Questions and concerns about hardware, firmware, and supply chains (Librem 14)

[fsflover]

@finofafish

1. How vulnerable is Purism to a hardware supply chain attack? Are there any steps they take to mitigate that threat? I ask because (as many have pointed out before) a company like Purism likely has a target on their back. I’m not too concerned with my specific laptop being tampered with, but rather I’m concerned that Purism’s supply chain (or even just supply chains in general) might be compromised on a hardware level. Before someone points it out, I know it would be expensive and difficult to do. But when we’re dealing with agencies who have billions of dollars, legal authority over manufacturers, and the most skilled technologists, I think it could be a plausible threat.

Purism products feel like an obvious vector for targeting

I’m kind of reluctant to get Purism products because it feels like an obvious vector for targeting those who want to ‘go dark’ that badly. [The Purism] products might be compromised in a way that renders interdiction redundant. Just a hunch though–nothing substantial to base this on. The same reasoning might apply to [software], but I think it’s much harder to compromise an open-source OS than it is to install a microscopic piece of hardware into a system (something the Bloomberg piece on Chin…