From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Craven Subject: Re: [PATCH 7/7] gnu: Enable CONFIG_HOTPLUG_PCI. Date: Thu, 2 Feb 2017 22:50:31 +0100 Message-ID: References: <20170201233531.2640-1-david@craven.ch> <20170201233531.2640-7-david@craven.ch> <20170202202006.03597708@scratchpost.org> <20170202214159.2901d3e4@scratchpost.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55455) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cZPH6-0001eJ-Ed for guix-devel@gnu.org; Thu, 02 Feb 2017 16:50:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cZPH0-0000yH-28 for guix-devel@gnu.org; Thu, 02 Feb 2017 16:50:39 -0500 Received: from mail-qt0-x236.google.com ([2607:f8b0:400d:c0d::236]:33929) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cZPGz-0000xy-Rg for guix-devel@gnu.org; Thu, 02 Feb 2017 16:50:33 -0500 Received: by mail-qt0-x236.google.com with SMTP id w20so1848968qtb.1 for ; Thu, 02 Feb 2017 13:50:33 -0800 (PST) In-Reply-To: <20170202214159.2901d3e4@scratchpost.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Danny Milosavljevic Cc: guix-devel Hi Danny, > For example, let's say Intel had non-updateable microcode on its CPUs and= it included a backdoor. If anyone *ever* found it, nobody would trust Inte= l ever again - and Intel couldn't sweep it under the rug because millions o= f physical chips that include the backdoor would be in the hands of differe= nt people. What could they do? > > On the other hand, if firmware is updateable by a (possibly automated) pr= ogram, that program could easily check whether it's running on *your* compu= ter specifically and then give you a special firmware. Now nobody but you h= as a chance to find it. Not to mention checking the date etc. > > With all the spying going on that's a *real* possibility. Also, many peop= le already found backdoors in BIOS updates for example - so it's not theore= tical. But you can check the hash of the firmware. If a device doesn't have internal flash we at least know that it's running the firmware we are giving it. If the device has internal storage and if someone wanted to target you and did have the resources to do so, they could reflash the chip and you'd never know. Isn't human error just as scary as the NSA?