20 ms·
Disabling Intel ME 11 via undocumented mode
- eganist 9y agoRather than assume anything nefarious on the part of the USG, I'm willing to bet a buck that someone in the USG asked the right questions during contract negotiation, which is why this kill switch was added but not publicized to anyone outside participants in the HAP Program.
- dane-pgp 9y agoBut maybe that contract negotiation also included a rhetorical question like "And you won't offer this option to other governments, will you?".
- codedokode 9y agoIf ME is not a backdoor then why doesn't Intel allow to disable it? Why don't they publish detailed descriptions? Why don't they allow user to run their programs on ME CPU?
- valarauca1 9y agoIf ME isn't a backdoor why did Russia and China start efforts to surplant Intel with locally sourced processors (even before US embargo'd Intel from china)
- baybal2 9y ago>even before US embargo'd Intel from china You can see how well this embargo works in every electronics mall
- valarauca1 9y agoIt isn't a blanket sanction, just against government and computing centers. The last 3 chinese super computers have used home grown FeiTeng RISC processors which were binary compatible to Itanium, but for new models their using OpenSPARC.
- equalunique 9y agoI wish there were OpenSPARC super computers in the US...
- monocasa 9y agoEhh, SPARC was a great architecture for ancient process nodes, but doesn't really line up with today's needs IMO.
- Triesault 9y agoWhere is the suggestion that Intel ME isn't a backdoor? The article states: > In this article, we describe how we discovered this undocumented mode and how it is connected with the U.S. government's High Assurance Platform (HAP) program. > Googling did not take long. The second search result said that the name belongs to a trusted platform program linked to the U.S. National Security Agency (NSA). >We believe that this mechanism is designed to meet a typical requirement of government agencies, which want to reduce the possibility of side-channel leaks. But the main question remains: how does HAP affect Boot Guard? Due to the closed nature of this technology, it is not possible to answer this question yet, but we hope to do so soon.
- kogepathic 9y ago> We believe that this mechanism is designed to meet a typical requirement of government agencies, which want to reduce the possibility of side-channel leaks. Interesting that Intel will provide this to the US government for enough money, but wouldn't offer it as an additional $50 or $100 option for end-customers to disable the ME. I think there are probably enough privacy conscious people who would be willing to buy a Skylake or newer platform from Intel if they could easily disable the non-BUP components of the ME for a reasonable fee.
- dingo_bat 9y ago$50 or $100 for turning off the spyware in my own CPU is hardly reasonable.
- daxorid 9y agoSure it's unreasonable, but at least charging for it would be better, and make more business sense, than the current "Fuck You, Plebe" they offer to us prisoners of the FVEY panopticon.
- onli 9y agoYou are seeing this wrong. Intel has two reasons to have ME: 1. It is useful in business settings 2. It enables the US spy agencies complete surveillance of all PCs It's the second point that explains why they can't make it optional. And that makes business sense. That way they ensure backing from the NSA, instead of having to fight against them.
- kiallmacinnes 9y agoEvery supported configuration paramater adds to the cost of supporting the platform, so, I totally get reducing the surface of supported parameters and charging whoever really needs this[1] through the nose for a custom support plan... [1]: I'm not suggesting most, if not all, people don't need the ability to disable Intel ME, only that, they more often than not don't value it enough to pay for it..
- dmitrygr 9y agoThe interesting question here is: why undocumented. It was created on request, but nobody was told. Who pushed so hard ME to be on for everything but them? And why? We know the answer :)
- lima 9y agoAs soon as it's documented, you have to support it.
- tux3 9y agoNot wanting to support it is a strange argument for not documenting it. I am not surprised that they're not documenting it, but not for this reason. Their client — the Unites States Government — demanded this feature be made specifically for their internal use, so I would hope it is a pretty well supported configuration already. Furthermore as it only seems to be disabling features rather than enabling new ones, there should be little support needed in the first place. Anyone with the knowledge and equipment to go enable the HAP bit is unlikely to need any more support than the documentation itself.
- ajross 9y ago> Not wanting to support it is a strange argument for not documenting it. Seriously, no. That happens all the time in all kinds of software environments. Someone adds a crazy hack in a product with an API. Do you add it to the API, even though bits of it may leak visibly into the stuff seen by the customer? Hell no. That's what happened here.
- codezero 9y agoIntel's response to the authors kind of explains it: they added this feature hastily to meet specific requirements of the HAP program and didn't fully validate it – so it's not supported.
- dmitrygr 9y agoYou missed the point. It was added for people with big money. I promise you - it is supported. Just not for you. You need to be backdoorable. They don't
- discreditable 9y agoTL;DR: Intel put a special High Assurance Platform (HAP) mode in ME for the US government. If toggled on, it disables all non-critical ME functionality. Questioned, Intel responded: > In response to requests from customers with specialized requirements we sometimes explore the modification or disabling of certain features. In this case, the modifications were made at the request of equipment manufacturers in support of their customer’s evaluation of the US government’s “High Assurance Platform” program. These modifications underwent a limited validation cycle and are not an officially supported configuration.
- deleted 9y ago[deleted]
- trhway 9y agobasically govt finally learned about ME (like VNC built into CPU) and said "what?! are you kidding!?" and on second breath - "keep it on for everybody else though!"
- matt_wulfeck 9y agoIt's really not just the US government. I'm sure there are many other countries who demand such a feature.
- h1b2 9y agoI don't think so. Most of other governments(especially developing nations) don't have a clue about this, or they refuse to accept such concerns, calling it conspiracy theories, as if they have some secret pact to allow US govt. surveillance of their citizens via unofficially if not officially.
- mjg59 9y agoME isn't like VNC built into the CPU - that's AMT. AMT is restricted to higher-end Intel platforms, but ME is everywhere.
- 9y ago
- arkainW123 9y agoI really can't grasp the "undocumented mode" term. I believe It was created on request.
- dfox 9y agoThat is pretty much standard term for processor features that are not supported by Intel. The main selling point of the whole Intel's x86 platform is that when something is supported and documented it will either behave the same way on newewr processors or newer processors would include some mechanism to emulate the old behavior. Intel tends to go especially overboard with this approach and even support feature combinations that are not useful in any way. Recent example is that original AMD's x86_64 CPUs did not support certain descriptor formats in long mode and didn't support x87 FPU ISA for 64b code. Intel's EMT64 supports both of these things. Usefulnes of first is somewhat questionable as only real user of that is dosemu, another would be if somebody would want to modify some Concurrent DOS/FlexOS derived OS to be 64b aware (there actually might be some small bussiness case for doing so). Microsoft solved this by droping support for 16b and DOS applications in 64b builds. And for the second limitation it is pretty obvious that there cannot be any code that would be broken by that. Older examples are the whole A20M# business and then there is LOADALL, which was never officially documented, has three diferrent encodings and behaviors depending on CPU generation but got used by Microsoft and thus the 386 encoding and behavior is somewhat semi-documented and semi-supported even 30 years later.
- ajross 9y agoJust to clarify: the A20 stuff was an IBM PC/AT feature in the chipset of the original machine, not a CPU thing. It was actually a response to an Intel mistake in backward compatibility between the 8086 and 286 (real mode segments that pointed "beyond" the first 1MB would wrap around on the original processor but hit the second megabyte on the 286). But when the memory mapping went on-chip in later devices, it needed to be part of the CPU core for compatibility with software written to work on the AT.
- dfox 9y ago
- throw2016 9y agoThe more details leak about ME the more shocking it becomes. Why is this accepted in any free democratic society? There can be discussions, there can be debates but in everyday life this is already accepted. And even if one does not want to accept it what are the choices given similar technology is now integrated in other processors? If we accept that computers are essential to operate in modern society then this is akin to a company taking control of the water supply with the ability to stop supply and do other unknown actions with zero accountability. If you expand this thought this is a kind of fascism. We could be left with a shell of freedom and democracy while the government in partnership with corporates take deeper control of day to day life.
- baq 9y agointel gets asked for features, intel develops them, intel gets paid. you can be sure that intel wouldn't develop ME for free. follow the money.
- jjawssd 9y agoHas it ever occurred to you that just perhaps - we do NOT live in a free democratic society? The USA has a whole caste of untouchables - and I don't mean the ostracised. Just look at how surprised they were that Trump got elected. In a "free democratic society" this would have been a "so what?" moment.
- zanny 9y agoThis is just a footnote in the decades long trend away from ownership and the right to repair towards control and magic. Up until the 80s, anything you bought would, reasonably, provide schematics, diagnostic info, and at worst on request details on the original designs or how substitute parts would work in almost any mechanical system, including TVs. Phones were extraordinarily unique at the time in how proprietary they were, in that Bell Labs had a government monopoly until that decade that gave them carte blanche to not care about consumer satisfaction and let them extort people en masse both for money and never giving an inch of control in the PSTN. Then computers happened, and they were sufficiently magical for a sufficient number of people to tip all of our society away from the autonomy to own things and know how they work towards having magical black boxes that seem to do what you want them to. The Intel ME is just one aspect of this. Of how government will seize the opportunity to take advantage of the willful and tolerated ignorance of the people as a tool to spy on whomever they want. This trend is also not even close to reversing. Cars made in the 90s were still fairly open, but introduced OBD computer systems that were proprietary black boxes of diagnostic info. Now, every new car is entirely computer driven, and that computer controls the whole vehicles operation in undocumented and proprietary ways. Talk to any garage that isn't a brand dealer - the newer the car, the less they can actually do to fix it. This is applying to everything now. New tvs are now completely irreparable. Cell phones are holistically compromised and proprietary. New appliances all have proprietary computers in them. Your new house is built with proprietary computers that control the climate, the power, everything. If something breaks? You have to send it to the manufacturer I guess because you aren't allowed to know how it works or how to fix it anymore. Its "too complicated", is the excuse. Its the same excuse why the FCC is trying to cripple open source firmware on routers, or why ham radio and broadcast television are being sabotaged at every level of government. People gave up trying to understand computers, to be able to treat them like any other machine they use - and break - in knowing how to fix them. And so governments and companies took full advantage of that yielding of knowledge and authority and now hold it over all of us as a tool of subjugation and exploitation.
- DarkKomunalec 9y agoImagine if some non-US government voided Intel and AMD's patents as a self-defence measure against these probably-backdoored 'features'. Why should they protect the profits of hostile corporations?
- pg_is_a_butt 9y agobecause they are paid to protect those profits with those profits, and you sheep are too feeble to do anything about it. you're all idiots.
- codedokode 9y agoVoiding patents probably doesn't change anything because patents usually contain just vague description.
- DarkKomunalec 9y agoYou underestimate how much patents are used to impede competition - see https://arstechnica.com/information-technology/2017/06/intel-fires-warning-shots-at-microsoft-claims-x86-emulation-is-a-patent-minefield/ https://arstechnica.com/information-technology/2017/06/intel... , and the many less public patent licenses and threats.
- rubatuga 9y agoSo if i understand correctly, the way to disable intel me is to simply flip a bit? Using a software tool?
- totony 9y agoThw article also mentions removing some non critical binaries and modifying the ME filesystem
- eganist 9y agoMy understanding is this step isn't really a necessity but rather was done to prove that ME could be disabled at an extremely low level since the missing binaries would no longer trigger what's effectively a failure condition. Could be wrong. Probably safer to just set the killbit rather than also tamper with ME directly is ultimately my point. That's my risk aversion at work.
- rubatuga 9y agoI'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. It's literally an option in an intel software tool, and yet you have people who have vehemently complained about Intel ME for the past few years. I have some serious cognitive dissonance going on right now.
- dmm 9y agoThe latest version of ME, 11, uses a x86 processor. That's why the researchers were able to perform this analysis and find the bit to flip. It also doesn't disable ME, just most of it.
- rubatuga 9y agoI see, it appears ME 11 was introduced in September 2015, which means this discovery came about in less than two years.
- dabockster 9y agoDoes AMD have anything like Intel ME on their chipsets? I recently completed a Ryzen build and am curious.
- deleted 9y ago[deleted]
- v4n4d1s 9y agoSearch for "AMD PSP".
- wolfgke 9y ago> Search for "AMD PSP". To quote https://news.ycombinator.com/item?id=14803645 https://news.ycombinator.com/item?id=14803645 "AMD seems not to use the brand name "AMD PSP" anymore. Instead some years ago they began to use the name "AMD Secure Processor". Nevertheless it is just the same: Read the small footnote at http://www.amd.com/en-gb/innovations/software-technologies/security http://www.amd.com/en-gb/innovations/software-technologies/s... which begins with 'AMD Secure Processor (formerly “Platform Security Processor” or “PSP”)'."
- v4n4d1s 9y agoThank you
- eightysixfour 9y agoYes, the AMD Platform Security Professor. The CEO said in a Reddit AMA they would look into open sourcing it.
- 1001101 9y agoThey aren't going to: https://news.ycombinator.com/item?id=14803373 https://news.ycombinator.com/item?id=14803373
- 9y ago
- arca_vorago 9y agoThis is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) were infiltrating even low level chip manufacturers. Danny Casalaro's death was likely a required nastyness to keep it covered up.
- nickpsecurity 9y agoThey added it for business reasons for remote monitoring and control since enterprises like it. That's a large part of their sales. It also had consumer benefits. Related tech also helped DRM machines through Trusted Computing alliance. And they probably got defense contracts or payments for selective use by NSA or other organizations. Lots of return on that investment. Lots of reasons unrelated to those you mention.
- ar-jan 9y agoThen why refuse the possibility to disable it?
- arca_vorago 9y ago>remote monitoring and control There are opensource ways to do out of band management without it. >consumer benefits. Related tech also helped DRM machines through Trusted Computing alliance. Nobody I knew who was knowledgeable wanted that shit in the first place. It was always edging away consumer control of the platform. DRM is part of the problem here! Same thing with web standards. What annoys me the most about this is the audacity of calling it "consumer benefits". >probably got defense contracts or payments for selective use by NSA or other organizations Fine, but that's not a good enough reason to backdoor literally everything for everyone else. (reminds me of systemd and redhat actually)
- forapurpose 9y ago
- captainmuon 9y agoThis is something I always have been wondering about. I can't imagine the US government is happy having the ME in every computer, with a closed source operating system running that has complete access to CPU, memory and network. If anybody can call Intel and ask for a custom version without this stuff, it is the government. And it looks like they did. (If any important Silicon Valley CEO reads this, why don't you give Intel a call, as an important customer, and ask why 1) you can't disable the ME and 2) for a written guarantee that there is no backdoor in the ME?) Something else: does anybody know if the trick mentioned in the article has negative side effects? Does power management still work? Can we be sure that this doesn't activate a backdoor to begin with, and the computer tries to connect to an NSA domain :-) ?
- etatoby 9y agoConsidering that they left the HAP flag in the open and even commented it in an XML file; considering how it does not disable all of ME, but only certain bits; and contrasting it with the otherwise inscrutable, encrypted, and tamper-proof nature of ME, it's hard not to see it as a honeypot or bait.
- codedokode 9y agoIntel's management and QA probably looked only at UI where the flag is marked as "Reserved".
- ryanlol 9y agoHere's the me_cleaner dev branch which supports setting the HAP bit to disable ME. https://github.com/corna/me_cleaner/tree/dev https://github.com/corna/me_cleaner/tree/dev
- codedokode 9y agoI wonder if Apple is ok with this. They usually don't like someone's else software running on their machines, especially on such a low level. They will probably negotiate a kill switch for them too.
- CamperBob2 9y agoThey'll build their own, presumably. The decision they made almost 10 years ago to bring the PA Semi designers in-house is looking better every day. The iOS devices don't use Intel chips and the Macs don't really need to.
- mjg59 9y agoThey've been shipping hardware with an ME for a decade, so they can't be too upset.
- AsyncAwait 9y ago> I wonder if Apple is ok with this. They usually don't like someone's else software running on their machines. I think that it's true that they want to have as much control over the experience as possible, but that is more from a perspective of being able to control the (visible parts of) user experience. I'd be pretty surprised if they didn't already knew/had an idea of what was going on with the ME and that there must be some way to disable it, but MacBooks don't receive the amount of attention required for them to care about this low-level detail, which 'doesn't affect' regular customers anyway.
- danjoc 9y ago>I wonder if Apple is ok with this. https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... Oct 2012. Never forget.
- glasz 9y agoi've heard the ME is not enabled in macs. for technical/architectural reasons. somebody please enlighten me if that is true.
- 9y ago
- yborg 9y agoImpressive work on reverse engineering this. Am I correct in assuming that since this backdoor chip has access to all of the peripheral I/O that it could even be used on a device with onboard wireless in "power off" mode, which is usually some kind of low-level sleep? So a compromise of this subsystem (or intentional backdoor) would allow one to take control of even a device that is "off". Given the trend to non-removable batteries, it might actually be impossible to prevent such an attack without physically destroying a laptop.
- carapace 9y agoYes, that's correct.
- astrobe_ 9y agoa Faraday cage laptop bag is probably a less drastic solution.
- QAPereo 9y agoI think if you're at that point, a laptop is a luxury you can't really afford.
- rubatuga 9y agoOr remove the wifi chip?
- rrix2 9y agodon't forget the microphone, and the speakers (ultrasonic exfiltration) and the display (ISTR a fairly reproducable van eck attack in the last few years?) and the cpu (various research on elliptic curve extraction by monitoring CPU power draw using off the shelf SDR equipment)
- zeep 9y agoWe are pretty much screwed... the "smart" power meters can also probably "help".
- stinos 9y agoCould somebody explain in layman terms what exactly (say, 'spy-wise') ME could enable some parties to (remotely?) do with one's pc? And what are the chances this actually is being done?
- mtreis86 9y agoThey could put in a backdoor that opens when a magic packet is passed. These things exist[1]. Your cell phone likely has one in the radio[2]. The problem with this existing, other than the privacy issues, is that the packet can eventually be discovered by fuzzing[3] the hardware. [1]https://github.com/elvanderb/TCP-32764 https://github.com/elvanderb/TCP-32764 [2]https://www.contextis.com/resources/blog/binary-sms-old-backdoor-your-new-thing/ https://www.contextis.com/resources/blog/binary-sms-old-back... [3]https://www.owasp.org/index.php/Fuzzing https://www.owasp.org/index.php/Fuzzing
- wolfgke 9y agoWhat I consider as "interesting" is the fact that much more research (at least if you look at HN headlines/posts) goes into "Intel ME" vs. "AMD Secure Processor" (formerly known as "AMD PSP" ("Platform Security Processor")). I really don't want to badmouth this important research on "Intel ME", but I am a little bit confused from this asymmetry.
- richdougherty 9y agoPerhaps this is because Intel ME is deployed much more widely than AMD PSP.
- userbinator 9y agoNonetheless, our research team (Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy) Dmitry Sklyarov! There's a name I haven't seen in a while... good to see he's still actively doing this stuff. The immense complexity of the base firmware and hardware in a modern system is astonishing. XML, MINIX, and three(!) complete 486 cores in the PCH. Given this amazing feat of engineering, and the goals of the ME, it makes me wonder what people would be willing to work on it --- "making the nooses on which to hang ourselves", as the saying goes --- and if perhaps some of those people are actually not too approving of the idea and would, given an opportunity to do it without consequences to themselves, do a Snowden and leak everything that they could... The fact that such an "ME killswitch" exists doesn't surprise me either; in this case it seems to be an actual feature, but putting such functionalty into debug/test modes is not uncommon. It was only a matter of time before someone would find it.
- wmf 9y agoIn my experience firmware is developed by an underclass who are happy to have any decent-paying job at all. Or maybe the people who work on the ME realize that it's far from the largest risk in the system.
- nickpsecurity 9y agoHere's the main product using HAP if anyone wants to see if they can buy it and RE its firmware. https://gdmissionsystems.com/cyber/products/trusted-computing-cross-domain/trusted-multilevel-computing-solution https://gdmissionsystems.com/cyber/products/trusted-computin... Some stuff is government only but some for businesses. You'll have to contact them to find out.
- forapurpose 9y agoRecently I saw a guy in a cafe with a General Dynamics laptop. It looked ruggedized and a few years old; I don't know if it was an HAP system. He said he got if off of eBay.
- tomxor 9y agoQ: How does one actually determine intel ME is present in a CPU... I've got an old P8600, I can find no definitive list of CPUs or ways to test for it. Some articles say all intel CPUs since 2006, others say only the newer "core" brand.
- milcron 9y agoIntel Core 2 Duo P8600? That has the ME. Intel's ME was first available in 2006, and by the end of 2008 it was on every CPU they produce. According to ark.intel.com, the P8600 chip was produced Q3'08 so it's in the right timeline for having the ME. But the giveaway is that the chip has "Trusted Execution technology". Intel® Trusted Execution Technology for safer computing is a versatile set of hardware extensions to Intel® processors and chipsets that enhance the digital office platform with security capabilities such as measured launch and protected execution. It enables an environment where applications can run within their own space, protected from all other software on the system. On the bright side, older MEs are easier to de-fang. The 06-08 versions can sometimes be removed entirely.
- homerowilson 9y agoGreat new marketing phrase tho: MINIX Inside!
- nur0n 9y agoSuch blatant security holes are why Google resorts to measures like this: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-...
- foobiekr 9y agoThe company I founded built something very similar to a titan equipped server to allow attestation/measurement/signed logs/full external policy. I can tell you point blank that while the product we built is great, getting enterprises, the majority of whom ___still___ haven't patched eternal blue to worry about clean source, log traceability, etc. can be quite a challenging business at times. They don't understand problems with IPMI or anything else. The only thing that is going to change the face of the security market is that the loop between responsibility and inaction gets closed; as things stand today, the primary difficulty in the space is that for your average, not-very-knowledgeable customer, there is effectively no difference in mostly fraudulent security solutions and real ones - both get auditors out of your hair, so why bother buying anything real (or even not deploying anything like Comodo which actually makes things worse but still checks the box)?
- hellbanner 9y agoAre there any good open computers?
- e12e 9y agoI think that depends on what you mean by good and computer. You might, for example, want something that costs on the same order of magnitude as an Intel or AMD x86_64-bit cpu. Afaik the answer to that question then becomes no. There's some hope around power9-based systems: https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/ For more modest demands on performance, and affordability , there's LEON and OpenSPARC.
- hellbanner 9y agoThanks. I couldn't find LEON (bad google-fu?), can you link? So in effect, big $CORPs own computers and with Alphabet agency influence and systemic flaws, the hope for open and secure and powerful computing should be forgotten.
- e12e 9y agoSee: https://en.m.wikipedia.org/wiki/LEON https://en.m.wikipedia.org/wiki/LEON > the hope for open and secure and powerful computing should be forgotten I'd say it depends a bit. IBM still throwing money at POWER is interesting. The openSPARC is interesting for certain embedded applications that deal with signal processing - where there's real work to be done both in software and hardware (asic / fpga) - like wireless communication. Having a few sparc cores that run Linux well ready to drop in on a fpga is very nice. But for consumer hw... Yeah, it's difficult to compete with arm on one side and Intel/AMD on the other. Remember that even transmeta had to throw in the towel trying to compete in that space.
- ece 9y agoWhat happened to 3rd party chipsets? Seems like VIA, ALi, SiS, Nvidia nForce, all stopped making them for Intel processors around 2008. If there were alternative chipsets still around, we would see more motherboard makers adopting something like openBMC with an alternative chipset and using it. No Intel PCH, no Intel ME.
- wmf 9y agoIf there were alternative chipsets still around, we would see more motherboard makers adopting something like openBMC with an alternative chipset and using it. No we wouldn't. All the chipsets would be subject to the same market forces and thus would converge on similar features, including the ME. Just like how 99% of x86 systems are running UEFI instead of coreboot.
- ece 9y agoThat is not an apples to apples comparison. Plenty of features differ from motherboard to motherboard. Someone like an ASUS could adopt openbmc much easier if an alternative chipset existed. I'm not arguing about the marketability of openbmc, I know it exists. I'm talking about why there are no chipset alternatives to Intel PCH that would force Intel ME on us.
- audi100quattro 9y agoThis coreboot that is on every chromebook, and itself implements the UEFI standard? https://en.wikipedia.org/wiki/Coreboot#History https://en.wikipedia.org/wiki/Coreboot#History Big companies will do open consumer friendly products, once the ecosystem exists and there is some consumer awareness.
- makomk 9y agoI believe Intel stopped releasing the documentation required to make them around that timeframe.
- ece 9y agoIf the EU or US regulators can force Google and Microsoft to unbundle and provide APIs, surely unbundling chipsets fit in the same category. Making chipsets was a successful business for quite a few companies, too bad the FTC didn't force Intel to provide enough documentation, like it mandated the number of PCI-E lanes. Now if the NSA got to the FTC, that would be different.
- JudasGoat 9y agoI didn't notice if the HAP switch is available on earlier (pre ME 11) hardware.
- trapperkeeper74 9y agoACPI is almost as horrible: complicated, opaque, untrusted code running on a VM instead of using declarative data tables. Closed-source firmware and silicon must end, because it's impossible to authoritatively verify correctness or rule out malware implants inserted at some point along the way.
- unlmtd1 9y agoWell said. It also makes computing much more expensive and slow to progress. But those fraudsters love their violence-backed monopoly. Image if a few vital manufacturing plants were destroyed, we would have silicone shortages. We have made ourselves fragile, backwards and weak.
- xoroshiro 9y agoCan someone explain simply what this means for projects like libreboot and coreboot? I'm always interested with this stuff and it's implications, but don't have the background to understand a lot of low level details. Is the verdict still the same or are we gaining ground? Last time I checked, purism was quite optimistic about it, but the libreboot website seemed really pessimistic about it.
- aaronmdjones 9y agoI imagine coreboot might integrate this functionality or recommend that people using coreboot do so themselves, but libreboot won't, because the entire point of libreboot is to only use entirely free software and the ME firmware (even the stripped down version that obeys this disable bit) which is required to boot the machine is not free.
- chris_wot 9y agoIs this the same Dmitry Sklyarov who got caught up in a DMCA debacle over a decade ago?