Stories like this one from are not unusual:
arstechnica.com/information-te
That's why Purism takes the digital supply chain so seriously. Read about our efforts to protect the digital supply chain here:
puri.sm/posts/protecti
Conversation
This is a company making a fork of open source code and including a backdoor in it. These aren't Google Android devices. How exactly do you prevent someone doing the same with any of your projects? You don't, and as usual you're misleading people with your dishonest approach.
2
8
Unlike mainstream devices, you won't support full verified boot and attestation for the entirety of all the firmware and the operating system. That's the opposite of making devices more resistant to supply side attacks. The article talks a big game but reality is much different.