On 06/11/2014 10:24 AM, Anton Aylward wrote:

On 06/11/2014 12:30 PM, Lew Wolfgang wrote:

...

I know that there are ways of clearing CMOS memory, but I'm wondering about any other non-volatile storage that might lurk there.

This is the motherboard ONLY we are talking about here? All devices such as drives have been removed?

The only security flaw I can think of is that the motherboard config and first stage boot is sometimes password protected. There are people that use the same password for everything ...

That being said, there are also motherboards with 'added value features' such as additional authentication mechanisms, storage for on-board video ... But unless faced with a uber-hacker to have put stuff there in the first place ... Who knows. But without details, we can only give generic advice. I suggest you pull the manuals for the motherboards in question and check. "Go Google and RTFM" as they say.

Ultimately this is an exercise in risk management. In the end you are asserting that there is probably no risk that any critical information remains.

Yes, the disks are removed and aren't a part of this question. That's a good point about the password! Removing the CMOS battery should take care of that issue. There are known rootkits that will flash the BIOS to insert themselves into the boot process, so the concern was if code can be flashed, could other data be living in there somewhere? Either accidentally or on purpose? I know I'm being overly paranoid, it's just CYA on my part. Thanks, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/11/2014 10:58 AM, Anton Aylward wrote:

On 06/11/2014 01:49 PM, Lew Wolfgang wrote:

...

There are known rootkits that will flash the BIOS to insert themselves into the boot process, so the concern was if code can be flashed, could other data be living in there somewhere? Either accidentally or on purpose?

I know I'm being overly paranoid, it's just CYA on my part. Maybe not.

You said 'sensitive data'. If the mobo is rooted than there are risks in it use, but its not that there is sensitive data still there :-)

If the boards are to be decommissioned aka ground up then the rootkit isn't an issue.

Are are they going to be deployed in a setting of lower security rating and you are worried about information leak?

Hi Anton, The concern would be of information leaks. Of course, the safest course is to grind up the motherboards, but the residual value of the remaining carcasses goes way down... Regards, Lew Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 6/11/2014 10:49 AM, Lew Wolfgang wrote:

There are known rootkits that will flash the BIOS to insert themselves into the boot process, so the concern was if code can be flashed, could other data be living in there somewhere? Either accidentally or on purpose?

If you suspect these machines have already been root-kitted, I suggest to you that whatever amount of data that could be stored in the bios is the very least of your worries. I also suspect you've gone way over the edge, and are sliding down that slippery slope into paranoia. Evil Plan: Lets sneak a root kit onto Lew's machine, capture and hide some secret info in there, and then sit back and wait 5 years till he surpluses the machines and then: PROFIT!!!. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-11 19:49, Lew Wolfgang wrote:

There are known rootkits that will flash the BIOS to insert themselves into the boot process, so the concern was if code can be flashed, could other data be living in there somewhere? Either accidentally or on purpose?

Then just flash them yourself again :-) Of course, you have to locate the bios updates of those boards, which may be old and difficult to find. Otherwise, identify the flash memory chip and pull it out. No need to grind to dust the entire board. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-12 08:06, Per Jessen wrote:

Carlos E. R. wrote:

...

Otherwise, identify the flash memory chip and pull it out. No need to grind to dust the entire board.

That would reduce the board's residual value to 0, might as well grind it all up instead.

No, there is a large economy that thrives on dissembling circuit boards. The rip out the small gold wires inside chips and few other things. And they also sell some of the circuits as new. I saw a documentary on tv the other day. Apparently there has been a train accident in Germany because of such used circuits burning, and more incidents everywhere. It is apparently a big problem for manufacturers, they have to X ray new chips to verify that they are really new. Of course, you can not sell such a board for use. The price goes down a lot, to perhaps cents. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-12 13:43, Daniel Bauer wrote:

SCNR, but this "recycling"-fraud, letting us rest easy with peace of conscience, makes me angry...

It is a fraud, of course. In Europe we pay a recycling tax on every electronic gadget we buy. And not electronics. I have seen factories that do the recycling properly, really properly. So my personal conscience is "clean"; it is the authorities fault for not impeding the illegal sending of things to other countries for what they call "recycling". If they have to hire a hundred thousand new inspectors, do it! Less unemployment. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-12 20:00 (GMT+0200) Per Jessen composed:

...

In Europe we pay a recycling tax on every electronic gadget we buy.

s/tax/fee/

IMO, everything a gummint collects that isn't a user fee, like a road toll or park admission, it's a tax, something it collects because it can, not necessarily should, particularly something collected on account of making a purchase of a chattel or service. -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 13.06.2014 08:28, schrieb Per Jessen:

Felix Miata wrote:

...

On 2014-06-12 20:00 (GMT+0200) Per Jessen composed:

...

...

In Europe we pay a recycling tax on every electronic gadget we buy.

...

s/tax/fee/

IMO, everything a gummint collects that isn't a user fee, like a road toll or park admission, it's a tax, something it collects because it can, not necessarily should, particularly something collected on account of making a purchase of a chattel or service.

You're assuming this fee is collected by the government. It isn't in Switzerland.

http://www.swicorecycling.ch/en/home

Ha, Switzerland is perfect! Also perfect in privatizing profits and socializing losses. So many obligatory payments and enterprises getting paid by government just for sending out bills and collecting money, no risk, great earnings. I'm not against corruption (how else could I live in Spain ;-) ), I'm just disappointed that there's no law that obligates everyone to buy one of my images every year, and if not buying it, then at least paying it. Somehow I missed to make the right friends... Oh, I'm soooo OT, sorry list members, I'll keep quiet a while, I promise... Daniel -- -- Daniel Bauer photographer Basel Barcelona professional photography: http://www.daniel-bauer.com google+: https://plus.google.com/109534388657020287386 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-13 12:14, Per Jessen wrote:

Daniel Bauer wrote:

...

Also perfect in privatizing profits and socializing losses. So many obligatory payments and enterprises getting paid by government just for sending out bills and collecting money, no risk, great earnings.

I would rather have private enterprise doing it than government - state-operated machinery always end up bloated beyond belief, imho.

And things done by private enterprise are done for a profit, obviously. The end result is that they are more expensive, if they do render the same service. If they are cheaper, they typically "trimmed" the service, exploit their employees, or both. Here the politicians disassemble things that were done by the state/regional/local government and hire enterprises instead to do them. The result is that some entrepreneurs, friendly to the current government, get rich (ie, corruption), and the public not necessarily gets cheaper/better service. For example, if the city bus service is "privatized", they trim costs by removing buses (completely or partially) or removing bus stops at clusters of houses that they don't consider profitable enough. Or the garbage collection enterprises working for the city "trim costs" by lowering the salaries of the employees doing the actual dirty work, to amounts nearing 600..800 euros. Hey, anybody knows how to empty a garbage can. We do not need to pay enough. Pay less, there is a lot of unemployed people to choose from, happy to work for less. That's free enterprise here. Public service is expensive because they have to give service to everybody, regardless costs. Buses on every small village, for instance, at reasonable schedules. They do not work for profit, personal or otherwise, but for giving service (so they work "at a loss", by definition). Of course, they can get lazy, or have too many people. So they need to be watched closely by the public. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 06/13/2014 06:14 AM, Per Jessen wrote:

I would rather have private enterprise doing it than government - state-operated machinery always end up bloated beyond belief, imho.

In Ontario, we have experience with private enterprise taking tax payers for a ride, often providing poorer service and not always doing as good a job. In all cases, the employees are paid less the main aim of the company seems to be taking as much money as possible. The worst example is a company set up to run the air ambulance service, but the quality of that service dropped like a rock, to the point the provincial coroner has determined that company was responsible for several deaths, due to late or no transport. If all a private enterprise does is take public money for the owners and does not provide a significant improvement, then we're better off without them. This is sadly the case for many of them. I'd rather the money go to "overpaid" employees than someone who's aim is to take as much as he can from the public purse, while delivering as little as possible. Another example where this has killed is the town of Walkerton, Ontario. After the government relieved itself responsibility of water testing, downloading it to the municipalities and private labs, there was an e-coli outbreak that killed 7 (IIRC) and caused 2300 to get sick. Many of those suffered permanent injury. One of the reasons this was so bad was that the people doing the work, while they worked for the town, did not tell anyone about the problem and the lab was under no obligation to tell anyone else of the contaminated water. There are other examples of how "great" privatization is. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2014-06-13 14:15, James Knott wrote:

...

...

water. There are other examples of how "great" privatization is.

Sigh. It is "good" to know that it is not Spain only where such bad things happen.

The basic idea is that the private business works for a profit. They absolutely need a profit!

There are plenty examples of private business operating essentially as not-for-profit. For instance, all basic Swiss health insurance is run by private companies, but they are not allowed to make a profit on the provision of the basic health insurance & services. SWICO is another similar example. The up-front recycling fee is set by law, they are only there to manage it. For the recycling itself, they cooperate with many private businesses too. -- Per Jessen, Zürich (25.1°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/13/2014 09:57 AM, Per Jessen wrote:

There are plenty examples of private business operating essentially as not-for-profit.

Intentionally? ;-) Actually, that air ambulance service was supposed to be non-profit, but the guy running it did a lot to build his own empire on the taxpayer's dime. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott wrote:

On 06/13/2014 06:14 AM, Per Jessen wrote:

...

I would rather have private enterprise doing it than government - state-operated machinery always end up bloated beyond belief, imho.

In Ontario, we have experience with private enterprise taking tax payers for a ride, often providing poorer service and not always doing as good a job.

I think every country with some sort of privatized service public will recognize that. OTOH, I also have experience with government offices taking tax payers for a ride, often providing poorer service and not always doing as good a job. :-)

In all cases, the employees are paid less the main aim of the company seems to be taking as much money as possible. The worst example is a company set up to run the air ambulance service, but the quality of that service dropped like a rock, to the point the provincial coroner has determined that company was responsible for several deaths, due to late or no transport.

In Switzerland, REGA, a charity, has been operating 99% of all emergency air ambulance/transport services for more than 50 years. There is a new competitor on the scene now, TCS, an automobile club.

If all a private enterprise does is take public money for the owners and does not provide a significant improvement, then we're better off without them.

I would say, as long as they do as well as previous operator, it's fine.

There are other examples of how "great" privatization is.

There's nothing basically wrong with the idea, the problems are to be found in the implementation. Anyway, I wasn't really talking about privatization, but simply that it doesn't always take a government to run things. Switzerland is very slim on government and hence low on bureaucracy (when compared to many other European countries). -- Per Jessen, Zürich (24.9°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-12 16:07, Lew Wolfgang wrote:

On 06/12/2014 04:09 AM, Carlos E. R. wrote:

This reminds me of a shifty sot I knew in the mid 1970's who would round up all the e-waste he could find. He would then process it through a cyanide bath that would extract the gold plating for recycling. The "bath" was in an old child's wading pool and the whole operation was run in the back of a boat construction yard. Life was simple in the old daze...

And that's what they are doing, now. And then dump the stuff into the river, which is handy - boat yard, you know. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-12 19:58, Per Jessen wrote:

Carlos E. R. wrote:

...

No, there is a large economy that thrives on dissembling circuit boards. The rip out the small gold wires inside chips and few other things.

Can you ask someone to come and pick up about a hundred here in my office? We already pay for the recycling hwne we buy electronic goods, but unless we have about 500kg of them, we would have to take them to the recycling point ourselves (which would only create extra cost).

Sigh. :-( Same here, I guess. If you are a business, on a business or industrial park, there is no city garbage collection. You take care of it yourself. If you are just a consumer, you can dump just things into the dustbin, but the rules depends on each city. In mine, if it is not bottles, paper, food containers, food garbage, or small batteries, you have to go yourself to the special garbage point, which is on the outskirts, and no bus. You are out of luck if you don't own a car. In theory, you can dump computers on the shop you bought it from, or about any shop, but I have never seen the containers. But after you take that garbage to the special points at your own cost, as soon as the staff goes out for the day, people break en masse or discretely and steal everything that might have some value. There is an economy out there, making money out of our garbage. But they are not prepared to pay for it, not even collecting it. Such is life :-( -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 06/12/2014 02:06 AM, Per Jessen wrote:

...

Otherwise, identify the flash memory chip and pull it out. No need to

...

grind to dust the entire board. That would reduce the board's residual value to 0, might as well grind it all up instead.

Of course, given the price of new mom boards, an older one wouldn't be worth that much anyway. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

This is the motherboard ONLY we are talking about here? All devices such as drives have been removed?

If you decide to destroy the mainboard (because data is *so* sensitive, you should destroy everything. The GPU/PCI cards have also non-volatile parts (by the way this is scary, under some circumstances with radeon driver while experimenting with wayland for about a second I get small tiles from parts of the screen from reboots ago). Also nobody guarantees that there is nowhere some hidden chip in some part (e.g inside keyboard/mouse tiny key-logger for passwords or in the monitor screen capture). Absolute security can never be guaranteed. Regards. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org