Hacker News Reader

Comment by javajosh | Hacker News Reader

I'm particularly impressed with their anti-tamper measures. "For each server sled, shine a light into the cubby to look for any physical tampering or damage."

https://docs.oxide.computer/guides/system/rack-installation-...

View on HN

    The rack also comes with built-in security features to ensure all hardware and software are genuine Oxide products:

    purpose-built hardware root of trust (RoT) – present on every Oxide server and switch – cryptographically validates that its own firmware is genuine and unmodified
    encryption of data at rest via internal key management system built on the RoT
    trust quorum establishment at boot time to ensure the cryptographically-derived rack secret is verified before unlocking storage

https://docs.oxide.computer/release-notes/system/1-0-0

That's pretty standard? Anything that's going straight into 400V (I assume) deserves a good eyeball before it's energised. I doubt their "root of trust" knows how to protect the system from a dead mouse in the bus bars.

I'm not worried about dead mice; I'm worried about tampering. I would have hoped there'd be more guidance than "just look and see if anything looks weird". A determined threat actor can easily side-step that check with, for example, careful desoldering/resoldering technique.

I suspect this step is intended to protect you from FedEx, not the NSA.

If this is seriously your level of supply chain scrutiny, being an Oxide early adopter probably isn't the best idea.

I think for the unit price of $1M per rack or more, you can easily afford an armed guard to escort the crate from the factory.

> Anything that's going straight into 400V (I assume)

I think the sleds blind mate to a 55V DC common bus.

Reply on news.ycombinator.com