7 ms·

You would think that there enough geeks out there who are aware of the issues with Intel ME to do something about. But after this time the best we have is a nas

by Tharkun 10y ago

You would think that there enough geeks out there who are aware of the issues with Intel ME to do something about. But after this time the best we have is a nasty hack that can kind of disable it. Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Why can't we (the broader tech community) sell a laptop aimed principally at ourselves. Without Intel ME. Without closed-source firmware. No binary blobs. Pardon the rant. I'll go back to being naive in silence.

eropple 10y ago
> Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Why can't we (the broader tech community) sell a laptop aimed principally at ourselves. That's a really noble aim, and "we" totally could. But it'd cost millions of dollars in setup capital, the end product would cost significantly more than its competition, and it'd be from a restricted and likely heavily performance-impacted set of components. Given those restrictions, convincing the people with the money to back it that people won't just keep using Macs or off-the-rack PCs seems like a tall order. I mean, I called it a noble effort in honesty but I probably wouldn't use one because my calculus is such that having commonly-used, high-performance stuff matters more to me right now.
- eecc 10y ago
  I don't think ME is a performance related feature
  - adrianN 10y ago
    But the alternatives without ME have worse performance.
    - eropple 10y ago
      Right, exactly. You're talking about hardware that lacks these features, which constrains part choice pretty severely. Personally? I need x86, and I need pretty-fast. That shrinks choices to near-zero.
monocasa 10y ago
https://www.crowdsupply.com/sutajio-kosagi/novena https://www.crowdsupply.com/sutajio-kosagi/novena
- jakeogh 10y ago
  Awesome project, but it maxes out at 4GB due to the 32bit CPU.
  - deleted 10y ago
    [deleted]
  - semi-extrinsic 10y ago
    Doesn't physical adress extension (PAE) circumvent this problem? Then you are just limited to 4GB per process (or thread, can't remember), but that's a lot better.
    - wolfgke 10y ago
      Physical adress extension (PAE; https://en.wikipedia.org/wiki/Physical_Address_Extension https://en.wikipedia.org/wiki/Physical_Address_Extension) is a feature of x86 CPUs, not ARM ones.
      - monocasa 10y ago
        ARMv7a has the same thing (called LPAE by ARM). http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0438d/CHDCGIBF.html http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.... That being said, the Cortex A9 in the iMX6 doesn't support that, and therefore it only supports 3840MB (4GB minus a hole for ROM and MMIO).
- Tharkun 10y ago
  Thanks, that looks interesting, even in spite of the less than ideal specs.
__jal 10y ago
I completely agree. I'm surprised by how many people who know about the ME are so blasé about it - it may have some features useful to some people, some of the time, but as a whole the IME is malware. If there were a comparable chip at twice the price, I would happily buy it.
- ams6110 10y ago
  Well -- do AMD chips have it or something like it?
  - hedora 10y ago
    I believe this is their equivalent: http://www.amd.com/en-us/innovations/software-technologies/security# http://www.amd.com/en-us/innovations/software-technologies/s... Not sure if you can turn it off, or buy a decent cpu without it.
  - timonovici 10y ago
    Of course they do - you'd think that they would just lag behind, while Intel is implementing it's malware, and selling it to corporations? It's called AMD PSP
  - pmontra 10y ago
    Both AMD and Intel fail the test. From the Libreboot FAQs > It is unlikely that any post-2008 Intel hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern Intel hardware > It is extremely unlikely that any post-2013 AMD hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern AMD hardware. One wonders what we are left with and where Libreboot will be in five years, when all the hardware it can run on will be obsolete. It seems somebody managed to disable ME on some hardware, let's hope there is more to come. However I am not hopeful that they'll be able to do it quickly for newly released processors.
  - jhasse 10y ago
    They have it. Removing it was the #1 question on the AMA on Reddit last month: https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/ https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...
userbinator 10y ago
Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Consider that there's a probably not-small team at Intel responsible for designing and implementing ME. All of them have decided, either explicitly or implicitly, to willingly follow the company plan and keep ME secret. How many of those would, if there were no negative consequence to themselves, defect and leak everything they knew about it (including the critical private keys)? As it is, a handful doing it would be sued into oblivion, but if everyone working on ME somehow decided to defect, it wouldn't be easy to stop them. Just like with those who work on designing and implementing DRM and other anti-user features, I've always wondered: do these people genuinely believe that they are an overall good and actively promote/advocate for them, or do they personally oppose, but take the job because of some other factors and decide not to stand up for themselves due to the consequences? I mean, if I were forced to work on such things, I would likely not make them so strong and maybe even introduce some weaknesses, because I am fundamentally opposed to it.
- cgb223 10y ago
  > Don't we have the numbers (and quite frankly the money) to solve this issue at the root? With the amount of people on this site who come from tech and entrepreneurial backgrounds, I bet we could fix this issue 10-fold
- unlmtd 10y ago
  Let's put together a reward for leaking the whole thing out? If impossible, then building a platform to do such a thing is the most impactful action I can think of. Is there such a thing?
- wiz21c 10y ago
  I'm sure those people see this question through a different lens than you and me. But your question is totally spot on. It'd be great if someone could shed some light on this dark spot.
- nmjohn 10y ago
  > including the critical private keys If anyone actually has access to those keys in a manner in which they could be leaked, that is... utterly terrifying. Like the private keys for root CAs, they likely are under strict access controls making exfiltration quite difficult (hopefully impossible barring multiple levels of process breakdown)
jancsika 10y ago
> But after this time the best we have is a nasty hack that can kind of disable it. That's not true. We have the Novena. And the EOMA68 laptop is currently being worked on here: https://www.crowdsupply.com/eoma68/micro-desktop https://www.crowdsupply.com/eoma68/micro-desktop Have a look at the past few months of messages on the EOMA mailing list to get a sense of the intricacies involved in shipping such a product: http://lists.phcomp.co.uk/mailman/listinfo/arm-netbook http://lists.phcomp.co.uk/mailman/listinfo/arm-netbook But even if the EOMA68 laptop ships, it must ship with the mali-400 gpu disabled to be fully free because that gpu doesn't have a fully free driver. So to answer your question about numbers, let me ask here: can anyone reverse-engineer the mali-400 and write a shader compiler for it in their spare time?
- wolfgke 10y ago
  > can anyone reverse-engineer the mali-400 and write a shader compiler for it in their spare time? I don't believe this is the hardest part (though surely not easy). In my opinion the much harder part is to do it (and be able to show that you did it) in a way that is 100% legal (i.e. strong conditions on clean room reverse engineering etc.). So for example a few years ago some PowerVR driver source code was leaked (cf. for example http://libv.livejournal.com/26972.html http://libv.livejournal.com/26972.html). Of course you are not allowed to use it to build some "open" Linux driver for PowerVR GPUs. We could easily have some PowerVR GPU driver with source code available. The only reason why this does not exist yet is that people care about legality.
  - jancsika 10y ago
    Well, when 1000+ hackers have domain expertise you typically end up with at least a handful of projects containing working code. That's even if the code itself lives in a legally grey area. (Remember the various Popcorn Time forks?) So I don't think legality is the fundamental issue. Rather, I think it's that there are probably only 2 people with the domain expertise necessary to lead a successful reverse-engineering project of this particular chip. As a general response to the grandparent: I think the reason we don't have an affordable, fully-free modern laptop is because it requires many components for which the free software world only has a handful of domain experts. In other words, such a laptop is in the category of problems for which hackers tend to vastly overestimate their potential resources. (I think secure messaging applications also fall into this same category.)

by Tharkun 10y ago

eropple 10y ago

> Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Why can't we (the broader tech community) sell a laptop aimed principally at ourselves. That's a really noble aim, and "we" totally could. But it'd cost millions of dollars in setup capital, the end product would cost significantly more than its competition, and it'd be from a restricted and likely heavily performance-impacted set of components. Given those restrictions, convincing the people with the money to back it that people won't just keep using Macs or off-the-rack PCs seems like a tall order. I mean, I called it a noble effort in honesty but I probably wouldn't use one because my calculus is such that having commonly-used, high-performance stuff matters more to me right now.

eecc 10y ago
I don't think ME is a performance related feature
- adrianN 10y ago
  But the alternatives without ME have worse performance.
  - eropple 10y ago
    Right, exactly. You're talking about hardware that lacks these features, which constrains part choice pretty severely. Personally? I need x86, and I need pretty-fast. That shrinks choices to near-zero.

monocasa 10y ago

https://www.crowdsupply.com/sutajio-kosagi/novena https://www.crowdsupply.com/sutajio-kosagi/novena

jakeogh 10y ago
Awesome project, but it maxes out at 4GB due to the 32bit CPU.
- deleted 10y ago
  [deleted]
- semi-extrinsic 10y ago
  Doesn't physical adress extension (PAE) circumvent this problem? Then you are just limited to 4GB per process (or thread, can't remember), but that's a lot better.
  - wolfgke 10y ago
    Physical adress extension (PAE; https://en.wikipedia.org/wiki/Physical_Address_Extension https://en.wikipedia.org/wiki/Physical_Address_Extension) is a feature of x86 CPUs, not ARM ones.
    - monocasa 10y ago
      ARMv7a has the same thing (called LPAE by ARM). http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0438d/CHDCGIBF.html http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.... That being said, the Cortex A9 in the iMX6 doesn't support that, and therefore it only supports 3840MB (4GB minus a hole for ROM and MMIO).
Tharkun 10y ago
Thanks, that looks interesting, even in spite of the less than ideal specs.

__jal 10y ago

I completely agree. I'm surprised by how many people who know about the ME are so blasé about it - it may have some features useful to some people, some of the time, but as a whole the IME is malware. If there were a comparable chip at twice the price, I would happily buy it.

ams6110 10y ago
Well -- do AMD chips have it or something like it?
- hedora 10y ago
  I believe this is their equivalent: http://www.amd.com/en-us/innovations/software-technologies/security# http://www.amd.com/en-us/innovations/software-technologies/s... Not sure if you can turn it off, or buy a decent cpu without it.
- timonovici 10y ago
  Of course they do - you'd think that they would just lag behind, while Intel is implementing it's malware, and selling it to corporations? It's called AMD PSP
- pmontra 10y ago
  Both AMD and Intel fail the test. From the Libreboot FAQs > It is unlikely that any post-2008 Intel hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern Intel hardware > It is extremely unlikely that any post-2013 AMD hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern AMD hardware. One wonders what we are left with and where Libreboot will be in five years, when all the hardware it can run on will be obsolete. It seems somebody managed to disable ME on some hardware, let's hope there is more to come. However I am not hopeful that they'll be able to do it quickly for newly released processors.
- jhasse 10y ago
  They have it. Removing it was the #1 question on the AMA on Reddit last month: https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/ https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...

userbinator 10y ago

Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Consider that there's a probably not-small team at Intel responsible for designing and implementing ME. All of them have decided, either explicitly or implicitly, to willingly follow the company plan and keep ME secret. How many of those would, if there were no negative consequence to themselves, defect and leak everything they knew about it (including the critical private keys)? As it is, a handful doing it would be sued into oblivion, but if everyone working on ME somehow decided to defect, it wouldn't be easy to stop them. Just like with those who work on designing and implementing DRM and other anti-user features, I've always wondered: do these people genuinely believe that they are an overall good and actively promote/advocate for them, or do they personally oppose, but take the job because of some other factors and decide not to stand up for themselves due to the consequences? I mean, if I were forced to work on such things, I would likely not make them so strong and maybe even introduce some weaknesses, because I am fundamentally opposed to it.

cgb223 10y ago
> Don't we have the numbers (and quite frankly the money) to solve this issue at the root? With the amount of people on this site who come from tech and entrepreneurial backgrounds, I bet we could fix this issue 10-fold
unlmtd 10y ago
Let's put together a reward for leaking the whole thing out? If impossible, then building a platform to do such a thing is the most impactful action I can think of. Is there such a thing?
wiz21c 10y ago
I'm sure those people see this question through a different lens than you and me. But your question is totally spot on. It'd be great if someone could shed some light on this dark spot.
nmjohn 10y ago
> including the critical private keys If anyone actually has access to those keys in a manner in which they could be leaked, that is... utterly terrifying. Like the private keys for root CAs, they likely are under strict access controls making exfiltration quite difficult (hopefully impossible barring multiple levels of process breakdown)

jancsika 10y ago

> But after this time the best we have is a nasty hack that can kind of disable it. That's not true. We have the Novena. And the EOMA68 laptop is currently being worked on here: https://www.crowdsupply.com/eoma68/micro-desktop https://www.crowdsupply.com/eoma68/micro-desktop Have a look at the past few months of messages on the EOMA mailing list to get a sense of the intricacies involved in shipping such a product: http://lists.phcomp.co.uk/mailman/listinfo/arm-netbook http://lists.phcomp.co.uk/mailman/listinfo/arm-netbook But even if the EOMA68 laptop ships, it must ship with the mali-400 gpu disabled to be fully free because that gpu doesn't have a fully free driver. So to answer your question about numbers, let me ask here: can anyone reverse-engineer the mali-400 and write a shader compiler for it in their spare time?

wolfgke 10y ago
> can anyone reverse-engineer the mali-400 and write a shader compiler for it in their spare time? I don't believe this is the hardest part (though surely not easy). In my opinion the much harder part is to do it (and be able to show that you did it) in a way that is 100% legal (i.e. strong conditions on clean room reverse engineering etc.). So for example a few years ago some PowerVR driver source code was leaked (cf. for example http://libv.livejournal.com/26972.html http://libv.livejournal.com/26972.html). Of course you are not allowed to use it to build some "open" Linux driver for PowerVR GPUs. We could easily have some PowerVR GPU driver with source code available. The only reason why this does not exist yet is that people care about legality.
- jancsika 10y ago
  Well, when 1000+ hackers have domain expertise you typically end up with at least a handful of projects containing working code. That's even if the code itself lives in a legally grey area. (Remember the various Popcorn Time forks?) So I don't think legality is the fundamental issue. Rather, I think it's that there are probably only 2 people with the domain expertise necessary to lead a successful reverse-engineering project of this particular chip. As a general response to the grandparent: I think the reason we don't have an affordable, fully-free modern laptop is because it requires many components for which the free software world only has a handful of domain experts. In other words, such a laptop is in the category of problems for which hackers tend to vastly overestimate their potential resources. (I think secure messaging applications also fall into this same category.)