The firmware code is available in a well known instruction set and, if I'm willing to spend an extended period of time working on it, I can verify that it's not doing anything nasty in SMM. The impact on a vendor of a user discovering that would be pretty huge. The CPU? That's a massively harder problem to solve.
But yes, my biggest problems are that there's no mechanism for anyone else to get their code signed by Google and it's excessively difficult to install user keys. Is there an actual requirement from Google that vendors have jumpers for disabling the write-protect, or is that just an artefact of manufacturer production and testing processes?
Power management, mobile and firmware developer on Linux. Security developer at Aurora. Ex-biologist. mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer. Also on Mastodon.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: Everything that glitters isn't Secure Boot
Date: 2013-02-06 07:19 pm (UTC)But yes, my biggest problems are that there's no mechanism for anyone else to get their code signed by Google and it's excessively difficult to install user keys. Is there an actual requirement from Google that vendors have jumpers for disabling the write-protect, or is that just an artefact of manufacturer production and testing processes?