HackerTube

THE VIDEO SHELF · hardware trust and supply chain security

36C3 - Open Source is Insufficient to Solve Trust Problems in Hardware

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Watch & explore the libraryYouTube ↗

Why HN readers recommended it

HN commenters point to it whenever the question is how far hardware can be trusted, including FPGAs, supply chain attacks and firmware TPMs.

This is a summary from the source dataset, not an endorsement by Hacker News or the video creator.

Video & recommendation details

Creator / channel
media.ccc.de
Topic
hardware trust and supply chain security
Format
talk
Level
intermediate
HN recommenders in dataset
2
HN mentions in dataset
4
Recommendation years in dataset
2020–2023

These counts and years describe the included Hacker News records; they are not YouTube views or the video’s publication date.

From the original HN conversations

Excerpts from the recorded comments. Follow each source for the full comment and surrounding discussion.

  • Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

    Confiks on Hacker News · 2020-05
    In OpenTitan RTL Synthesis with Yosys

  • Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

    Confiks on Hacker News · 2020-11
    In Bunnie's Precursor Crowdfunding Begins

  • As I'm sure you're aware FPGAs are nice because they can complicate things for an attacker in the physical supply chain. Andrew "bunnie" Huang did an excellent talk on the subject: [VIDEO]

    kfreds on Hacker News · 2023-05
    In AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defeating Disk Encryption

Summaries, classifications and recommendation records are from the HackerTube source dataset. Read about this library and its limitations.