Binary Risk Hunt from Binarly

Hi all,

As some of you might have noticed, I've added a new binarly_cloud plugin to=
 the LVFS which scans UEFI firmware for critical security problems. This wi=
ll soon replace the FwHunt functionality which did the same thing. The new =
Binary Risk Hunt scanning is done on the Binarly servers rather than locall=
y on the LVFS infrastructure, and so each vendor that wants to use it needs=
 to *opt-in*. The new Binary Risk Hunt service offers a next-generation lev=
el of scanning, and allows us to find security issues that were simply not =
detected by FwHunt.

If you found the FwHunt tests useful, please tell your LVFS vendor manager =
to login, then click "Home", "Vendor" in the left menubar and then "Relatio=
nships" in the tab navigation. Then you can read the Terms and Conditions a=
nd click the "Add Feature" button to enable the tests. The firmware image i=
s kept confidential as per the terms of service, and the service is complet=
ely free like FwHunt was before =E2=80=93 there are no hidden charges to wo=
rry about.

I've worked with Binarly (who also built the FwHunt scanner too) for some t=
ime, and I've checked the terms and conditions are suitable for how vendors=
 use the LVFS. I think the tests being done on the firmware are very useful=
 and important for the ecosystem -- even if the uploader isn't always the c=
orrect person to actually fix the firmware.

A few vendors already have an existing relationship with Binarly, and they'=
ve already been receiving Binary Risk Hunt reports for the last few days. T=
he Binary Risk Hunt service is completely free, but if you do want to talk =
to them about a paid "on-prem" solution (with other analysis and unknown/un=
disclosed vulnerability detection) or if you want to talk to them more gene=
rally about firmware and software security, there's a link for that too: ht=
tps://www.binarly.io/book-a-demo

If anyone has any questions please ask me off-list. The local FwHunt scanni=
ng is officially deprecated now, and will be removed in a few weeks time.

Richard