5 ms·

If you want this there is no reason the software needs to be embedded in the hardware. Install a hypervisor with remote access, install the other OS in a VM and

by zrm 10y ago

If you want this there is no reason the software needs to be embedded in the hardware. Install a hypervisor with remote access, install the other OS in a VM and you have all the same capabilities through the hypervisor, but now you can inspect or improve the hypervisor and update it when it's vulnerable.

drdaeman 10y ago
The whole point of a independent hardware KVM is that it's autonomous - no matter which state the software (and unrelated hardware) is in, you can still access the system and try to recover. But, sure, I fully agree about the need of such system being an open platform that user can audit, update and control - rather than a black box. (Well, if there is a platform at all - a simplest external IP KVM could be a very dumb hardware box with the only software being an extremely primitive TCP/IP stack.) Added: Anecdote: In early 2000s, some company I know of, had quite simplest remote access tools - DIY remote reboot devices made of externally-powered Realtek network cards. Sending a WoL packet to a known MAC (on a well-isolated network) would forcibly power-cycle the connected machine or router. No amount of fancy software solutions would bring a well-hung host back online. ;)
- zrm 10y ago
  > The whole point of a independent hardware KVM is that it's autonomous Which Intel ME isn't any more than a hypervisor is. It uses the same CPU and network interface and can be misconfigured in the same ways a hypervisor can. It essentially is a hypervisor but one that you can't remove or replace. There are advantages to really independent hardware but firmware doesn't get you those, and there are advantages to management software but none of them require the software to be burned into the silicon. I agree that the feature set can be useful, it just doesn't belong where they put it (and in that sense we may only be arguing past each other).
  - Tiksi 10y ago
    There's no hypervisor that'll let you power up a halted server, change bios settings, change boot device or order, boot the system of pxe, etc, etc. It's not the same thing at all, and almost every server made in the last decade has a BMC that gives you all the remote access features anyways, so getting IME isn't much of a change there.
    - zrm 10y ago
      > There's no hypervisor that'll let you power up a halted server, change bios settings, change boot device or order, boot the system of pxe, etc, etc. Wake on LAN is a 20th century technology that requires no other privileges to implement and can be access controlled via managed switches. Pretty much every hypervisor will allow you to turn on a VM, change its boot device order or boot PXE and can change BIOS/firmware settings on any platform with an API to do that.
      - Tiksi 10y ago
        Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways.
        zrm 10y ago
        > Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. That's the point. If all you need is the ability to power on the machine, why are you exposing any more than that to the network? > Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways. And the party in control of that is Intel, so they could provide that API instead of IME.
        Tiksi 10y ago
        Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Automatic hardware provisioning fully depends on BMCs. Intel is the party in control, and Dell, and Supermicro, and HP, and.... IPMI is the API you're looking for, you can always just shut off the networking. But again, it's still done through the BMC. SOMETHING has to do it, and that something needs access independent of the OS and the rest of the system due to the nature of the settings you can change. Also how is IME any different than providing an API? The api has to actually do something, how exactly do you propose to do that without something like IME?

by zrm 10y ago

drdaeman 10y ago

The whole point of a independent hardware KVM is that it's autonomous - no matter which state the software (and unrelated hardware) is in, you can still access the system and try to recover. But, sure, I fully agree about the need of such system being an open platform that user can audit, update and control - rather than a black box. (Well, if there is a platform at all - a simplest external IP KVM could be a very dumb hardware box with the only software being an extremely primitive TCP/IP stack.) Added: Anecdote: In early 2000s, some company I know of, had quite simplest remote access tools - DIY remote reboot devices made of externally-powered Realtek network cards. Sending a WoL packet to a known MAC (on a well-isolated network) would forcibly power-cycle the connected machine or router. No amount of fancy software solutions would bring a well-hung host back online. ;)

zrm 10y ago
> The whole point of a independent hardware KVM is that it's autonomous Which Intel ME isn't any more than a hypervisor is. It uses the same CPU and network interface and can be misconfigured in the same ways a hypervisor can. It essentially is a hypervisor but one that you can't remove or replace. There are advantages to really independent hardware but firmware doesn't get you those, and there are advantages to management software but none of them require the software to be burned into the silicon. I agree that the feature set can be useful, it just doesn't belong where they put it (and in that sense we may only be arguing past each other).
- Tiksi 10y ago
  There's no hypervisor that'll let you power up a halted server, change bios settings, change boot device or order, boot the system of pxe, etc, etc. It's not the same thing at all, and almost every server made in the last decade has a BMC that gives you all the remote access features anyways, so getting IME isn't much of a change there.
  - zrm 10y ago
    > There's no hypervisor that'll let you power up a halted server, change bios settings, change boot device or order, boot the system of pxe, etc, etc. Wake on LAN is a 20th century technology that requires no other privileges to implement and can be access controlled via managed switches. Pretty much every hypervisor will allow you to turn on a VM, change its boot device order or boot PXE and can change BIOS/firmware settings on any platform with an API to do that.
    - Tiksi 10y ago
      Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways.
      - zrm 10y ago
        > Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. That's the point. If all you need is the ability to power on the machine, why are you exposing any more than that to the network? > Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways. And the party in control of that is Intel, so they could provide that API instead of IME.
        Tiksi 10y ago
        Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Automatic hardware provisioning fully depends on BMCs. Intel is the party in control, and Dell, and Supermicro, and HP, and.... IPMI is the API you're looking for, you can always just shut off the networking. But again, it's still done through the BMC. SOMETHING has to do it, and that something needs access independent of the OS and the rest of the system due to the nature of the settings you can change. Also how is IME any different than providing an API? The api has to actually do something, how exactly do you propose to do that without something like IME?