Trusting the Evil Maids
Alex Oliva (GNU Linux-Libre) correctly points out that trusting binary blobs from untrustworthy companies (known for back-dooring things, based on their track record) is misguided if not foolish (the latter is more crude a term, but still deserving). This morning in IRC we discussed again in simple terms what it means to have IBM's LVFS (Linux Vendor Firmware Service) running as root.
In very very very simple terms that every user can understand, having things like these running in the background is like having a giant back door available all the time, allowing an intruder to remotely control everything on your computer; not to mention what happens in case of system breach in the controlling party of LVFS (previously Linux Foundation) or any OEM/vendor that pipes things through it.
Oliva is right. Allowing some blobs to be pushed and pulled passively - without warning and with neither user consent nor audit - seems rather insane.
Speaking of "evil maids", suppose you are specifically targeted. If you purchase or order a computer anonymously, it's hard to compromise only your machine. However, once connected and authenticated, letting oneself be remotely controlled at such a low level seems insane. We expressed concerns like these in relation to WordPress 13 years ago, but this is much worse because Automattic does not get root-level access to your physical server.
In short, whatever Oliva said seems appropriate and timely. Don't listen to liars and frauds who lie to courts. They warn us about "Evil Maids", but they themselves are those Evil Maids. █
Image source: Myosotis