<story><title>Open source firmware is important for security</title><url>https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/</url></story><parent_chain></parent_chain><comment><author>acd</author><text>Agree with the author that UEFI is bad for security. You have this huge binary UEFI blob in a pre os boot environment that does not run open source. After the motherboard,laptop manufacturer looses interest and they loose interest as soon as the product does not sell more new products UEFI remains unpatched and insecure.&lt;p&gt;The boot loader should be simple and relatively dumb IMHO, then it is secure. If it should be bigger then it should be Open source.&lt;p&gt;Management processors like Intel ME built into the CPU, firmware another x86 insecurity.</text></comment>
<story><title>Open source firmware is important for security</title><url>https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/</url></story><parent_chain></parent_chain><comment><author>transpute</author><text>Videos from the 2018 Open Source Firmware conference are available: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;osfc.io&amp;#x2F;archive&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;osfc.io&amp;#x2F;archive&lt;/a&gt;&lt;p&gt;See also &amp;quot;Firmware is the new Software&amp;quot; from Trammell Hudson, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.platformsecuritysummit.com&amp;#x2F;2018&amp;#x2F;speaker&amp;#x2F;hudson&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.platformsecuritysummit.com&amp;#x2F;2018&amp;#x2F;speaker&amp;#x2F;hudson&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;i&gt;&amp;gt; Secure firmware is the foundation of secure systems. If we want to build slightly more secure systems they will require open, auditable and measured firmware. If we can’t read and audit the firmware code, we can’t reason about what is going on during the critical phases of the boot process; if we can’t modify and reproducibly build the firmware, we can’t fix vulnerabilities or tailor it to our needs; and if the firmware isn’t measured and attested, we can’t be certain that our system hasn’t been tampered with.&lt;/i&gt;</text></comment>