Practical security for 2014

> Unfortunately for us PC firmware authors are terrible at writing software. The fact that UEFI is FUCKING HUGE and extremely complex is not helping any. Combine that with the fact that it's closed source and then it's pretty much a nightmare. There is no bottom you can trust.

The verifying uboot system Google developed for its Chromebooks looks like a sensible alternative to me, which they run after loading coreboot (at least for x86). That stuff is sensibly coded, reasonably small, and all free software. I haven't looked very closely, so I may be missing something, but that's how it looks to me.