Hacker News Reader

Comment by dcw303 | Hacker News Reader

This is great, I love the idea of building a complete laptop from the ground up to dispel all the "magic" that goes on inside a manufacturer built consumer model.

Hypothetically speaking, if I was a super-paranoid type who wanted to build my own laptop from scratch so that I trusted every component installed, how would I go about verifying the CPU / SOC was not a threat?

I guess I'm asking if there's anything equivalent to an MD5 checksum for hardware?

It seems that backdoors are being discovered in parts as esoteric as hard drive controller firmware, so I'm wondering if it's practical to believe I could build a personal computing device that is trustworthy.

View on HN

According to Ken Thompson's lecture at his Turing Award, you can't:

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

Practically speaking, you can verify that it's unlikely that there is no backdoor, but it'd take a fair bit of effort.

Impractically speaking, you could singlehandedly reimplement decades of computer engineering starting with a pencil, paper, and a bucket of sand.

From NAND to Tetris in 12 steps

https://www.youtube.com/watch?v=IlPj5Rg1y2w

I prefer placing rocks in an infinite desert to simulate the the flow of data through a computer myself.

Model your threat and then mitigate it, for example if you are worried about China buy an Intel CPU made in the US, if you are worried about the US buy Huawei gear.

Lets just leave it at you don't posses the budget to make any reasonably legitimate claims about your op sec.

If one of your use cases is browsing the internet, you might as well just give up.

If they can put stuxnet on Iranian PLCs you're fucked, however, in reality no one really gives a shit about what porn you might be watching or whatever other irrelevant activities you might be doing.

"Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software."[0]

Needless to say, if you run Microsoft software, you're going to have a bad time.

[0]https://en.wikipedia.org/wiki/Stuxnet

The best you can do is use a processor with an open-source design. Stallman used a MIPS CPU like this for a while.

The processor Stallman was using wasn't open-source. The MIPS instruction set was opened up, but most of the implementations weren't.

But what about fabbing or the PLC? Can you verify those? or disk controllers, &c.

Bunnie huang also showed that even sdcards have potent microcontrollers ..

Reply on news.ycombinator.com