8 ms·

Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD

Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing?

thg 9y ago
Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.
- tdb7893 9y ago
  What's the state of x86 emulation on ARM? Using ARM before that might be a dealbreaker. If I remember correctly Microsoft was working on it
  - my123 9y ago
    Release is on track for December 2017, but Qualcomm chips have ME-like firmware too (from SCM to the modem)
- agumonkey 9y ago
  it's less painful if you only pay half for being pwnd
- bryanbuckley 9y ago
  AMD PSP is an ARM core. Running some derivative of Trustonic OS (based on L4), if I'm not mistaken.
  - em3rgent0rdr 9y ago
    Somewhat numerous that the most secure OS kernel (the L4) is utilized in a bad way to result in a less secure system overall.
- disconnected 9y ago
  > ARM could be a affordable alternative to x86 if that works for you. Even the open source friendly Raspberry Pi relies on proprietary blobs and proprietary firmware, with vast parts of the documentation only being available to system integrators (meaning: not you) under an NDA. Theirs is a Broadcom chip, but my understanding is that the scenario is pretty much the same for other ARM vendors. If the chip is anything more complicated than your average 8-bit micro-controller, expect it to be running some kind of "system" which is, of course, closed source.
  - khedoros1 9y ago
    The stuff running on the ARM itself is all open, but the firmware blob runs on a separate CPU with a different instruction set, which has a view of the entire memory map of the device and ultimate control over the device's behavior (sound familiar?). I may be wrong, but my impression is that a lot of the other ARM boards out there have the ARM chip as the main CPU, and without a management chip watching it. In any case, a board like that, or a Pi with a reverse-engineered firmware blob (currently in development) would be better than the Raspberry Pi as it is now.
  - wolfgke 9y ago
    > Even the open source friendly Raspberry Pi Broadcom (producer of the chips used on the RPi) and open source friendly? A sense an oxymoron.
api 9y ago
Yep. "Let's put a chip in it" IoT nightmare now applies recursively to chips. Everything is insecure by design. I am really looking forward for either ARM to displace x64 or even better RISC-V. With ARM you have many more vendors so more chance for options, and RISC-V is the ultimate in openness.
- my123 9y ago
  Good luck getting a modern ARM SoC which doesn't depend on binary blobs.
  - api 9y ago
    At least you might be able to get a chip without a backdoor in hardware. Binary blobs are still a little easier to audit and can in theory be replaced.
    - my123 9y ago
      ME FW is just a signed binary blob after all... Just running on an x86 core in the PCH, no difference at all compared to Qualcomm SCM/TZ firmware in that regard at least...
  - mastax 9y ago
    i.MX6 is modern-ish and is bootable without blobs.
    - ac29 9y ago
      Modern-ish as in smartphone-from-2010? Cortex A9 is pretty old.
    - wolfgke 9y ago
      > i.MX6 is modern-ish and is bootable without blobs. i.MX8 will soon be released in quantity to the public and it is claimed by people who experimented with testing samples of it that it is similarly open as the i.MX6 in this sense.
orblivion 9y ago
My alternative is a Librem: https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/ https://puri.sm/posts/purism-librem-laptops-completely-disab...
- tpearson-raptor 9y ago
  Note that the ME still runs on their platforms. They are not being honest about that fact.
  - em3rgent0rdr 9y ago
    Actually Purism is being completely honest that they have isolated and disabled the ME while not actually removing it.
    - tpearson-raptor 9y ago
      No, it is not isolated and it is certainly not disabled. It must run as part of the initial platform boot; whether or not they politely ask it to shut itself down after boot is irrelevant to the core claim being made that the ME is "isolated and disabled" on their platforms.
      - orblivion 9y ago
        Can you provide a source on this?
stefantalpalaru 9y ago
> Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing? Yes, but it was implemented only after Piledriver (family 15h). I have an FX-8320E overclocked at 4.4 GHz on all cores, all the time (turbo core disabled) and I'm happy with it.

Unreal. Kept scrolling and the vulnerabilities kept coming. Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing?

thg 9y ago

Well, maybe AMD does at least some security reviewing on their own? /s ARM could be a affordable alternative to x86 if that works for you.

tdb7893 9y ago
What's the state of x86 emulation on ARM? Using ARM before that might be a dealbreaker. If I remember correctly Microsoft was working on it
- my123 9y ago
  Release is on track for December 2017, but Qualcomm chips have ME-like firmware too (from SCM to the modem)
agumonkey 9y ago
it's less painful if you only pay half for being pwnd
bryanbuckley 9y ago
AMD PSP is an ARM core. Running some derivative of Trustonic OS (based on L4), if I'm not mistaken.
- em3rgent0rdr 9y ago
  Somewhat numerous that the most secure OS kernel (the L4) is utilized in a bad way to result in a less secure system overall.
disconnected 9y ago
> ARM could be a affordable alternative to x86 if that works for you. Even the open source friendly Raspberry Pi relies on proprietary blobs and proprietary firmware, with vast parts of the documentation only being available to system integrators (meaning: not you) under an NDA. Theirs is a Broadcom chip, but my understanding is that the scenario is pretty much the same for other ARM vendors. If the chip is anything more complicated than your average 8-bit micro-controller, expect it to be running some kind of "system" which is, of course, closed source.
- khedoros1 9y ago
  The stuff running on the ARM itself is all open, but the firmware blob runs on a separate CPU with a different instruction set, which has a view of the entire memory map of the device and ultimate control over the device's behavior (sound familiar?). I may be wrong, but my impression is that a lot of the other ARM boards out there have the ARM chip as the main CPU, and without a management chip watching it. In any case, a board like that, or a Pi with a reverse-engineered firmware blob (currently in development) would be better than the Raspberry Pi as it is now.
- wolfgke 9y ago
  > Even the open source friendly Raspberry Pi Broadcom (producer of the chips used on the RPi) and open source friendly? A sense an oxymoron.

api 9y ago

Yep. "Let's put a chip in it" IoT nightmare now applies recursively to chips. Everything is insecure by design. I am really looking forward for either ARM to displace x64 or even better RISC-V. With ARM you have many more vendors so more chance for options, and RISC-V is the ultimate in openness.

my123 9y ago
Good luck getting a modern ARM SoC which doesn't depend on binary blobs.
- api 9y ago
  At least you might be able to get a chip without a backdoor in hardware. Binary blobs are still a little easier to audit and can in theory be replaced.
  - my123 9y ago
    ME FW is just a signed binary blob after all... Just running on an x86 core in the PCH, no difference at all compared to Qualcomm SCM/TZ firmware in that regard at least...
- mastax 9y ago
  i.MX6 is modern-ish and is bootable without blobs.
  - ac29 9y ago
    Modern-ish as in smartphone-from-2010? Cortex A9 is pretty old.
  - wolfgke 9y ago
    > i.MX6 is modern-ish and is bootable without blobs. i.MX8 will soon be released in quantity to the public and it is claimed by people who experimented with testing samples of it that it is similarly open as the i.MX6 in this sense.

orblivion 9y ago

My alternative is a Librem: https://puri.sm/posts/purism-librem-laptops-completely-disable-intel-management-engine/ https://puri.sm/posts/purism-librem-laptops-completely-disab...

tpearson-raptor 9y ago
Note that the ME still runs on their platforms. They are not being honest about that fact.
- em3rgent0rdr 9y ago
  Actually Purism is being completely honest that they have isolated and disabled the ME while not actually removing it.
  - tpearson-raptor 9y ago
    No, it is not isolated and it is certainly not disabled. It must run as part of the initial platform boot; whether or not they politely ask it to shut itself down after boot is irrelevant to the core claim being made that the ME is "isolated and disabled" on their platforms.
    - orblivion 9y ago
      Can you provide a source on this?

stefantalpalaru 9y ago

> Most annoying thing is that there isn’t even a real alternative. If I understand it right then AMD chips have pretty much the same thing? Yes, but it was implemented only after Piledriver (family 15h). I have an FX-8320E overclocked at 4.4 GHz on all cores, all the time (turbo core disabled) and I'm happy with it.