Hacker News Reader

Comment by sneak | Hacker News Reader

That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.

View on HN

Your approach won’t solve that, you’d need to also flash the chip with patched / clean firmware

And you might not be able to.

Zero it and install Linux. Problem solved.

It could effectively a ring -2 rootkit, and it could prevent you from removing it.

Short of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds?

For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?

Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.

Disabling all of the parts of the ME except the part that lets the computer stay powered on is fortunately now well-documented (NSA-requested HAP support).

Again, not looking for a perfect solution. So I take it loading a different boot-loader first wouldn't be enough?

The EFI partition is on disk, not in firmware.

Clearly there's some component of UEFI that's in firmware, right? I don't really know all the terminology and such here, so please correct my understanding, but -- even if you don't have a disk, you'll get some UEFI bootloader. I seem to recall that some devices like many Chromebooks will have some extensive EFI blobs in firmware partitions, at least some of which is a read-only "get back to factory settings if you really screw up" stuff. I don't see what could stop a vendor from putting whatever they want into a a read-only firmware EFI partition, I'm pretty sure they exist in the wild.

The Chromebook’s user partition is read-write, and the system is read only (save for updates). The “powerwash” factory reset just wipes the user partition. The OS restore (if you can call it that) is not stored in boot flash, just standard data/nvme disk.

If you wipe the whole disk, you still need to use a bootable restore USB to restore it.

This has nothing to do with the fact that it is UEFI booting.

Such are the problems Purism is said to be attacking: https://puri.sm/products/librem-13/

For anyone who has bought one of their laptops, how does the build quality compare to an old macbook or thinkpad?

I have a librem 15. The screws inside the case seem to come loose every once in a while. Also I wish the body was a little more rigid (I'm guessing the librem 13 doesn't have this issue since it's lighter and smaller). Otherwise I like it. The speakers also aren't very loud so I often have to make the volume higher than 100% to hear clearly. I think the trackpad is fine using libinput (I haven't tried other drivers).

I didn't want to use PureOS so I installed NixOS and everything seems to work fine.

I used to have an issue where the fan would get stuck on high after resume, but I think that was fixed when I updated coreboot to the latest version.

After a quick gander, I'm actually more interested in their phone. The idea of a phone that can not and will not track me, and which I know is doing only what I want it to do is pretty damned exciting.

The laptop is certainly nice though.

If it has a SIM card, it is tracking you. If you leave Bluetooth or WiFi enabled, then it is being tracked. All the Librem 5 can do is 1) give trusted RF kill switches, and 2) not add additional tracking on top.

I will probably still buy one if it materializes, and is functional.

> If you leave Bluetooth ... enabled, then it is being tracked.

Wait, can you expand on this? Are you saying (current, existing) Bluetooth radios can be used for location tracking without additional hardware/OS support?

Maybe the MAC address or other broadcasted information could be used to fingerprint your device. That’s why WiFi MAC addresses are randomized on iOS, but I’m not sure that Bluetooth has gotten the same treatment.

Apple sells this as a product (iBeacon). There are others.

Reply on news.ycombinator.com