5 ms·

So if switching to AMD is NOT the solution, what is? ARM? For your portable needs there is: https://puri.sm/posts/purism-librem-laptops-completely-disable-inte

So if switching to AMD is NOT the solution, what is? ARM? For your portable needs there is: https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/ https://puri.sm/posts/purism-librem-laptops-completely-disab...

jlebrech 9y ago
using your dollar elsewhere will help.
- akoncius 9y ago
  for example where?
  - jlebrech 9y ago
    AMD?
    - Crespyl 9y ago
      AMD processors now include PSP/TrustZone.
SXX 9y ago
AMD PSP is efficiently ARM tech called TrustZone so I would expect most of SOC to have own backdoors as well. So far only option is POWER-based systems and they're costly.
- walterbell 9y ago
  Pre-PSP AMD CPUs are an option.
cjsuk 9y ago
SPARC was the solution. It's open and royalty free and was sold by multiple vendors. Add to that Open Firmware and you're done. It's also not the hacked up turd that x86-64 is or the fragmented mess that ARM is. Problem is it's dead. Going out on a limb here, but we can solve this with another layer of abstraction in the long term. We need to develop a fully portable open source virtual machine model (think p-code machine) that is portable and make that the canonical hardware abstraction. That makes all vendors irrelevant if they can't comply with it and opens the market to new hardware vendors with different sales models to provide an optimised hardware implementation of that abstraction. The incumbents (ARM, Intel, AMD) can't sell a security model if the abstraction denies them that ability. Sure they can sell you out, but new competition which is privacy focused should end that.
- chii 9y ago
  > Problem is it's dead. and if it's so good, why is sparc dead?
  - detaro 9y ago
    Because most people don't buy their CPUs for openness, they buy them for price, performance and software support. As far as I know, Fujitsu still sells it with high-end servers (attempting to take on IBM POWER), and it's still floating around in embedded designs, but it's a niche choice, with the associated downsides.
    - cjsuk 9y ago
      Yes. Software support was good, but price and performance were not. That and Oracle.
  - the_mitsuhiko 9y ago
    Big endian, not enough suppliers, Oracle, too expensive, not enough market share and much more
  - sverige 9y ago
    They are not making more, but reasonably priced used sparc64 servers are still reasonably easy to find. OpenBSD runs well on most models.
- sfifs 9y ago
  wasn't Java supposed to be precisely that?
  - cjsuk 9y ago
    Yes I suppose it was.
deno 9y ago
For desktop your options are: — FX 8350 (Piledriver) from AMD with no PSP: very cheap, no flashing necessary, but not the best performance. Single core performance much worse than even Pentium G4620[1]. — Some Intel processors and a Raspberry Pi: much better performance but you have to ME_Clean the firmware, hence the Pi. — POWER9 processor for amazing performance and completely open & free firmware all around: the CPU is $400 but you get $400 worth of performance, PCIe 4.0 etc., however the only mainboard you can get right now costs $2000, and it’s not x86, so you’d need to run your Windows VMs (if you need) on a seperate box. Personally I recommend used IvyBridge-EP or Haswell Xeon E5 system, make sure it takes ECC DDR3 Reg ram and you can pick up lots of very cheap DDR3 ECC memory to go along with it. Performance is pretty good, on par with mid level Ryzen[1], and it’s recent enough to have all the hardware extensions anyone cares about. [1] http://cpu.userbenchmark.com/Compare/AMD-FX-8350-vs-Intel-Pentium-G4620/1489vs3895 http://cpu.userbenchmark.com/Compare/AMD-FX-8350-vs-Intel-Pe... [2] http://cpu.userbenchmark.com/Compare/Intel-Xeon-E5-1650-v2-vs-AMD-Ryzen-5-1600/m7574vs3919 http://cpu.userbenchmark.com/Compare/Intel-Xeon-E5-1650-v2-v... EDIT: Post before wrongly stated that you need pre-Skylake chip. Skylake/Kabylake µarch is also an option now, however some restrictions apply. I don’t think it’s very good value though, at least until Coffeelake is compatible.
- jabl 9y ago
  > Personally I recommend IvyBridge-EP or Haswell Xeon E5 Err, the ME has been present on every Intel system since 2006 or so. The only thing that changed with Skylake is that the ME runs on an x86 core, on previous processors the ME ran on some RISC microcontroller.
  - deno 9y ago
    That’s not the only thing, but yeah I suppose you can get Skylake/Kabylake now with the HAP workaround.
  - ChickeNES 9y ago
    Not just any RISC, but ARC, a descendant of the SNES's Super-FX chip
  - 9y ago
timonovici 9y ago
It's good to note that you still have mysterious chunks of blobs with newer laptops (including the purism one), also thanks to Intel - that's Intel FSP, that does the initialization for the processor and the memory. Second, all system since about....2007 (?) have a Intel ME ROM burned inside the chipset, so there's no telling what is still running there, and what exactly is capable of.
als0 9y ago
ARM is an option as long as you have control over the TrustZone code, and some manufacturers give that to you. You'd probably have to rule out the large SoC vendors, though.
SparkleBunny 9y ago
https://en.wikipedia.org/wiki/RISC-V https://en.wikipedia.org/wiki/RISC-V
nickpsecurity 9y ago
Maybe this: https://minifree.org/product/libreboot-t400/ https://minifree.org/product/libreboot-t400/ However, I assume any chip released after they added the backdoors also has the backdoors. So, you'd be looking for pre-2007, Pentium-class chips in SMP configuration. Maybe Pentium 4 Prescot-2M or Cedar Mill. Wikipedia shows the latter was on same node as Core Duo with 3-3.6GHz plus 2MB cache. Far as non-Intel, both PPC and SPARC used Open Firmware. Plenty of them on eBay. Gaisler also made GPL versions of Leon3 you could build yourself or buy as a development board for who knows what price. https://en.wikipedia.org/wiki/Open_Firmware https://en.wikipedia.org/wiki/Open_Firmware In high-assurance security, I remember BootSafe tech letting someone write firmware in Java to benefit from all its testing and verification tech that was then translated into Open Firmware's Forth in a way that preserved the properties. That tech went proprietary but still exists. Something similar could be done in FOSS with a Rust or SPARK to Forth converter leveraging hard work already done by compiler/verification teams of source languages. http://www.cs.cornell.edu/~kozen/papers/acsac.pdf http://www.cs.cornell.edu/~kozen/papers/acsac.pdf

jlebrech 9y ago

using your dollar elsewhere will help.

akoncius 9y ago
for example where?
- jlebrech 9y ago
  AMD?
  - Crespyl 9y ago
    AMD processors now include PSP/TrustZone.

SXX 9y ago

AMD PSP is efficiently ARM tech called TrustZone so I would expect most of SOC to have own backdoors as well. So far only option is POWER-based systems and they're costly.

walterbell 9y ago
Pre-PSP AMD CPUs are an option.

cjsuk 9y ago

SPARC was the solution. It's open and royalty free and was sold by multiple vendors. Add to that Open Firmware and you're done. It's also not the hacked up turd that x86-64 is or the fragmented mess that ARM is. Problem is it's dead. Going out on a limb here, but we can solve this with another layer of abstraction in the long term. We need to develop a fully portable open source virtual machine model (think p-code machine) that is portable and make that the canonical hardware abstraction. That makes all vendors irrelevant if they can't comply with it and opens the market to new hardware vendors with different sales models to provide an optimised hardware implementation of that abstraction. The incumbents (ARM, Intel, AMD) can't sell a security model if the abstraction denies them that ability. Sure they can sell you out, but new competition which is privacy focused should end that.

chii 9y ago
> Problem is it's dead. and if it's so good, why is sparc dead?
- detaro 9y ago
  Because most people don't buy their CPUs for openness, they buy them for price, performance and software support. As far as I know, Fujitsu still sells it with high-end servers (attempting to take on IBM POWER), and it's still floating around in embedded designs, but it's a niche choice, with the associated downsides.
  - cjsuk 9y ago
    Yes. Software support was good, but price and performance were not. That and Oracle.
- the_mitsuhiko 9y ago
  Big endian, not enough suppliers, Oracle, too expensive, not enough market share and much more
- sverige 9y ago
  They are not making more, but reasonably priced used sparc64 servers are still reasonably easy to find. OpenBSD runs well on most models.
sfifs 9y ago
wasn't Java supposed to be precisely that?
- cjsuk 9y ago
  Yes I suppose it was.

deno 9y ago

For desktop your options are: — FX 8350 (Piledriver) from AMD with no PSP: very cheap, no flashing necessary, but not the best performance. Single core performance much worse than even Pentium G4620[1]. — Some Intel processors and a Raspberry Pi: much better performance but you have to ME_Clean the firmware, hence the Pi. — POWER9 processor for amazing performance and completely open & free firmware all around: the CPU is $400 but you get $400 worth of performance, PCIe 4.0 etc., however the only mainboard you can get right now costs $2000, and it’s not x86, so you’d need to run your Windows VMs (if you need) on a seperate box. Personally I recommend used IvyBridge-EP or Haswell Xeon E5 system, make sure it takes ECC DDR3 Reg ram and you can pick up lots of very cheap DDR3 ECC memory to go along with it. Performance is pretty good, on par with mid level Ryzen[1], and it’s recent enough to have all the hardware extensions anyone cares about. [1] http://cpu.userbenchmark.com/Compare/AMD-FX-8350-vs-Intel-Pentium-G4620/1489vs3895 http://cpu.userbenchmark.com/Compare/AMD-FX-8350-vs-Intel-Pe... [2] http://cpu.userbenchmark.com/Compare/Intel-Xeon-E5-1650-v2-vs-AMD-Ryzen-5-1600/m7574vs3919 http://cpu.userbenchmark.com/Compare/Intel-Xeon-E5-1650-v2-v... EDIT: Post before wrongly stated that you need pre-Skylake chip. Skylake/Kabylake µarch is also an option now, however some restrictions apply. I don’t think it’s very good value though, at least until Coffeelake is compatible.

jabl 9y ago
> Personally I recommend IvyBridge-EP or Haswell Xeon E5 Err, the ME has been present on every Intel system since 2006 or so. The only thing that changed with Skylake is that the ME runs on an x86 core, on previous processors the ME ran on some RISC microcontroller.
- deno 9y ago
  That’s not the only thing, but yeah I suppose you can get Skylake/Kabylake now with the HAP workaround.
- ChickeNES 9y ago
  Not just any RISC, but ARC, a descendant of the SNES's Super-FX chip
- 9y ago

timonovici 9y ago

It's good to note that you still have mysterious chunks of blobs with newer laptops (including the purism one), also thanks to Intel - that's Intel FSP, that does the initialization for the processor and the memory. Second, all system since about....2007 (?) have a Intel ME ROM burned inside the chipset, so there's no telling what is still running there, and what exactly is capable of.

als0 9y ago

ARM is an option as long as you have control over the TrustZone code, and some manufacturers give that to you. You'd probably have to rule out the large SoC vendors, though.

SparkleBunny 9y ago

https://en.wikipedia.org/wiki/RISC-V https://en.wikipedia.org/wiki/RISC-V

nickpsecurity 9y ago

Maybe this: https://minifree.org/product/libreboot-t400/ https://minifree.org/product/libreboot-t400/ However, I assume any chip released after they added the backdoors also has the backdoors. So, you'd be looking for pre-2007, Pentium-class chips in SMP configuration. Maybe Pentium 4 Prescot-2M or Cedar Mill. Wikipedia shows the latter was on same node as Core Duo with 3-3.6GHz plus 2MB cache. Far as non-Intel, both PPC and SPARC used Open Firmware. Plenty of them on eBay. Gaisler also made GPL versions of Leon3 you could build yourself or buy as a development board for who knows what price. https://en.wikipedia.org/wiki/Open_Firmware https://en.wikipedia.org/wiki/Open_Firmware In high-assurance security, I remember BootSafe tech letting someone write firmware in Java to benefit from all its testing and verification tech that was then translated into Open Firmware's Forth in a way that preserved the properties. That tech went proprietary but still exists. Something similar could be done in FOSS with a Rust or SPARK to Forth converter leveraging hard work already done by compiler/verification teams of source languages. http://www.cs.cornell.edu/~kozen/papers/acsac.pdf http://www.cs.cornell.edu/~kozen/papers/acsac.pdf