3 ms·

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying tha

The real question is why there's no way to disable it. Certainly, if it was only for out-of-band management then why can't a retail consumer disable? Saying that it's because it does "hardware initialisation" is a weak response, Intel could've designed it in a way that doesn't do that such as with the very first models of CPUs with ME.

tptacek 9y ago
Was it universally easy to disable the lights-out managers on Unix server platforms 10-15 years ago, or did vendors sometimes omit that feature because only a tiny subset of their customers cared about that? I'm not saying you shouldn't be able to disable it.
cyphar 9y ago
I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what you or I want to be the case, but even if that were solved -- Intel CPUs have a whole variety of other issues that extend beyond ME. But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...
- jerheinze 9y ago
  You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.
  - cyphar 9y ago
    I'm not contradicting myself. The US Government isn't a normal consumer, and they have enough manpower to manually flash their machines (they might even get custom firmware from vendors). Intel hiding CPU features is nothing new. Especially a feature that requires you to attach a flash programmer to your motherboard in order to use it, because you need to modify the descriptor table. If you're asking why they didn't make it easier to "disable" Intel ME (it's still used for hardware initialisation), then we go back to economics. And they'd have to co-ordinate with people that write mainboard firmware in order to make sure this feature is available for all machines that have Intel CPUs. [Just to be clear, I'm also critical of Intel. I just don't understand the view that Intel's decisions are anything other than profit-driven. That's how all companies work.]

tptacek 9y ago

Was it universally easy to disable the lights-out managers on Unix server platforms 10-15 years ago, or did vendors sometimes omit that feature because only a tiny subset of their customers cared about that? I'm not saying you shouldn't be able to disable it.

cyphar 9y ago

I would think it's more pertinent to ask "is there an economic reason to allow a retail consumer to disable it". Most people don't know (or care) what Intel ME is, and some enterprises that buy machines with Intel CPUs want the management features. Companies aren't implicitly evil, they just don't have altruistic motives (generally). Which means that likely they didn't see it as having a good ROI. This is not what you or I want to be the case, but even if that were solved -- Intel CPUs have a whole variety of other issues that extend beyond ME. But all of that is missing the point that there is a way to disable it[1], with the HAP or AltMeDisable bits[2]. It's believed they were added for the US government to be able to disable Intel ME (after hardware initialisation). It's not easy (you have to reflash the firmware) because most vendor firmware doesn't allow "internal" flashing from userspace, but it is doable if you buy a $5 flash programmer and a Raspberry PI. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner [2]: https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bi...

jerheinze 9y ago
You're contradicting yourself, maintaining that they didn't allow disabling the ME because "nobody cared", and on the other hand that they specifically crafted a way to disable the ME for the US government. If they did for the US government, but hided it for everyone else, then the explanation can't be economical.
- cyphar 9y ago
  I'm not contradicting myself. The US Government isn't a normal consumer, and they have enough manpower to manually flash their machines (they might even get custom firmware from vendors). Intel hiding CPU features is nothing new. Especially a feature that requires you to attach a flash programmer to your motherboard in order to use it, because you need to modify the descriptor table. If you're asking why they didn't make it easier to "disable" Intel ME (it's still used for hardware initialisation), then we go back to economics. And they'd have to co-ordinate with people that write mainboard firmware in order to make sure this feature is available for all machines that have Intel CPUs. [Just to be clear, I'm also critical of Intel. I just don't understand the view that Intel's decisions are anything other than profit-driven. That's how all companies work.]