DNS filtering usually only filters on incoming packets, but for bot stuff that should catch issues.

In general, most routers run everything from a serial flash chip on the board. These are usually 8, 16, or 32 megabytes. They have a simple bootloader like U-Boot. This is what loads the operating system. These devices have a UART serial port on the PCB. You can use a USB to serial UART adaptor to see what is happening in the device. With a proprietary OS, you are still likely to see the pre-init boot sequence that the bootloader prints to terminal. Most operating systems also print information to this interface, at least of the couple dozen junk devices I have been given and messed around with. I make a little mount for a USB to serial adaptor and add it to all of my routers when new, so I only need to plug in USB to get to the internal bootloader and tty terminal interface of OpenWRT. You will need to know the default baud rate of the device, although it is probably listed somewhere online or can be guessed as one of the common high values at or above 9600.

Getting into this further gets complicated. It is probably better to look for any CVE that is relevant to the device or software and work backwards. Look for any software updates that have obfuscated the risk for each CVE. If the issue was not fixed, that is where to look to see if someone has exploited the device. Ultimately, they need clock cycles from the CPU scheduler. So it must be a process or some way of executing code from unregistered memory.

This is getting to the edge of what I have messed around with and understand. There may be a way to get a memory map that includes unused pages, and compare that with a hex dump of the flash memory. This is outside of your scope of a proprietary OS, but hopefully frames the abstract scope of what is possible on this class of device when you have an open source stack. The main advantage of this kind of device and issue is that you can physically remove the flash chip and then see and manipulate every page and memory location. The device likely doesn’t have microcode loaded into the CPU(s) that make it challenging to determine what is going on.

There is probably an easier way, but a hex dump of the current system can be hashed against the factory updated version to see if any differences are present. It is likely that any exploit will include a string with the address to connect to somewhere in flash memory. It could be obfuscated through encryption or a cypher, but a simple check for strings in the hex dump and a grep for “http” is a simple way to looks for issues.

The OpenWRT forum is a good general source. The people behind the bootloaders for these devices are also Linux kernel developers and on the OpenWRT forum.

There is a lot of ambiguous nonsense about this subject by people that lack a fundamental understanding of secure boot. Secure Boot, is not supported by Linux at all. It is part of systems distros build outside of the kernel. These are different for various distros. Fedora does it best IMO, but Ubuntu has an advanced system too. Gentoo has tutorial information about how to setup the system properly yourself.

The US government also has a handy PDF about setting up secure boot properly. This subject is somewhat complicated by the fact the UEFI bootloader graphical interface standard is only a reference implementation, with no guarantee that it is fully implemented, (especially the case in consumer grade hardware). Last I checked, Gentoo has the only tutorial guide about how to use an application called Keytool to boot directly into the UEFI system, bypassing the GUI implemented on your hardware, and where you are able to set your own keys manually.

If you choose to try this, some guides will suggest using a better encryption key than the default. The worst that can happen is that the new keys will get rejected and a default will be refreshed. It may seem like your system does not support custom keys. Be sure to try again with the default for UEFI in your bootloader GUI implementation. If it still does not work, you must use Keytool.

The TPM module is a small physical hardware chip. Inside there is a register that has a secret hardware encryption key hard coded. This secret key is never accessible in software. Instead, this key is used to encrypt new keys, and hash against those keys to verify that whatever software package is untampered with, and to decrypt information outside of the rest of the system using Direct Memory Access (DMA), as in DRAM/system memory. This effectively means some piece of software is able to create secure connections to the outside world using encrypted communications that cannot be read by anything else running on your system.

As a more tangible example, Google Pixel phones are the only ones with a TPM chip. This TPM chip is how and why Graphene OS exists. They leverage the TPM chip to encrypt the device operating system that can be verified, and they create the secure encrypted communication path to manage Over The Air software updates automatically.

There are multiple Keys in your UEFI bootloader on your computer. The main key is by the hardware manufacturer. Anyone with this key is able to change all software from UEFI down in your device. These occasionally get leaked or compromised too, and often the issue is never resolved. It is up to you to monitor and update… - as insane as it sounds.

The next level key below, is the package key for an operating system. It cannot alter UEFI software, but does control anything that boots after. This is typically where the Microsoft key is the default. It means they effectively control what operating system boots. Microsoft has issued what are called shim keys to Ubuntu and Fedora. Last I heard, these keys expired in October 2025 and had to be refreshed or may not have been reissued by M$. This shim was like a pass for these two distros to work under the M$ PKey. In other words, vanilla Ubuntu and Fedora Workstation could just work with Secure Boot enabled.

All issues in this space have nothing to do with where you put the operating systems on your drives. Stating nonsense about dual booting a partition is the stupid ambiguous misinformation that causes all of the problems. It is irrelevant where the operating systems are placed. Your specific bootloader implementation may be optimised to boot faster by jumping into the first one it finds. That is not the correct way for secure boot to work. It is supposed to check for any bootable code and deplete anything without a signed encryption key. People that do not understand this system, are playing a game of Russian Roulette. There one drive may get registered first in UEFI 99% of the time due to physical hardware PCB design and layout. That one time some random power quality issue shows up due to a power transient or whatnot, suddenly their OS boot entry is deleted.

The main key, and package keys are the encryption key owners of your hardware. People can literally use these to log into your machine if they have access to these keys. They can install or remove software from this interface. You have the right to take ownership of your machine by setting these yourself. You can set the main key, then you can use the Microsoft system online to get a new package key to run W10 w/SB or W11. You can sign any distro or other bootable code with your main key. Other than the issue of one of the default keys from the manufacturer or Microsoft getting compromised, I think the only vulnerabilities that secure boot protects against are physical access based attacks in terms of 3rd party issues. The system places a lot of trust in the manufacturer and Microsoft, and they are the owners of the hardware that are able to lock you out of, surveil, or theoretically exploit you with stalkerware. In practice, these connections are still using DNS on your network. If you have not disabled or blocked ECH like cloudflare-ech.com, I believe it is possible for a server to make an ECH connection and then create a side channel connection that would not show up on your network at all. Theoretically, I believe Microsoft could use their PKey on your hardware to connect to your hardware through ECH after your machine connects to any of their infrastructure.

Then the TMP chip becomes insidious and has the potential to create a surveillance state, as it can be used to further encrypt communications. The underlying hardware in all modern computers has another secret operating system too, so it does not need to cross your machine. For Intel, this system is call the Management Engine. In AMD it is the Platform Security Processor. In ARM it is called TrustZone.

Anyways, all of that is why it is why the Linux kernel does not directly support secure boot, the broader machinery, and the abstracted broader implications of why it matters.

I have a dual boot w11 partition on the same drive with secure boot and have had this for the last 2 years without ever having an issue. It is practically required to do this if you want to run CUDA stuff. I recommend owning your own hardware whenever possible.

I was the buyer for a chain of bike shops. Unfortunately, distribution is the market bottleneck that is nearly impossible to break through.

So, at scale, no one is capable of predicting global demand accurately for any type of retail. Almost all products that are sold by small retailers are made and sold by the real manufacturer to distributors for 30-35% of MSRP. These distributors then wholesale the inventory to retailers with a 15-20% markup. This is absolutely necessary because it distributes the burden of inventory commitment to a hierarchy where local conditions are accounted for. The distributor is actually buying the inventory and taking on the risk of overburden that does not sell.

Likewise with retail. The markup is called keystone which means 50% margin. Most retailers will barely break even if the whole store averages 40% margins. Retail property and labor are extremely expensive and hard. In almost all small businesses, overburden is what kills them eventually. Overburden is what does not sell and becomes unmarketable over time.

Another aspect that is not intuitive here is that no matter how you select inventory, you will never sell that entire selection on a single platform. If you are not actively attempting to recuperate cash flow from overburden, the business will slowly drown. Sales in retail are not about overburden at all. Statistically, getting new people in the front door is the only metric that matters. Loss leaders and sales are about traffic not overburden. A good buyer plans and negotiates their loss leaders for sales within their preseason ordering.

Over the last couple of decades, more and more products have been created that bypass the big distributors. Most of it is because the product is just not worth the markup required for scaled independent distribution and middlepersons margins. However, now there is an issue of global demand where the manufacturer has the impossible task of financing scale and the inherent risk. If the product is not made at very large scale, it is uncompetitive to manufacture. You need someone willing to take that risk. As a person that has made these types of decisions at smaller scales of a few million dollars, go bet all that money on a hand of single deck blackjack because those 47-48% winning odds are outstanding by comparison.

Retailers place preseason order commitments to get slightly better margins, but primarily because the distributors are more like banks in retail. They offer credit and repayment options that mean the retailer is not required to pay up front in cash. With bicycle stuff, I placed all of my preseason orders between September and October for the following year. Stuff started arriving between December and January. I then had a first payment due in April, but I had to pay it back by the end of July. So I had to predict the summer market a year in advance and have all of my plan detailed by autumn.

This is how mom and pop independent retail actually works. It was not competitive with big box retail because those are not actually retailers. Those are rogue distributors selling directly to the public. The actual products are still the same 30-35% of MSRP.

The worst product trends in retail have been the tendency for companies to market themselves as exceptions. Like I despised GoPro in my stores. The margin on the cameras was 20% and each one costs a fortune. They constantly tried to deprecate models too. They tried to pitch that all the accessories were keystone and it made up for the terrible return on investment. In reality that inventory of accessories was overburden suicide of niche garbage for special use cases.

All electronic devices people want have fallen into this trap of low margins that are impossible for sustainable retail. When you see factory direct stores, that means the product has no margin for scale distribution. It is a neo feudalistic, brute force approach where someone is dumb enough to believe they will be able to predict global demand indefinitely without making any major errors. The public is dumb enough to follow along. Few realize the enormous power that is consolidated from cutting out the democracy of distributors and retailers. This consolidated monolith will eventually enslave everyone when they must overcome the inevitable mistakes they make. They will not just eat the loss or go out of business because they own your right to choose in a market without competition. It is surrendering choice to the dictator that makes their own demand by force.

Yeah, so, we don’t want that. - said no one. What you want is irrelevant. The lowest common denominator dictates the market. Democracy requires a well informed and skeptical citizenry. We live in an era with the smallest information bottleneck in several centuries. Search results are not deterministic and there are only two relevant web crawlers that all providers query. These are not deterministic. Two people searching on separate devices with identical queries will get different results. All major media is owned by less than a dozen people. You have absolutely no chance of informing the citizenry to make better decisions that may cost a good bit more money. People cringe if you tell them they are slaves, but do nothing if the word citizen is redefined as functionally equivalent.

The only way you will ever see such a product sold in any traditional independent retail scenario, is if some exceptionally altruistic billionaire were to chose to fund the thing with no concern over the loss. The only way to be competitive in price is to build at competitive scale of manufacturing. If someone else is doing this and using factory direct retail to stay in business with just a 30% gross margin in total, you will never find the necessary slice for regional distribution and retail. Your device will be $1000 at MSRP to their $600 equivalent. There is no solution to this issue. It is raw capitalism where the biggest fish makes the rules. The only counter balance in the system is an informed citizenry. This is why information and education are all that really matter. If the average person is too stupid for independent thought, it is the ultimate pwn as citizen means slave, and the peasantry are too stupid to recognize the situation where they own nothing and have no outlet to tell anyone or hear the plight of all the others.

All mobile devices are proprietary. Android is a scheme to make a Linux kernel that has everything ready to deploy except the actual hardware drivers for the processor and modem. Manufacturers take this kernel and add their proprietary binaries at the last possible moment. That source code is not available anywhere. The hardware documentation is not available anywhere publicly. Every device model is just different enough that reverse engineering one does nothing transferable to any other. The level of reverse engineering is extreme and requires destroying many devices using things like fuming nitric acid and fluorine solutions just to have a small chance at reading some parts of embedded memory. These are some of the most dangerous and hazardous chemicals humans make, and you still need xray equipment, special microscopes with stepping automation to stitch images, and a ton of time.

This is moving to a tyrannical surveillance state of fascist authoritarianism. Open source software is a major front on the line of real democracy. This is a nuclear bomb released on that democracy. You fear the wrong pirates and criminals. The biggest threats always come from within. Trust as a mechanism is fundamentally antithetical to democracy. Everyone demanding trust is a traitor to democracy. Trust is the key of the fascist kingdom. Once that key is held, democracy has failed regardless of whomever is aware of the situation. Democracy requires fully informed citizens with skepticism and the liberal right to decide for themselves even when they are wrong. This is impossible without full access to information. The source of that information cannot be filtered at any level. We already have the narrowest bottleneck of available information sources in the last 1000 years of history. There are only 2 relevant web crawlers. All search queries filter through one or both of these two and the results from these are not deterministic. Two people searching for the same thing at the same time will get very different and very biased results. This is individualized regardless of any protections people imagine they have in place. Outside of the internet there is no real unbiased media. A dozen people own it all. Even the garbage claiming to comb all sources is drawing the line and dictating what is center right or left is. Anyone at the grassroots level is impossible to find because there are no organic unbiased search results. The results are all filtered junk full of agenda and bias.

This is the real big picture abstract issue in play. When the maga traitors said this was a coup, they absolutely ment that. Mobile devices are all rental garbage someone else controls. Your computer likewise has a secret operating system running in the background that you do not control. In Intel it is called the Intel Management Engines or ME. This started with Intel VPro in 2008. AMD adopted it is 2013. Arm has one too.

All that is left is to steal your right to have a digital front door by eliminating DNS filtering and all of these devices will be controlled and connected directly by someone else that is watching and listening at all times. You are already in tethers as a digital slave that can be bought and sold for exploitation and manipulation without your consent or knowledge using your digital presence. You have not effectively realized the implications of that surrendering of rights to citizenship with full autonomy. The next step is to redefine the word citizen to be functionally equivalent to slave. “You will own nothing, and you will be happy about it” because if you are not, you will be dead. This is the death of democracy. My words will echo in your head years from now. The dystopia to come is beyond anything you can presently imagine and there is no way to stop it now short of taking up arms and playing Luigi if you are able.

The consolidation of wealth is what really made Caesar. That was the death of the republic. It was not Caesar. We are all a product of our time and environment. It was the consolidation of great wealth. All that wealth did not give a shit about Rome, it went to Constantinople for better opportunities at first chance because consolidation of wealth is treasonous. It is as it was, just look at outsourcing and off shoring, or the disgusting mismanagement of banking and housing that have made the American worker completely uncompetitive with Asian counterparts at the same standard of living. No, I have no fear of the boogie man or foreign state actors. I am terrified of the criminal that normalizes domestic trust, actively manipulates and exploits me, and steals my purchased property. That is a real monster.