Comment on Router Hardware: How Much Paranoia is Too Much?
lordnikon@lemmy.world 3 days agoYour welcome but that’s the point he was making even if you build everything on your own. The backdoor would be in the compiler. So even if you built /bin/login for example the would just inject it at compile time when compiling your code. But then you asked I will just compile the compiler but you have to compile it at some point and he can inject the code back into the compiler at that point.
libretech@reddthat.com 3 days ago
Sorry, imprecise wording on my part, I meant build as in build/code from scratch, not build from source!
lordnikon@lemmy.world 3 days ago
No worries , but i think I’m not being clear if you build it from scratch. how are you going you going to compile it ?
GreatBlue@infosec.pub 2 days ago
In the end you would build your compiler in assembler, so no compiling would be needed.
But if you run your compiler on compromised hardware it would still be possible to insert a backdoor in your programs without you knowing.
To mitigate this vector you would be required to build your own chips… with self developed and assembled machines all the way down starting at growing your own silicon crystals.
libretech@reddthat.com 3 days ago
No I think we’re aligned! I am not trying to say the “build literally everything” from scratch is a viable alternative. You could go all the way down the rabbit hole of building a compiler, your own programming language, a smelter to refine the metals you need to try to cobble together your own hardware. But of course that is not realistic, which was what I was trying to get at in my comment. Basically, given that it is not feasible to do everything by yourself, at some point it seems you have to decide to trust something to be a functional human and not devolve into solipsism. So the question I am asking is, what are your own evaluations of what is trustworthy? Do you trust coreboot more than AMI? Protectli versus Qotom? It seems to me that we have to make these sorts of evaluations, versus believing that because there is some risk to everything that those risks are all equal. Apologies if I am not being clear though.
lordnikon@lemmy.world 3 days ago
Yeah that is his point he is trying to make at some point you just have to come to terms with that trust since you are right it’s not feasible to build your own hardware.