Firmware Flashing is Riskier on Linux - Lemmy.World
lemmy.world
Most Linux firmware tools (flashrom, coreboot utilities, vendorā€‘reverseā€‘engineered scripts, NVMe tools) load the firmware into ram (assume itā€™s ECC), trust the RAM is correct, and write directly to SPI/EC/NVME. Thereā€™s no double-buffering, memory integrity checks, vendor-grade validation, protected memory regions, or automatic rollback. If the buffer is corrupted, Linux flashes it anyway. Windows OEM flashers never trust raw RAM blindly. Because vendors donā€™t ship Linux flashers, users rely on flashrom, fwupd (reverseā€‘engineered metadata), Community EC flashers, Community NVMe firmware tools, and Coreboot scripts. Reverseā€‘engineering = incomplete understanding = higher brick risk. Windows uses official vendor tools with signed capsules, verified update paths, vendor QA, and recovery logic. Linux gives userspace access to /dev/mem /dev/spidev IĀ²C/SMBus EC registers and PCI config space which is terrible for safety. Windows blocks almost all of this.

Itā€™s sorrowful some people choose to hate, complain, ridicule, and block everything that does not fit their choiceā€¦

With just a single idea shared, a lone message posted in a community, with your finite priceless time and experience invested, you may get banned instantly, and permanently, instead of actually learning and discover togetherā€¦

The single message that resulted in my immediate permanent ban:

Message

Itā€™s not Linux, but your distribution, or you, what makes it ā€œunsafeā€.
There are numerous options to harden your Linux environment, and itā€™s relatively trivial to keep it safer if you ever want it, or actually stop blaming and complaining.

For example, to limit the access for root or custom group hwaccess, without much fuss but to give you an idea, for the most popular distros as Debian-based:

  1. Add a Udev rule:
# /etc/udev/rules.d/90-hwaccess.rules

KERNEL=="mem",        GROUP="hwaccess", MODE="0660"
SUBSYSTEM=="spidev",  GROUP="hwaccess", MODE="0660"
SUBSYSTEM=="i2c-dev", GROUP="hwaccess", MODE="0660"
  1. Set at boot:
setfacl -Rm 'g:hwaccess:rwX' -- \
    /sys/kernel/debug/ec \
    /sys/bus/pci/devices/*/config;

You may then setup SELinux, AppArmor, and secure it via SecureBootā€™s shim, too.
Yet, you chose to effortlessly complain insteadā€¦

  • Broadfern@lemmy.worldEnglish
    24Ā·
    1 month ago

    You broke the commā€™s rules:

    Rules:

    1. FOSS (especially GPL) advocates and Linux (specifically GNU/Linux) evangelists arenā€™t welcome (GNU Hurd will count as Linux). -We ask that you block us and we will perma-ban for violations of this rule.

    That is entirely on you.

    • Artwork@lemmy.worldBanned from communityOPEnglish
      73Ā·
      1 month ago

      Ohā€¦ I seeā€¦ Thank you!
      I could not even imagine such a rule when I noticed the post at home page of LemmyWorld instance, and commented on itā€¦ ^^"

    • csolisr@hub.azkware.net
      4Ā·
      1 month ago

      I wonder, what will happen when the mods of the community realize their server doesnā€™t use FreeBSD or something? Self-termination?

  • limer@lemmy.ml
    151Ā·
    1 month ago

    Ydi, you spoke reason in a troll community that has rules that any tech savvy person could see as a danger sign.

    Donā€™t feed the trolls

    • madthumbs@lemmy.worldEnglish
      24Ā·
      1 month ago

      Reason? Do you see this advice on noob or help communities for Linux? Is it actually honest? (no) You all go around preaching and evangelizing, then blaming the user when they fail and it doesnā€™t live up to your grand endorsements.

    • Artwork@lemmy.worldBanned from communityOPEnglish
      12Ā·
      1 month ago

      Yes, indeedā€¦ it was justā€¦ unexpected to get banned in just 4 minutes participating in that communityā€¦ ^^"
      Though, re-considering the purpose of the community, it may beā€¦

  • Harvey656@lemmy.world
    7Ā·
    1 month ago

    Linux gives userspace access to /dev/mem /dev/spidev IĀ²C/SMBus EC registers and PCI config space which is terrible for safety.

    I might be ignorant, but isnt that information technically different per distro?

    • Artwork@lemmy.worldBanned from communityOPEnglish
      3Ā·
      1 month ago

      Of course it is! Thank you! And hence mentioned it in the comment, too!

      • Harvey656@lemmy.world
        51Ā·
        1 month ago

        Thereā€™s been a ton of antis recently spreading straight up misinformation.

        Saw one recently saying anticheats dont work on linux because the apps canā€™t run root. Which is massively wrong. Weirdos.

        • A404@lemmy.dbzer0.com
          6Ā·
          1 month ago

          just wait until they find out that you have to literally use a exploit to load your own kernel drivers on windows

  • frongt@lemmy.zip
    51Ā·
    1 month ago

    Yeah I mean technically PTB, but itā€™s a community specifically for that, so what did you expect?

  • csolisr@hub.azkware.net
    31Ā·
    1 month ago

    Do they happen to have the same moderators as the subreddit? Because theyā€™re also famous for being trigger-happy with the ban-hammer