Hacker News Reader

Comment by AnthonyMouse | Hacker News Reader

> So why would a company, in this new environment, invest resources in making their hardware compatible with competing software environments?

Because that's what customers want to buy. People are paying premium iPhone prices for hardware with mediocre specs and then the hardware sells out when someone like Purism or Fairphone actually makes an open one. How many sales would you get if you did the same thing on a phone that was actually price/performance competitive with the closed ones?

Meanwhile all of that "profit center" talk is MBA hopium. Nobody is actually using the Xiaomi App Store, least of all the people who would put a different OS on their phone.

The real problem here is Google. Hardware attestation needs to be an antitrust violation the same as Microsoft intentionally breaking software when you tried to run it on a competing version of DOS and for exactly the same reason.

View on HN

> Hardware attestation needs to be an antitrust violation

Yes!! Absolutely agree. This needs to be made illegal.

Some of the funnest work, if you could get it, was swapping ssds out of laptops coming through customs for high value targets.

Which is another reason we need to strip this hardware attestation stuff out of the hardware. It either needs to use exclusively keys the user loaded into the device themselves or the keys aren't on the device whatsoever and then the "high value targets" verify the contents of the drive from a known-clean machine once they get it back from the adversarial foreign officials before putting it back into service. Or better yet, keep a separate laptop on each side of the border and then sync the data over the internet instead of losing physical control over the device at an adversarial border.

Plenty of adversarial countries have a competent security service. A foreign government can compromise the corporation's root signing key for the devices through technical attacks and through bribery, espionage, physical intrusion, etc. And they're not going to tell you that they have before using it against your high value targets, so how do you protect them? By not relying on systems with a single point of compromise.

These are new machines before users get a chance to load anything. Thus the customs part.

Are they also putting malware on all the drives in every random retail store or what stops someone from just buying one when they get there?

Can you expand a bit? They didn’t notice the ssd swapped? Which country? Customs as in sending deliveries or passing a border with a laptop?

A company buys laptops for its employees and they get shipped from outside the US, and before they get delivered nice changes have been made.

Any specific individual that is high value will walk into a store and buy from stock.

Ok and buys the laptop with malware? How the customs knows that high value target will buy that specific laptop they swapped the ssd? And what they do exactly? Put malware to steal his data?

You are working inside freaking customs and know where it is being delivered. Read between the lines.

Reply on news.ycombinator.com