4 ms·

Next time I change laptop (which will probably happen soon, my laptop is also a 2007 hardware), it will be a Librem 13 from Purism. I want to send money to a co

Next time I change laptop (which will probably happen soon, my laptop is also a 2007 hardware), it will be a Librem 13 from Purism. I want to send money to a company that cares about this issue, and Purism has demonstrated they do multiple times already[0][1]. I know purism is just neutralizing IME, so it's the same as this, but they're the best solution right now, and I hope that by supporting them, I participate in a clear message to the industry that I don't want their undocumented blackbox on my hardware. Who knows ? Maybe one of the major players will take the hint and try to remove them, or document them. Or maybe a new player will displace them. [0]: https://puri.sm/posts/reverse-engineering-the-intel-management-engine-romp-module/ https://puri.sm/posts/reverse-engineering-the-intel-manageme... [1]: https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/ https://puri.sm/posts/neutralizing-intel-management-engine-o...

Foxboron 9y ago
Are they actually selling laptops without IME? It seems to me like they have published how it can be removed, not that they are selling products with IME disabled.
- xwvvvvwx 9y ago
  They describe what they do here: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/ If I read it right they do the same as described in the gentoo wiki page (get rid of every module except the bring up).
  - Foxboron 9y ago
    Right, so they select HW so the remote access isn't available. Good, but this doesn't remove IME.
    - xwvvvvwx 9y ago
      From that page: we take the extra precaution of neutralizing the ME itself (removing everything but the “hardware initialization” module) Am I missing something?
      - Foxboron 9y ago
        No, you seem to be correct. I'm just being highly sceptical of the puri.sm folks because of their marketing. It seems like their current devices are sold with me_cleaner being ran, along with removing several "fuses". Which is pretty good. I'm still unsure if buying these laptops actually sends a signal that this isn't OK. Intel gets their money in the end.
        zanny 9y ago
        You can't buy a mass-market computer that doesn't have either an obvious backdoor or proprietary firmware right now, except for the one Chromebook that Libreboot supports. And even then, your RAM has proprietary code running on it (I'm not aware of any DDR4 that doesn't have embedded SoCs for initialization, none of that is done in CPU firmware anymore), your hard drives can have up to entire embedded SoCs with proprietary code running on them, and there isn't an unencumbered 802.11AN wireless chip in existence. The only bright side to that is none of that hardware has system-wide access the way these backdoor coprocessors do.
        zdkl 9y ago
        Who needs system wide compromise when you can read what's hitting both RAM and persistent memory.
        roblabla 9y ago
        I doubt we can get Intel to change directly. Most people don't buy from them directly anyway. My belief is that we can get OEMs to consider this a serious issue, and have them turn into a market pressure on CPU manufacturers. After all, OEM's life would be simpler if Intel simply didn't put the IME that everyone wants removed.
fghtr 9y ago
I think, if your goal is fully free laptop, you should consider Libreboot https://minifree.org/product/libreboot-t400/ https://minifree.org/product/libreboot-t400/. The IME has been fully removed from it.
miles 9y ago
See Tobias Platen's "Why I won’t buy the Purism Librem" for why he prefers Libreboot: http://blogs.fsfe.org/tobias_platen/2015/09/22/why-i-wont-buy-the-libre/ http://blogs.fsfe.org/tobias_platen/2015/09/22/why-i-wont-bu...
- roblabla 9y ago
  The alternative presented is a laptop with 2008 hardware. Sure, I can do that. But that's not sending a message to the industry. That's just living in a bubble, while still giving Lenovo some money. Don't get me wrong, I love minifree and what they're doing, I just don't believe it to be a viable alternative. There are lots of people who can't or won't use outdated hardware. Purism is a sane solution to this problem. Also, Purism is taking steps to get coreboot to run on their laptops[1][2], so the graph on this website isn't even right anymore. And I just found out that, interestingly, the T400 and X200 both come with IME. The only difference is that the AMT can be fully disabled on older intel chipsets[0]. [0]: https://libreboot.org/docs/hardware/gm45_remove_me.html https://libreboot.org/docs/hardware/gm45_remove_me.html [1]: https://puri.sm/posts/coreboot-on-the-librem-13-v2-part-1/ https://puri.sm/posts/coreboot-on-the-librem-13-v2-part-1/ [2]: https://puri.sm/posts/coreboot-on-the-skylake-librems-part-2/ https://puri.sm/posts/coreboot-on-the-skylake-librems-part-2...
  - ynniv 9y ago
    First, Lenovo doesn't receive any money when you buy a used laptop. Second, using a ten year old laptop sends a much stronger message than buying a new, slightly alternative laptop. Third, security is like history - if you want to get it right, you have to wait for rigors of time to reveal the truth. We think that Purism is at least as secure as Libreboot, but we know a lot more about ten year old hardware than something fresh off the fab in China.
  - lurker12390879 9y ago
    Coreboot does run on their laptops, but it has too many blobs to make the Libre crowd happy. Purism has mentioned they may take interest in porting the rest of the way to libreboot someday. The real issue too is that a lot of naysayers dislike Purism because they provide modern competition to people selling Librebooted laptops.
bo1024 9y ago
Awesome and I applaud that decision. I think you'll be very happy with the quality.

Foxboron 9y ago

Are they actually selling laptops without IME? It seems to me like they have published how it can be removed, not that they are selling products with IME disabled.

xwvvvvwx 9y ago
They describe what they do here: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/ If I read it right they do the same as described in the gentoo wiki page (get rid of every module except the bring up).
- Foxboron 9y ago
  Right, so they select HW so the remote access isn't available. Good, but this doesn't remove IME.
  - xwvvvvwx 9y ago
    From that page: we take the extra precaution of neutralizing the ME itself (removing everything but the “hardware initialization” module) Am I missing something?
    - Foxboron 9y ago
      No, you seem to be correct. I'm just being highly sceptical of the puri.sm folks because of their marketing. It seems like their current devices are sold with me_cleaner being ran, along with removing several "fuses". Which is pretty good. I'm still unsure if buying these laptops actually sends a signal that this isn't OK. Intel gets their money in the end.
      - zanny 9y ago
        You can't buy a mass-market computer that doesn't have either an obvious backdoor or proprietary firmware right now, except for the one Chromebook that Libreboot supports. And even then, your RAM has proprietary code running on it (I'm not aware of any DDR4 that doesn't have embedded SoCs for initialization, none of that is done in CPU firmware anymore), your hard drives can have up to entire embedded SoCs with proprietary code running on them, and there isn't an unencumbered 802.11AN wireless chip in existence. The only bright side to that is none of that hardware has system-wide access the way these backdoor coprocessors do.
        zdkl 9y ago
        Who needs system wide compromise when you can read what's hitting both RAM and persistent memory.
      - roblabla 9y ago
        I doubt we can get Intel to change directly. Most people don't buy from them directly anyway. My belief is that we can get OEMs to consider this a serious issue, and have them turn into a market pressure on CPU manufacturers. After all, OEM's life would be simpler if Intel simply didn't put the IME that everyone wants removed.

fghtr 9y ago

I think, if your goal is fully free laptop, you should consider Libreboot https://minifree.org/product/libreboot-t400/ https://minifree.org/product/libreboot-t400/. The IME has been fully removed from it.

miles 9y ago

See Tobias Platen's "Why I won’t buy the Purism Librem" for why he prefers Libreboot: http://blogs.fsfe.org/tobias_platen/2015/09/22/why-i-wont-buy-the-libre/ http://blogs.fsfe.org/tobias_platen/2015/09/22/why-i-wont-bu...

roblabla 9y ago
The alternative presented is a laptop with 2008 hardware. Sure, I can do that. But that's not sending a message to the industry. That's just living in a bubble, while still giving Lenovo some money. Don't get me wrong, I love minifree and what they're doing, I just don't believe it to be a viable alternative. There are lots of people who can't or won't use outdated hardware. Purism is a sane solution to this problem. Also, Purism is taking steps to get coreboot to run on their laptops[1][2], so the graph on this website isn't even right anymore. And I just found out that, interestingly, the T400 and X200 both come with IME. The only difference is that the AMT can be fully disabled on older intel chipsets[0]. [0]: https://libreboot.org/docs/hardware/gm45_remove_me.html https://libreboot.org/docs/hardware/gm45_remove_me.html [1]: https://puri.sm/posts/coreboot-on-the-librem-13-v2-part-1/ https://puri.sm/posts/coreboot-on-the-librem-13-v2-part-1/ [2]: https://puri.sm/posts/coreboot-on-the-skylake-librems-part-2/ https://puri.sm/posts/coreboot-on-the-skylake-librems-part-2...
- ynniv 9y ago
  First, Lenovo doesn't receive any money when you buy a used laptop. Second, using a ten year old laptop sends a much stronger message than buying a new, slightly alternative laptop. Third, security is like history - if you want to get it right, you have to wait for rigors of time to reveal the truth. We think that Purism is at least as secure as Libreboot, but we know a lot more about ten year old hardware than something fresh off the fab in China.
- lurker12390879 9y ago
  Coreboot does run on their laptops, but it has too many blobs to make the Libre crowd happy. Purism has mentioned they may take interest in porting the rest of the way to libreboot someday. The real issue too is that a lot of naysayers dislike Purism because they provide modern competition to people selling Librebooted laptops.

bo1024 9y ago

Awesome and I applaud that decision. I think you'll be very happy with the quality.