Hacker News Reader

Comment by jingo | Hacker News Reader

I thought we were talking about SIM cards.

Can I upload software to my SIM card? No.

Most phones accept some type of SIM card, while not all phones have a means of user-controlled offline external storage (microSD, etc.).

Why can't the user access a SIM card? Why can't she look at the software stored on a SIM card?

The SIM card slot is pretty much off-limits to the user. Yet the user owns the phone.

This is like buying a computer that has a special card slot owned by a single company or a consortium of companies that produce special cards only for their own use. The user is effectively denied access to the slot.

View on HN

You do not own the SIM card, it remains full property of your network operator. As such, they have a right to keep you off-limits.

FYI: the main Javacard applet on a SIM card is the GSM applet, the one you use to authenticate against your network. Other applets are useful for network operators: IMEI tracking sends them your phone ID to help them configure it correctly -- it is also used to track stolen phones. Another useful one updates your preferred foreign network list when you change countries, connecting you automatically to a cheaper network when available.

Uploading your own software will not do you much good. As mentioned above, CPU and memory are very limited on SIM cards, and Javacard is basically a glorified assembler you do not want to touch. SIM cards are mostly there to perform some simple crypto operations for network authentication and that's it.

Imagine reversing the direction of reporting: allowing the user to learn more about the network, for example. That would be just one reason to put custom firmware on a SIM card. Another might be running a known-secure firmware for security-conscious users (corporations, governments, kidnapping/extortion targets, etc.).

SIM cards don't know anything about the network they are running on, this all happens inside your terminal. They hold an IMSI (=contract #), a set of private keys, and some utility applets. SIM cards don't even know their own phone number.

As for running a known-secure firmware: in the end a SIM card only authenticate you against a Mobile Operator with a pre-shared key. If you believe your SIM is running a non-secure firmware, how can you trust your Mobile Network Operator not to do fancy stuff on their network behind your back?

Who says there can only be one SIM card? What if the user can have her own SIM card? Who says SIM cards are only useful with cell networks? What if the user has her own network? Is that impossible, now and forever? What if she has her own authentication and encryption needs, apart from some telecom's network?

Yes, the telecom owns the card they give you. Indeed, that is their property. But they don't need to own the smart card standard and use it to exclude users from using the slot.

Imagine if the motherboard you bought would had certain slots that were off-limits to you and open to use only by certain companies.

As for "glorified assemler", have you considered something more succinct, like FORTH. There's nothing glorious about Java.

SIM cards are just your average smart cards dedicated to do mobile network stuff. You can buy your own blank smart cards from Gemalto and Oberthur if you so wish.

Javacard is not Java. No OO, no classes, no GC, no floats, no strings, the only data type you can use is int16. Have fun.

I'm no authority on JavaCard, but I'd guess it's verbose like Java and expects some sort of auto-completion capable "IDE". I took a quick peek at a JavaCard standard and I could swear it said there are classes.

I don't want no stinking Java, whether it's a small subset of the language or the full blown monster. For the task at hand, I'd have more fun with assembly language than anything prefixed with "Java".

The blank smart card possibilities are enticing. If we can use our own crypto.

Doesn't OpenMoko's WikiReader run FORTH?

Do you program your PC BIOS or firmware?

http://www.coreboot.org

How many PCs ship with it?

Usually, whatever software PC's "ship with" is crapware. Go figure.

"Crapware" is just my opinion. Although I've heard others note the same thing.

I think at least some Chromebooks use it. It finds use in HPC clusters and embedded/industrial settings as well.

All Chromebooks except for the ARM model and the CR48 prototype use coreboot.

The ChromeOS developers are currently porting coreboot to ARM, too.

I wish! I hate my PC's bios. So many superfluous timeouts, so much waiting around (clearly braindead programming that doesn't do hardware well). A stupid text based config interface. Nothing about the BIOS is good.

You mean, besides providing a standard way to access hardware that ARM systems still don't have to this day?

And all this time, I thought my x86-64 workstation was BIOS free!

http://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Int...

> UEFI is meant to replace the Basic Input/Output System (BIOS) firmware interface

Hence firmware to replace BIOS, with the same purpose as BIOS.

So do you re-program your UEFI firmware?

And since when is x86-64 an ARM system, since that was my remark?

Having a specification and a reference implementation is possible without the reference implementation being proprietary... Personally I would much prefer that.

According to https://news.ycombinator.com/item?id=6083583, Coreboot is being ported to ARM.

Yes.

Reply on news.ycombinator.com