6 ms·

UPDATE: I've made a huge mistake. seduced by the matte black dark side. Avoid all modern Intel CPU/chipsets (post 2006) if you value your privacy and security:

UPDATE: I've made a huge mistake. seduced by the matte black dark side. Avoid all modern Intel CPU/chipsets (post 2006) if you value your privacy and security: In summary, the Intel Management Engine and its applications are a backdoor with total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the libreboot project strongly recommends avoiding it entirely. Since recent versions of it can't be removed, this means avoiding all recent generations of Intel hardware. http://libreboot.org/faq/#intel http://libreboot.org/faq/#intel Original comment follows: Former Thinkpad fan. I love my new Dell Rugged Extreme. I got the 12. This thing is built the way Thinkpads used to be (complete with the price tag of a used car). The only thing(s) I don't like about it is the missing trackpoint. I really miss that. And the fact that black-box UEFI is built in (but what do we know about modern microcode anyway, might as well get some ostensible security measures for 'free'). Oh, one more: the "QD" connectors do not accept standard straps/slings -- only insanely expensive (and hard to find) Dell brand straps/handles. Everything else about it is outstanding. This thing is a brick with rounded, rubber edges. Drive over it with your truck. (watch the video) Use it as body armor. (no, don't really) Go scuba diving in the arctic. (Check out the frozen-in-an-ice-block video on Youtube.. while running on battery.) The screen is incredibly bright, but it also has a slick quick-kill for all the lights. Just the thing for when a warlord is on your tail. The multi-color LED backlit keyboard looks awesome. It runs Kali Linux (built on Debian Jessie) perfectly. Everything works, including the touch screen and stylus, out of the box.

JoshTriplett 11y ago
> And the fact that black-box UEFI is built in UEFI isn't any more black-box than BIOS in general. Sure, I'd rather run entirely FOSS firmware, but in the absence of that, UEFI doesn't make things any worse. If anything, it allows quite a bit more introspection and extensibility. And its core is FOSS (https://github.com/tianocore/edk2 https://github.com/tianocore/edk2), just not the versions shipped by board/system vendors.
- jamiesonbecker 11y ago
  UEFI starts with encrypted code and wraps additional layers of encrypted, signed code around it. It's impenetrable, and purposefully so. That's the practical definition of "black box". It's huge, too, with a much larger attack surface. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...
  - JoshTriplett 11y ago
    You say "encrypted" and "signed" as though that's a bad thing. When they're used against the owner of the system, sure; however, they can also be used by the owner of the system to protect themselves. "Only runs authorized code" can be a good thing as long as you're the one doing the authorizing.
    - jamiesonbecker 11y ago
      > "Only runs authorized code" can be a good thing as long as you're the one doing the authorizing.
      - jamiesonbecker 11y ago
        as you're the one doing the authorizing [signing].
derefr 11y ago
Intel Management Engine is the exact same thing as Windows' Group Policy or OSX's Enterprise Configuration Profiles, just applied at the hypervisor level[1]. IOW, it's a thing you use to pair a corporate-owned PC with its mothership. If you bought your PC, you control it; you can just turn IME off in the BIOS or whatever you like. Note that this level of enterprise control has been possible for some time; even without IME, if HR hands you a laptop and doesn't tell you the BIOS password, then it might be set to, say, attempt to network PXE boot by default from the corporate intranet's deployment-and-compliance servers. --- [1] Actually it's more literally like the kind of "smart" server-rack backplane that allows you to connect a remote serial console to an unresponsive server to see what's going on, or send it a hard reboot or whatever else. Except for managing desktops instead of servers.
- jamiesonbecker 11y ago
  You're applying several inadequate metaphors. To do the same thing, it's kind of like saying my tool box full of tools is similar to a screwdriver. No, wait, it's more literally like a box to carry tools in. ;) It's hard to argue with metaphors, because they start out being inexact and go downhill from there. (oh, another one!) But I'll try anyway :) It's really nothing like group policy's or configuration profiles, except it could be used to deliver similar functionality for your machine from either the manufacturer, or from your company, or from anyone else along the way who implemented their own backdoor into your hardware during shipping[1] or maybe just inserted their own microcode into the CPU, because it literally is an all-powerful hardware backdoor that lives below your OS. It can even be upgraded remotely in many cases. Backdoors can be used for good or for evil, of course, but that's what it is. (and it actually has nothing to do with hypervisors, unless you take the metaphor that any operating system you install is really running under the control and whim of the Intel Management Engine.) Again, the metaphor of a remote management console is again over-simplifying, but, sure, it can do that, too. When you're reading this[2], remember that you don't control those keys and you can't remove that software. You can't 'just turn it off': 1. http://gizmodo.com/the-nsa-actually-intercepted-packages-to-put-backdoors-1491169592 http://gizmodo.com/the-nsa-actually-intercepted-packages-to-... 2. http://libreboot.org/faq/#intelme http://libreboot.org/faq/#intelme

JoshTriplett 11y ago

> And the fact that black-box UEFI is built in UEFI isn't any more black-box than BIOS in general. Sure, I'd rather run entirely FOSS firmware, but in the absence of that, UEFI doesn't make things any worse. If anything, it allows quite a bit more introspection and extensibility. And its core is FOSS (https://github.com/tianocore/edk2 https://github.com/tianocore/edk2), just not the versions shipped by board/system vendors.

jamiesonbecker 11y ago
UEFI starts with encrypted code and wraps additional layers of encrypted, signed code around it. It's impenetrable, and purposefully so. That's the practical definition of "black box". It's huge, too, with a much larger attack surface. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...
- JoshTriplett 11y ago
  You say "encrypted" and "signed" as though that's a bad thing. When they're used against the owner of the system, sure; however, they can also be used by the owner of the system to protect themselves. "Only runs authorized code" can be a good thing as long as you're the one doing the authorizing.
  - jamiesonbecker 11y ago
    > "Only runs authorized code" can be a good thing as long as you're the one doing the authorizing.
    - jamiesonbecker 11y ago
      as you're the one doing the authorizing [signing].

derefr 11y ago

Intel Management Engine is the exact same thing as Windows' Group Policy or OSX's Enterprise Configuration Profiles, just applied at the hypervisor level[1]. IOW, it's a thing you use to pair a corporate-owned PC with its mothership. If you bought your PC, you control it; you can just turn IME off in the BIOS or whatever you like. Note that this level of enterprise control has been possible for some time; even without IME, if HR hands you a laptop and doesn't tell you the BIOS password, then it might be set to, say, attempt to network PXE boot by default from the corporate intranet's deployment-and-compliance servers. --- [1] Actually it's more literally like the kind of "smart" server-rack backplane that allows you to connect a remote serial console to an unresponsive server to see what's going on, or send it a hard reboot or whatever else. Except for managing desktops instead of servers.

jamiesonbecker 11y ago
You're applying several inadequate metaphors. To do the same thing, it's kind of like saying my tool box full of tools is similar to a screwdriver. No, wait, it's more literally like a box to carry tools in. ;) It's hard to argue with metaphors, because they start out being inexact and go downhill from there. (oh, another one!) But I'll try anyway :) It's really nothing like group policy's or configuration profiles, except it could be used to deliver similar functionality for your machine from either the manufacturer, or from your company, or from anyone else along the way who implemented their own backdoor into your hardware during shipping[1] or maybe just inserted their own microcode into the CPU, because it literally is an all-powerful hardware backdoor that lives below your OS. It can even be upgraded remotely in many cases. Backdoors can be used for good or for evil, of course, but that's what it is. (and it actually has nothing to do with hypervisors, unless you take the metaphor that any operating system you install is really running under the control and whim of the Intel Management Engine.) Again, the metaphor of a remote management console is again over-simplifying, but, sure, it can do that, too. When you're reading this[2], remember that you don't control those keys and you can't remove that software. You can't 'just turn it off': 1. http://gizmodo.com/the-nsa-actually-intercepted-packages-to-put-backdoors-1491169592 http://gizmodo.com/the-nsa-actually-intercepted-packages-to-... 2. http://libreboot.org/faq/#intelme http://libreboot.org/faq/#intelme