15 ms·
Purism Librem Laptops Completely Disable Intel’s Management Engine
- nerdponx 9y agoThere's a blog post on their site that goes into detail on how this is done: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/
- dmix 9y agoThat's a fun article. Thanks. The best part was the wifi breaking randomly. This is why I could never be a hardware guy: > Therefore, I started progressively whitelisting more modules so me_cleaner wouldn’t remove them, and testing if it affected the wifi module. This was annoying to test because I’d have to change me_cleaner, neutralize the ME firmware, then copy the image from my main PC to the Librem then flash the new image, poweroff, then restart the machine, and if the Wifi wasn’t working, which was 99% of the time, I had to copy the files through a USB drive. Sounds painful. We've all had debugging experiences like that once in our lives. I appreciate their effort and public documentation!
- uytuijhgj 9y agoThat article's crap. You want http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
- pmoriarty 9y agoHow much do they cost and where can I buy them?
- deleted 9y ago[deleted]
- 0x6c6f6c 9y agohttps://puri.sm/ https://puri.sm/ is their website and should have more there.
- flukus 9y agoThe products page of the linked article: https://puri.sm/products/ https://puri.sm/products/ . That Librem 11 looks tempting...
- em3rgent0rdr 9y agoLibrem 11 looks tempting, but important to note that "To be announced (prototyping and supplier negotiations phase)" which probably means several more months...
- broodbucket 9y agoand now they have a phone to build.
- mkesper 9y agoIn Germany: https://www.floss-shop.de/de/hardware/ https://www.floss-shop.de/de/hardware/
- hedora 9y agoI really want one of these, but the ergonomics look awful. Is there a technical reason they only come with low resolution (1080p) screens? (“Linux” is not a valid reason...) Also, as much as I would like a 15” screen, the off center keyboard is a deal-breaker. It’s just asking for RSI. Does anyone own one? How is the trackpad / keyboard / battery life / fan noise? Maybe I can deal with 1080p in exchange for a reasonable OS and security.
- mi100hael 9y agoYeah I would have bought one when I was shopping but numpads on a laptop are a terrible idea. I ended up going for a Dell Precision 15 instead.
- duncan_bayne 9y agoSeconded. I discovered this the hard way when I bought a 15" Lenovo.
- klibertp 9y ago> numpads on a laptop are a terrible idea. I disagree completely. Having a numpad on a laptop is the only way of getting cursors and function keys (from Home to Insert to Delete) in a sane place. On my current laptop, were it not for a numpad, I'd have to press a Fn key every time I wanted to use Home/End. I'd also need to hunt for Delete somewhere above the Backspace, and PageUp/PageDown being on both sides of Up arrow (and close to it!) is simply infuriating. And it's a Dell Latitude[1], much better in this regard than tons of normal laptops. I'm not against remapping some keys, but you need the physical keys to be there in the first place to remap to them! Without the numpad, disabling the irritatingly placed PageDown/PageUp keys would leave me without the keys completely. There are downsides - mainly the fact that it's harder to work with a laptop actually on my lap, ie. it's harder to balance the device when most of the applied weight is on the left side, but I can deal with this with a $20 laptop tray. For additional $10 I can even get a tray with a place for an external mouse, although as I use trackballs exclusively I have little need for it. [1] https://www.computershopper.com/var/ezwebin_site/storage/images/media/images/dell-latitude-15-5000-keyboard/1258789-1-eng-US/dell-latitude-15-5000-keyboard.jpg https://www.computershopper.com/var/ezwebin_site/storage/ima...
- em3rgent0rdr 9y agoI'm still waiting for them to ship a Librem 15 I ordered exactly 2 weeks ago. The product page still says "Available to ship from inventory (1-2 weeks ETA), while quantities last" so I don't know why that hasn't shipped or why they haven't responded to my email about an update of status.
- brobinson 9y agoGreat news! Does anyone know of any efforts to remove the ME equivalent from AMD's processors?
- kevin_thibedeau 9y agoIntel is going to screw them over soon with a hardware revision.
- hawski 9y agoIs there any other new hardware other than Purism and Chromebooks that uses Coreboot/Libreboot? EDIT: A list from coreboot site [1] does not look comprehensive as it is not mentioning Chromebooks or Purism. [1] https://www.coreboot.org/Products https://www.coreboot.org/Products
- ac29 9y agoPC Engines uses coreboot for their APU boards (usually used as routers or firewalls). The price/performance & energy efficiency isn't too compelling in my opinion, but if you like the idea of running your router, firewall or other network appliance on x86 with an open source BIOS and OS, its worth looking into.
- forapurpose 9y agoMinistry of Freedom claims some of its laptops don't have ME, such as the Libreboot T400
- ploggingdev 9y agoWhat do the security experts think about Librem products? Does it live up to what's promised? Any gotchas users need to be aware of? I have not come across their comments on this topic, so links to the same would be appreciated if I missed them.
- whamlastxmas 9y agoThey have a track record of lying about their product, though disabling IME is a big step towards living up to their marketing.
- bo1024 9y agoExamples?
- forapurpose 9y ago> The Management Engine (ME), part of Intel AMT Not hugely consequential, but Intel's product line is confusing enough without any help. AMT for years has been an application that runs on ME (unless something has changed). From the authoritative book, Platform Embedded Security Technology Revealed: Safeguarding the Future of Computing with Intel Embedded Security and Management Engine by Xiaoyu Ruan, a security researcher with the Platform Engineering Group at Intel (2014) The list of old inventions finding new applications in new domains goes on. The new applications benefit a much wider population and improve more people’s quality of life. When Intel’s Active Management Technology (AMT) first appeared in 2005, it was marketed as an advanced system management feature for Intel 82573E series gigabit Ethernet controllers. In 2007, a new embedded coprocessor, namely the management engine, was introduced. Originally, the management engine was designed primarily for implementing the AMT rather than running security applications. At that time, the main problem that was supposed to be resolved by the embedded engine and AMT was the high expense and difficulty of system management by network administrators. The management engine was a component of Intel chipsets with vPro technology. The Intel AMT implementation was moved from gigabit Ethernet controllers to the management engine and became a feature of vPro. Intel AMT is not the only application on the management engine. The first security application on the engine was the integrated TPM ...
- G8WyaX 9y agoWhat about the https://en.wikipedia.org/wiki/Baseband_processor#Security_concerns https://en.wikipedia.org/wiki/Baseband_processor#Security_co... in Purism 5 phone?
- em3rgent0rdr 9y agoThe baseband processor isn't started as first boot, and as I understand it can be selectively enabled/disabled while main cpu is on.
- flashdance 9y agoThe Purism 5 is going to be using a baseband processor that's similar to ones used in car infotainment systems. It won't share RAM with the CPU and will be isolated from the rest of the phone. It'll even have a hardware kill switch, where you can physically sever the circuit, if you're that paranoid! The CEO of purism did an interview where he went to a moderate degree of depth on the technical side, you can watch it here if you're curious. He mentions all of the above features in it, and more! https://www.youtube.com/watch?v=4SwE9W8JasA https://www.youtube.com/watch?v=4SwE9W8JasA
- flashdance 9y agoJust noticed I said Purism 5. It's called the Librem 5--and of course I see this after it's too late to edit! :'(
- guaka 9y agoFor website of a purist software freedom company I was surprised to see Privacy Badger show up with a red 5: ajax.googleapis.com fonts.googleapis.com secure.gravatar.com fonts.gstatic.com code.jquery.com
- belorn 9y agoCan someone explain why you would want to link to fonts/js libraries rather than have a copy on the server and server that yourself?
- askvictor 9y agoOne reason would be that the browser will cache them if they are used in multiple sites, so loading will be much faster on subsequent sites using the same resources. Another might be that such resources load faster off a CDN than your own server.
- nilved 9y agoIn practice, this never happens. The value is certainly less than the data you're selling about your users to Google.
- askvictor 9y agoWhat data are you giving to Google (or another CDN) by loading jQuery or a font from them? What does the ToS say? Genuine question. Edit: here's the ToS: https://developers.google.com/speed/libraries/terms https://developers.google.com/speed/libraries/terms If you believe Google, they're not collecting anything.
- nilved 9y agoDon't be naive.
- skj 9y agoValue to whom? The site loads faster (so people like it slightly better), it's easier to maintain (less files to serve and keep track of), all for the cost of something the site owners didn't pay for in the first place.
- scoopr 9y agoI've been looking at librem laptops, as I'd kinda like a dedicated linux laptop. But as with many of these kinds of projects, i18n concerns are secondary, and in this case, there is no scandinavian/nordic keyboard options :/ (And I do appreciate that it might not be quite simple to have all kinds of keyboard configurations available)
- zsoltgyongyosi 9y agoIt's surprisingly easy to switch to the English layout. As a programmer, it was refreshing to leave behind the convoluted key combinations while coding. (I'm looking at you, `tilde`, on a Hungarian keyboard) On Linux, writing accents using a compose key isn't much slower than typing the letters directly either.
- einr 9y agoScandinavian languages do not really have accented letters, though. What we have in Swedish, Danish and Norwegian are three more letters than the English alphabet, with distinct sound and meaning, that happen to look a bit like accented A's and O's. These letters are very common in our languages and a without them would be nigh unusable; like a keyboard without V, P or B (these letters have similar frequency in Swedish)
- vidarh 9y agoI'm Norwegian, and what I've found is that I prefer a US keyboard layout for coding, and only switch to a Norwegian layout when writing Norwegian. Especially given that æøå are generally using the triangle right of p and l, and so messing with my brackets and braces. I remember those well enough that I have no reason to have them on the keyboard, which doesn't make it particularly inconvenient not to have them on the keys, and I can always switch to US layout with a quick keyboard combo if I need a character I don't remember the position of on Norwegian layout. Of course, it helps that I live in the UK where the layout differences between US/UK keyboards are minor, so I'm not particularly inconvenienced when I have to use someone else's keyboard - if I lived in Norway I'd probably have stuck to a Norwegian layout.
- sspiff 9y agoYou can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap door setting - once disabled, there is no way to turn it back on. From what I've heard, this disabling is done through the Intel HAM (high assurance mode), but I have no idea what the differences between the Dell and Purism approaches are.
- n1000 9y agoCould you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.
- nickpsecurity 9y agoProbably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements: https://gdmissionsystems.com/cyber/products/trusted-computing-cross-domain/trusted-multilevel-computing-solution https://gdmissionsystems.com/cyber/products/trusted-computin... http://www.integrityglobalsecurity.com/pages/solutions.html http://www.integrityglobalsecurity.com/pages/solutions.html https://www.ghs.com/products/safety_critical/integrity-do-178b.html https://www.ghs.com/products/safety_critical/integrity-do-17... Warning: These companies' marketing folks like to go overboard. Sharing for the technical data and Dell references but not endorsing every claim you see. ;)
- sspiff 9y agoIt was indeed an Optiplex system. You can find reference to it in this KB article[1] about replacement system boards. [1] http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/manageability-mode-options-on-replacement-system-boards-for-the-dell--optiplex--755---kb-article---327359?lang=en http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/...
- sspiff 9y agoSorry for the late response! I've just checked and I could not find it for most models. I could find it for the OptiPlex 7450 All-in-One, but not for the Precision line. At [1], you can find a screenshot of the setting that reflects this option. A colleague of mine ordered such a system and it came with a leaflet explaining that this meant that Intel ME was turned off and could no longer be turned on for this machine (trap door mechanism). It also explained that SKUs with Intel ME enabled could enter this state through the UEFI menu. He opened his system up and inspected the system board, and it was also labeled with a seal stating that Intel ME had been disabled on this system and could not be turned on. I'm trying to get hold of the leaflet so I can give you the exact wording Dell used for this. The fact that this state can be entered through a UEFI program makes me believe that other systems running Dell's newest UEFI platform will have the same capability, but I have not been able to confirm this. My screenshot is from the Belgian Dell enterprise portal. The wording translates to "System management: vPro Management Engine (ME) not executable, customer order". [1] https://i.imgur.com/lpidbH3.png https://i.imgur.com/lpidbH3.png
- skocznymroczny 9y agoHow do you verify it's disabled? It's like saying "it's open source, it has no backdoors!"
- dredmorbius 9y agoQuestion: how would one ensure that such systems aren't interdicted, presuming that concern falls within your threat model? http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969.html http://www.spiegel.de/international/world/the-nsa-uses-power...
- jonathanstrange 9y agoCall me cynic, but it wouldn't surprise me if the NSA intercepted those in their hardware interception program[1] and install spyware on them whenever they are delivered to an address outside the US. [1] https://www.extremetech.com/computing/173721-the-nsa-regularly-intercepts-laptop-shipments-to-implant-malware-report-says https://www.extremetech.com/computing/173721-the-nsa-regular...
- deleted 9y ago[deleted]
- dmix 9y agoThat's why the OS should check to make sure the ME is still disabled and not boot otherwise, or signature check it somehow, create a hardware indicator, etc. But then there's still the harddrive firmware and who knows what else. Still, this is upping the bar quite a bit if you're security conscious. In security all you can do is make the attackers lives harder, you can't fool proof it. Plus they mentioned two different open source tools to disable it yourself (via software, not hardware as they do here). So you can buy a laptop with cash off craigslist and do it yourself if you're super paranoid.
- squarefoot 9y ago"But then there's still the harddrive firmware and who knows what else." Graphics card blobs, wifi cards blobs, etc. Just about every vital subsystem on a modern PC/phone/tablet etc. has been compromised by design through closed device drivers so that someone with enough skills and access to those information (such as some 3 letter agencies) can create a sort of covert channel where data can be computed, read or stored and transmitted without any means of intercepting that by any applications, because every part it's going to pass through contains some closed code that can be instructed to encrypt and tunnel the data from one place to another. This came to mind years ago when I was struggling with a network card requiring a firmware blob that refused to load. I started wondering why were they making things so complicated for users and admins by keeping drivers closed; that blob could have contained just about every possible malware in existence and I would never have noticed it. Then I had a flash: disk drives also contain closed firmware, and video cards too. I recall having thought "heh, if they had a blob into the CPU as well they could close the circle and build a system where they can move information inside the machine or receive/transmit them from/to the external world completely unbeknown to the user. Then years later I read about Intel ME and got a thousand flashes because I almost saw that coming. To me there is no such thing as a trustworthy system anywhere in the world, at least not until every single line of its software, firmware and hardware has been opened for public scrutiny. There is too much at stake, and surveillance is a damn rich business both for companies and people in power.
- nerdponx 9y agoDoes disabling the IME have implications for performance or energy consumption?
- bradfa 9y agoProbably no implications on performance or energy consumption. Disabling it will prevent many remote management capabilities which are desirable in corporate environments. Some details: https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt https://www.kernel.org/doc/Documentation/misc-devices/mei/me...
- driverdan 9y agoI love the concept but not the prices. In comparing their 13" to the Macbook Pro 13" I found the prices are about the same. The Macbook has a much better screen, a better touchpad, and the resale value will be much higher so its lifetime cost will be lower.
- Finnucane 9y agoUnfortunately, doing custom manufacturing for a limited market (i.e., people who will pay for privacy) means they're probably never going to be able get price parity with mass-market brands.
- bo1024 9y agoI don't worry so much about resale because I plan on using my computers as long as possible. The touchpad works fine for me, and I don't notice the difference in screens (except aspect ratio). Battery life and weight are comparable. So to me, the privacy factor and supporting Purism is well worth the price. Also the Librem probably runs native Linux better, which is a huge difference-maker for me.
- cat199 9y agoExcept for the long run you're pretty much guaranteed a brick when apple drops hardware support if you plan on running MacOS.. Not sure if these have replaceable battery which is another gotcha, so it might be a moot point in the 'disposable hardware' era.. That said, lack of replaceable battery on macs will change the resale value picture.. don't think that's really hit things yet..
- jxramos 9y agoOn a side note I liked reading about a phone campaign by the same group. This post introduced me to it. Librem 5 – A Security and Privacy Focused Phone https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/
- louithethrid 9y agoI want to see the layout in that chip, i want to see the dissasembly that ran on it. Playing dead with a clock signal still going into it- thats not enough.
- tekjenitalor 9y agoIf in doubt act correctly and in due accordance with all applicable law and regulation: all will then be fine. If you can't follow our rules then you deserve to be persecuted, surveilled and imprisoned at our whim but always know that you are being watched and your past will be used against you. Luddite time?