Firmware Flashing is Riskier on Linux - Lemmy.World
lemmy.world
Most Linux firmware tools (flashrom, coreboot utilities, vendor‑reverse‑engineered scripts, NVMe tools) load the firmware into ram (assume it’s ECC), trust the RAM is correct, and write directly to SPI/EC/NVME. There’s no double-buffering, memory integrity checks, vendor-grade validation, protected memory regions, or automatic rollback. If the buffer is corrupted, Linux flashes it anyway. Windows OEM flashers never trust raw RAM blindly. Because vendors don’t ship Linux flashers, users rely on flashrom, fwupd (reverse‑engineered metadata), Community EC flashers, Community NVMe firmware tools, and Coreboot scripts. Reverse‑engineering = incomplete understanding = higher brick risk. Windows uses official vendor tools with signed capsules, verified update paths, vendor QA, and recovery logic. Linux gives userspace access to /dev/mem /dev/spidev I²C/SMBus EC registers and PCI config space which is terrible for safety. Windows blocks almost all of this.

It’s sorrowful some people choose to hate, complain, ridicule, and block everything that does not fit their choice…

With just a single idea shared, a lone message posted in a community, with your finite priceless time and experience invested, you may get banned instantly, and permanently, instead of actually learning and discover together…

The single message that resulted in my immediate permanent ban:

Message

It’s not Linux, but your distribution, or you, what makes it “unsafe”.
There are numerous options to harden your Linux environment, and it’s relatively trivial to keep it safer if you ever want it, or actually stop blaming and complaining.

For example, to limit the access for root or custom group hwaccess, without much fuss but to give you an idea, for the most popular distros as Debian-based:

  1. Add a Udev rule:
# /etc/udev/rules.d/90-hwaccess.rules

KERNEL=="mem",        GROUP="hwaccess", MODE="0660"
SUBSYSTEM=="spidev",  GROUP="hwaccess", MODE="0660"
SUBSYSTEM=="i2c-dev", GROUP="hwaccess", MODE="0660"
  1. Set at boot:
setfacl -Rm 'g:hwaccess:rwX' -- \
    /sys/kernel/debug/ec \
    /sys/bus/pci/devices/*/config;

You may then setup SELinux, AppArmor, and secure it via SecureBoot’s shim, too.
Yet, you chose to effortlessly complain instead…

  • Artwork@lemmy.worldOPEnglish
    52·
    7 days ago

    Oh… I see… Thank you!
    I could not even imagine such a rule when I noticed the post at home page of LemmyWorld instance, and commented on it… ^^"