HackerTube.dev

36C3 - Open Source is Insufficient to Solve Trust Problems in Hardware

media.ccc.de · 12.6K views · 2019-12-27 · 1:00:46

Open on YouTube ↗

If playback is restricted in your region, try opening the original video. Use Mark watched to add it to your marked videos.

Overview

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

On Hacker News

HN commenters point to it whenever the question is how far hardware can be trusted, including FPGAs, supply chain attacks and firmware TPMs.

Recommended by 2 HN people across 3 months · HN mentions 2020–2023

Topics

Security & hackingSemiconductors & chip manufacturingHacker culture & free software
Search by tags
hardware securitysupply chainfpgaopen hardwarebetrustedtoctou

What people said

Confiks · 2020-11 · Strong recommendation

Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

Read the original HN comment ↗
Confiks · 2020-05 · Strong recommendation

Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

Read the original HN comment ↗
kfreds · 2023-05 · Recommendation

As I'm sure you're aware FPGAs are nice because they can complicate things for an attacker in the physical supply chain. Andrew "bunnie" Huang did an excellent talk on the subject: [VIDEO]

Read the original HN comment ↗

Sources

Video by media.ccc.de, played through YouTube.

Data and selection notes

HN summaries and labels may contain AI errors. HN dates refer to discussions, not video publication.

HN Library: HackerTube export (2026-10-31) and open-index/hacker-news. Upstream summaries and classifications may contain AI errors.

Views, duration and playback status refresh separately from the published catalog. When an update fails, existing data remains visible.

Selection checks
  • SaaS & AI candidates: Topic keywords do not match
  • Editor-approved picks: Editorial review is required

Rule matches identify candidates. They do not guarantee video quality or financial results.

About the library and its sources