• 5 Posts
  • 15 Comments
Joined 5 days ago
cake
Cake day: August 10th, 2025

help-circle


  • Here’s the pinout for the webcam component: https://github.com/FrameworkComputer/Framework-Laptop-13/tree/main/Webcam

    Unfortunately it isn’t really clear whether the switch positions are in the pinout because it’s the mainboard’s job to implement shutting off the camera when it’s off, or just as information with the webcam module responsible for shutting it off in hardware. I have no idea which it is, but it wouldn’t be super-hard for someone capable with EE to take off the bezel and fool around with it and see which it is (or just pay $19 for the magic of buying two of them, if you didn’t want to take apart your own laptop for it.)

    They say they provide full schematics on demand to repair shops (https://knowledgebase.frame.work/availability-of-schematics-and-boardviews-BJMZ6EAu). I’m not sure why they don’t want to just post them publicly, so in that sense you might be right, but they also don’t seem like they are trying to keep them or the interface details of the webcam module fully top secret either.

    They do seem like they publish enough information that someone could figure out the answer if they wanted to. (People in the forums have fooled around with them and seem to be convinced that they are actually hardware switches: https://community.frame.work/t/how-do-the-camera-and-microphone-switches-work/4271 IDK whether that’s accurate, but that’s what the forum people think.)

    No idea why you’re trying to lecture me from this position of authority about taking apart PCBs and whatnot. Anyway, that’s how it works, hope this is helpful for you.



  • Framework laptops have a little physical switch to turn off the camera / mic when you don’t want them.

    The original SGI webcams, some of the first that ever existed, actually had a physical plastic cover that you could slide over them when you didn’t want the camera on. “No, I don’t trust your hardware any more than your software. I shouldn’t need to. Stop looking at me when I don’t want you to, and prove to me that you are not, or else I will be suspicious.” Back in those days that was sort of a universal point of view among internet people, I think…












  • I sort of have a suspicion that there is some mathematical proof that, as soon as it becomes quick and easy to import an arbitrary number of dependencies into your project along with their dependencies, the size of the average project’s dependencies starts to follow an exponential growth curve increasing every year, without limit.

    I notice that this stuff didn’t happen with package managers + autoconf/automake. It was only once it became super-trivial to do from the programmer side, that the growth curve started. I’ve literally had trivial projects pull in thousands of dependencies recursively, because it’s easier to do that than to take literally one hour implementing a little modified-file watcher function or something.



  • I feel like this is kind of the amateur-hour stuff. It’s certainly dangerous, but in comparison to a lot of state-actor activities (or even committed-amateur activities), this kind of supply-chain attack is pretty blatant and easy to spot. Which doesn’t mean it’s easy to spot – I just mean would be trivial to volunteer and contribute some minimal fixes and enhancements to some open source project, and then at one point smuggle in a zero-day that will basically never be detected unless someone detects the intrusion itself and then works backwards from there with a ton of time to spend on it.

    If you’ve ever looked at the obfuscated C contest it should be obvious that this kind of thing can be made completely invisible if you know what you’re doing. Some of the interactions and language features that lead to problems are basically impossible for a casual viewer to see, even if they’re paying attention, and the attack surface is massive and the amount of attention that goes into checking it for weird subtle vulnerabilities is minuscule.