Hacker News new | past | comments | ask | show | jobs | submit login

If you're running fully free software, you're not running x86, since it can't boot without backdoored binary blobs.



What about Libreboot? Doesn't that allow booting x86 without binary blobs?


Yes, very old hardware that's no longer on the market. I don't consider that a solution. Eventually that pool of hardware dries up.



It's easy to find x200 etc. used. Flashing is another story.


> Flashing is another story.

https://tehnoetic.com/tet-lis


They still need some parts of blobs to configure/initialize the system and that “some” now means full MINIX kernel along its userland


That's not correct, Libreboot does not work on those systems that require any part of the ME to boot.

You might be thinking of me_cleaner[1], which removes most but not all of the ME blobs. This is unrelated to Libreboot though, it works on newer systems and is not needed when using Libreboot because the latter gets rid of the (very early versions of) the ME completely.

[1] https://github.com/corna/me_cleaner


Are you saying a librebooted machine is still probably backdoored?


Precisely.


You are talking about Coreboot, not Libreboot. The latter has no blobs whatsoever.


Does that mean that a firmware backdoor is impossible or very unlikely?


Yes, it should be harder.


All modern ARMs have ROM block containing undocumented booting sequence.


You're wrong, but with such confidence! Here is a documented ARM booting sequence with fully free firmware,

https://stikonas.eu/wordpress/2019/09/15/blobless-boot-with-...


That 32k BootROM isn't free in your example.

SoCs will also have "pre-boot" code that runs before that:

> However, even one of their most ardent open-source advocates pushed back quite hard when I suggested they should share their pre-boot code. By pre-boot code, I’m not talking about the little ROM blob that gets run after reset to set up your peripherals so you can pull your bootloader from SD card or SSD. That part was a no-brainer to share. I’m talking about the code that gets run before the architecturally guaranteed “reset vector”. A number of software developers (and alarmingly, some security experts) believe that the life of a CPU begins at the reset vector. In fact, there’s often a significant body of code that gets executed on a CPU to set things up to meet the architectural guarantees of a hard reset – bringing all the registers to their reset state, tuning clock generators, gating peripherals, and so forth. Critically, chip makers heavily rely upon this pre-boot code to also patch all kinds of embarrassing silicon bugs, and to enforce binning rules.

https://www.bunniestudios.com/blog/?p=5127


>That 32k BootROM isn't free in your example.

It's a ROM. Read only.

https://www.fsf.org/news/freebios.html

"The BIOS was impossible to replace because it was stored in ROM: the only way to to put in a different BIOS was by replacing part of the hardware. In effect, the BIOS was itself hardware--and therefore didn't really count as software. It was like the program that (we can suppose) exists in the computer that (we can suppose) runs your watch or your microwave oven: since you can't install software on it, it may as well be circuits, not a computer at all."

Edit: >ROMs can still be backdoored, which is the point of this discussion.

You said it wasn't free, and when proven wrong, you moved the goalpost. Since I'm a wrongthinker who can only post once every hour or two on this site, I'm done discussing this with you. If you want to try to convince people that a 32K ROM is the same as IntelME, then you're not worth my time anyway.


ROMs can still be backdoored, which is the point of this discussion.

Since we're editing: Free has many definitions. The FSF's on that one page doesn't take into account backdoored software; they would absolutely agree that backdoored ROMs aren't free. It removes user ownership over their computation. It's not "moving the goalposts" to point this out, especially when the entire point of the discussion is around backdoored software.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: