2022-06-30 06:19:28 +01:00
|
|
|
<!DOCTYPE html>
|
2022-11-21 22:26:33 +00:00
|
|
|
|
|
|
|
|
<!-- Inferencium - Website - About -->
|
|
|
|
|
|
2023-03-05 05:13:07 +00:00
|
|
|
<!-- Copyright 2022-2023 Jake Winters -->
|
|
|
|
|
<!-- SPDX-License-Identifier: BSD-3-Clause-Clear -->
|
2022-11-21 22:26:33 +00:00
|
|
|
|
2023-03-16 08:38:55 +00:00
|
|
|
<!-- Version: 3.2.0.46 -->
|
2022-11-21 22:26:33 +00:00
|
|
|
|
|
|
|
|
|
2022-06-30 06:19:28 +01:00
|
|
|
<html>
|
2022-11-22 04:19:44 +00:00
|
|
|
|
2022-06-30 06:19:28 +01:00
|
|
|
<head>
|
2022-11-21 22:26:33 +00:00
|
|
|
<title>Inferencium - About</title>
|
2022-12-09 09:52:14 +00:00
|
|
|
<link rel="stylesheet" href=inf.css>
|
2022-12-20 04:53:45 +00:00
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
2022-06-30 06:19:28 +01:00
|
|
|
</head>
|
2022-11-21 22:26:33 +00:00
|
|
|
|
2022-11-22 04:19:44 +00:00
|
|
|
<!-- Navigation bar. -->
|
2022-10-29 01:30:35 +01:00
|
|
|
<div class="sidebar">
|
2022-12-26 06:28:11 +00:00
|
|
|
<img src="asset/img/logo-inferencium-no_text.png"
|
2022-12-09 11:49:56 +00:00
|
|
|
width="110px" height="110px">
|
2022-11-21 22:26:33 +00:00
|
|
|
<a class="title">Inferencium</a><br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
|
|
|
|
<br>
|
|
|
|
|
<div><a href="about.html">About</a></div>
|
|
|
|
|
<div><a href="contact.html">Contact</a></div>
|
|
|
|
|
<div><a href="blog.html">Blog</a></div>
|
|
|
|
|
<div><a href="source.html">Source</a></div>
|
2023-01-13 21:09:39 +00:00
|
|
|
<div><a href="key.html">Key</a></div>
|
2022-10-29 01:30:35 +01:00
|
|
|
</div>
|
2022-11-21 22:26:33 +00:00
|
|
|
|
2022-06-30 06:19:28 +01:00
|
|
|
<body>
|
2022-10-29 23:54:59 +01:00
|
|
|
<h1>About</h1>
|
|
|
|
|
<br>
|
2023-03-10 06:27:08 +00:00
|
|
|
<br>
|
|
|
|
|
<br>
|
2023-03-09 07:43:33 +00:00
|
|
|
|
|
|
|
|
<!-- Table of contents. -->
|
2023-03-10 04:11:51 +00:00
|
|
|
<h2 id="toc"><a href="#toc" class="h2"
|
|
|
|
|
>Table of Contents<a/></h2>
|
2023-03-09 07:43:33 +00:00
|
|
|
<ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#about_me" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>About Me</a></li>
|
2023-03-15 16:57:06 +00:00
|
|
|
<li><a href="#licensing" class="body-link"
|
|
|
|
|
>Licensing</a></li>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a href="#licensing-preferred" class="body-link"
|
|
|
|
|
>Preferred</a></li>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a href="#licensing-bsd-3-clause-clear" class="body-link"
|
2023-03-16 07:16:57 +00:00
|
|
|
>BSD 3-Clause Clear License</a></li>
|
2023-03-15 16:57:06 +00:00
|
|
|
<li><a href="#licensing-mit" class="body-link"
|
|
|
|
|
>MIT</a></li>
|
|
|
|
|
<li><a href="#licensing-gpl-2.0" class="body-link"
|
|
|
|
|
>GPLv2</a></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<li><a href="#licensing-other" class="body-link"
|
|
|
|
|
>Other</a></li>
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a href="#licensing-gpl-3.0" class="body-link"
|
|
|
|
|
>GPLv3</a></li>
|
|
|
|
|
</ul>
|
|
|
|
|
</ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#recommendations" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Recommendations</a></li>
|
|
|
|
|
<ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#hardware" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Hardware</a></li>
|
2023-03-10 02:39:25 +00:00
|
|
|
<ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#hdw-smartphone" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Smartphone</a></li>
|
2023-03-10 02:39:25 +00:00
|
|
|
</ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#software" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Software</a></li>
|
2023-03-10 02:39:25 +00:00
|
|
|
<ul>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#sfw-desktop" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Desktop</a></li>
|
2023-03-11 08:15:01 +00:00
|
|
|
<li><a href="#sfw-smartphone" class="body-link"
|
2023-03-10 04:11:51 +00:00
|
|
|
>Smartphone</a></li>
|
2023-03-10 02:39:25 +00:00
|
|
|
</ul>
|
2023-03-10 04:11:51 +00:00
|
|
|
</ul>
|
2023-03-10 06:29:07 +00:00
|
|
|
</ul>
|
2023-03-10 02:28:41 +00:00
|
|
|
<br>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2023-03-09 07:43:33 +00:00
|
|
|
|
2022-11-21 22:26:33 +00:00
|
|
|
<!-- About me. -->
|
2023-03-10 04:11:51 +00:00
|
|
|
<h2 id="about_me"><a href="#about_me" class="h2"
|
|
|
|
|
>About Me</a></h2>
|
2023-03-10 07:07:26 +00:00
|
|
|
<p>I am Jake Winters, also known by my pseudonym "Inference", a cybersecurity researcher based in
|
2023-03-09 03:29:06 +00:00
|
|
|
United Kingdom.<br>
|
2023-03-05 05:13:07 +00:00
|
|
|
I am the founder, lead developer, and administrator, of Inferencium.<br>
|
2022-12-09 09:38:02 +00:00
|
|
|
All opinions are my own, and are not necessarily shared with projects or people I am
|
|
|
|
|
affiliated with.<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
2022-12-09 09:38:02 +00:00
|
|
|
<p>I write about my research and experience in cybersecurity and also physical security.
|
|
|
|
|
Most of my postings are security-related, but I occasionally post about other aspects of my
|
|
|
|
|
life.</p>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
2022-12-09 09:38:02 +00:00
|
|
|
<p>I am an open source advocate for the preservation and modifiability of source code. I
|
|
|
|
|
believe source code should be considered human knowledge as much as past knowledge and
|
|
|
|
|
teachings were; it is how modern humanity survives and runs.<br>
|
|
|
|
|
Source code being modifiable allows it to be adapted for use by anyone, whether to add
|
|
|
|
|
features, harden it for increased security and/or privacy, or provide accessibility for
|
|
|
|
|
disabled users.<br>
|
|
|
|
|
I am also a modular design advocate for the ability to securely and robustly make changes to
|
|
|
|
|
hardware and software without the entire system being affected.</p>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
2022-11-03 05:27:50 +00:00
|
|
|
<p>If you want to contact me for any reason, you can use my
|
2022-11-25 04:28:54 +00:00
|
|
|
<a class="body-link" href="https://inferencium.net/contact.html"
|
|
|
|
|
>contact methods</a>.</p>
|
2022-11-03 05:27:50 +00:00
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
2023-03-09 07:43:33 +00:00
|
|
|
|
2023-03-15 17:18:58 +00:00
|
|
|
<h2 id="licensing"><a href="#licensing" class="h2"
|
|
|
|
|
>Licensing</a></h2>
|
2023-03-15 19:34:12 +00:00
|
|
|
<p>Inferencium cares about upstreaming and sharing code, strongly preferring licenses which
|
2023-03-16 06:14:09 +00:00
|
|
|
have high license compatibility in order to permit sharing code with as many other projects
|
|
|
|
|
as possible; for this reason, permissive licenses are our preferred choice, while avoiding
|
|
|
|
|
copyleft licenses and other licenses which place restrictions on how our code may be used,
|
|
|
|
|
and prevent us from including important proprietary code, such as firmware, which can patch
|
|
|
|
|
security vulnerabilities and privacy issues. All Inferencium code is and will be
|
|
|
|
|
permissively licensed unless specific circumstances make it impractical or infeasible to do
|
|
|
|
|
so. Our goal is to share code which has the least amount of restrictions as possible, to
|
|
|
|
|
allow wider propagation of our code and allow more use cases and possibilities, as well as
|
|
|
|
|
ensuring proprietary code, whenever required, is permitted to be included.</p>
|
2023-03-15 19:34:12 +00:00
|
|
|
<br>
|
|
|
|
|
<h3 id="licensing-bsd-3-clause-clear"><a href="#licensing-bsd-3-clause-clear" class="h3"
|
2023-03-16 07:16:57 +00:00
|
|
|
>BSD 3-Clause Clear License</a></h3>
|
2023-03-16 06:56:10 +00:00
|
|
|
<code>SPDX-License-Identifier: BSD-3-Clause-Clear</code>
|
2023-03-16 06:51:09 +00:00
|
|
|
<p>Type: Permissive</p>
|
|
|
|
|
<br>
|
2023-03-16 06:58:16 +00:00
|
|
|
<p><a href="https://spdx.org/licenses/BSD-3-Clause-Clear.html" class="body-link"
|
2023-03-16 07:16:57 +00:00
|
|
|
>BSD 3-Clause Clear License</a> is a highly permissive license which allows content licensed
|
|
|
|
|
under it to be used in any way, whether in source or binary form, and allows sublicensing
|
|
|
|
|
under a different license, with the only restrictions being the original copyright notice
|
|
|
|
|
must be kept in order to attribute the original creator of the licensed content, and the
|
|
|
|
|
name of the project and/or its contributors may not be used to endorse or promote products
|
|
|
|
|
derived from the original project.<br>
|
|
|
|
|
BSD 3-Clause Clear License is a derivative of <a href="https://spdx.org/licenses/
|
2023-03-16 06:58:16 +00:00
|
|
|
BSD-3-Clause.html" class="body-link"
|
2023-03-16 07:16:57 +00:00
|
|
|
>BSD 3-Clause "New" or "Revised" License</a>, which adds an explicit statement clarifying
|
|
|
|
|
that patent rights are not granted by the license alone, and must be granted separately by
|
|
|
|
|
the copyright and/or patent holder(s). We prefer this license over the BSD 3-Clause "New" or
|
|
|
|
|
"Revised" License due to this explicit statement which removes any possibility of debate and
|
2023-03-16 08:38:55 +00:00
|
|
|
misunderstanding in regards to patents applied to code using the BSD 3-Clause "New" or
|
2023-03-16 07:16:57 +00:00
|
|
|
"Revised" License.</p>
|
2023-03-15 17:18:58 +00:00
|
|
|
<br>
|
2023-03-16 07:27:54 +00:00
|
|
|
<h3 id="licensing-mit"><a href="#licensing-mit" class="h3"
|
|
|
|
|
>MIT License</a></h3>
|
|
|
|
|
<code>SPDX-License-Identifier: MIT</code>
|
|
|
|
|
<p>Type: Permissive</p>
|
|
|
|
|
<br>
|
|
|
|
|
<p>MIT License is a highly permissive license which allows content licensed under it to be
|
|
|
|
|
used in any way, whether in source or binary form, and allows sublicensing under a different
|
|
|
|
|
license, with the only restriction being the original copyright notice must be kept in order
|
|
|
|
|
to attribute the original creator of the licensed content.<br>
|
|
|
|
|
Due to this license allowing the original project's name and/or contributors to be used to
|
|
|
|
|
endorse or promote products derived from the original project, unless an explicit statement
|
|
|
|
|
is made alongside this license, increasing complexity and deviating from the standard
|
|
|
|
|
license text, we prefer <a href="#licensing-bsd-3-clause-clear"
|
|
|
|
|
>BSD 3-Clause Clear License</a>; however, MIT License is a great choice when derivatives
|
|
|
|
|
using the name of the original project and/or its contributors is a non-issue.
|
|
|
|
|
<br>
|
2023-03-15 17:18:58 +00:00
|
|
|
<br>
|
|
|
|
|
|
2023-03-10 04:11:51 +00:00
|
|
|
<h2 id="recommendations"><a href="#recommendations" class="h2"
|
|
|
|
|
>Recommendations</a></h2>
|
2023-03-10 06:39:55 +00:00
|
|
|
<br>
|
2023-03-09 03:34:34 +00:00
|
|
|
<!-- Hardware I recommend as production hardware. -->
|
2023-03-10 04:11:51 +00:00
|
|
|
<h3 id="hardware"><a href="#hardware" class="h3"
|
|
|
|
|
>Hardware</a></h3>
|
2023-03-10 06:39:55 +00:00
|
|
|
<br>
|
2023-03-10 04:11:51 +00:00
|
|
|
<h4 id="hdw-smartphone"><a href="#hdw-smartphone" class="h4"
|
|
|
|
|
>Smartphone</a></h4>
|
2022-12-20 05:21:08 +00:00
|
|
|
<div style="overflow-x:auto;">
|
2022-10-31 00:22:30 +00:00
|
|
|
<table>
|
|
|
|
|
<tr>
|
2022-11-09 02:46:01 +00:00
|
|
|
<td class="table-title">Type</td>
|
|
|
|
|
<td class="table-title">Hardware</td>
|
|
|
|
|
<td class="table-title">Description</td>
|
|
|
|
|
<td class="table-title">Source model<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(License - SPDX)</td>
|
2022-10-31 00:22:30 +00:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Smartphone</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/google-pixel_6.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"/><br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2023-03-09 03:39:00 +00:00
|
|
|
Google Pixel</td>
|
2022-12-09 09:38:02 +00:00
|
|
|
<td>Google Pixel devices are the best Android devices available on the market for
|
|
|
|
|
<a class="table-link" href="https://security.googleblog.com/2021/10/
|
|
|
|
|
pixel-6-setting-new-standard-for-mobile.html"
|
2022-11-07 08:55:02 +00:00
|
|
|
>security and privacy</a>.<br>
|
2022-11-03 00:11:16 +00:00
|
|
|
<br>
|
|
|
|
|
They allow locking the bootloader with a
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://android.googlesource.com/platform/external/avb/+/
|
|
|
|
|
master/README.md#pixel-2-and-later"
|
|
|
|
|
>custom Android Verified Boot (AVB) key</a> in order to preserve security and privacy
|
|
|
|
|
features when installing a custom operating system, such as
|
|
|
|
|
<a class="table-link" href="https://source.android.com/docs/security/features/
|
|
|
|
|
verifiedboot/"
|
|
|
|
|
>verified boot</a> which verifies that the OS has not been corrupted or tampered with,
|
|
|
|
|
and
|
|
|
|
|
<a class="table-link" href="https://source.android.com/docs/security/features/
|
|
|
|
|
verifiedboot/verified-boot#rollback-protection"
|
|
|
|
|
>rollback protection</a> which prevents an adversary from rolling back the OS or
|
|
|
|
|
firmware version to a previous version with known security vulnerabilities.<br>
|
2022-11-03 00:11:16 +00:00
|
|
|
<br>
|
2022-11-03 05:24:14 +00:00
|
|
|
They also include a
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://developer.android.com/training/articles/
|
|
|
|
|
keystore#HardwareSecurityModule"
|
2022-11-07 08:55:02 +00:00
|
|
|
>hardware security module</a> (Titan M2, improving on the previous generation
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://security.googleblog.com/2018/10/
|
|
|
|
|
building-titan-better-security-through.html"
|
|
|
|
|
>Titan M</a>) which is extremely resistant to both remote and physical attacks due to
|
|
|
|
|
being completely isolated from the rest of the system, including the operating system.
|
|
|
|
|
Titan M2 ensures that the device cannot be remotely compromised by requiring the side
|
|
|
|
|
buttons of the device to be physically pressed for some sensitive operations. Titan M2
|
|
|
|
|
also takes the role of
|
|
|
|
|
<a class="table-link" href="https://source.android.com/docs/security/best-practices/
|
|
|
|
|
hardware#strongbox-keymaster"
|
2022-11-07 08:55:02 +00:00
|
|
|
>Android StrongBox Keymaster</a>,
|
|
|
|
|
a <a class="table-link" href="https://source.android.com/docs/security/features/keystore"
|
|
|
|
|
>hardware-backed Keystore</a> containing sensitive user keys which are unavailable to
|
2022-11-07 07:54:16 +00:00
|
|
|
the OS or apps running on it without authorisation from Titan M2 itself.
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://android-developers.googleblog.com/2018/05/
|
|
|
|
|
insider-attack-resistance.html"
|
|
|
|
|
>Insider attack resistance</a> ensures that Titan M2 firmware can be flashed only if the
|
|
|
|
|
user PIN/password is already known, making it impossible to backdoor the device without
|
|
|
|
|
already knowing these secrets.<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2022-11-07 07:54:16 +00:00
|
|
|
Google Pixel device kernels are compiled with
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://android-developers.googleblog.com/2018/10/
|
|
|
|
|
control-flow-integrity-in-android-kernel.html"
|
2022-11-07 07:54:16 +00:00
|
|
|
>forward-edge control-flow integrity</a> and
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://security.googleblog.com/2019/10/
|
|
|
|
|
protecting-against-code-reuse-in-linux_30.html"
|
|
|
|
|
>backward-edge control-flow integrity</a> to prevent code reuse attacks against the
|
|
|
|
|
kernel. MAC address randomisation is
|
|
|
|
|
<a class="table-link" href="https://android-developers.googleblog.com/2017/04/
|
|
|
|
|
changes-to-device-identifiers-in.html"
|
|
|
|
|
>implemented well, along with minimal probe requests and randomised initial sequence
|
|
|
|
|
numbers</a>.<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2022-11-07 07:54:16 +00:00
|
|
|
Google releases
|
|
|
|
|
<a class="table-link" href="https://source.android.com/docs/security/bulletin/pixel/"
|
2022-12-09 09:38:02 +00:00
|
|
|
>guaranteed monthly security updates</a>, ensuring Google Pixel devices are up-to-date
|
|
|
|
|
and quickly protected against security vulnerabilities.<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2023-03-09 03:39:00 +00:00
|
|
|
Pixel 6-series and 7-series devices are a large improvement over the already very
|
|
|
|
|
secure and private previous generation Pixel devices. They replace ARM-based Titan M
|
|
|
|
|
with RISC-V-based Titan M2, reducing trust by removing ARM from the equation. Titan M2
|
|
|
|
|
is more resiliant to attacks than Titan M, and is
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/
|
|
|
|
|
09/nscib-cc-22-0228971-cert-final.pdf"
|
2022-11-07 07:54:16 +00:00
|
|
|
>AVA_VAN.5 certified</a>, the highest level of vulnerability assessment. Google's
|
2022-10-31 00:25:44 +00:00
|
|
|
in-house Tensor SoC includes Tensor Security Core, further improving device security.<br>
|
2022-11-09 03:36:12 +00:00
|
|
|
<br>
|
2023-03-09 03:39:00 +00:00
|
|
|
Pixel 6-series and 7-series devices are supported for a
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://support.google.com/nexus/answer/
|
|
|
|
|
4457705#zippy=%2Cpixel-and-later"
|
|
|
|
|
>minimum of 5 years from launch</a>, an increase from previous generations'
|
|
|
|
|
<a class="table-link" href="https://support.google.com/nexus/answer/
|
|
|
|
|
4457705#zippy=%2Cpixel-xl-a-a-g-and-a-g"
|
2022-11-07 07:54:16 +00:00
|
|
|
>support lifecycles of 3 years</a>.</td>
|
2022-10-31 00:22:30 +00:00
|
|
|
</tr>
|
|
|
|
|
</table>
|
2022-12-20 05:21:08 +00:00
|
|
|
</div>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
|
|
|
|
<br>
|
2023-03-09 03:34:34 +00:00
|
|
|
<!-- Software I recommend as production software. -->
|
2023-03-10 04:11:51 +00:00
|
|
|
<h3 id="software"><a href="#software" class="h3"
|
|
|
|
|
>Software</a></h3>
|
2023-03-10 06:39:55 +00:00
|
|
|
<br>
|
2023-03-10 04:11:51 +00:00
|
|
|
<h4 id="sfw-desktop"><a href="#sfw-desktop" class="h4"
|
|
|
|
|
>Desktop</a></h4>
|
2022-12-20 05:21:08 +00:00
|
|
|
<div style="overflow-x:auto;">
|
2022-10-29 23:54:59 +01:00
|
|
|
<table>
|
|
|
|
|
<tr>
|
2022-11-09 02:46:01 +00:00
|
|
|
<td class="table-title">Type</td>
|
|
|
|
|
<td class="table-title">Software</td>
|
|
|
|
|
<td class="table-title">Description</td>
|
|
|
|
|
<td class="table-title">Source model<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(License - SPDX)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Operating system</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-gentoo_linux.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"/><br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
|
|
|
|
Gentoo Linux</td>
|
2022-11-08 02:15:09 +00:00
|
|
|
<td><a class="table-link" href="https://www.gentoo.org/"
|
2022-12-09 09:38:02 +00:00
|
|
|
>Gentoo Linux</a> is a highly modular, source-based Linux-based operating system which
|
|
|
|
|
allows vast customisation to tailor the operating system to suit your specific needs.
|
|
|
|
|
There are many advantages to such an operating system, with the most notable being the
|
|
|
|
|
ability to optimise the software for security, privacy, performance, or power usage;
|
|
|
|
|
however, there are effectively unlimited other use cases, or a combination of multiple
|
|
|
|
|
use cases.<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
I have focused on security hardening and privacy hardening, placing performance below
|
|
|
|
|
those aspects, although my system is still very performant. Some of the hardening I
|
2022-11-08 02:15:09 +00:00
|
|
|
apply includes
|
|
|
|
|
<a class="table-link" href="https://en.wikipedia.org/wiki/Buffer_overflow_protection"
|
|
|
|
|
>stack protection</a>,
|
|
|
|
|
<a class="table-link" href="https://en.wikipedia.org/wiki/Integer_overflow"
|
|
|
|
|
>signed integer overflow wrapping</a>, and GrapheneOS'
|
2022-11-07 09:04:09 +00:00
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/hardened_malloc/"
|
|
|
|
|
>hardened_malloc</a> memory allocator.<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2022-12-09 09:38:02 +00:00
|
|
|
You can find my personal Gentoo Linux configurations in my personal
|
2022-11-07 08:55:02 +00:00
|
|
|
<a class="table-link" href="https://git.inferencium.net/inference/cfg/"
|
|
|
|
|
>configuration respository</a>.</td>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Open source<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(GPL-2.0-only)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
2022-10-30 02:38:49 +00:00
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Web browser</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-chromium.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"/><br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
|
|
|
|
Chromium</td>
|
2022-11-08 02:15:09 +00:00
|
|
|
<td><a class="table-link" href="https://chromium.org/"
|
2022-12-09 09:38:02 +00:00
|
|
|
>Chromium</a> is a highly secure web browser which is often ahead of other web browsers
|
|
|
|
|
in security aspects. It has a dedicated security team and a very impressive
|
2022-11-07 08:55:02 +00:00
|
|
|
<a class="table-link" href="https://www.chromium.org/Home/chromium-security/brag-sheet/"
|
|
|
|
|
>security brag sheet</a>.
|
2022-10-30 02:38:49 +00:00
|
|
|
Chromium's security features include a strong
|
2022-11-07 08:55:02 +00:00
|
|
|
<a class="table-link" href="https://code.google.com/p/chromium/wiki/LinuxSandboxing"
|
|
|
|
|
>multi-layer sandbox</a>,
|
2022-12-09 09:38:02 +00:00
|
|
|
strong <a class="table-link" href="https://www.chromium.org/Home/chromium-security/
|
|
|
|
|
site-isolation"
|
2022-11-07 08:55:02 +00:00
|
|
|
>site isolation</a>,
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://www.chromium.org/Home/chromium-security/
|
|
|
|
|
binding-integrity"
|
2022-11-07 08:55:02 +00:00
|
|
|
>Binding Integrity</a> memory hardening, and
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://www.chromium.org/developers/testing/
|
|
|
|
|
control-flow-integrity/"
|
2022-11-09 02:50:12 +00:00
|
|
|
>control-flow integrity (CFI)</a>.</td>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Open source<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(BSD-3-Clause)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
</table>
|
2022-12-20 05:21:08 +00:00
|
|
|
</div>
|
2023-03-10 06:39:55 +00:00
|
|
|
<br>
|
2023-03-10 04:11:51 +00:00
|
|
|
<h4 id="sfw-smartphone"><a href="#sfw-smartphone" class="h4"
|
|
|
|
|
>Smartphone</a></h4>
|
2022-12-20 05:21:08 +00:00
|
|
|
<div style="overflow-x:auto;">
|
2022-10-29 23:54:59 +01:00
|
|
|
<table>
|
|
|
|
|
<tr>
|
2022-11-09 03:34:25 +00:00
|
|
|
<td class="table-title">Type</td>
|
|
|
|
|
<td class="table-title">Software</td>
|
|
|
|
|
<td class="table-title">Description</td>
|
|
|
|
|
<td class="table-title">Source model<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(License - SPDX)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Operating system</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-grapheneos.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"/><br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
|
|
|
|
GrapheneOS</td>
|
2022-11-08 02:15:09 +00:00
|
|
|
<td><a class="table-link" href="https://grapheneos.org/"
|
|
|
|
|
>GrapheneOS</a> is a security-hardened, privacy-hardened, secure-by-default
|
2022-12-09 09:38:02 +00:00
|
|
|
Android-based operating system which implements extensive, systemic security and privacy
|
|
|
|
|
hardening to the Android Open Source Project used as its base codebase. Its hardening
|
|
|
|
|
includes closing gaps for apps to access sensitive system information, a secure app
|
|
|
|
|
spawning feature which avoids sharing address space layout and other secrets AOSP's
|
|
|
|
|
default Zygote app spawning model would share,
|
2022-11-07 08:55:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/kernel_gs-gs101/"
|
|
|
|
|
>hardened kernel</a>, hardened memory allocator
|
|
|
|
|
(<a class="table-link" href="https://github.com/GrapheneOS/hardened_malloc/"
|
|
|
|
|
>hardened_malloc</a>) to protect against common memory corruption vulnerabilties,
|
|
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/platform_bionic/"
|
|
|
|
|
>hardened Bionic standard C library</a>,
|
|
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/platform_system_sepolicy/"
|
|
|
|
|
>stricter SELinux policies</a>, and local and remote hardware-backed attestation
|
2022-11-07 08:55:56 +00:00
|
|
|
(<a class="table-link" href="https://attestation.app/about/"
|
2022-11-09 02:50:12 +00:00
|
|
|
>Auditor</a>) to ensure the OS has not been corrupted or tampered with.<br>
|
|
|
|
|
<br>
|
2022-11-07 09:04:09 +00:00
|
|
|
GrapheneOS only supports
|
|
|
|
|
<a class="table-link" href="https://grapheneos.org/faq#device-support"
|
2022-12-09 09:38:02 +00:00
|
|
|
>high security and well-supported devices</a> which receive full support from their
|
|
|
|
|
manufacturers, including firmware updates, long support lifecycles, secure hardware, and
|
|
|
|
|
overall high security practices.<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
For an extensive list of features GrapheneOS provides, visit its
|
2022-11-07 08:56:56 +00:00
|
|
|
<a class="table-link" href="https://grapheneos.org/features/"
|
2022-11-09 02:50:12 +00:00
|
|
|
>official features list</a> which provides extensive documentation.</td>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Open source<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
|
|
|
|
(MIT)</td>
|
|
|
|
|
</tr>
|
2022-10-30 02:38:49 +00:00
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Web browser</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-vanadium.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"/><br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
|
|
|
|
Vanadium</td>
|
2022-12-09 09:38:02 +00:00
|
|
|
<td>Vanadium is a security-hardened, privacy-hardened Chromium-based web browser which
|
|
|
|
|
utilises GrapheneOS' operating system hardening to implement stronger defenses to the
|
|
|
|
|
already very secure Chromium web browser. Its hardening alongside Chromium's base
|
|
|
|
|
security features includes
|
|
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/
|
|
|
|
|
0081-Implement-UI-for-JIT-site-settings.patch"
|
2022-11-08 02:15:09 +00:00
|
|
|
>disabling JavaScript just-in-time (JIT) compilation by default</a>,
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/
|
|
|
|
|
0051-stub-out-the-battery-status-API.patch"
|
2022-11-08 02:15:09 +00:00
|
|
|
>stubbing out the battery status API to prevent abuse of it</a>, and
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/
|
|
|
|
|
0084-Toggle-for-navigating-external-URL-in-incognito.patch"
|
2022-11-08 02:15:09 +00:00
|
|
|
>always-on Incognito mode as an option</a>.<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2022-11-03 00:11:16 +00:00
|
|
|
Vanadium's source code, including its Chromium patchset, can be found in its
|
2022-11-07 08:55:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/Vanadium/"
|
|
|
|
|
>official repository</a>.</td>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Open source<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(GPL-2.0-only)</td>
|
2022-11-08 09:56:58 +00:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Messenger</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-molly.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"><br>
|
2022-11-08 09:56:58 +00:00
|
|
|
<br>
|
|
|
|
|
Molly</td>
|
|
|
|
|
<td><a class="table-link" href="https://molly.im/"
|
|
|
|
|
>Molly</a> is a security-hardened, privacy-hardened
|
|
|
|
|
<a class="table-link" href="https://signal.org/"
|
|
|
|
|
>Signal</a> client which hardens Signal by using a variety of
|
|
|
|
|
<a class="table-link" href="https://github.com/mollyim/mollyim-android#features"
|
2022-11-09 02:46:46 +00:00
|
|
|
>unique features</a>, allowing
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/mollyim/mollyim-android/wiki/
|
|
|
|
|
Data-Encryption-At-Rest"
|
2022-11-08 09:56:58 +00:00
|
|
|
>locking the database when not in use</a>, and
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/mollyim/mollyim-android/blob/
|
|
|
|
|
a81ff7d120adc9d427be17239107343146bad704/app/src/main/java/org/thoughtcrime/securesms/
|
|
|
|
|
crypto/MasterSecretUtil.java#L91"
|
|
|
|
|
>utilising Android StrongBox</a> to protect user keys using the device's hardware
|
|
|
|
|
security module.<br>
|
2022-11-08 09:56:58 +00:00
|
|
|
<br>
|
2022-11-09 02:46:01 +00:00
|
|
|
Molly is available in
|
2022-12-09 09:38:02 +00:00
|
|
|
<a class="table-link" href="https://github.com/mollyim/
|
|
|
|
|
mollyim-android#free-and-open-source"
|
2022-11-09 02:46:01 +00:00
|
|
|
>2 flavours</a>:<br>
|
|
|
|
|
<ul>
|
2023-03-09 06:24:43 +00:00
|
|
|
<li>Molly, which includes the same proprietary Google code as Signal to support
|
|
|
|
|
more features.</li>
|
2022-11-09 02:46:01 +00:00
|
|
|
<br>
|
2023-03-09 06:24:43 +00:00
|
|
|
<li>Molly-FOSS, which removes the proprietary Google code to provide an
|
|
|
|
|
entirely open-source client.</li>
|
2022-11-09 02:46:01 +00:00
|
|
|
</ul></td>
|
2022-11-09 02:09:59 +00:00
|
|
|
<td class="table-main">Open source<br>
|
2022-11-08 09:56:58 +00:00
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(GPL-3.0-only)</td>
|
2022-11-08 09:56:58 +00:00
|
|
|
</tr>
|
2022-11-22 03:33:44 +00:00
|
|
|
<tr>
|
|
|
|
|
<td class="table-main">Messenger</td>
|
2022-12-26 07:55:29 +00:00
|
|
|
<td class="table-main"><img src="asset/img/logo-conversations.png"
|
2022-12-09 09:38:02 +00:00
|
|
|
width="100px" height="100px"><br>
|
2022-11-22 03:33:44 +00:00
|
|
|
<br>
|
|
|
|
|
Conversations</td>
|
|
|
|
|
<td><a class="table-link" href="https://conversations.im/"
|
|
|
|
|
>Conversations</a> is a well-designed Android
|
|
|
|
|
<a class="table-link" href="https://xmpp.org/"
|
2022-12-09 09:38:02 +00:00
|
|
|
>XMPP</a> client which serves as the de facto XMPP reference client and has great
|
|
|
|
|
usability.</td>
|
2022-11-22 03:33:44 +00:00
|
|
|
<td class="table-main">Open source<br>
|
|
|
|
|
<br>
|
2023-03-09 06:37:35 +00:00
|
|
|
(GPL-3.0-only)</td>
|
2022-11-22 03:33:44 +00:00
|
|
|
</tr>
|
2022-10-29 23:54:59 +01:00
|
|
|
</table>
|
2022-12-20 05:21:08 +00:00
|
|
|
</div>
|
2022-10-29 23:54:59 +01:00
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-06-30 06:19:28 +01:00
|
|
|
</body>
|
2022-11-22 04:19:44 +00:00
|
|
|
|
2022-06-30 06:19:28 +01:00
|
|
|
</html>
|
