{"slug": "heads", "name": "Heads", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 5, "warners": 1, "score": 2.114, "rising": 0.02, "first": "2026-01-28", "latest": "2026-10-24", "why": "I use Heads with a hardware key to defend myself from an Evil Maid.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 9, "neutral": 1, "compare": 0, "warn": 1}, "spark": [0, 0, 1, 2, 2, 1, 1, 1, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I use Heads with a hardware key to defend myself from an Evil Maid.", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/linuxboot/heads", "official_url": "https://osresearch.net", "pricing": "", "aliases": ["Heads"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 803623328, "item_id": 50226458, "url": "https://news.ycombinator.com/item?id=50226458", "by": "bubblethink", "date": "2026-10-24", "stance": "recommend", "quote": "Look at the heads project", "excerpt": "What does it matter if it doesn't unlock the disk? It's a different device with a logger. The purpose of the maid is to be evil and steal your pin. The maid has your real device. The only way to prevent this is by you authenticating the device before you enter anything. Look at the heads project (https://github.com/linuxboot/heads).", "context": "", "use_case": "", "switched_from": "", "story": "Full Disk Encryption on Fedora with TPM2"}, {"id": 778137376, "item_id": 48633586, "url": "https://news.ycombinator.com/item?id=48633586", "by": "fsflover", "date": "2026-06-22", "stance": "recommend", "quote": "There are very few machines that are capable of running Heads", "excerpt": "There are very few machines that are capable of running Heads, https://osresearch.net/Prerequisites. I checked that it works on two Librem laptops with a Librem Key, https://puri.sm/posts/the-librem-key-makes-tamper-detection-easy/", "context": "", "use_case": "Firmware / boot verification", "switched_from": "", "story": "Update Your Secure Boot Cert Before It Expires"}, {"id": 767583088, "item_id": 47973943, "url": "https://news.ycombinator.com/item?id=47973943", "by": "fsflover", "date": "2026-05-01", "stance": "recommend", "quote": "I use Heads with a hardware key to defend myself from an Evil Maid.", "excerpt": "You may never be able to completely protect yourself, but you can make an attack much more costly. For example, I use Heads with a hardware key to defend myself from an Evil Maid.", "context": "", "use_case": "Evil maid protection", "switched_from": "", "story": "The Whistleblower Who Uncovered the NSA's 'Big Brother Machine'"}, {"id": 767250368, "item_id": 47953148, "url": "https://news.ycombinator.com/item?id=47953148", "by": "fsflover", "date": "2026-04-29", "stance": "recommend", "quote": "I layed down the tooling for anyone wanting to further protection", "excerpt": "@TommyTran732, you are going to a great length to downplay everything about devices/companies promoting freedom, including Librem 5, Purism, and laptops with Heads. And you are promoting proprietary staff instead. This looks like trolling or astroturfing. For observers, here is the actual quote from the heads developer, not in the (incorrect) interpretation of TommyTran732: As I pointed before @TommyTran732 and to an", "context": "", "use_case": "Measured boot firmware", "switched_from": "", "story": "Original GrapheneOS responses to WIRED fact checker"}, {"id": 756025457, "item_id": 47251591, "url": "https://news.ycombinator.com/item?id=47251591", "by": "fsflover", "date": "2026-03-04", "stance": "recommend", "quote": "Heads is updated regularly: https://github.com/linuxboot/heads/", "excerpt": "Perhaps you are right, and the hardware attestation is more reliable on a Pixel. However, doesn't it rely on proprietary hardware, unlike Heads? coreboot with Heads is not the same as Qubes AEM. Heads is updated regularly: https://github.com/linuxboot/heads/", "context": "", "use_case": "Firmware boot environment", "switched_from": "", "story": "F-Droid Board of Directors nominations 2026"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 767267680, "item_id": 47954230, "url": "https://news.ycombinator.com/item?id=47954230", "by": "TommyTran732", "date": "2026-04-29", "stance": "warn", "quote": "I wouldn't call heads \"best approach on what is available\"", "excerpt": "Yeah, why are you selectively reading? This is after he admitted what I said was true. His only contention is that he thinks it's hard to know what the PCR values should be to fake, so he calls that \"security\". You are being extra ordinarily disingenuous here. The actual admission (requires a login): https://forum.qubes-os.org/t/how-exactly-is-heads-pureboot-secure/23092/3 His words, not mine: > The goal of Heads is ", "context": "", "use_case": "Firmware trust for laptops", "switched_from": "", "story": "Original GrapheneOS responses to WIRED fact checker"}]}], "who": [], "tags": [], "use_cases": ["firmware / boot verification", "evil maid protection", "firmware trust for laptops", "measured boot firmware", "firmware boot environment", "laptop firmware"], "compared": [{"slug": "coreboot", "name": "coreboot", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "qubes-os", "name": "Qubes OS", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "libreboot", "name": "Libreboot", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 801665168, "item_id": 50104073, "url": "https://news.ycombinator.com/item?id=50104073", "by": "cwiggs", "date": "2026-10-15", "stance": "neutral", "quote": "This relates to work I've been doing with the [Heads](https://osresearch.net/) project.", "excerpt": "Wow, this is awesome! This relates to work I've been doing with the [Heads](https://osresearch.net/) project. Specifically I got a PR merged for the first ChromeOS Port using MrChromebox's code as an upstream dependency: https://github.com/linuxboot/heads/pull/2133 I'm now working on the 2nd ChromeOS device in this PR right now: https://github.com/linuxboot/heads/pull/2225 And there is a 3rd port by someone else: htt", "context": "contributes ports to Heads", "use_case": "firmware, ChromeOS ports", "switched_from": "", "story": "Libreboot 26.10 \"Ominous Olive\" released with UEFI, Chromebook support"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47178863", "title": "F-Droid Board of Directors nominations 2026", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47849854", "title": "Original GrapheneOS responses to WIRED fact checker", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50194602", "title": "Full Disk Encryption on Fedora with TPM2", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50102923", "title": "Libreboot 26.10 \"Ominous Olive\" released with UEFI, Chromebook support", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49937718", "title": "GrapheneOS has fixed the Android 17 QPR1 kernel performance regression", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48632385", "title": "Update Your Secure Boot Cert Before It Expires", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 2}, "2026-03": {"recommend": 2}, "2026-04": {"recommend": 1, "warn": 1}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"neutral": 1, "recommend": 1}}, "quotes": [{"id": 803623328, "item_id": 50226458, "url": "https://news.ycombinator.com/item?id=50226458", "by": "bubblethink", "date": "2026-10-24", "stance": "recommend", "quote": "Look at the heads project", "excerpt": "What does it matter if it doesn't unlock the disk? It's a different device with a logger. The purpose of the maid is to be evil and steal your pin. The maid has your real device. The only way to prevent this is by you authenticating the device before you enter anything. Look at the heads project (https://github.com/linuxboot/heads).", "context": "", "use_case": "", "switched_from": "", "story": "Full Disk Encryption on Fedora with TPM2"}, {"id": 799229699, "item_id": 49951856, "url": "https://news.ycombinator.com/item?id=49951856", "by": "fsflover", "date": "2026-10-04", "stance": "neutral", "quote": "My Qubes laptop runs coreboot with Heads", "excerpt": "> mainstream security How is this mainstream security, if GrapheneOS are the only ones offering it? Cutting edge, maybe. Except Qubes OS of course. > Do you have source code of the BIOS, firmware and microcode of your chosen Qubes OS pc? :D My Qubes laptop runs coreboot with Heads with disabled and neutralized Intel ME. It does not offer the full user freedom, but it comes as close as possible. > or a statement that ", "context": "", "use_case": "", "switched_from": "", "story": "GrapheneOS has fixed the Android 17 QPR1 kernel performance regression"}, {"id": 778137376, "item_id": 48633586, "url": "https://news.ycombinator.com/item?id=48633586", "by": "fsflover", "date": "2026-06-22", "stance": "recommend", "quote": "There are very few machines that are capable of running Heads", "excerpt": "There are very few machines that are capable of running Heads, https://osresearch.net/Prerequisites. I checked that it works on two Librem laptops with a Librem Key, https://puri.sm/posts/the-librem-key-makes-tamper-detection-easy/", "context": "", "use_case": "Firmware / boot verification", "switched_from": "", "story": "Update Your Secure Boot Cert Before It Expires"}, {"id": 767583088, "item_id": 47973943, "url": "https://news.ycombinator.com/item?id=47973943", "by": "fsflover", "date": "2026-05-01", "stance": "recommend", "quote": "I use Heads with a hardware key to defend myself from an Evil Maid.", "excerpt": "You may never be able to completely protect yourself, but you can make an attack much more costly. For example, I use Heads with a hardware key to defend myself from an Evil Maid.", "context": "", "use_case": "Evil maid protection", "switched_from": "", "story": "The Whistleblower Who Uncovered the NSA's 'Big Brother Machine'"}, {"id": 767267680, "item_id": 47954230, "url": "https://news.ycombinator.com/item?id=47954230", "by": "TommyTran732", "date": "2026-04-29", "stance": "warn", "quote": "I wouldn't call heads \"best approach on what is available\"", "excerpt": "Yeah, why are you selectively reading? This is after he admitted what I said was true. His only contention is that he thinks it's hard to know what the PCR values should be to fake, so he calls that \"security\". You are being extra ordinarily disingenuous here. The actual admission (requires a login): https://forum.qubes-os.org/t/how-exactly-is-heads-pureboot-secure/23092/3 His words, not mine: > The goal of Heads is ", "context": "", "use_case": "Firmware trust for laptops", "switched_from": "", "story": "Original GrapheneOS responses to WIRED fact checker"}, {"id": 767250368, "item_id": 47953148, "url": "https://news.ycombinator.com/item?id=47953148", "by": "fsflover", "date": "2026-04-29", "stance": "recommend", "quote": "I layed down the tooling for anyone wanting to further protection", "excerpt": "@TommyTran732, you are going to a great length to downplay everything about devices/companies promoting freedom, including Librem 5, Purism, and laptops with Heads. And you are promoting proprietary staff instead. This looks like trolling or astroturfing. For observers, here is the actual quote from the heads developer, not in the (incorrect) interpretation of TommyTran732: As I pointed before @TommyTran732 and to an", "context": "", "use_case": "Measured boot firmware", "switched_from": "", "story": "Original GrapheneOS responses to WIRED fact checker"}, {"id": 756025457, "item_id": 47251591, "url": "https://news.ycombinator.com/item?id=47251591", "by": "fsflover", "date": "2026-03-04", "stance": "recommend", "quote": "Heads is updated regularly: https://github.com/linuxboot/heads/", "excerpt": "Perhaps you are right, and the hardware attestation is more reliable on a Pixel. However, doesn't it rely on proprietary hardware, unlike Heads? coreboot with Heads is not the same as Qubes AEM. Heads is updated regularly: https://github.com/linuxboot/heads/", "context": "", "use_case": "Firmware boot environment", "switched_from": "", "story": "F-Droid Board of Directors nominations 2026"}, {"id": 756023008, "item_id": 47251438, "url": "https://news.ycombinator.com/item?id=47251438", "by": "upboundspiral", "date": "2026-03-04", "stance": "recommend", "quote": "Heads + TPM is solid but I suspect it is not at the level of Google/Apple secure enclave.", "excerpt": "Heads + TPM is solid but I suspect it is not at the level of Google/Apple secure enclave. And a strong secure enclave provides benefits outside of first boot to secure certain processor state and continuosly ensure integrity. For desktop TPM at least to me they seem a bit of a black box with many past vulnerabilities https://en.wikipedia.org/w/index.php?title=Trusted_Platform_Module#Security_issues. I think at cold b", "context": "", "use_case": "", "switched_from": "", "story": "F-Droid Board of Directors nominations 2026"}, {"id": 754968241, "item_id": 47185515, "url": "https://news.ycombinator.com/item?id=47185515", "by": "fsflover", "date": "2026-02-27", "stance": "recommend", "quote": "I use Qubes with TPM and Heads", "excerpt": "I use Qubes with TPM and Heads and with a hardware key. All based on FLOSS.", "context": "", "use_case": "", "switched_from": "", "story": "F-Droid Board of Directors nominations 2026"}, {"id": 754158258, "item_id": 47134891, "url": "https://news.ycombinator.com/item?id=47134891", "by": "alias_neo", "date": "2026-02-24", "stance": "recommend", "quote": "", "excerpt": "It replaces a proprietary component of your system with an open source one. Reading https://libreboot.org/#why-use-libreboot might provide further enlightenment.", "context": "", "use_case": "Laptop firmware", "switched_from": "", "story": "I Ported Coreboot to the ThinkPad X270"}, {"id": 748684304, "item_id": 46792769, "url": "https://news.ycombinator.com/item?id=46792769", "by": "fsflover", "date": "2026-01-28", "stance": "recommend", "quote": "It works well with Qubes btw, and is recommended by the developers", "excerpt": "Laptops can already have TPM based on FLOSS (with coreboot with Heads). It works well with Qubes btw, and is recommended by the developers: https://forum.qubes-os.org/t/qubes-certified-novacustom-v54-and-v56-series-laptops-now-available-with-heads-firmware/34015", "context": "", "use_case": "Laptop firmware measurement", "switched_from": "", "story": "Lennart Poettering, Christian Brauner founded a new company"}]}