6 ms·
This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious
by arca_vorago 9y ago
This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) were infiltrating even low level chip manufacturers. Danny Casalaro's death was likely a required nastyness to keep it covered up.
- nickpsecurity 9y agoThey added it for business reasons for remote monitoring and control since enterprises like it. That's a large part of their sales. It also had consumer benefits. Related tech also helped DRM machines through Trusted Computing alliance. And they probably got defense contracts or payments for selective use by NSA or other organizations. Lots of return on that investment. Lots of reasons unrelated to those you mention.
- ar-jan 9y agoThen why refuse the possibility to disable it?
- arca_vorago 9y ago>remote monitoring and control There are opensource ways to do out of band management without it. >consumer benefits. Related tech also helped DRM machines through Trusted Computing alliance. Nobody I knew who was knowledgeable wanted that shit in the first place. It was always edging away consumer control of the platform. DRM is part of the problem here! Same thing with web standards. What annoys me the most about this is the audacity of calling it "consumer benefits". >probably got defense contracts or payments for selective use by NSA or other organizations Fine, but that's not a good enough reason to backdoor literally everything for everyone else. (reminds me of systemd and redhat actually)
- forapurpose 9y ago>>remote monitoring and control > There are opensource ways to do out of band management without it. I'd be surprised if there is a cost-effective open source alternative to this requirement: Remotely access and control a computer under any circumstance where it has power and a physical network connection. Solutions like AMT work even if there is no functioning processor or memory, because ME provides its own processor and memory. The open source alternative would need the same hardware. At best, it would mean the corporate IT department designing, buying, installing, integrating, and supporting additional hardware, for tens of thousands of computers. That's very hard to justify when the computers come with hardware already installed, integrated with everything else, and supported by the vendor. If someone could put FOSS on ME (or competing proprietary solutions), I'd be all for it. I suspect it would be very difficult, as we can't even figure out how to disable ME.
- bubblethink 9y agoThere's open BMC, which I think Facebook uses. Google has its own thing from a recent thread.
- ams6110 9y agoMost BMCs are rather limited aren't they? They can switch power off and on, read a few sensors. ME goes well beyond that from what I gather.
- wmf 9y agoThat's what BMCs were like 15 years ago; they're much more sophisticated now.
- snuxoll 9y agoThey've supported a lot more than that for a very long time. The BMCs on both my ThinkServer TD340 and ProLiant ML10 support remote KVM access, CD/DVD emulation (mount a local .iso as a virtual drive on the server), firmware updates, and quite a bit more. On top of that, I should note they do this without assistance of the Intel ME. The remote KVM access is handled through a video adapter embedded in the BMC.
- agumonkey 9y agoI got a mail from a company doing power9 boards (something eagle ??). A bit pricey but it seems worth it if you have such needs.
- justinjlynn 9y agoRaptor CS?
- agumonkey 9y agoThemselves. The logo is an eagle :) https://www.raptorcs.com/content/base/products.html https://www.raptorcs.com/content/base/products.html
- userbinator 9y agoIf some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled gardens became popular: because they are heavily promoted as a security/safety feature, and "who doesn't want to be safe and secure?" Remember that, shortly before the turn of the century, Intel was convinced by the masses to remove a feature that would seem almost innocuous today, a serial number, but only because they marketed it as for DRM/identification instead of a security feature: https://www.wired.com/1999/01/intel-on-privacy-whoops/ https://www.wired.com/1999/01/intel-on-privacy-whoops/
- ams6110 9y ago> The underlying reason why ME became popular ... ... is also because it provides management features that are wanted by enterprise customers. If you're running hundreds of servers in a data center, the more management you can do remotely, without visiting the machine room and preferably automated as much as possible, the better. This is quite irrelevant and even undesirable for an individual's personal computer.
- codedokode 9y agoWhile enterprise customers might want remote control they also would like to be able to disable it.
- rekado 9y agoI read statements like this often on HN, but not once during my years of work as a sysadmin in enterprise IT in different countries did I meet anyone who used ME/AMT for employee laptops. Also not at conferences. Admins use the ILOM/IPMI for servers, so you don't really need it for server CPUs. For laptops all management happens at the operating system level, not below it.
- 9y ago
- narrator 9y agoThis is why Russia makes their own chips in their own fabs for defense applications. [1] 1. https://en.m.wikipedia.org/wiki/MCST https://en.m.wikipedia.org/wiki/MCST
- cabalamat 9y agoAs do all countries with any sense.
- yellowapple 9y agoAnd sufficient money and other resources. I'm all for national governments making their own hardware not subject to backdoors installed by other national governments, but there's a huge difference in capability between Russia and, say, Lebanon.
- lsjdfkljdfwkwdf 9y agoYou really have quite some faith in government, or defense contractors?
- cabalamat 9y agoThat's a good point. Big countries can afford to fab their own chips; small countries cannot. This has geopolitical considerations: The best option for a small country may be to decide which of the big countries it wants to be an ally or puppet of. Incidentally this is one reason I think the UK is daft to leave the EU.
- kijiki 9y agoThey're actually fabbed by TSMC. MCST is fabless, not an IDM.
- dchest 9y agoAccording to their videos, their most recent chips are made by TSMC, but the older ones are made in Russia (I believe these are used for war applications). When the Russian factory switches to a better fab process, they'll also use it for modern chips. Indeed, the Russian factory is not theirs, though, as they are fabless.
- foobiekr 9y agoIt seems to me that the alternate vendor argument does not make sense. If we do not trust Intel, then there is no reason at all to trust any of the other vendors. Intel might actually require infiltration or an order; most of your smaller chip would add backdoors for cash (and in contrast to intel, a little cash would make a huge difference in their bottom lines).
- yzmtf2008 9y agoI’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data center is in Chicago. I wouldn’t write a useful feature off as a conspiracy for surveillance just like that.
- lsjdfkljdfwkwdf 9y agoAs I understand ME is not a prerequisite for IPMI?
- goodplay 9y agoThen let owners control whether it's enabled or not (by a hardware switch if necessary). As it currently stands, I can't imagine a benign reason that would drive intel and AMD to lock users out of their machines.
- therealjumbo 9y agoYou can't think of any reason? Have you or do you work for a large company [1], especially hardware companies? I've sat through I don't know how many "planning" meetings, which were little better than design by committee, and whose outcome was not in the best interest of the customer despite the best intentions of everyone there. 1. Or the government or one of it's contractors. I've even sat through meetings 12 engineers sat around and argued about what to name something internal. I started calling this "name by committee".
- la_oveja 9y agoExplain to me why I can't disable it for my home PC.
- vertex-four 9y ago
- blitmap 9y agoSpeaking as a naive outside observer, I am excited with the rumors that Microsoft and Apple will be making a move toward ARM in the nearish future. I don't think ARM is the answer (dear god give us riscv) but I see it as a step in the right direction away from closed systems.
- rhabarba 9y ago> I like x86 but it's not the cpu of the future unless it's open SPARC has been open for years FYI.