>he still hasn't escaped the botnet Why don't you

>>61020727
Because worrying about systemd and management-engine malware is getting worked up about a very small risk. It's like people who worry about being killed in a terrorist attack, when they're really hundreds of times more likely to die in a car accident, and thousands of times more likely to die of heart disease.

You close the barn door before you worry about the tiny crack in the wall, if you worry about it at all.

>>61020727
Isn't your CPU still backdoored? Or HDD firmware?

>>61020767
Nope, I use an old Intel processor which doesn't likely have a backdoor and if it does libreboot adds a layer of protection from it.

>>61020727
Processors can't run encrypted code, anon. That's why you have to have /boot on a flash drive that you keep on your person so that it can't be tampered with.
> he still doesn't have plausible deniability
Why don't you use plain dm-crypt instead of LUKS so that you can claim that your HDDs are full of random data when the feds come?

>>61020727
Because I don't care

>>61020727
Ryzen is probably going to opensource their platform security. Thus coreboot will be able to boot with Ryzen PCs

>>61021357
>probably
Loving every laugh

File: 1488244418707.jpg (177KB, 960x955px) Image search: [Google]

177KB, 960x955px

>>61020727
I use a ThinkPad T400 with Coreboot and SeaBIOS as the payload. I really enjoy it. I also disabled the Intel ME. The OS is Debian stretch with XFCE. The main 275GB SSD is encrypted, and the optical drive has been replaced by a 500GB HDD. Haven't bothered to encrypt the latter though, since it just holds pepes and my shitty C projects. I have a dock that allows me to easily attach it to a display, a mouse, and an old IBM keyboard when I'm at my desk. I am beyond comfy.

>>61020767
>HDD firmware
A majority of drives use ROM chips to store their firmware, so unless these things are getting backdoored in the factory then I wouldn't worry about it. Even if they are, it's probably targeting Windows systems. I don't care.

As far as the Intel ME goes, you can strip it of unwanted networking and hardware accessing "features" using ME Cleaner so that it becomes a harmless little ARM chip doing basic hardware init and power management.

>>61021357
I'll believe it when I see it. I also want the option to fully disable that little fucker, or else I'm not buying Pajeet hardware.

POO in the CPU

>>61020727
>Why don't you have /boot encrypted
Encrypted home partition is good enough for me.
>libreboot flashed
I like OpenFirmare.
Parabola GNU/Linux
I'm not interested in downgrading
>with OpenRC
See above.

>>61020727
>Why don't you have /boot encrypted
I put it on a zip disquette. If the system is going to be out of my control I shut it down and take the drive with me so that it can't boot. The drive in it is fully encrypted.

Fun Fact: when you set this up, you have to remember to blow away the bootloader that used to be on the internal drive (dd a few MB of urandom onto the disk from parted live or something) Otherwise you take out the flash drive, try to boot the system without /boot, but instead of failing, GRUB is still there on the internal drive, can't make any sense of things, and drops into a rescue shell.