Hacker News Reader

You usually have some sort of boot chain signature for the efuses. You have an initial bootloader and then that checks the signature of the next in the boot chain and so on. You could write an unlocked signed bootloader on the board, that is valid and boots and that can boot into anything.

If I'm not mistaken, that's _exactly_ what G is doing with the Chromebooks.

View on HN

> You could write an unlocked signed bootloader on the board, that is valid and boots and that can boot into anything.

True, but almost no one does this (Google/Chromebooks being an exception).

It would be a hugely positive step if manufacturers were required to ship/escrow/provide an unlocked bootloader to sell their products.

Unfortunately, that isn't the case today and it's only through goodwill that this is possible.

On the contrary, Chromebooks are one of the better options; they can generally have their bootloader unlocked, unlike ex. most phones

I might have been unclear. I meant that google ship devicess e-fuses enabled but with the unlocked bootloader option (using, I believe, the mechanism I tried describing above). They do make this, a lot of other vendors don't. Good for them!

Reply on news.ycombinator.com