jackpot51

Sorry, I did not mean to be secretive.

That is precisely what I am going to do

Why is Redox not viable competition?

Yep, I look forward to the day OpenBSD is obsolete. How Theo can be so anal about features like ASLR but then completely disregard the potential of compiler enforced memory safety is beyond my cognitive power.

I believe that Linus's attacks are usually good intentioned, to get people in the Linux community to act better. I am not sure what Theo's intent is.

Theo is completely ignorant here. I also saw him spout similar inaccuracies in this video: https://youtu.be/fYgG0ds2_UQ?t=2112

Uutils and Redox are setting out to provide POSIX compatible coreutils, and Redox builds from scratch in less than 30 minutes.

Firstly, the ME section is locked until a message is sent to the EC. Flashing firmware on a live system can be dangerous, more so on a laptop. Our flashing method has to take place in EFI.

Signing keys are fused into the CPU for boot guard when the CPU is attached to the motherboard during production, for soldered CPUs like the U and H class. Having a customer signing key would seriously complicate BIOS updates, as only one key can be utilized, meaning our firmware updates would not work.

It would also make returns much more difficult, as all CPUs with customer keys would have to be replaced.

Right now, boot guard is only used on the Galago and Lemur.

We do both - set HAP and remove code.

Do you have a ticket that I can look at? I don't like to have Oryxen not living to their full potential

Yep - RISC-V is the best bet for full freedom

On the side note - a new initial setup was released today for Pop that may have fixed your account creation issue. I am sorry if you ran into problems with Pop.

Not as good as I want it to be. When we manufacture our laptop chassis here in Denver, Colorado we will have more control of battery size and will always prefer longer battery life

Yes, see the firmware-update repository mentioned above

The reason is that our laptops have more homogeneous firmware than our desktops.

Thanks!

Not currently. I have experimented with coreboot but did not get far yet. We are tied into AMI for most machines right now, and I would love to cut them out and go open source!

We may be experimenting with coreboot more in the near future

Reproducible builds

This simply does not scale. Every single customer has to download the BIOS, usually from a questionable source, plop it on an unreliable flash drive, and then boot into the setup menu to manually select the right file. Our method will automate most of this process more reliably.

To answer more harshly than before, you did not really try to help us get into LVFS. Instead, you continued to question our method of updating firmware, even though we have open sourced a large amount of our infrastructure.

Still, I have been changing our firmware updater to better suit LVFS and fwupd for when you finally decide to reconnect in a more positive way.

I am working on embedding all firmware flashing files into one EFI executable when it is built by our CI - this should make it much easier to use from fwupd.

Yeah, they can certainly do that.

Thanks!

Wait until the firmware updater is released through the System76 stable PPA.

Yes, we have. There were compatibility issues that I am still working to resolve.

No, we do not. We do expect to pressure them to do the right thing, which is one of the following:

- Release ME source code

- Remove ME from consumer products

- Have a provable method of disabling the ME entirely

I work on Redox at night and on weekends. I try to write software that can be used in both places.

For example, the graphics library orbclient was used in the firmware updater, and the UEFI library from the firmware updater may be used for a Redox UEFI bootloader.

Yes, you risk bricking your computer. You can create a Raspberry Pi with a SPI clip for fixing bricked computers.

If you have BootGuard, you will brick your machine, unless you have the manufacturer signing key. We have the signing key for our laptops, so we are able to sign updates for the four systems with BootGuard: galp2, galp3, lemu7, and lemu8.

I am the engineer at System76 currently working on this. We are using ME cleaner with -S on all systems where possible - HAP bit will be set AND code removed. All systems will then be tested thoroughly in this configuration before it is released to customers.

Relevant source code can be found in the following places, keep in mind that it is still work in progress:

- System76 Driver with Firmware Update support: https://github.com/pop-os/system76-driver/tree/firmware_artf...

- Firmware Update Frontend: https://github.com/system76/firmware-update

Please ask me anything

When the shit really hits the fan, bullets and cigarettes are the only currencies.

That's me