Ask HN: How do you trust that your personal machine is not compromised?
<i>ex-AOSP dev here</i><p>Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don&#x27;t prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader.<p>Pixels have several protections in place:<p>- Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built.<p>- Cryptographic verification (<i>verified boot</i>) of all the bootloaders (IPL, SPL), the kernels (Linux and LittleKernel), and the device tree.<p>- Integrity verification (<i>dm-verity</i>) of the contents of the ROM (<i>&#x2F;system</i> partition which contains privileged OEM software).<p>- File-based Encryption (<i>fscrypt</i>) of user data (<i>&#x2F;data</i> partition where installed apps and data go) and adopted external storage (<i>&#x2F;sdcard</i>); decrypted only with user credentials.<p>- Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM.<p>- Continued modularization of core ROM components so that they could be updated just like any other Android app, ie without having to update the entire OS.<p>- Heavily sandboxed userspace, where each app has very limited view of the rest of the system, typically gated by Android-enforced permissions, seccomp filters, selinux policies, posix ACLs, and linux capabilities.<p>- <i>Private Compute Core</i> for PII (personally identifiable information) workloads. And <i>Trusty Execution Environment</i> for high-trust workloads.<p>This is not to say Android is without exploits, but it seems it is most further ahead of the mainstream OSes. This is not a particularly high bar because of closed-source firmware and baseband, but this ties in generally with the need to trust the hardware vendors themselves (see point #1).