Librem 5 Verification against Hardware attacks during Manufacturing [RESOLVED]

Hardware Librem 5
1

Given the Chinese hardware attack reported in 2018 by Bloomberg would it be possible for Purism to pick random samples from the manufacturing line and carefully inspect them manually?

You will need to check that all logic lines have the correct chips as per your specs, no additional hardware is introduced to the PCBs and nothing is preloaded with compromised code on the secure part of the device - that is before the logically separated devices that are known to run proprietary code (and yes, I do understand the PHY issue).

I understand that hiring a third party to evaluate the boards is too expensive and introduces issues in verifying their work (we need to trust them as well as Purism). An evaluation from you and your technical staff will have to suffice, in my opinion.

@nicole.faerber @Kyle_Rankin @ekuzmenko

1 Like
2
8 Likes
3

Some links I found while looking for more info:



Most of the links I’ve found, put up serious questions towards Bloomberg, without getting much but “we stick to our story” from Bloomberg.

And, well, if you really want to be sure a possible solution would be:

  1. buy the phone
  2. wait for Purism to release the necessary data (@purism: no need to hurry for my sake :slight_smile: )
  3. check the hardware yourself
2 Likes
4

@Caliga Thank you. This answered all of my questions.

3 Likes
5

@s206 Hardware verification done by myself isn’t really practical. I do understand a little bit of electronics, but nowhere near to do a good verification. This will have to be done by Purism and I will have to trust them. I just don’t have the skills to do that myself.

2 Likes
6

The problem is real but I would put US in the same category as China. However, one has to trust somebody (to some extent) and I think Purism is better than Apple for example. Personally I would like the phone to be produced in the EU but it may be just because it is closer to home :-). And EU has a better policy of personal integrity (although not perfect).

7

No no, I agree - the EU is much more social oriented rather then money driven, but this is a somewhat divisive and political topic and I wouldn’t like to upset any Americans. Also it’d be incredibly expensive to manufacture here in the EU.

1 Like
8

You are right. And there is no homogeneous US as well as no homogeneous EU. The fact that Librem5 is a project originated in US is speaking for itself. It would be very expensive to produce the phone in EU or in US so I think it was necessary to involve China in some way but have a good control over the manufacturing process was the right decision. You can never be 100 % sure but that’s life …

9

Actually I think the final assembly takes place in the US.
Purism had expressed a desire to do so in the past. It’s not officially confirmed yet, but could be they do it in the same place where the Librem Keys are assembled.

1 Like
10

Maybe, but Raspberry Pi production was moved to the UK in 2012, and I think they still are being made in Wales. The Raspberry Pi 4B with 2 GB of memory has a retail price of something like €55 taxes included. This is clearly a different device than the Librem 5, and production volumes are much higher, so it’s a bit unfair to compare prices. (Baked in Britain, the millionth Raspberry Pi at BBC October 2013)

Of course, making and populating the PCBs is only part of manufacturing, and the complete supply chain that has to work. China is probably the easiest in that regard, with all the required experience available in “one place”.

edit: Comment on price comparison, link to BBC news on volume

1 Like