(untitled)

Buy a thinkpad x230 and install heads. Write protect the flash chip. Put nail polish on the screws and take high resolution pictures to ensure signs of tampering. Do NOT use a HDD or SSD. They have DMA so a malicious firmware could do a lot of damage, use of USB is preferred since they do not have DMA. Completely remove the microphone, sound card, webcam and the WWAN card from the laptop. Remove the fan to prevent binary acoustic data transmission. Replace the default wifi card with a supported atheros card. Disable wifi when not in use, preferably by physically removing the card. Make your own independent Linux distro from scratch. Most Linux distros value convenience over security and will thus never have good security. Your only option is to make your own. Use musl instead of glibc, Libressl instead of openssl, sinit instead of systemd, oksh instead of bash, toybox instead of gnu coreutils to reduce attack surface. Enable as little kernel modules as possible. Use a hardened memory allocator. Apply strong SELinux and sandboxing policies. Restrict the root account heavily to make sure it never gets compromised. Disable JavaScript and CSS in your browser. Block all FAGMAN domains in your hosts file. Monitor all network requests. Do not use a phone. Never speak near anyone who owns a phone, they are always listening. Never use any non-corebooted technology made after 2006. Never leave your devices unattended. Tape triple layer aluminum foil all around your room as tempest shielding. Type really quietly as defense against audio keylogging. Use ecc ram to minimize rowhammer and rambleed. Encrypt everything multiple times with various different encryption implementations. Compile everything from source. Use hardened compilation flags. Always read through the source before installing something if possible. Only use the internet when absolutely necessary.(USER WAS WARNED FOR THIS POST, You should always elaborate on your opinions rather than just spilling the soykaf.)

how about not using a computer at that point

>>23824 I think maybe that was the point, but considering where we are, I can't blame you for taking anything seriously no matter how unhinged it is

>how about not using a computer at that point can't do soykaf without it >I think maybe that was the point, but considering where we are, I can't blame you for taking anything seriously no matter how unhinged it is Actually OP has some pretty good ideas to consider, most people here are unaware of this crap

>>23811 Oopsa daisy! >Oopsa daisy!

i read this copypasta so many times it actually makes me want to use windows

>>23811 >They have DMA so a malicious firmware could do a lot of damage, use of USB is preferred since they do not have DMA. Then how did stuxnet do damage, wasnt it on a usb? >Remove the fan to prevent binary acoustic data transmission While everything else is valid this is soykaf cause unlesss you want a burned out motherboard or fried CPU dont do this lol.

>>23827 >>24957 >MISC QUOTES https://eldritchdata.neocities.org/

>>24958 >Then how did stuxnet do damage, wasnt it on a usb? Stuxnet exploited a bug in Windows. https://arstechnica.com/information-technology/2017/04/windows-bug-used-to-spread-stuxnet-remains-worlds-most-exploited/ >The Windows vulnerability resided in functions that process so-called .LNK files that Windows uses to display icons when a USB stick is connected to a PC. By hiding malicious code inside the .LNK files, a booby-trapped stick could automatically infect the connected computer even when its autorun feature was turned off. What the copypasta is talking about is the HDD/SSD firmware can use Direct Memory Access to inject malicious code directly into RAM. If you're not using full disk encryption then the firmware can also just inject malicious code into the files you asked it to store on disk. DMA attacks are more often associated with GPUs since anything on the PCIe bus can do can DMA too. It's especially a problem if you want to use your GPU inside a virtual machine. Apple's Thunderbolt was also particularly vulnerable since the ports are exposed on the outside of mac books. https://www.zdnet.com/article/thunderbolt-flaws-affect-millions-of-computers-even-locking-unattended-devices-wont-help/

Does heads neuter the Intel ME firmware? What would be the benefit of installing Heads over regular Coreboot or Libreboot?

>>25327 Heads does clean ME now today automatically. But the old link about the old process is here, just background info FYI https://osresearch.net/Clean-the-ME-firmware/ But today, grab an x230 laptop, just flash x230-hotp-maximized from the same site. It auto cleans the ME for you then installs the heads bios. Instructions on left side inthose pages search x230-hotp-maximized process. The major difference between heads vs coreboot is TLDR "heads is for serious OPSEC while coreboot is for general purpose". With heads you can get yourself a nitro or librem usb pgp key. Long story short it protects you from evil maid attacks on your bios having left your laptop unattended. You don't want your bios hacked if you have sensitive stuff and a whole disk encryption password that you don't want stolen by inadvertently inputting it on the hacked bios. The way the key protects you is it flashes green on the key and the screen to confirm between the pgp key written inside the key matches the hash of the bios havin not been modified in your absense. Or flashes read showing your bios has changed and you should NOT dun goof by entering your disk passphrase on your now detected hacked bios. Other than that's pretty much it. I think it does some cool write protect stuff as well when you launch your OS that there's no possible way the bios can be fuarrrked by extra-solar biological entity level exploits. *Sarcasm*. Overall the head community is really focused on the qubes implement and high OPSEC requirements while coreboot is just general purpose. They have a matrix and I think IRC. It's good to chat with them on deep discussion of OPSEC. They know their soykaf and won't psyop you like the DoD cuhddy-nubs on lain who always just omit a tad bit too much obviously classified stuff that civilians morally deserve for all the illegal soykaf the DoD has been doing to us for decades. And now this 5th gen era... It's a mess. Anyways, yea get heads. Good luck to you on your journey. Oh last tip. If you go through this process. Be sure once you receive your x230 to flash it with the latest stock Embedded controller update which is separate from the bios chip update. Laptop might have come with latest EC update. So first downgrade a single version. Then upgrade to latest. This is an attack vector for interdiction. The EC doesn't get wiped out when you're flashing the bios. It's two different chips. So you want make sure you got a clean EC as well. That's another place that can steal your keys by NSA Ghidra RE pros. Ciao.

>type really quietly protip: take estrogen to get soft and gentle girl fingers, it will make this easier

>>25483 I hate t r a n n ys but this is funny. Good one.

>>Make your own independent Linux distro from scratch. Why not just use Qubes OS or OpenBSD instead at that point? It's easier and more secure.

How much stuff could you get done online with nothing more than a dumb physical terminal that understands html, security protocols, and ethernet, and a secure router? Seems like that's all you would need to get most of the vital things done.

>>25907 I use QubesOS, and I can tell you for certain that a Linux system which you know in an out is gonna be much more secure than QubesOS (which is based on Xen, which already is tens of thousands of SLOC) when it comes to integrity checking. >>25909 Regular surfing with links is pretty easy (if you exclude sites that fully depend on javascript), but can take a bit of time getting used to. or you can hack your way with curl, some html processor and vi(m).

>>25909 With these things I can't use my subscription on BLACKED.COM. Imagine - having an Internet access and not watching streaming services. Totally INSANE

>>25945 >I use QubesOS, and I can tell you for certain that a Linux system which you know in an out is gonna be much more secure than QubesOS (which is based on Xen, which already is tens of thousands of SLOC) when it comes to integrity checking. Xen won't increase the attack surface of your device. Here's an example. Scenario 1: You run a Linux distribution on your laptop, an attacker compromises the operating system, and then gets all your data. Scenario 2: You run a Linux Qube in Qubes OS, an attacker compromises your Linux Qube, but now they have to additionally find a vulnerability in Xen to get all your data. As you can see here, virtualization provides an additional layer of security and won't increase attack surface as the attacker would have to compromise the entire VM first before managing to break through Xen.