The Next Centralised Dependency Is Your Bootloader

Duration: NaN:NaN:NaN

Speaker: Chris Hobcroft

Type: Talk

Expertise: Some familiarity with the topic

Event: Devcon

Date: Nov 2026

Findings from building a Swarm client that runs inside UEFI firmware, before any operating system exists: libp2p, Noise, yamux and BMT verification in no_std Rust, single-threaded, fixed heap. It pulls kernel, rootfs and clients (Geth, Lighthouse) by hash from public Swarm: storage our community built and barely uses for its own software. Three transferable results: 1. Authority can be money-grade without a chain on the boot path. The machine verifies m-of-n ECDSA signatures over a manifest - the same keys and thresholds that control funds - so it checks signatures, not contracts, and boots even when Ethereum is unreachable. 2. Real numbers for pulling an OS from a public mesh with nothing seeding it, and why that budget dictates the design. 3. What read as a firmware hang for a week was a leak starving the log transport: telemetry sharing a resource with the system under test. It generalises far beyond boot. Plus a scorecard of what is still centralised, starting with GitHub.