Hacker News Reader

Comment by oconnore | Hacker News Reader

Were you going to put the microprocessor under an electron microscope? No? Then nothing has changed.

I also think open hardware would be pretty neat, but software people who get really upset about layers they can't verify implemented on top of layers they can't verify sound pretty silly. Either you verify from the bottom or you can't verify at all.

View on HN

This is a common response but it's not addressing the core issue.

Bugs and vulnerabilities are discovered every day in the layers that can be independently verified. Your argument extends to every single piece of software everywhere that runs on Intel and AMD microprocessors, for instance. It's foolish to say that an OpenSSL instance shouldn't be examined because the network interface it communicates over uses a proprietary firmware blob, or runs on Windows, for instance.

I agree that the freedom to verify the behavior of (what amounts to) firmware is not one of the Four Freedoms, but there is a non-zero value in being able to find bugs and help the manufacturer improve the product, as well as being able to use that information to inform a purchasing decision. Especially for something which could potentially be considered to provide organizational security.

My point is not that you shouldn't verify OpenSSL code. My point is that you shouldn't pretend that you don't implicitly trust Intel/AMD (or Yubikey).

So something _has_ changed in other words. You used to implicitly trust Yubikey's word that they put the publicly available source code on their devices, just like now, but you used to also be able to verify their code such that you could be fairly sure that if the trust in the company is warranted, their product is fairly secure, or more importantly, find security issues in their code.

I don't have an electron microscope and I wouldn't know what to look for.

I see your point that we do need to implicitly trust the company at some level, but what's upsetting is we want to encourage the widest possible audience to be able to "look in" and with closed-source change they've stepped backwards by decreasing the number of people who can casually [or pointedly] audit their devices and software.

It is more closed to me now.

Honestly I thought they were a company that cared more about providing the security we need rather than making a profit off intellectual property. I thought they understood the niche community they were providing for.

I can't [implicitly] trust this - not after having had better in the past.

> Either you verify from the bottom or you can't verify at all.

So 'curl ... | sudo -' is just fine now because we can't verify from the bottom, so there's no sense in verifying what we're piping to sudo?

> software people who get really upset about layers they can't verify implemented on top of layers they can't verify sound pretty silly. Either you verify from the bottom or you can't verify at all.

You are kidding, right? Right?

Because, in principle, what you have said amounts to, "Open-source doesn't matter. Closed-source is just as good. Security by obscurity is valid and sensible." Or by real-world analogy, "I'm not a locksmith, so there's no point in having locks on my doors."

So, please tell me you are kidding...

If greater than 0% of the system is verifiable, that's better than 0% of the system being verifiable.

I do agree that we need open hardware, but in practice that usually isn't available.

Reply on news.ycombinator.com