LinuxCNC on non-backdoored hardware - what are the options?

Thanks for all the suggestions and advice so far.

After more research into this problem today, we have determined that we cannot reliably secure a 'modern' computer. It appears that the entire microprocessor industry has turned their CPUs into surveillance devices. This makes them obsolete for any serious industrial work - if they are connected to the internet.

We have therefore decided to completely air-gap our LinuxCNC manufacturing systems, and to physically remove their networking hardware.

The problem extends beyond the chip-on-chip surveillance processors embedded in AMD and Intel CPUs: We additionally ran into the problem of auditing a version of Linux itself, which is a massive undertaking that we don't have the resources to undertake.

The best solution appears to be to air-gap the Linux computers we use for manufacturing and then use seperate machines running OpenBSD on Libreboot compatible systems for internet comms.

I'm still interested in hearing from others who have addressed this issue, but my conclusion is that air-gapping the manufacturing process is the only way to be sure we are secure.

Arguably Opensource Linux with thousands of users auditing and checking the code would be more secure than OpenBSD with 6-12 security auditors.

Arguably Opensource Linux with thousands of users auditing and checking the code would be more secure than OpenBSD with 6-12 security auditors.

I'd like to hear more about this.

My understanding was that although there are fewer auditors for OpenBSD, there is substantially less code, less features enabled by default, and a primary focus on security.

Please note that, at this stage, I don't have any allegiance to any particular OS, so I'm open to hearing how others here are securing their systems. As I understand it, however, although there are plausibly more people auditing Linux in general, there are many different distributions across which these audits occur, and a general inclination (in the most popular Linux distributions) to push functionality and third-party software-bundling over security. This makes audits hard.

For example, we have used the Debian edition of Linux Mint on some machines here, and while I admire the OS, there is a lot of complexity there on the standard installation, and a lot of features automatically enabled.

Conversely, with OpenBSD, on other test machines here, we have to turn on features as we need them, rather than disable features when we don't.

It seems like the most popular Linux distributions (and therefore the most audited) are also the most difficult to audit, as they are designed for mainstream use where functionality and bundled software is prioritized over security.

Obviously, we could opt for a more 'secure' Linux distribution, but then these distributions are less widely used and therefore less audited.

I hope this makes sense. In summary: The most audited Linux distributions are also the most sprawling; making audits much harder to rely on.

OpenBSD seems to strike a balance between the size and skill of the audit team, combined with a smaller codebase to audit.

In other words: There may be more Linux being audited, but I feel there is also more Linux to audit. This makes the equation a difficult one...

Thank you for making more people aware of these problems.

the LED's on the RJ45 connector are still on and sending data.

As well as using non-backdoored CPUs and ethernet cards, we are also in the process of designing a router that will checksum incoming and outgoing data at a low-level. We are also switching to the Gemini protocol for our library systems and gradually phasing out http use for our company. I know a few others are also making this change, for the reason you highlight.

And you will have phones around, they spy on everything all the time.

We've equipped our engineering team with Motorola V3s (2004), which we have audited for security. These are unable to geolocate or stream audio/video data at any usable rate for surveillance. They're also great phones. Engineers are instructed not to discuss projects on open lines, but they work well for basic comms.

TV's do also

Thank you again for bringing awareness to this issue. We are not using any backdoored equipment, as far as we know. This includes these so-called 'smart TVs' and other devices with concealed surveillance tech.

We're very serious about running a secure manufacturing facility, and this has largely involved going back to technology that was thought to be obsolete, but which it is now becoming clear still represents the best the industry currently has to offer.

Its not the Linux applications that are the security risk. Focus on the Linux kernel which is common  to all distros. Just get rid of Xwindows. Command line only like CentOS or Ubuntu server. Ubuntu Server guarantee the OS security to 2025.

Linuxcnc will run on my Chromebook Linux without any xwindows installed.
Then there is Android maybe running on the New Tensor chipset from Google which also uses a dedicated 2nd generationTitan M2 security chip. The chip’s primary function is to verify the boot conditions for starting up Android, ensuring that it hasn’t been tampered with at a low level. The Titan M verifies the signature of its flash-based firmware using a public key built into the chip’s silicon.