7 ms·

If I read that right, they're allowing Intel ME, which sounds like a sad compromise to me. Given that it's a pretty big complex black box that one can't easily

by d33 9y ago

If I read that right, they're allowing Intel ME, which sounds like a sad compromise to me. Given that it's a pretty big complex black box that one can't easily disable, would you agree that x86 is doomed when it comes to security? If that's the case, is there any hope we could have a CPU with competitive capabilities? (For example, is there an i7 alternative for ARM?) What could one do to make it possible to have ME-less x86 in the future?

vbezhenar 9y ago
When you're running megabytes of proprietary code on numerous processors in your laptop completely out of your control, why do you focusing on Intel ME? What about your network card which runs dedicated processor with some kind of operating system, executing firmware and processing every network frame before your OS receives it, for example?
- _jal 9y ago
  There are use cases where pulling the network card leaves a viable system. I'm unaware of a use case where pulling the CPU leaves one. Also, the ME appears to be a nice one-stop-shop for compromise. It is the janitor's entrance; it is right there in the name.
- majewsky 9y ago
  When the network card tampers with the packets, this can be detected if the network protocols use the correct cryptographic algorithms to ensure integrity and confidentiality. Protecting against tampering on the CPU level is much harder, since this is where these algorithms are carried out.
  - problems 9y ago
    If you think you're going to catch every possible NIC-level modification, does tampering on the CPU really matter if there's no way to store or exfiltrate the data without being detected?
- hinkley 9y ago
  I keep hoping we'll get a decent consumer grade interconnect fabric and just run half a dozen standard SoCs for all of the peripherals.
adrianN 9y ago
You can't buy a processor with comparable performance to a modern Intel without some kind of scary management engine. AMD has them too and Arm doesn't compete on performance.
- horusthecat 9y ago
  When you say "performance" do you mean at or below the price point? POWER is open but seriously expensive.
  - girvo 9y ago
    Yeah the POWER8 server I'm playing with is definitely competitive performance wise with Xeon, but I didn't have to pay for it, heh.
  - adrianN 9y ago
    Oh that's true, I forgot about those. But do they fit in a laptop?
    - xoa 9y ago
      For certain values of "laptop" probably (or "notebook" might be better since I don't know if I'd want to put one on my lap), but I don't think the tradeoffs would be generally worth it right now. As a spec sheet eyeball check, I know there are ultra high performance gaming notebooks that do ridiculous stuff, like Acer makes one IIRC with SLI 1080s and an i7 that is rated to pull up to 330W from the wall, and of course it weighs something like 8-8.5 kg (18-19 lbs). There seem to be ones that "merely" use a single 100-150W desktop class GPU and processor that are more like in the 5.5 kg/12 lbs range, but that's still no fairy (a 15" Macbook Pro for contrast is about 1.8 kg/4 lbs, and even in the mid-90s the big old PowerBooks maxed out around 3.2 kg/7 lbs IIRC) and obviously we're generally going to be talking just a few hours of battery life at best away from mains. But at any rate it's not unfeasible or unknown right now to deal with 100-200W worth of TDP in big 17" (or even 21"(!!!)) notebooks, and there does seem to be a functional (albeit niche) market for it. So at that range it'd be feasible in principle to stick in a low end POWER8 and smallish but functional GPU and have a "notebook POWER8 system", but it'd be a compromised machine in terms of what we'd normally find desirable in a mobile system. POWER9 (which I think is still slated to go online in the Summit & Sierra supercomputers this year?) is supposed to have improved energy efficiency and management features, which though aimed at scaleup/scaleout of course might help out a bit in other settings in theory. But even so it'd be a tougher chip to build in an SFF system around let alone a notebook. Any potential buyers would have to care a very great deal about what it brought to the table.
cmiles74 9y ago
It seems to me that there's not much hope for an ME-less x86 compatible machine in the near future. Intel is pretty invested in the product and AMD has introduced a similar solution for their systems. Another architecture all together, designed from the ground up to support a free and secure system, seems a better bet.
lmm 9y ago
There are open processor designs, e.g. many SPARC designs are published. You could run a reasonable webserver or what have you on those. But only the mega-corps chipmakers are going to be competitive with the current state of the art, and the mega-corp chipmakers are going to include ME or equivalent because their mega-corp clients want it. More generally if the processor's going to have any dynamic internal logic then that has to run somewhere. Frequency scaling, wake-on-lan, microcode updates... you probably do want an ME-style embedded management processor that runs the processor's firmware just as you would for any other peripheral (hard drives, wifi controllers and so on all contain their own embedded ARM cores these days). ME itself isn't the issue - having what runs there be open and inspectable is.
mtgx 9y ago
> is there an i7 alternative for ARM Qualcomm will first minimize its risk going into the PC market by making its mobile chips a bit more optimized for the PC market. But if that goes well and all, it may eventually go "upmarket" with higher-end chips, which will require their own R&D and so on. However, I don't know if that necessarily means we'll have a more open alternative to Intel. Evidence so far seems to show that Qualcomm may be an even bigger bully than Intel was or is, so I would not look up to Qualcomm to being a savior for the market, but more like the tyrant that replaces the previous tyrant.
mozartoz 9y ago
The best option right now is to use Rockchip ARM devices. With a few little compromises you can run a pretty much free architecture: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html
zer0tonin 9y ago
I think the whole point of Qubes OS is t not trust hardware because of potential BIOS or ME backdoors. Joanna Rutkowska, Qubes founder, is the person who brought up intel ME as a problem in her paper Intel x86 considered harmful (https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf).
- adrianN 9y ago
  You can't run trusted software on untrusted hardware. If someone has a backdoor in your ME, you can't protect yourself from it.
  - falcolas 9y ago
    I'm curious: if we can solve the "trusting trust" problem - that is identifying compromised compilers, even if the other compiler is compromised - couldn't we potentially solve this problem in a similar way?
    - jancsika 9y ago
      Ignoring for the moment all the indeterminism on a running laptop, the main reason is that we don't have the tooling to do that. For example: compiler is to software as X is to hardware. What is X? And how does one go about creating their own X?
      - BenjiWiebe 9y ago
        If X is "foundry" you probably can't create your own. And I think it is.
      - falcolas 9y ago
        Ultimately a compiler is just a bit of software; one that takes inputs and produces outputs. The identification of compromise is the difference in outputs for the same inputs (simplified, of course). So, given we can control most inputs to hardware, and most outputs, it seems possible to objectively identify when the HW is misbehaving (such as "A" produces network output that "B" does not). It wouldn't nail down which piece of hardware was compromised, but it would help identify that hardware is compromised. It will never be _that_ easy, of course... but it seems possible.
x86insecure 9y ago
You could contact AMD and show support for open sourcing PSP (their ME equivalent) or having an option to disable it. There is hope: https://www.reddit.com/r/linux/comments/5xvn4i/update_corebootlibreboot_on_amd_has_ceo_level/ https://www.reddit.com/r/linux/comments/5xvn4i/update_corebo...
cyphar 9y ago
OpenPOWER[1] would be a great option. There was a recent crowd-funding effort to try to make an OpenPOWER desktop a reality[2] but unfortunately it didn't get nearly enough funding (though apparently they are still developing it[3]). [1]: https://openpowerfoundation.org/ https://openpowerfoundation.org/ [2]: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation https://www.crowdsupply.com/raptor-computing-systems/talos-s... [3]: https://www.raptorengineering.com/TALOS/prerelease.php https://www.raptorengineering.com/TALOS/prerelease.php
- krylon 9y ago
  That would have been a cool machine, but unfortunately, the price was way outside my budget. If such a machine with reasonable specs (I do not expect a 64-core 256-GB-RAM-monster) could be brought down to the 1000 $/€ price range, I would seriously look into it. (I am not sure how realistic that price range is, though.) What about Loongson? IIRC, Richard Stallmann uses a Notebook based on it, because it has free firmware. Performance is probably not breathtaking, but it exists. Does somebody know if there are Desktop machines built around that chip?
  - djsumdog 9y ago
    I have to agree. The Talon looked amazing, but the crowdfunding price was way out there. They should have offered a bare version with just the board, ram and maybe video card (to ensure comparability). They needed the ~$1k USD hobbyist market. It seems like the goals were way too high, like the Ubuntu Edge.
    - wmf 9y ago
      They should have offered a bare version with just the board... They did offer that, but the board alone was $3,700.
fghtr 9y ago
>What could one do to make it possible to have ME-less x86 in the future? One could lock all the devices that can store data: https://blog.invisiblethings.org/papers/2015/state_harmful.pdf https://blog.invisiblethings.org/papers/2015/state_harmful.p... "The general idea is to remove the SPI flash chip from the motherboard, and route the wiring to one of the external ports, such as either a standard SD or a USB port, or perhaps even to a custom connector. A Trusted Stick (discussed in the next chapter) would be then plugged into this port before the platform boots, and would be delivering all the required firmware requested by the processor, as well as other firmware and, optionally, all the software for the platform."

by d33 9y ago

vbezhenar 9y ago

When you're running megabytes of proprietary code on numerous processors in your laptop completely out of your control, why do you focusing on Intel ME? What about your network card which runs dedicated processor with some kind of operating system, executing firmware and processing every network frame before your OS receives it, for example?

_jal 9y ago
There are use cases where pulling the network card leaves a viable system. I'm unaware of a use case where pulling the CPU leaves one. Also, the ME appears to be a nice one-stop-shop for compromise. It is the janitor's entrance; it is right there in the name.
majewsky 9y ago
When the network card tampers with the packets, this can be detected if the network protocols use the correct cryptographic algorithms to ensure integrity and confidentiality. Protecting against tampering on the CPU level is much harder, since this is where these algorithms are carried out.
- problems 9y ago
  If you think you're going to catch every possible NIC-level modification, does tampering on the CPU really matter if there's no way to store or exfiltrate the data without being detected?
hinkley 9y ago
I keep hoping we'll get a decent consumer grade interconnect fabric and just run half a dozen standard SoCs for all of the peripherals.

adrianN 9y ago

You can't buy a processor with comparable performance to a modern Intel without some kind of scary management engine. AMD has them too and Arm doesn't compete on performance.

horusthecat 9y ago
When you say "performance" do you mean at or below the price point? POWER is open but seriously expensive.
- girvo 9y ago
  Yeah the POWER8 server I'm playing with is definitely competitive performance wise with Xeon, but I didn't have to pay for it, heh.
- adrianN 9y ago
  Oh that's true, I forgot about those. But do they fit in a laptop?
  - xoa 9y ago
    For certain values of "laptop" probably (or "notebook" might be better since I don't know if I'd want to put one on my lap), but I don't think the tradeoffs would be generally worth it right now. As a spec sheet eyeball check, I know there are ultra high performance gaming notebooks that do ridiculous stuff, like Acer makes one IIRC with SLI 1080s and an i7 that is rated to pull up to 330W from the wall, and of course it weighs something like 8-8.5 kg (18-19 lbs). There seem to be ones that "merely" use a single 100-150W desktop class GPU and processor that are more like in the 5.5 kg/12 lbs range, but that's still no fairy (a 15" Macbook Pro for contrast is about 1.8 kg/4 lbs, and even in the mid-90s the big old PowerBooks maxed out around 3.2 kg/7 lbs IIRC) and obviously we're generally going to be talking just a few hours of battery life at best away from mains. But at any rate it's not unfeasible or unknown right now to deal with 100-200W worth of TDP in big 17" (or even 21"(!!!)) notebooks, and there does seem to be a functional (albeit niche) market for it. So at that range it'd be feasible in principle to stick in a low end POWER8 and smallish but functional GPU and have a "notebook POWER8 system", but it'd be a compromised machine in terms of what we'd normally find desirable in a mobile system. POWER9 (which I think is still slated to go online in the Summit & Sierra supercomputers this year?) is supposed to have improved energy efficiency and management features, which though aimed at scaleup/scaleout of course might help out a bit in other settings in theory. But even so it'd be a tougher chip to build in an SFF system around let alone a notebook. Any potential buyers would have to care a very great deal about what it brought to the table.

cmiles74 9y ago

It seems to me that there's not much hope for an ME-less x86 compatible machine in the near future. Intel is pretty invested in the product and AMD has introduced a similar solution for their systems. Another architecture all together, designed from the ground up to support a free and secure system, seems a better bet.

lmm 9y ago

There are open processor designs, e.g. many SPARC designs are published. You could run a reasonable webserver or what have you on those. But only the mega-corps chipmakers are going to be competitive with the current state of the art, and the mega-corp chipmakers are going to include ME or equivalent because their mega-corp clients want it. More generally if the processor's going to have any dynamic internal logic then that has to run somewhere. Frequency scaling, wake-on-lan, microcode updates... you probably do want an ME-style embedded management processor that runs the processor's firmware just as you would for any other peripheral (hard drives, wifi controllers and so on all contain their own embedded ARM cores these days). ME itself isn't the issue - having what runs there be open and inspectable is.

mtgx 9y ago

> is there an i7 alternative for ARM Qualcomm will first minimize its risk going into the PC market by making its mobile chips a bit more optimized for the PC market. But if that goes well and all, it may eventually go "upmarket" with higher-end chips, which will require their own R&D and so on. However, I don't know if that necessarily means we'll have a more open alternative to Intel. Evidence so far seems to show that Qualcomm may be an even bigger bully than Intel was or is, so I would not look up to Qualcomm to being a savior for the market, but more like the tyrant that replaces the previous tyrant.

mozartoz 9y ago

The best option right now is to use Rockchip ARM devices. With a few little compromises you can run a pretty much free architecture: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html

zer0tonin 9y ago

I think the whole point of Qubes OS is t not trust hardware because of potential BIOS or ME backdoors. Joanna Rutkowska, Qubes founder, is the person who brought up intel ME as a problem in her paper Intel x86 considered harmful (https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf).

adrianN 9y ago
You can't run trusted software on untrusted hardware. If someone has a backdoor in your ME, you can't protect yourself from it.
- falcolas 9y ago
  I'm curious: if we can solve the "trusting trust" problem - that is identifying compromised compilers, even if the other compiler is compromised - couldn't we potentially solve this problem in a similar way?
  - jancsika 9y ago
    Ignoring for the moment all the indeterminism on a running laptop, the main reason is that we don't have the tooling to do that. For example: compiler is to software as X is to hardware. What is X? And how does one go about creating their own X?
    - BenjiWiebe 9y ago
      If X is "foundry" you probably can't create your own. And I think it is.
    - falcolas 9y ago
      Ultimately a compiler is just a bit of software; one that takes inputs and produces outputs. The identification of compromise is the difference in outputs for the same inputs (simplified, of course). So, given we can control most inputs to hardware, and most outputs, it seems possible to objectively identify when the HW is misbehaving (such as "A" produces network output that "B" does not). It wouldn't nail down which piece of hardware was compromised, but it would help identify that hardware is compromised. It will never be _that_ easy, of course... but it seems possible.

x86insecure 9y ago

You could contact AMD and show support for open sourcing PSP (their ME equivalent) or having an option to disable it. There is hope: https://www.reddit.com/r/linux/comments/5xvn4i/update_corebootlibreboot_on_amd_has_ceo_level/ https://www.reddit.com/r/linux/comments/5xvn4i/update_corebo...

cyphar 9y ago

OpenPOWER[1] would be a great option. There was a recent crowd-funding effort to try to make an OpenPOWER desktop a reality[2] but unfortunately it didn't get nearly enough funding (though apparently they are still developing it[3]). [1]: https://openpowerfoundation.org/ https://openpowerfoundation.org/ [2]: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation https://www.crowdsupply.com/raptor-computing-systems/talos-s... [3]: https://www.raptorengineering.com/TALOS/prerelease.php https://www.raptorengineering.com/TALOS/prerelease.php

krylon 9y ago
That would have been a cool machine, but unfortunately, the price was way outside my budget. If such a machine with reasonable specs (I do not expect a 64-core 256-GB-RAM-monster) could be brought down to the 1000 $/€ price range, I would seriously look into it. (I am not sure how realistic that price range is, though.) What about Loongson? IIRC, Richard Stallmann uses a Notebook based on it, because it has free firmware. Performance is probably not breathtaking, but it exists. Does somebody know if there are Desktop machines built around that chip?
- djsumdog 9y ago
  I have to agree. The Talon looked amazing, but the crowdfunding price was way out there. They should have offered a bare version with just the board, ram and maybe video card (to ensure comparability). They needed the ~$1k USD hobbyist market. It seems like the goals were way too high, like the Ubuntu Edge.
  - wmf 9y ago
    They should have offered a bare version with just the board... They did offer that, but the board alone was $3,700.

fghtr 9y ago

>What could one do to make it possible to have ME-less x86 in the future? One could lock all the devices that can store data: https://blog.invisiblethings.org/papers/2015/state_harmful.pdf https://blog.invisiblethings.org/papers/2015/state_harmful.p... "The general idea is to remove the SPI flash chip from the motherboard, and route the wiring to one of the external ports, such as either a standard SD or a USB port, or perhaps even to a custom connector. A Trusted Stick (discussed in the next chapter) would be then plugged into this port before the platform boots, and would be delivering all the required firmware requested by the processor, as well as other firmware and, optionally, all the software for the platform."