Hacker News

Top stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. AI-generated posters don’t have to be horrible(john.hartnup.uk ↗)
    26comments
  2. Human brain is two separate organs, Stanford Medicine-led research finds(stanford.edu ↗)
    103comments
  3. If math is more than proof, we need to better celebrate the rest of it(terrytao.wordpress.com ↗)
    69comments
  4. GPT-6 Astra Solves a WWI German Radio Cipher(prinzai.com ↗)
    57comments
  5. Android 17 is the first since 3.x to add new APIs without releasing to the AOSP(grapheneos.social ↗)
    416comments
  6. San Francisco Onion Futures Company(onionfutures.com ↗)
    68comments
  7. "The Secret Life of Circuits" is here(coredump.cx ↗)
    12comments
  8. Apple M6 Pro Achieves the Highest Single-Core CPU Score in Geekbench 7(geekbench.com ↗)
    42comments
  9. Cloudflare Quick Tunnels(cloudflare.com ↗)
    285comments
  10. SDCC – Small Device C Compiler(sourceforge.net ↗)
    18comments
  11. Science Is Open Software(jepedersen.dk ↗)
    38comments
  12. How to Write with an LLM(sockpuppet.org ↗)
    331comments
  13. Saving another 100TB of RAM(cloudflare.com ↗)
    78comments
  14. You can run Git on object storage if you re-make packfiles(tigrisdata.com ↗)
    15comments
  15. How OpenAI Used Its Own LLMs to Design Its Jalapeño Chip(ieee.org ↗)
    88comments
  16. Typesafe-computer-use drives a Mac toward a goal for 1/50th of a cent per step(github.com/awlevin ↗)
    52comments
  17. Why building a Rust LSP is hard(rust-glancer.github.io ↗)
    32comments
  18. Communication by means of modulated Johnson noise(pnas.org ↗)
    discuss
  19. Ctenophores: Wonders of Biology(quantamagazine.org ↗)
    6comments
  20. NASA-IBM Lunar Foundation open-Source Geospatial AI Model(usra.edu ↗)
    2comments
  21. The first new cat species discovered in 100 years(nationalgeographic.com ↗)
    105comments
  22. OpenJev(openjev.com ↗)
    266comments
  23. Goroutine Leak Profiles(go.dev ↗)
    4comments
  24. Show HN: Cactus Needle 3: 8-29MB automation models can match DeepSeek V4 Flash(cactuscompute.com ↗)
    89comments
  25. Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug(ledger.com ↗)
    70comments
  26. Cache-to-Cache: Direct Semantic Communication Between LLMs (2025)(arxiv.org ↗)
    13comments
  27. Warez: The Infrastructure and Aesthetics of Piracy (2021)(archive.org ↗)
    71comments
  28. Suppress vulnerabilities applying Kubernetes context to scans(github.com/alegrey91 ↗)
    2comments
  29. Veronese's Dogs(publicdomainreview.org ↗)
    1comments
  30. Inside ZCode: Silently uploading your Git history to the cloud(ferstar.org ↗)
    100comments

ZeroRISC Gets $10M Funding, Says Open-Source Silicon Security Inevitable

50 pointsby 1y agoeetimes.com
9 comments
1y agoHN ↗

When we discuss the security of silicon, and are calling it open silicon, is this because the design specs and libraries are all open source, or is it due to being able to do research on chip attacks without fear of being sued?

1y agoHN ↗

The hardware IP is Apache-licensed, https://github.com/lowRISC/opentitan. Ideally, it will be possible to buy commercial hardware that incorporates an open silicon RoT, perform a reproducible build of open firmware for the device RoT, then sign and install firmware with the device owner's key.

From OP:

Moving away from unverifiable ‘black boxes’ and towards fully transparent and verifiable foundations unlocks a new paradigm, putting device owners back in control of their remotely connected devices without requiring physical diligence by hardware manufacturers.. assurance-first approach ensures that security starts below the operating system, offering protection against the most sophisticated hardware and firmware attacks and more common software vulnerabilities.

  research on chip attacks without fear of being sued

If a commercial SoC is marketing their usage of an open-source silicon IP block with transparent high assurance, one can only hope they would welcome open security research, ideally via a bug bounty program.

1y agoHN ↗

Hopefully 2025 will be the year of open-source silicon + open firmware RoT! https://opensource.googleblog.com/2025/02/fabrication-begins...

For client devices, https://lowrisc.org/news/lowrisc-a-decade-of-bringing-open-s... > OpenTitan’s “Earl Grey”, will be the plan of record hardware RoT for [2025] Chromebooks.. Caliptra, another open source Root of Trust project with wide industry adoption, has incorporated a considerable amount of OpenTitan’s IP into its design.. OpenTitan’s CPU core, the Ibex RISC-V microcontroller, is an important project in its own right.. Microsoft based its CHERIoT-Ibex design on lowRISC’s commercial-grade Ibex CPU core, extending it with the proven CHERI hardware security extensions.

For servers, https://github.com/chipsalliance/Caliptra & https://146a55aca6f00848c565-a7635525d40ac1c70300198708936b4...

Caliptra consists of IP and firmware for an integrated Root of Trust block.. targets datacenter-class SoCs like CPUs, GPUs, DPUs, TPUs.. implementing a Root of Trust for Measurement (RTM) block inside an SoC. A Caliptra integration provides the SoC with Identity, Measured Boot and Attestation capabilities.

https://opentitan.org/book/doc/use_cases/index.html & https://github.com/Microsoft/ms-tpm-20-ref

OpenTitan can be used to implement the full Trusted Platform Module (TPM) 2.0 specification to meet client and server platform use cases.

1y agoHN ↗

inevitable

RISC-V based, follows the RISC-V marketing book.

1y agoHN ↗

Oh joy. So when this sort of stuff comes to mobile phones, at least when the McDonalds app refuses to start on your pocket general purpose computer (because it's not running software that Google considers 'trustworthy') you'll be able to confidently say that the RTL for the part of the chip that is ultimately responsible for betraying your interests is open source. Surely consolation enough for missing out on your burger discount.

I like to bring up McDonalds as an example because IIRC it requires the highest, 'strong integrity' verdict from SafetyNet/Play Integrity/nom-du-jour. Maybe they should rename it to something with Open in the name when OpenTitan comes to Chromebooks.

1y agoHN ↗

"Open" does not mean "open source" anymore thanks to "OpenAI"

1y agoHN ↗

It never did, what open source has Open Group ever did?

In the old days Open was about industry standards not source code.

1y agoHN ↗

CDE is Open Source :)

But of course, you are correct.