 |
| “strcat is right here.” (comment) | ||
| recommended by 1 user | 2022 | marcan_42 on: Librem 5: First Impressions | trusted computing | original thread | | ||
| marcan_42 on Mar 22, 2022 | on: Librem 5: First Impressions | view on HN | ||
| One user recommended this comment. What they said: |
|
rollcat May 25, 2022 | on: Symbian Source Code | context
> If you want there to be a viable competitor to Apple and Google (and you have the cash), buy a Librem 5. No thank you, I will never buy or use any hardware from Purism. They are openly hypocritical and I have zero trust for them. Quoting from: https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd... > The RYF has a “secondary processor” exclusion that can be granted on a case by case basis. We will leverage this exclusion to load and train the DDR PHY on the i.MX 8. We will use a secondary processor to keep binary blobs out of u-boot and the kernel. Add extra silicon, to lock the user out of updating the firmware. Because the FSF will grant you an arbitrary badge of honour if the firmware is closed source, but not user-updatable. This is some next-level bullshit. This is on top of the hardware being utter crap in terms of protecting user security or privacy; marcan_42 explains it quite well: https://news.ycombinator.com/item?id=30761886 If you want a reasonable trade-off between freedom and security, GrapheneOS is actually the only viable contender I'm aware of. > If you want there to be a viable competitor to Chrome, use Firefox. The IE monopoly was broken, because Mozilla made a better product. Also, it took Chrome to fully displace IE. This is why FOSS can't "win". You have to have a better product, not just a feel-good badge. Look at the FOSS projects out there that are actually successful: they all have a good product strategy behind them. But for most FOSS activists, designing a better product is apparently much harder than indoctrination. |
strcat is right here. Purism designs and markets their devices, effectively, to cater to a crowd that believes that devices with actual security are inherently evil, because they do not understand it. You can have better security with user control, but for that you need to look at the details. They don't care about the details; their story is all fluff under the guise of freedom and privacy.
Purism's marketing material is outright deceptive, e.g. they insist that in competing phones the baseband blob has access to system memory, which is a lie. The reality is that the baseband blob in the Librem 5 (which is every bit a giant blob as that in the competition) has access to the USB port of the AP and there is no filtering implemented yet, so the attack surface it is exposed to is every USB driver in the Linux kernel, which is much worse than systems with embedded basebands and proper memory firewalling where the baseband has no more inherent access, but is exposed to a smaller attack surface. That means that you are more vulnerable to giant blobs doing evil things with a Librem 5 than with, say, an Android phone running a free OS build.
Then there's the whole hilarious situation with the RAM initialization blob where Purism went and hid it behind two layers of CPUs (not execution, just handling it), because somehow doing that - which provides absolutely no benefit to the user, it's just a waste of engineering time - made it possible to certify the phone under the FSF's utterly broken and nonsensical "Respects your Freedom" program, even though precisely zero freedom was gained by doing this, since it still running the same blob on the same final CPU with the same access. All the while while reducing security, since the blob is then made no longer part of the normal OS image and is not validated with it, so it could be backdoored as part of a supply chain attack and you would be none the wiser.
The whole thing just stinks the more you look into it, and it is completely evident that the folks behind Purism are a mix of deliberately deceiving people and just clueless about security and modern embedded platforms.