8 ms·

It makes me so unhappy that this is what things have come to. They make hardware that we can't control, there's no real alternative to buy, and now we gotta rel

It makes me so unhappy that this is what things have come to. They make hardware that we can't control, there's no real alternative to buy, and now we gotta rely on volunteers and wiki pages to give instructions that might work but who knows you might brick it. I wish there was more widespread outrage over ME and PSP and "trusted computing" so we could collectively tell them to stop selling this garbage. There's so much cynicism out there, though, that I think the public would hardly bat an eye if they knew that all hardware since 2008 or so has secret backdoors. We're just used to this kind of abuse and control. I haven't bought a new computer since 2007 because I don't want backdoored hardware. If it really is For My Own Safety, as they advertise it to us, then let me control it!

chongli 9y ago
I hear you! It's frustrating to me, too. Having said that, I think it's but one manifestation of a larger phenomenon. People, in general, believe in a just world. They implicitly trust the mechanisms of society and government. They either can't or don't want to take responsibility for every detail of their lives. They trust the police. They trust big companies like Apple, Facebook, and Google. They trust the government! I honestly believe that a lot of people would be capable of taking responsibility for all of this themselves. I think they just don't want to. They have neither the time nor the energy to put constant pressure on all of these organizations. They have so much other stuff to worry about in their lives.
- abraae 9y ago
  I think most people trust their government, large companies etc. to some degree, but much more so they trust others who are in "their tribe". e.g. if I read a story on HN about some police brutality, posted by some familar, karma-rich HN user, I'd quite possibly give it more credence than a report from said police department denying it. Just because I'm in the HN tribe. This effect is why posting deliberately inflammatory fake news on platforms like Facebook is so damn effective. The typical pattern is (a) establishing the author's tribe (e.g. gun-toting 50-something male living in a southern state) and then (b) launching the attack. I really like to think that, as a rational person, my bullshit detectors would fire... but its an interesting thought experiment as to what I'd give credence to just because it was uttered by a respected HN poster.
roblabla 9y ago
Next time I change laptop (which will probably happen soon, my laptop is also a 2007 hardware), it will be a Librem 13 from Purism. I want to send money to a company that cares about this issue, and Purism has demonstrated they do multiple times already[0][1]. I know purism is just neutralizing IME, so it's the same as this, but they're the best solution right now, and I hope that by supporting them, I participate in a clear message to the industry that I don't want their undocumented blackbox on my hardware. Who knows ? Maybe one of the major players will take the hint and try to remove them, or document them. Or maybe a new player will displace them. [0]: https://puri.sm/posts/reverse-engineering-the-intel-management-engine-romp-module/ https://puri.sm/posts/reverse-engineering-the-intel-manageme... [1]: https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ https://puri.sm/posts/neutralizing-intel-management-engine-o...
- Foxboron 9y ago
  Are they actually selling laptops without IME? It seems to me like they have published how it can be removed, not that they are selling products with IME disabled.
  - xwvvvvwx 9y ago
    They describe what they do here: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/ If I read it right they do the same as described in the gentoo wiki page (get rid of every module except the bring up).
    - Foxboron 9y ago
      Right, so they select HW so the remote access isn't available. Good, but this doesn't remove IME.
      - xwvvvvwx 9y ago
        From that page: we take the extra precaution of neutralizing the ME itself (removing everything but the “hardware initialization” module) Am I missing something?
abtinf 9y ago
Edit: removing comment as a correction in a reply below makes my original view extremely misleading.
- binaryapparatus 9y ago
  Article states that AMD has its own version of IME, with no known ways to analyze, access or fix.
  - platinumrad 9y ago
    Yes, the state of things is currently worse (i.e. no known way to disable) as far as the AMD PSP is concerned as not much research has been done on it due to their lack of market share.
  - abtinf 9y ago
    Ugh, I didn’t know that. Thanks for pointing it out.
jknz 9y ago
It seems strange to me that the European Union is allowing this. The fact that a foreign company has a backdoor in every computer running in European countries is so concerning on so many levels. Defense ministers from European countries should wake up and outlaw this. Of course, there is no specificity to the EU here -- this applies to Russia, China and other countries too. Edit: maybe Intel is already eligible to a € multiple Billions fine from the EU based on this? (Disclaimer: I have no clue about how such fine works).
- amelius 9y ago
  The EU has one very strong negotiation point: ASML. Without that company, Intel wouldn't even be able to produce their CPUs.
  - n0ric 9y ago
    It should be noted that ASML pretty much has an monopoly on the EUV Lithography market... At least that's what they said at the CYMER (Subsidiary of ASML) tour I went to recently. I'm not exactly sure about the DUV market, so I won't comment on it.
  - selectodude 9y ago
    I'm not sure that's a negotiation point for Intel, as they own 15 percent of ASML. Might be a rough ride for everybody if the EU had any intention of playing that card.
    - vixen99 9y ago
      But agreement specifically excludes rights on future development by ASML
- 5eyes5 9y ago
  See 5eyes The important EU states certainly have the same back door access or a 'trusted' means of disabling it. Freedom is for the powerful and important, not the pish posh tax slaves these Grace's fatten themselves upon.
avodonosov 9y ago
Is that (our inability to influence this) a result of a monopoly? If so, should it be addressed using anti-monopoly institutions (FTC)? Update: I know other vendors (AMD) do that too, but it still looks monopolistic. First of all, Intel has a huge CPU market share. Also, probably the vendors together constitute a monopoly.
- wmf 9y ago
  Nope. Basically every vendor is doing the same thing.
  - rurban 9y ago
    Power9 is not. See https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/
- platinumrad 9y ago
  Nah because AMD ships something similar with its processors as well. There was an effort to get AMD to open source its management coprocessor which could have given AMD a competitive advantage but they resisted, which has really fueled the conspiracy theories that some outside organization is responsible for this industry-wide stubbornness.
- zanny 9y ago
  Its indicative of an extremely high barrier to entry into the CPU market, and certainly a large part of that has to do with both industry collusion to keep competition down and the behavior of corrupt government actors under their payroll. It also shows that the market of people willing to put money where their mouth is on this are fairly few and far between. The Raptor workstation crowdfunding campaign promised to get rid of all the proprietary firmware in the system and failed by a large margin.
amelius 9y ago
Perhaps our best bet would be the European Union, as they have to put up with all this backdoored stuff the US is selling them. EDIT: Hah, jknz beat me to it.
foobiekr 9y ago
IMHO (not speaking for skyport, of which I am an employee, but using us as an example) there is a huge mismatch between how technical people (on hacker news and elsewhere) perceive and _hypothetically_ value security and how enterprises value security that is the source of your unhappiness/surprise. We sell an x86 server where the management engine is unreachable; there is no path from the external network to the ME. I can tell you point blank that most enterprise customers are unaware of even hypothetical issues there or for that matter with IPMI implementations. We stopped using this as an early feature in our customer conversations because they just couldn't care less about it until they hand you off to their deeper technical team (if they even have one, which is not as often as you'd think if you have not realized that security in enterprise datacenters is almost always an afterthought). Otherwise it just doesn't come up very often. Until high-volume customers take a concern, no amount of outrage or paranoia is going to make any difference. You might as well be outraged that, for example, implementations of some BIOSes are so poor that the measured boot (hashes to TPM) don't cover all of the configuration items or vendors fail to correctly lock down their firmware flash or update path. This is pretty common and you don't hear about it because most people can't make measured boot work and generally don't even try. Security, in general, appears to be mostly viewed as optional. Obviously I think getting this right is important, in our case for other reasons, but in and of itself people generally view security as an expensive vitamin.
- belorn 9y ago
  Could it be that high volume customers stay high volume because they keep buying new machines before malware developers has time to find a security fault and the exploits trickle down to exploit tools?
  - foobiekr 9y ago
    I think that's true but orthogonal. IPMI stacks had huge issues for a decade and no one ever upgrades that or the other lights-out management solutions (idrac, etc.). Buying cycles and planning are such that no one ever does responsive buying in the short term, but customers demonstrate a lack of valuing security-by-design regardless of that. I'm not pushing our solution, just sharing what I have observed. Management engine in practice will _always_ be unpatched. It is _inherently_ unsafe. Anyone who thinks they will keep their patches up to date, unless they work at Amazon or some other entity where they can institutionalize it, is crazy. I had a CIO directly tell me their mean-time-to-patch CVEs in their exposed servers was two years. The statistics on Linux bug lifetimes show that 5Y is not uncommon. Security is our underpinning but not how we sell (for the reasons I am explaining); there is a very good reason for that which is that people don't actually buy real security, they buy tools to pass audits. You can see shadows of this in the way that companies continue to deploy vulnerable agents even when they are revealed to degrade host security, or in the resistance to internal secure communications (and the reaction in general to TLS1.3). Security practices inside large enterprises are bizarre and the result of perverse incentives. Let me give an example. The internal use of Websense proxies, for example, will tend to block encrypted content within TLS connections using entropy detection; a malicious actor will simply use an entropy reduction strategy (bananaphone or whatever trivial solution); a legitimate user who is sending an encrypted document will have that document blocked. People justify these tools as meeting the need to allow inspection of traffic; however your Websense administrator is not actually qualified to see all of the traffic that flows over the proxy (for example, does being able to read the CEO's mail make the admin an insider?) and protocols that carry content that is both safe-to-inspect and unsafe-to-inspect (the CFO's password, for example) do not differentiate the two making inspection inherently dangerous. A decade and a half ago, I knew someone who peeked at the loading dock, invoicing and shipping so that they could predict how the quarter was going to time stock sales. That's a comical example but it's one we have directly encountered in the secure exchange of cryptographic material; but similar issues crop up all over, from the use of transparent proxies and corporate CAs (to "allow inspection") to all manner of craziness. The facts lead you to a world view that is even more cynical than the idea of security as theater: instead, security as _ritual_. "I need this server to be secure, I'll install some agent"; "We need this server to be inspectable; I'll disable all forward-secrecy protocols and decrypt and inspect the content." And so on. So .. I don't think it's high volume or anything else like that which is an outcome of process rather than a choice. It's that many companies long ago adopted a world view where any kind of real security is as far from consideration as possible. (not speaking for skyport, speaking for me)
nextos 9y ago
There's brand new non-backdoored (on paper) hardware. Cheap RockChip-based Chromebooks. Not even CPU microcode needed. No binary blobs anywhere, as long as you disable 3D acceleration: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html
- woolvalley 9y ago
  A macbook pro 15" has a ~15000 score on geekbench, and Apple's A11 has a score that is almost at 10000. We are a generation or two away from ARM having the same power as top of the line laptop processors, which can free us from intel and the ME.
  - Crontab 9y ago
    That'll probably be around the time they announce a management engine that is built into every ARM CPU.
    - cyphar 9y ago
      TrustZone exists and is can be used for the same purpose as ME.
    - incompatible 9y ago
      I don't care that such things exist, as long as there's a way to completely disable them. It should also be possible to verify that they are disabled, and be sure that they can't be re-enabled by rogue software. The approach of Intel and AMD is completely hostile to anybody who cares about such things.
    - zanny 9y ago
      The chipset firmware will still be proprietary, and ARM chips are very often configured with a "secret" core that runs only firmware based code that is invisible to the OS. Add in the fact almost all ARM SoCs integrate modems that are themselves turing complete systems that have total system access and have priority control over the host CPU and you have less power there than you do being able to kill the IME and rarely run coreboot.
ptero 9y ago
Maybe it is a business opportunity for a system builder -- disable IME, eat bricking risk (minimal if you set up a rigorous process), then sell the end system to the consumer. I would gladly buy one
- wmf 9y ago
  That's called Purism.
feelin_googley 9y ago
"If it really For My Own Safety, as they advertise it to us, then let me control it!" I do not believe the argument that these changes are undertaken out of concern to protect users, whether it is made with respect to "features" of Intel chips (including Intel SGX), corporate-controlled OS, advertising-supported browsers, etc. It is difficult to prove such organizations are deliberately trying to make things more difficult for users to control, unless of course employees inside these organizations speak out. The organizations can always provide alternate reasons for doing what they are doing. However I recall reading of a comment made by Gates in the 1990's, at a time when he wanted Windows installed on every PC sold, that he did not like the idea of users potentially changing BIOS settings. I can only guess as to why, but it is curious to me that we are left with certain strange historical artifacts such as Windows always needing to be installed in the first partition. Other OS do not have this requirement. While that sort of deliberate subterfuge may be difficult to prove, I think it would be easier to argue these organizations believe (or pretend to believe) that users are "incapable" in ways that have no basis in fact. You, dear user, are incapable of controlling your computer. We, benevolent organization, can help. Just sit back and we will take care of everything.
userbinator 9y ago
I wish there was more widespread outrage over ME and PSP and "trusted computing" so we could collectively tell them to stop selling this garbage. It's almost 20 years ago since the public convinced Intel to remove a feature from their processors which would seem almost harmless today: https://news.ycombinator.com/item?id=10106870 https://news.ycombinator.com/item?id=10106870 However, the serial number was not heavily marketed as a security feature, unlike ME and all the other new and oppressive functionality today. The security argument is impressively powerful --- and more scarily, it seems the companies and government have almost perfected how to harness it.
earenndil 9y ago
How about this? https://www.raptorcs.com/TALOSII/prerelease.php https://www.raptorcs.com/TALOSII/prerelease.php
acd 9y ago
Please read x86 considered harmful by the security researcher Joanna rutkowska. It highlights the x86 flaws. https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
vectorEQ 9y ago
The problem is not that everything is shit, but that everyone just points at it, and expects other people to fix it. There are mutliple efforts to design and create a 'better'future for computing, in operating systems, but also in hardware areas, people desining new CPUs which are open and well documented etc. If you want things to change, invest time and effort into such projects, or start on of your own. Be the change!

chongli 9y ago

I hear you! It's frustrating to me, too. Having said that, I think it's but one manifestation of a larger phenomenon. People, in general, believe in a just world. They implicitly trust the mechanisms of society and government. They either can't or don't want to take responsibility for every detail of their lives. They trust the police. They trust big companies like Apple, Facebook, and Google. They trust the government! I honestly believe that a lot of people would be capable of taking responsibility for all of this themselves. I think they just don't want to. They have neither the time nor the energy to put constant pressure on all of these organizations. They have so much other stuff to worry about in their lives.

abraae 9y ago
I think most people trust their government, large companies etc. to some degree, but much more so they trust others who are in "their tribe". e.g. if I read a story on HN about some police brutality, posted by some familar, karma-rich HN user, I'd quite possibly give it more credence than a report from said police department denying it. Just because I'm in the HN tribe. This effect is why posting deliberately inflammatory fake news on platforms like Facebook is so damn effective. The typical pattern is (a) establishing the author's tribe (e.g. gun-toting 50-something male living in a southern state) and then (b) launching the attack. I really like to think that, as a rational person, my bullshit detectors would fire... but its an interesting thought experiment as to what I'd give credence to just because it was uttered by a respected HN poster.

roblabla 9y ago

Next time I change laptop (which will probably happen soon, my laptop is also a 2007 hardware), it will be a Librem 13 from Purism. I want to send money to a company that cares about this issue, and Purism has demonstrated they do multiple times already[0][1]. I know purism is just neutralizing IME, so it's the same as this, but they're the best solution right now, and I hope that by supporting them, I participate in a clear message to the industry that I don't want their undocumented blackbox on my hardware. Who knows ? Maybe one of the major players will take the hint and try to remove them, or document them. Or maybe a new player will displace them. [0]: https://puri.sm/posts/reverse-engineering-the-intel-management-engine-romp-module/ https://puri.sm/posts/reverse-engineering-the-intel-manageme... [1]: https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ https://puri.sm/posts/neutralizing-intel-management-engine-o...

Foxboron 9y ago
Are they actually selling laptops without IME? It seems to me like they have published how it can be removed, not that they are selling products with IME disabled.
- xwvvvvwx 9y ago
  They describe what they do here: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/ If I read it right they do the same as described in the gentoo wiki page (get rid of every module except the bring up).
  - Foxboron 9y ago
    Right, so they select HW so the remote access isn't available. Good, but this doesn't remove IME.
    - xwvvvvwx 9y ago
      From that page: we take the extra precaution of neutralizing the ME itself (removing everything but the “hardware initialization” module) Am I missing something?

abtinf 9y ago

Edit: removing comment as a correction in a reply below makes my original view extremely misleading.

binaryapparatus 9y ago
Article states that AMD has its own version of IME, with no known ways to analyze, access or fix.
- platinumrad 9y ago
  Yes, the state of things is currently worse (i.e. no known way to disable) as far as the AMD PSP is concerned as not much research has been done on it due to their lack of market share.
- abtinf 9y ago
  Ugh, I didn’t know that. Thanks for pointing it out.

jknz 9y ago

It seems strange to me that the European Union is allowing this. The fact that a foreign company has a backdoor in every computer running in European countries is so concerning on so many levels. Defense ministers from European countries should wake up and outlaw this. Of course, there is no specificity to the EU here -- this applies to Russia, China and other countries too. Edit: maybe Intel is already eligible to a € multiple Billions fine from the EU based on this? (Disclaimer: I have no clue about how such fine works).

amelius 9y ago
The EU has one very strong negotiation point: ASML. Without that company, Intel wouldn't even be able to produce their CPUs.
- n0ric 9y ago
  It should be noted that ASML pretty much has an monopoly on the EUV Lithography market... At least that's what they said at the CYMER (Subsidiary of ASML) tour I went to recently. I'm not exactly sure about the DUV market, so I won't comment on it.
- selectodude 9y ago
  I'm not sure that's a negotiation point for Intel, as they own 15 percent of ASML. Might be a rough ride for everybody if the EU had any intention of playing that card.
  - vixen99 9y ago
    But agreement specifically excludes rights on future development by ASML
5eyes5 9y ago
See 5eyes The important EU states certainly have the same back door access or a 'trusted' means of disabling it. Freedom is for the powerful and important, not the pish posh tax slaves these Grace's fatten themselves upon.

avodonosov 9y ago

Is that (our inability to influence this) a result of a monopoly? If so, should it be addressed using anti-monopoly institutions (FTC)? Update: I know other vendors (AMD) do that too, but it still looks monopolistic. First of all, Intel has a huge CPU market share. Also, probably the vendors together constitute a monopoly.

wmf 9y ago
Nope. Basically every vendor is doing the same thing.
- rurban 9y ago
  Power9 is not. See https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/
platinumrad 9y ago
Nah because AMD ships something similar with its processors as well. There was an effort to get AMD to open source its management coprocessor which could have given AMD a competitive advantage but they resisted, which has really fueled the conspiracy theories that some outside organization is responsible for this industry-wide stubbornness.
zanny 9y ago
Its indicative of an extremely high barrier to entry into the CPU market, and certainly a large part of that has to do with both industry collusion to keep competition down and the behavior of corrupt government actors under their payroll. It also shows that the market of people willing to put money where their mouth is on this are fairly few and far between. The Raptor workstation crowdfunding campaign promised to get rid of all the proprietary firmware in the system and failed by a large margin.

amelius 9y ago

Perhaps our best bet would be the European Union, as they have to put up with all this backdoored stuff the US is selling them. EDIT: Hah, jknz beat me to it.

foobiekr 9y ago

IMHO (not speaking for skyport, of which I am an employee, but using us as an example) there is a huge mismatch between how technical people (on hacker news and elsewhere) perceive and _hypothetically_ value security and how enterprises value security that is the source of your unhappiness/surprise. We sell an x86 server where the management engine is unreachable; there is no path from the external network to the ME. I can tell you point blank that most enterprise customers are unaware of even hypothetical issues there or for that matter with IPMI implementations. We stopped using this as an early feature in our customer conversations because they just couldn't care less about it until they hand you off to their deeper technical team (if they even have one, which is not as often as you'd think if you have not realized that security in enterprise datacenters is almost always an afterthought). Otherwise it just doesn't come up very often. Until high-volume customers take a concern, no amount of outrage or paranoia is going to make any difference. You might as well be outraged that, for example, implementations of some BIOSes are so poor that the measured boot (hashes to TPM) don't cover all of the configuration items or vendors fail to correctly lock down their firmware flash or update path. This is pretty common and you don't hear about it because most people can't make measured boot work and generally don't even try. Security, in general, appears to be mostly viewed as optional. Obviously I think getting this right is important, in our case for other reasons, but in and of itself people generally view security as an expensive vitamin.

belorn 9y ago
Could it be that high volume customers stay high volume because they keep buying new machines before malware developers has time to find a security fault and the exploits trickle down to exploit tools?
- foobiekr 9y ago
  I think that's true but orthogonal. IPMI stacks had huge issues for a decade and no one ever upgrades that or the other lights-out management solutions (idrac, etc.). Buying cycles and planning are such that no one ever does responsive buying in the short term, but customers demonstrate a lack of valuing security-by-design regardless of that. I'm not pushing our solution, just sharing what I have observed. Management engine in practice will _always_ be unpatched. It is _inherently_ unsafe. Anyone who thinks they will keep their patches up to date, unless they work at Amazon or some other entity where they can institutionalize it, is crazy. I had a CIO directly tell me their mean-time-to-patch CVEs in their exposed servers was two years. The statistics on Linux bug lifetimes show that 5Y is not uncommon. Security is our underpinning but not how we sell (for the reasons I am explaining); there is a very good reason for that which is that people don't actually buy real security, they buy tools to pass audits. You can see shadows of this in the way that companies continue to deploy vulnerable agents even when they are revealed to degrade host security, or in the resistance to internal secure communications (and the reaction in general to TLS1.3). Security practices inside large enterprises are bizarre and the result of perverse incentives. Let me give an example. The internal use of Websense proxies, for example, will tend to block encrypted content within TLS connections using entropy detection; a malicious actor will simply use an entropy reduction strategy (bananaphone or whatever trivial solution); a legitimate user who is sending an encrypted document will have that document blocked. People justify these tools as meeting the need to allow inspection of traffic; however your Websense administrator is not actually qualified to see all of the traffic that flows over the proxy (for example, does being able to read the CEO's mail make the admin an insider?) and protocols that carry content that is both safe-to-inspect and unsafe-to-inspect (the CFO's password, for example) do not differentiate the two making inspection inherently dangerous. A decade and a half ago, I knew someone who peeked at the loading dock, invoicing and shipping so that they could predict how the quarter was going to time stock sales. That's a comical example but it's one we have directly encountered in the secure exchange of cryptographic material; but similar issues crop up all over, from the use of transparent proxies and corporate CAs (to "allow inspection") to all manner of craziness. The facts lead you to a world view that is even more cynical than the idea of security as theater: instead, security as _ritual_. "I need this server to be secure, I'll install some agent"; "We need this server to be inspectable; I'll disable all forward-secrecy protocols and decrypt and inspect the content." And so on. So .. I don't think it's high volume or anything else like that which is an outcome of process rather than a choice. It's that many companies long ago adopted a world view where any kind of real security is as far from consideration as possible. (not speaking for skyport, speaking for me)

nextos 9y ago

There's brand new non-backdoored (on paper) hardware. Cheap RockChip-based Chromebooks. Not even CPU microcode needed. No binary blobs anywhere, as long as you disable 3D acceleration: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html

woolvalley 9y ago
A macbook pro 15" has a ~15000 score on geekbench, and Apple's A11 has a score that is almost at 10000. We are a generation or two away from ARM having the same power as top of the line laptop processors, which can free us from intel and the ME.
- Crontab 9y ago
  That'll probably be around the time they announce a management engine that is built into every ARM CPU.
  - cyphar 9y ago
    TrustZone exists and is can be used for the same purpose as ME.
  - incompatible 9y ago
    I don't care that such things exist, as long as there's a way to completely disable them. It should also be possible to verify that they are disabled, and be sure that they can't be re-enabled by rogue software. The approach of Intel and AMD is completely hostile to anybody who cares about such things.
  - zanny 9y ago
    The chipset firmware will still be proprietary, and ARM chips are very often configured with a "secret" core that runs only firmware based code that is invisible to the OS. Add in the fact almost all ARM SoCs integrate modems that are themselves turing complete systems that have total system access and have priority control over the host CPU and you have less power there than you do being able to kill the IME and rarely run coreboot.

ptero 9y ago

Maybe it is a business opportunity for a system builder -- disable IME, eat bricking risk (minimal if you set up a rigorous process), then sell the end system to the consumer. I would gladly buy one

wmf 9y ago
That's called Purism.

feelin_googley 9y ago

"If it really For My Own Safety, as they advertise it to us, then let me control it!" I do not believe the argument that these changes are undertaken out of concern to protect users, whether it is made with respect to "features" of Intel chips (including Intel SGX), corporate-controlled OS, advertising-supported browsers, etc. It is difficult to prove such organizations are deliberately trying to make things more difficult for users to control, unless of course employees inside these organizations speak out. The organizations can always provide alternate reasons for doing what they are doing. However I recall reading of a comment made by Gates in the 1990's, at a time when he wanted Windows installed on every PC sold, that he did not like the idea of users potentially changing BIOS settings. I can only guess as to why, but it is curious to me that we are left with certain strange historical artifacts such as Windows always needing to be installed in the first partition. Other OS do not have this requirement. While that sort of deliberate subterfuge may be difficult to prove, I think it would be easier to argue these organizations believe (or pretend to believe) that users are "incapable" in ways that have no basis in fact. You, dear user, are incapable of controlling your computer. We, benevolent organization, can help. Just sit back and we will take care of everything.

userbinator 9y ago

I wish there was more widespread outrage over ME and PSP and "trusted computing" so we could collectively tell them to stop selling this garbage. It's almost 20 years ago since the public convinced Intel to remove a feature from their processors which would seem almost harmless today: https://news.ycombinator.com/item?id=10106870 https://news.ycombinator.com/item?id=10106870 However, the serial number was not heavily marketed as a security feature, unlike ME and all the other new and oppressive functionality today. The security argument is impressively powerful --- and more scarily, it seems the companies and government have almost perfected how to harness it.

earenndil 9y ago

How about this? https://www.raptorcs.com/TALOSII/prerelease.php https://www.raptorcs.com/TALOSII/prerelease.php

acd 9y ago

Please read x86 considered harmful by the security researcher Joanna rutkowska. It highlights the x86 flaws. https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

vectorEQ 9y ago

The problem is not that everything is shit, but that everyone just points at it, and expects other people to fix it. There are mutliple efforts to design and create a 'better'future for computing, in operating systems, but also in hardware areas, people desining new CPUs which are open and well documented etc. If you want things to change, invest time and effort into such projects, or start on of your own. Be the change!