4 ms·

Would love to see and ARM or MIPS setup get within shouting range of Intel. I have yet to hear any explanation of the IME that makes sense without the presence

by __jal 10y ago

Would love to see and ARM or MIPS setup get within shouting range of Intel. I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent.

timonovici 10y ago
Management of "corporate" computers. Installing Windows on hundreds of machines at once, remotely wiping stolend laptops with corporate secrets. But the cancer has spread to all computers, regardless of domain of activity.
rocqua 10y ago
> I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent. The entirety of enterprise laptop management. Not because you don't want users to change their laptop. The point is to be able to run updates for the users. Or consider the remote KVM option. Disregarding security, that is a sysadmin's wet dream. Being able to recover a system that can't boot saves a lot of boots on the ground.
- 1001101 10y ago
  Even if the CPU running Windows is bluescreened, you can still pull up a KVM remotely. Demonstrates the power that AMT possesses for good or ill.
- __jal 10y ago
  I get all that - I've worked in enterprise IT my entire career. It does not explain the 30 minute timer.
  - discreditable 10y ago
    > It does not explain the 30 minute timer. An innocent use would be: "If the ME is hung, turn it off and on again."
    - __jal 10y ago
      Sigh. If I need to spell this out: Why is the ME watchdog mandatory? What innocent explanation details why Intel has chosen to deny me the option to consider the ME a security risk in my environment and disable it?
Spooky23 10y ago
You need a PKI infrastructure to implement AMT/IME. I used it a few years ago to automatically build classroom computers for training classes. The trainer would pick a configuration, and a complete server and workstation environment would be installed. You can also do KVM from a powered down state, brick the device, or validate that management engines are present.
ajross 10y ago
Consumer ARM-based platforms in the market right now are even more locked down and spy-hook-infected than any x86 laptop. The baseband CPU on most phones is a far more capable device than the microcontrollers used for this on big core machines, and they routinely have access to all of DRAM without the possibility of interception by the application core.

by __jal 10y ago

Would love to see and ARM or MIPS setup get within shouting range of Intel. I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent.

timonovici 10y ago

Management of "corporate" computers. Installing Windows on hundreds of machines at once, remotely wiping stolend laptops with corporate secrets. But the cancer has spread to all computers, regardless of domain of activity.

rocqua 10y ago

> I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent. The entirety of enterprise laptop management. Not because you don't want users to change their laptop. The point is to be able to run updates for the users. Or consider the remote KVM option. Disregarding security, that is a sysadmin's wet dream. Being able to recover a system that can't boot saves a lot of boots on the ground.

1001101 10y ago
Even if the CPU running Windows is bluescreened, you can still pull up a KVM remotely. Demonstrates the power that AMT possesses for good or ill.
__jal 10y ago
I get all that - I've worked in enterprise IT my entire career. It does not explain the 30 minute timer.
- discreditable 10y ago
  > It does not explain the 30 minute timer. An innocent use would be: "If the ME is hung, turn it off and on again."
  - __jal 10y ago
    Sigh. If I need to spell this out: Why is the ME watchdog mandatory? What innocent explanation details why Intel has chosen to deny me the option to consider the ME a security risk in my environment and disable it?

Spooky23 10y ago

You need a PKI infrastructure to implement AMT/IME. I used it a few years ago to automatically build classroom computers for training classes. The trainer would pick a configuration, and a complete server and workstation environment would be installed. You can also do KVM from a powered down state, brick the device, or validate that management engines are present.

ajross 10y ago

Consumer ARM-based platforms in the market right now are even more locked down and spy-hook-infected than any x86 laptop. The baseband CPU on most phones is a far more capable device than the microcontrollers used for this on big core machines, and they routinely have access to all of DRAM without the possibility of interception by the application core.