Hacker News new | ask | show | jobs
by mike-cardwell 3382 days ago
Even if Intel gave you the source code, you still wouldn't know if there was any unauthorised code running.
1 comments
Taek 3382 days ago
Reproducible builds is a very important part of knowing you are secure, and in the absence of that at least being able to flash on your own compilation.
link
hdhzy 3382 days ago
Well even with reproducible builds how do you check what actually is running there? That'd be the ME reporting "I'm running version X" without a way to really verify it. Also if you flashed it you cannot be 100% sure there is no other component that is still running a rootkit.
link
schoen 3382 days ago
Good analysis of this issue in Halvar Flake's https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-... ("Why Johnny can't tell if he is compromised").
link
ams6110 3382 days ago
Or Ken Thompsons's Reflections on Trusting Trust.
link