| >Without compromising the freedom to change operating system. Privacy, freedom, and security advocates seem to have opposing and wholly incompatible goals when it comes to technology. This attack is possible because the NVRAM is overwriteable. In order to mitigate this attack, you a manufacturer would need to make NVRAM non-NV or add an security device like Apple's T2 chip. Or encrypt the NVRAM and (to prevent a key management nightmare brought about by having millions of users) keep the keys private, in which case all of the haxxors would be crying "they're locking us out of our own hardware!" But adding a security device attacks "freedom". 10 PRINT "Having the vulnerability is bad."
20 PRINT "But adding security attacks freedom."
30 GOTO 10
If all of these raging against the machine Zer0cools were highly paid security consultants in 1981 looking to stir up business by raging against some machines, they would have pilloried IBM for implementing their (pre) ISA bus and Commodore for allowing users to PEEK and POKE into random memory addresses. The former created the entire personal computing marketplace as we know it today, and the latter enabled millions of programmers to understand their machines and make them do things the designers never could have imagined.There was a HN article a while ago about how manufacturers were dumb and we were all going to die because of Thunderbolt and PCIe security flaws where attackers could sniff traffic on the bus. I was just like "no shit, you've been able to do that forever, that's the point of busses and locking them down will just speed the Applefication of computing". Back in "THE GOOD OLD DAYS" when men were men and computers were free and open they had god damned card-edge connectors sticking out of the back of the case which gave anyone within arms reach of the machine direct and unrestricted access to the CPU lines. You cannot have closed openness. |