3 ms·

Yeah, I am not saying that the mere presence and integration of ME/PSP is indicative of a nefarious plot, these things have commercial merit which is obvious to

Yeah, I am not saying that the mere presence and integration of ME/PSP is indicative of a nefarious plot, these things have commercial merit which is obvious to anyone who knows anything. I'm saying that the specific way that both vendors are handling this is uncharacteristic at least for Intel, and suspicious because it leaves a lot of crucial ethical and technical questions completely unanswered. There are some obvious reasons why it's not completely open, notably that ME enables feature unlocking keys and DRM at a lower cost than more hardware-involved approaches; but I don't think that explains the recent PR attempts and complete dodging of this issue.

lamontcg 9y ago
> is uncharacteristic at least for Intel Have you worked in large enterprise organizations that sold things to other large enterprise organizations? Did you go read the bit about how banks were pressuring Intel to include full blown JVMs into the ME and they resisted that? > leaves a lot of crucial ethical and technical questions completely unanswered. The truth is mundane which is that Intel wanted money from Banks, and a bunch of workers tried to split the difference between giving the Banks everything they wanted and trying not to engineer gaping security holes. They were operating with imperfect information and got that equation wrong. And the truth is that no company in the world attempts to engineer for perfect security. When security runs up against economic concerns they try to balance the costs and benefits. Assume that we (you the reader) can know perfectly which possible vulnerabilities are actually exploitable and which are not. If Intel spends any time on possible vulnerabilities which in practice are not exploitable or never exploitable, that is entirely wasted time. If AMD spends no time at all on those, AMD can focus on shipping features and get ahead of Intel doing useful work. Since Intel and AMD cannot have perfect information, they make guesses as to the impact of possible security holes. That naturally will always result in them "cutting corners" from the perspective of someone who measures them only on their security posture. Enterprise corporations like this are a complicated non-linear non-convex optimization algorithm that attempts to balance economic, security and other concerns against a complicated and shifting landscape in the face of imperfect information. Any company that tried to have always perfect security would largely fail in the marketplace. This is related to the explanation of why the locks on the front door of your house or apartment can likely easily be picked. Security concerns are sacrificed for economic concerns, commonly, everywhere around you.

lamontcg 9y ago

> is uncharacteristic at least for Intel Have you worked in large enterprise organizations that sold things to other large enterprise organizations? Did you go read the bit about how banks were pressuring Intel to include full blown JVMs into the ME and they resisted that? > leaves a lot of crucial ethical and technical questions completely unanswered. The truth is mundane which is that Intel wanted money from Banks, and a bunch of workers tried to split the difference between giving the Banks everything they wanted and trying not to engineer gaping security holes. They were operating with imperfect information and got that equation wrong. And the truth is that no company in the world attempts to engineer for perfect security. When security runs up against economic concerns they try to balance the costs and benefits. Assume that we (you the reader) can know perfectly which possible vulnerabilities are actually exploitable and which are not. If Intel spends any time on possible vulnerabilities which in practice are not exploitable or never exploitable, that is entirely wasted time. If AMD spends no time at all on those, AMD can focus on shipping features and get ahead of Intel doing useful work. Since Intel and AMD cannot have perfect information, they make guesses as to the impact of possible security holes. That naturally will always result in them "cutting corners" from the perspective of someone who measures them only on their security posture. Enterprise corporations like this are a complicated non-linear non-convex optimization algorithm that attempts to balance economic, security and other concerns against a complicated and shifting landscape in the face of imperfect information. Any company that tried to have always perfect security would largely fail in the marketplace. This is related to the explanation of why the locks on the front door of your house or apartment can likely easily be picked. Security concerns are sacrificed for economic concerns, commonly, everywhere around you.