Free Advice for FBI/OPM/NSA/DOE: full-disclosure hardware

Troy Benjegerdes hozer at hozed.org
Tue Jun 16 21:25:13 PDT 2015


Okay, so apparently the CIA pulled a fast one on you, and now
everyone with a security clearance is (probably) getting doxed[1].

"Outsiders must be deputized to audit the systems, brutally assess their failings, and put together an aggressive plan to both find existing breaches (who knows what’s still lurking in OPM’s systems right now?) and prevent further ones. Every government agency should be subject to an outside cybersecurity audit, and I include the NSA in that"

So since I'm a nice guy (or maybe just a guy with an open-source
hardware business plan) the first thing I want to audit is the
PCB layout of the server(s) that got hacked. I'll even do it for
free if you publish the schematic and board layout under a license
compatible with the Debian Free Software guidelines.

Now, on the other hand, if your hardware vendor is going to whine
like a child who got caught with their hand in the candy jar about
'IP' and such, I will be happy to start reviewing how broken
Intel/AMD/etc chips and motherboards are with a confidentiality 
agreement if you agree to pay my retainer. (which is approximately
the amount I need to buy some farmland and wind turbines.)

[1] http://www.slate.com/articles/technology/future_tense/2015/06/opm_hack_it_s_a_catastrophe_here_s_how_the_government_can_stop_the_next.html


So if anyone is actually serious about security, then I'll know 
because there will be more than just me talking about why we need
full-disclosure hardware that you can X-ray and compare to an image
signed and hosted by multiple independent and competing nation-state
or multinational-corporate level security agencies.

If your Intel motherboard matches the image signed by IBM,
China Telcom, and Iran, than it's probably safe for Democrats to use,
and good for Republicans if Saudi Arabia signs it.

Any politician using an image signed only by an agency they supervise
should be immediately impeached.




More information about the cypherpunks mailing list