4 ms·

Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, oth

Re: Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money. I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down. Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1] [1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

openasocket 9y ago
I'm completely aware of the hap bit, I explicitly linked it in the GP, and so did the OP. If you have a source to back up the claim that Google offered money for access/documentation for disabling ME and were rejected, that's something, though.
- platinumrad 9y ago
  Ah, I was reading quickly and didn't realize that "while giving the US government the ability to disable ME" was a given, not one of the things that had to be shown. I did some quick searching (I mostly skipped the coreboot mailing list which is probably the most interesting place to look but I didn't want to spend too much time) and every reference I've found alludes to someone from Google or Coreboot _asking_ for Intel's assistance in the form of documentation or source code, which Intel has plenty of non-NSA-related reasons to refuse to provide for free (licensed code, preserving competitive advantage, DRM shit, etc.). I couldn't find any references to anyone offering to _pay_ Intel for ME firmware source code or similar but then again such an offer would hardly be public. So this is weak circumstantial evidence at best. I find AMD's refusal to cooperate with the FOSS community on the matter of its management coprocessor to be slightly suspicious as well as it's an area where it could possibly gain a significant competitive advantage vs Intel but a lot of Intel's reasons for keeping the IME locked down apply to AMD's insistence on black boxing its PSP as well.

openasocket 9y ago

I'm completely aware of the hap bit, I explicitly linked it in the GP, and so did the OP. If you have a source to back up the claim that Google offered money for access/documentation for disabling ME and were rejected, that's something, though.

platinumrad 9y ago
Ah, I was reading quickly and didn't realize that "while giving the US government the ability to disable ME" was a given, not one of the things that had to be shown. I did some quick searching (I mostly skipped the coreboot mailing list which is probably the most interesting place to look but I didn't want to spend too much time) and every reference I've found alludes to someone from Google or Coreboot _asking_ for Intel's assistance in the form of documentation or source code, which Intel has plenty of non-NSA-related reasons to refuse to provide for free (licensed code, preserving competitive advantage, DRM shit, etc.). I couldn't find any references to anyone offering to _pay_ Intel for ME firmware source code or similar but then again such an offer would hardly be public. So this is weak circumstantial evidence at best. I find AMD's refusal to cooperate with the FOSS community on the matter of its management coprocessor to be slightly suspicious as well as it's an area where it could possibly gain a significant competitive advantage vs Intel but a lot of Intel's reasons for keeping the IME locked down apply to AMD's insistence on black boxing its PSP as well.