What other "trustable" things are "untrustable"?
Only all of them ...

@theruran @thegibson @yojimbo And now people know why I don't / won't support things like secure boot and such on the Kestrel. The only security possible is utter transparency and the willingness to periodically check your code. Impractical? Maybe. But, so is 6 MIPS performance these days, so who cares?

Not that I will prevent others from forking and/or porting their own implementations. But me? Nope. Not gonna happen.

@vertigo @theruran @thegibson @yojimbo Not that secure boot is necessarily a panacea, but check your code... how, exactly? And how do you catch some malicious firmware change before it ransomwares you or leaks all your secrets? One of the things secure boot tries to do is to check the code on every boot to make sure your computer is running the code you (or MS and Intel usually) think it is.

@freakazoid @vertigo @theruran @yojimbo

The entire world must move to some form of EDR.

Our best defense is protecting from these attacks by dynamically stop malicious code execution by pattern recognition.


@thegibson @freakazoid @theruran @yojimbo In the case of the Kestrel, the system firmware is, as far as the FPGA is concerned, located in mask-programmed ROM. Not flash. There is *no* write ability from the Kestrel itself to the system's flash chip.

Meaning, the only way to compromise the flash is to gain physical access to the computer, take it apart, desolder the chip, solder a new chip in it's place (or reprogram and resolder).

Sign in to participate in the conversation

Server run by the main developers of the project 🐘 It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!