/6a/09/f4/6a09f4c78c82187da893...
Daintree in FNQ for example, quite a lot of inner australia. Don't get me wrong... I do understand the complexities of delivery, but it isn't perfect either.
Is this like signing an RPM package?
I believe seL4 is verified and used in production ( https://sel4.systems/ )
There is an ongoing effort and it becomes more complex with vendored packages, embedded jars and 'containers'.
I'm assuming that the indexing is done at compile time, how far back into your dep tree do you go ?
This of course requires vendors to also play with this scheme, which I'm not sure NVIDIA has the clout to ensure that point-of-sale people can enforce this.
It can be used for 'out of band' management of your system, including firmware/bios rollouts and updates. Allows remote hijacking of attached hardware devices. Basically can puppeteer your entire system.
> why can't we do anything about it?
Because there is no ability to update or modify this code. It is only updatable by the hardware vendor as it is encrypted, signed and checked during update.