Hacker News Reader

Comment by gf000 | Hacker News Reader

Above a certain complexity, there is basically no 100% open-source hardware out there.

Like none of the Pinephone, Librem, Framework laptops are "open-source" to the bone.

Given how easy is to put and keep hidden malware into devices, governments should demand openness in that field as well. By "putting malware" I don't mean script kiddies in their moms basement but malware/spyware planted by design, which is extremely easy to do if you're the manufacturer, extremely easy to demand/force if you're the government above that manufacturer, and extremely hard to detect if you're a different user in a different country under a government that didn't demand full openness. I know it's impossible as business rules go, but ideally it shouldn't be.

Every intel processor has a closed source IME, which is probably a NSA backdoor.

Isn’t minix open source?

Yes, the original is, but it's under a permissive license so Intel don't have to release the modified source code of their version.

The thing is governments are the people doing it, and most governments want to be able to put backdoors in more badly than they want other governments to not put backdoors in.

Precursor is fully open though, https://www.crowdsupply.com/sutajio-kosagi/precursor

It's not. Most of the ICs and components are not open. Most notably the Xilinx XC7S50 FPGA. It does go much further then any other phone.

Open silicon is a big leap beyond open hardware schematics and BOMs that allow people to repair boards, or redesign them to use alternative components.

Precursor is the most open personal computing device that can be built currently.

The comment I replied to was about being "fully open". That indeed goes beyond open hardware. Precursor could go further by at least using an FPGA that has great open source tooling support. It's also not impossible to fab an open FPGA but that's also another hard(and expensive) step.

Precursor goes far, but definitely not as far as currently possible.

The framework laptop , any hard drive ( meaning the hard drives , internal system software ) would not be open source. the embedded software in a SSD , possibly, but the chips could have backdoors etc

> Above a certain complexity, there is basically no 100% open-source hardware out there. > > Like none of the Pinephone, Librem, Framework laptops are "open-source" to the bone.

As an aside, GNU Librephone aims to rectify that by reverse-engineering those blobs and develop their own firmware for baseband chips etc. But I am carefully optimistic about the success since it is a relatively new project and quite a moonshot, even though I would personally stand first in line to buy one if it would materialize.

The BeTrusted/Precursor devices and Raptor Engineering workstations are actually 100% open software and schematics.

So don't say 100%? Not hard.

Human speech is not mathematical formalism. What would even "open-source" mean in case of hardware, is there a consensus on it to begin with? Is it only 'every firmware is open-source and available', or would you want the whole floorplan of the chip?

So given that the word doesn't really apply to hardware, I believe they used it correctly (100% means the set of things where it makes sense to be used) and are not misleading. In fact I strongly dislike some of the "open-hardware" marketing of some previously mentioned devices, when that is obviously false and misleading.

"Not needing binary blobs" would be a start, wouldn't it?

I don't know, depends on a lot of stuff. If you are interested in this property from a security perspective, then no -- it's trivial to have hardware backdoors without any binary blobs.

This likely would also mean that it can't be flashed, so if you care about future maintainability, this is also a negative -- it can not be updated/fixed in the future, which may or may not make sense depending on what part we are talking about.

But if there are some kind of signature validation then it gets even more complicated (like e.g. iphone screens knowing if they are from apple or not).

> I don't know, depends on a lot of stuff. If you are interested in this property from a security perspective, then no -- it's trivial to have hardware backdoors without any binary blobs.

This is a "necessary but not sufficient" thing.

Reply on news.ycombinator.com