Bootstrapping a slightly more secure laptop [video]
![Bootstrapping a slightly more secure laptop [video] by @ianopolous](/og/bootstrapping-a-slightly-more-secure-laptop-video-13348512.png)
Published in 2017, this chronicle by @ianopolous details the mechanics of building a profitable, self-funded business without venture backing.
Core Principles for Independent Builders:
Charging customers from day one acts as the ultimate filter for building software that solves genuine, high-urgency problems.
Keeping fixed overhead low and leveraging lean infrastructure allows founders to stay alive until market tailwinds kick in.
Small, repetitive improvements in customer retention and conversion rates yield massive returns over multi-year horizons.
Community Debate Themes:
The community focused on B2B customer acquisition channels, cold email vs SEO distribution, and balancing full-time employment with side-project development.
CATEGORY Bootstrapping & MRR →
HISTORICAL ERA Cloud & Mobile Era (2014–2019)
COMMUNITY SCORE 89 points
TOTAL DISCUSSIONS 14 comments
In summary: Coreboot+Linux as a bootloader
I think I've seen this before in an HPC context. But they've build a firmware distribution called Heads. It boots using coreboot then fires up a Linux kernel from flash.
The kernel is then used as a second stage bootloader. It takes about 2 seconds to get Linux booted from flash.
They can then boot the system OS, optionally using kexec to smoothly transition to the system kernel.
Very neat! Along the way they've also done other important work, like put together a minimal firmware for the Management engine (a second CPU in Intel system with its own OS, and many many issues).
The biggest problem here is same issue that coreboot has. Coreboot support is really limited. I think it down supports Lenovo X220s, but late time I looked not much modern hardware.
What would be really interesting is to use this with a UAF/U2F. The TPM produces a value, this value could be used the same way the domain name gets used in 'normal' UAF/U2F (as the AppID). The UAF/U2F authenticator would only sign the challenge if the TPM is correct, saving you from the Evil Maid attack. This the same mechanism that protect from phishing in the web.
Then you can validate the signed token, and if everything is correct you can use the TPM value to decrypt the harddisk.
Right now I am using my remembered password plus static password mode of my Yubikey to have a fake 2FA decryption requirement on boot but UAF/U2F would be way cooler.
It there something wrong with this idea?
Slides -> https://lab.dsst.io/slides/33c3/8314.html ↗ Slides(pdf)->https://lab.dsst.io/slides/33c3/slides/8314.pdf ↗
An unrelated but interesting point he noted was that Apple are one of the only vendors that provide long term firmware updates (he mentioned 8 years). It's a shame nobody else really does this.
Secure what? Please add "laptop" to the title as it is on the original.