Firmware Write Protect page -- Disabling WP one way street

[stellariax]

My suggestion is for the Firmware Write Protect page.

This is touched on in the FAQ but I think could be added near the end of the pasge above, words to the effect of:

"Disabling Write Protect is a one way street. Because , once WP is disabled, it cannot be re-enabled. This includes models where the hardware WP is via a screw; replacing the screw will not restore WP once disabled."

Maybe the CR50 / Ti50 models are exceptions to this rule?

PS -- Really appreciate the work that has gone into MrChromebox!

[MrChromebox]

but this is not correct, one can always re-enable firmware WP on any model. You just have to re-enable software WP as well (usually first)

[stellariax]

Ah, so I have misunderstood.

I guess I will need to look into this, my follow-up thoughts would be, is it conferring protection from any known attack vectors, and, if the firmware has been successfully flashed and is working, aren't you as well re-enabling WP ... at least in a situation like mine where I don't envisage switching back?

[MrChromebox]

is it conferring protection from any known attack vectors

is what?

if the firmware has been successfully flashed and is working, aren't you as well re-enabling WP

because the stock firmware uses a RO + RW_A/RW_B layout where part of the firmware is immutable and part is updatable, whereas my firmware does not -- for the simple reason that doing so locks you into a specific version of coreboot.

One could build my firmware in a way that you could WP parts of it other than the NVRAM and RAM training data, and then unprotect it to update, but that's a pretty large hassle for something most people don't care about.

[stellariax]

I was assuming that the WP 'feature' guards against malware that manages to insert itself into the boot sequence??

So would it be worth adding to the page:
"Your computer will run perfectly well with WP disabled, and you should not attempt to re-enable Write Protection unless you are technically proficient." ?