One year ago, AWS deleted my 10-year account over a disputed $100 bill.
-
@seuros My impression of FireWire was always that it was inherently insecure and gave the device a backdoor to the host. Was this inaccurate or later fixed or is it just something you have to accept using that ecosystem?
@dalias FireWire has direct DMA access to the host’s memory (up to the 4 GB address space on most implementations), which is why it earned that reputation. In many ways, it became the scapegoat.
You know what else has DMA? PCI Express. Every GPU, NVMe SSD, NIC, and Thunderbolt device.
The real issue was that, at the time, IOMMUs either didnt exist or werent widely deployed or enabled.
The driver will use the IOMMU after few round of refactoring. My priority was to get the driver correct and working on real hardware first. And get it out the deprecation list.
-
@dalias FireWire has direct DMA access to the host’s memory (up to the 4 GB address space on most implementations), which is why it earned that reputation. In many ways, it became the scapegoat.
You know what else has DMA? PCI Express. Every GPU, NVMe SSD, NIC, and Thunderbolt device.
The real issue was that, at the time, IOMMUs either didnt exist or werent widely deployed or enabled.
The driver will use the IOMMU after few round of refactoring. My priority was to get the driver correct and working on real hardware first. And get it out the deprecation list.
@seuros Right, but in those other cases, the device in question was a fixed installation inside the computer's enclosure that you had chosen to trust, not an external device. I've always deemed bus-mastering DMA a design flaw in all of those other things too, though IOMMU mostly fixed it on hardware new enough to have an IOMMU that's an actual security boundary and not just advisory like some early ones were.
None of this detracts from what you're doing, and I'm glad you'll be wiring up the IOMMU stuff.
-
@dalias FireWire has direct DMA access to the host’s memory (up to the 4 GB address space on most implementations), which is why it earned that reputation. In many ways, it became the scapegoat.
You know what else has DMA? PCI Express. Every GPU, NVMe SSD, NIC, and Thunderbolt device.
The real issue was that, at the time, IOMMUs either didnt exist or werent widely deployed or enabled.
The driver will use the IOMMU after few round of refactoring. My priority was to get the driver correct and working on real hardware first. And get it out the deprecation list.
-
@seuros Right, but in those other cases, the device in question was a fixed installation inside the computer's enclosure that you had chosen to trust, not an external device. I've always deemed bus-mastering DMA a design flaw in all of those other things too, though IOMMU mostly fixed it on hardware new enough to have an IOMMU that's an actual security boundary and not just advisory like some early ones were.
None of this detracts from what you're doing, and I'm glad you'll be wiring up the IOMMU stuff.
@dalias Thanks.
the real distinction isnt internal versus external.Without an IOMMU, an attacker can plug in a FireWire cable and the controller may have unrestricted DMA access. With an IOMMU, the FireWire controller only sees the buffers the driver explicitly maps. From the attacker’s perspective, it is like being locked in an empty room.
If you leave your desktop unattended, PCIe is effectively the same attack vector, it just requires opening the case or otherwise getting access to an internal slot. That is a higher physical barrier.
For this exact reason is why APPLE hardware and consoles rarely provide such ports.
-
@seuros Right, but in those other cases, the device in question was a fixed installation inside the computer's enclosure that you had chosen to trust, not an external device. I've always deemed bus-mastering DMA a design flaw in all of those other things too, though IOMMU mostly fixed it on hardware new enough to have an IOMMU that's an actual security boundary and not just advisory like some early ones were.
None of this detracts from what you're doing, and I'm glad you'll be wiring up the IOMMU stuff.
thunderbolt devices are not usually fixed installations inside the enclosures, same for e.g. eGPUs. the security boundary these days is very much 'late firewire' in style.
except we don't get plug-in debuggers with thunderbolt! underrated firewire utility right there
CC: @seuros@bsd.cafe @dalias@hachyderm.io
-
A anderslund@expressional.social shared this topic
-
One year ago, AWS deleted my 10-year account over a disputed $100 bill. That day I learned something uncomfortable: unless you are a customer capable of causing a PR disaster, your monthly bill doesn’t buy much leverage.
That same week I noticed something else.
Vendor lock-in isnt just a cloud problem. Its a hardware problem too.
Here in Tangier (Morocco), there are warehouses filled with computers that Europe has already written off. Machines with 2-8 GB of RAM and 64-256 GB SSDs, sold by the pallet for almost nothing after being discarded by companies upgrading their fleets.
The hardware wasnt broken. The software had simply moved on.
The OS kept nagging users to upgrade, only to tell them afterward that their computer was too old to run the upgrade.
That is software gaslighting hardware into becoming e-waste. LOL.
So I started buying them.
In the past months I have bought over 5,000 discarded computers, not to build a datacenter, but to understand them, resurrect them, and eventually donate many of them.
That project became ChaosBSD.
In just six months, ChaosBSD has landed 87 upstream commits (it is not a AI number, lol). Ironically, after I started buying old hardware, the prices of SSDs and RAM even DDR2 went through the roof.
Drivers are unlike almost every other subsystem. Frameworks get rewritten. Filesystems get replaced. APIs evolve. But silicon doesn’t get updates. A driver is either correct, incomplete, or it never gets merged. Once it is upstream, it often stays there for decades. I updated drivers that were not touched for 24 years.
Losing my AWS account taught me not to trust a single cloud provider.
ChaosBSD was my answer to the same problem in hardware.
The project was never just about my machines. The drivers went upstream, so every FreeBSD user benefits from them.
If you have an Intel Apple computer, you can install FreeBSD 16 or DragonFlyBSD on it. The computer will feel snappier than it original OS.
@seuros You sir are a man of Vision, and I salute you
-
T tanyakaroli@expressional.social shared this topic
-
One year ago, AWS deleted my 10-year account over a disputed $100 bill. That day I learned something uncomfortable: unless you are a customer capable of causing a PR disaster, your monthly bill doesn’t buy much leverage.
That same week I noticed something else.
Vendor lock-in isnt just a cloud problem. Its a hardware problem too.
Here in Tangier (Morocco), there are warehouses filled with computers that Europe has already written off. Machines with 2-8 GB of RAM and 64-256 GB SSDs, sold by the pallet for almost nothing after being discarded by companies upgrading their fleets.
The hardware wasnt broken. The software had simply moved on.
The OS kept nagging users to upgrade, only to tell them afterward that their computer was too old to run the upgrade.
That is software gaslighting hardware into becoming e-waste. LOL.
So I started buying them.
In the past months I have bought over 5,000 discarded computers, not to build a datacenter, but to understand them, resurrect them, and eventually donate many of them.
That project became ChaosBSD.
In just six months, ChaosBSD has landed 87 upstream commits (it is not a AI number, lol). Ironically, after I started buying old hardware, the prices of SSDs and RAM even DDR2 went through the roof.
Drivers are unlike almost every other subsystem. Frameworks get rewritten. Filesystems get replaced. APIs evolve. But silicon doesn’t get updates. A driver is either correct, incomplete, or it never gets merged. Once it is upstream, it often stays there for decades. I updated drivers that were not touched for 24 years.
Losing my AWS account taught me not to trust a single cloud provider.
ChaosBSD was my answer to the same problem in hardware.
The project was never just about my machines. The drivers went upstream, so every FreeBSD user benefits from them.
If you have an Intel Apple computer, you can install FreeBSD 16 or DragonFlyBSD on it. The computer will feel snappier than it original OS.
@seuros what an awesome story with an outcome I never expected. Thanks for your contributions to these solutions!
-
Now let me tell you about the 87th commit.
It was about FireWire.
https://github.com/freebsd/freebsd-src/commit/e7efe2f059a474f8f8e14393713071761a633e65
Most people think FireWire died when USB became famous. It didnt.
Its still used by professional audio interfaces, DV camcorders, industrial and scientific cameras, and plenty of legacy equipment that continues to do its job every day. Audio equipment don't need upgrades if they are still operating correctly. A firewire cable is superior to a new USB cable.
That where i tested it. The users just kept using old version of MacOS that don't even have updated SSH.
Together with Adrian Chadd, we dusted off the stack, rediscovered how it worked, cleaned it up, and refactored years of accumulated code.
And we didnt stop there.
We also added three new drivers:
• fwcam - Firewire webcams
• fwisound - Apple FireWire audio interfaces.
• fwdv - DV camcorders, including many classic Sony, Canon, Panasonic, and JVC models.That means #FreeBSD can now talk directly to equipment that many operating systems have quietly abandoned.
Someone in reddit used it to dump 50 tapes of childhood to digital format. I used it to have a zoom call with FreeBSD wifi group.
Thanks for the work. I've always had a bit of a soft spot for FireWire.
Did you test out dcons? To make sure it still works?
-
One year ago, AWS deleted my 10-year account over a disputed $100 bill. That day I learned something uncomfortable: unless you are a customer capable of causing a PR disaster, your monthly bill doesn’t buy much leverage.
That same week I noticed something else.
Vendor lock-in isnt just a cloud problem. Its a hardware problem too.
Here in Tangier (Morocco), there are warehouses filled with computers that Europe has already written off. Machines with 2-8 GB of RAM and 64-256 GB SSDs, sold by the pallet for almost nothing after being discarded by companies upgrading their fleets.
The hardware wasnt broken. The software had simply moved on.
The OS kept nagging users to upgrade, only to tell them afterward that their computer was too old to run the upgrade.
That is software gaslighting hardware into becoming e-waste. LOL.
So I started buying them.
In the past months I have bought over 5,000 discarded computers, not to build a datacenter, but to understand them, resurrect them, and eventually donate many of them.
That project became ChaosBSD.
In just six months, ChaosBSD has landed 87 upstream commits (it is not a AI number, lol). Ironically, after I started buying old hardware, the prices of SSDs and RAM even DDR2 went through the roof.
Drivers are unlike almost every other subsystem. Frameworks get rewritten. Filesystems get replaced. APIs evolve. But silicon doesn’t get updates. A driver is either correct, incomplete, or it never gets merged. Once it is upstream, it often stays there for decades. I updated drivers that were not touched for 24 years.
Losing my AWS account taught me not to trust a single cloud provider.
ChaosBSD was my answer to the same problem in hardware.
The project was never just about my machines. The drivers went upstream, so every FreeBSD user benefits from them.
If you have an Intel Apple computer, you can install FreeBSD 16 or DragonFlyBSD on it. The computer will feel snappier than it original OS.
@seuros mad respect!
-
Now let me tell you about the 87th commit.
It was about FireWire.
https://github.com/freebsd/freebsd-src/commit/e7efe2f059a474f8f8e14393713071761a633e65
Most people think FireWire died when USB became famous. It didnt.
Its still used by professional audio interfaces, DV camcorders, industrial and scientific cameras, and plenty of legacy equipment that continues to do its job every day. Audio equipment don't need upgrades if they are still operating correctly. A firewire cable is superior to a new USB cable.
That where i tested it. The users just kept using old version of MacOS that don't even have updated SSH.
Together with Adrian Chadd, we dusted off the stack, rediscovered how it worked, cleaned it up, and refactored years of accumulated code.
And we didnt stop there.
We also added three new drivers:
• fwcam - Firewire webcams
• fwisound - Apple FireWire audio interfaces.
• fwdv - DV camcorders, including many classic Sony, Canon, Panasonic, and JVC models.That means #FreeBSD can now talk directly to equipment that many operating systems have quietly abandoned.
Someone in reddit used it to dump 50 tapes of childhood to digital format. I used it to have a zoom call with FreeBSD wifi group.
@seuros Audio person with a firewire i7 laptop here, appreciating this.
I have been wanting to move my old i7 gen3 laptop off windows, but it has the Texas Instruments FW chipset, which is the gold standard for audio. I've done 16 channels for 8 solid hours without losing a bit.Thank you!
-
@encthenet @seuros We'll tackle that eventually, there's a lot of cleanup to do and both seuros and i have plenty of device<->device setups to test this on.
(I've already found lols when doing iperf between FW connected devices so that's on my plate to fix..)
-
One year ago, AWS deleted my 10-year account over a disputed $100 bill. That day I learned something uncomfortable: unless you are a customer capable of causing a PR disaster, your monthly bill doesn’t buy much leverage.
That same week I noticed something else.
Vendor lock-in isnt just a cloud problem. Its a hardware problem too.
Here in Tangier (Morocco), there are warehouses filled with computers that Europe has already written off. Machines with 2-8 GB of RAM and 64-256 GB SSDs, sold by the pallet for almost nothing after being discarded by companies upgrading their fleets.
The hardware wasnt broken. The software had simply moved on.
The OS kept nagging users to upgrade, only to tell them afterward that their computer was too old to run the upgrade.
That is software gaslighting hardware into becoming e-waste. LOL.
So I started buying them.
In the past months I have bought over 5,000 discarded computers, not to build a datacenter, but to understand them, resurrect them, and eventually donate many of them.
That project became ChaosBSD.
In just six months, ChaosBSD has landed 87 upstream commits (it is not a AI number, lol). Ironically, after I started buying old hardware, the prices of SSDs and RAM even DDR2 went through the roof.
Drivers are unlike almost every other subsystem. Frameworks get rewritten. Filesystems get replaced. APIs evolve. But silicon doesn’t get updates. A driver is either correct, incomplete, or it never gets merged. Once it is upstream, it often stays there for decades. I updated drivers that were not touched for 24 years.
Losing my AWS account taught me not to trust a single cloud provider.
ChaosBSD was my answer to the same problem in hardware.
The project was never just about my machines. The drivers went upstream, so every FreeBSD user benefits from them.
If you have an Intel Apple computer, you can install FreeBSD 16 or DragonFlyBSD on it. The computer will feel snappier than it original OS.
@seuros Wow! My 14yr old PC with its 2 even older HDDs just blushed. Any chance some of those "old" SSDs can migrate to South Africa?
-
@seuros Audio person with a firewire i7 laptop here, appreciating this.
I have been wanting to move my old i7 gen3 laptop off windows, but it has the Texas Instruments FW chipset, which is the gold standard for audio. I've done 16 channels for 8 solid hours without losing a bit.Thank you!
-
@seuros Wow! My 14yr old PC with its 2 even older HDDs just blushed. Any chance some of those "old" SSDs can migrate to South Africa?
@adritheonly Your country receive deprecated hardware from Netherlands for sure.
Sometime some of those companies just like to destroy them instead of sorting them/donating them.
Check this video https://youtu.be/NU040CTdJI0 ...
-
@adritheonly Your country receive deprecated hardware from Netherlands for sure.
Sometime some of those companies just like to destroy them instead of sorting them/donating them.
Check this video https://youtu.be/NU040CTdJI0 ...
@seuros
I bought mine 2nd hand from a shop that imported them from the US. Haven't seen SSDs 2nd hand though?
EDIT: the Tube seems to be about game boxes in England. That's a whole different kettle of fish. -
@seuros
I bought mine 2nd hand from a shop that imported them from the US. Haven't seen SSDs 2nd hand though?
EDIT: the Tube seems to be about game boxes in England. That's a whole different kettle of fish.@adritheonly the tube is correct link. go to minute 27 (the scrapyards) ... At one point the guy say that everything he don't buy end up in Africa....
You can even see he has a shit lot of Samsung Evo at his home, which he bought for 2-6 GBP per kg.
-
@khm @dalias @seuros
DMA between host and external peripherals are NOT always insecure.
What's mutually insecure would be to allow external peripherals to become bus master "managers".
Until host manages memory range to be transferred by DMA from peripherals under proper control by properly secured IOMMU && the memory range are assured NOT for executing something, maybe it would be considered safe (bus master transfers are allowed, but to secured, protected memory area only). -
@adritheonly the tube is correct link. go to minute 27 (the scrapyards) ... At one point the guy say that everything he don't buy end up in Africa....
You can even see he has a shit lot of Samsung Evo at his home, which he bought for 2-6 GBP per kg.
@seuros Thanks! Will check. Would love to find the outlet here.
-
One year ago, AWS deleted my 10-year account over a disputed $100 bill. That day I learned something uncomfortable: unless you are a customer capable of causing a PR disaster, your monthly bill doesn’t buy much leverage.
That same week I noticed something else.
Vendor lock-in isnt just a cloud problem. Its a hardware problem too.
Here in Tangier (Morocco), there are warehouses filled with computers that Europe has already written off. Machines with 2-8 GB of RAM and 64-256 GB SSDs, sold by the pallet for almost nothing after being discarded by companies upgrading their fleets.
The hardware wasnt broken. The software had simply moved on.
The OS kept nagging users to upgrade, only to tell them afterward that their computer was too old to run the upgrade.
That is software gaslighting hardware into becoming e-waste. LOL.
So I started buying them.
In the past months I have bought over 5,000 discarded computers, not to build a datacenter, but to understand them, resurrect them, and eventually donate many of them.
That project became ChaosBSD.
In just six months, ChaosBSD has landed 87 upstream commits (it is not a AI number, lol). Ironically, after I started buying old hardware, the prices of SSDs and RAM even DDR2 went through the roof.
Drivers are unlike almost every other subsystem. Frameworks get rewritten. Filesystems get replaced. APIs evolve. But silicon doesn’t get updates. A driver is either correct, incomplete, or it never gets merged. Once it is upstream, it often stays there for decades. I updated drivers that were not touched for 24 years.
Losing my AWS account taught me not to trust a single cloud provider.
ChaosBSD was my answer to the same problem in hardware.
The project was never just about my machines. The drivers went upstream, so every FreeBSD user benefits from them.
If you have an Intel Apple computer, you can install FreeBSD 16 or DragonFlyBSD on it. The computer will feel snappier than it original OS.
@seuros You bought FIVE THOUSAND old computers? Do you live in a warehouse or something?
-
@seuros You bought FIVE THOUSAND old computers? Do you live in a warehouse or something?
@guenther I don't have have 5000 computer now. I buy a pallet with 300 mac minis or 200 laptops, ect ... (they are cheap because not all of them are working, or marked as working)
I take 1-2 at home, make get the drivers, install them.
The vendor handle the logistic to deliver them to some place that need them. -
A abekonge@venner.network shared this topic
