4 ms·

> The fundamental objection with ME isn't that it's "proprietary" or "non-libre" or whatever other ideological objections, it's that it's an opaque embuggerance

> The fundamental objection with ME isn't that it's "proprietary" or "non-libre" or whatever other ideological objections, it's that it's an opaque embuggerance that makes any analysis or reasoning about the system's security/trustworthiness/reliability completely impossible and specious. Erm, your fundamental objection is exactly the same objection as it being non-libre. You presented the same argument while trying to distance yourself from it. Maybe you don't like the words "non-libre" or "proprietary" but you certainly seem to be arguing for the same thing that they are arguing for. > I don't care much about whether its source code is public or not, I care about the fact that I have no verifiable and irreversible way to disable that little implant's function. Having source code is but a tool towards having the freedom to do what you want with your hardware. I can't see another tool that would also work and give the verifiability that you want. Again, maybe you don't like the way people argue for it, but you're arguing for the same freedom that others want.

userbinator 9y ago
Having source code is but a tool towards having the freedom to do what you want with your hardware. I can't see another tool that would also work and give the verifiability that you want. Access to the firmware binary running on the ME processor and documentation for the latter would be even better than having source, since the latter assumes you trust the toolchain too.
kazagistar 9y ago
Auditability and modifyability are different.
timonovici 9y ago
The source code won't give you shit. Even if you have it all, right here, right now: 1. you cannot disable it completely - there's an image of Intel ME, burned into the chipset, which checks for the presence of the ME + AMT in the SPI flash, and it checks for signature. (There's an exception to this, with skylake and above) 2. you cannot run a modified or reverse engineered version of it, unless you have Intel's private key to sign your own binary. Basically the hardware is tivoized.
- jordigh 9y ago
  Well, source code under GPLv3 would prevent this too. The source code is one building block, but it's not the only one. It does seem like a necessary building block to begin with, though. Otherwise, how could you make the hardware do what you want it to do if you don't even have access to modify what it's currently doing?

userbinator 9y ago

Having source code is but a tool towards having the freedom to do what you want with your hardware. I can't see another tool that would also work and give the verifiability that you want. Access to the firmware binary running on the ME processor and documentation for the latter would be even better than having source, since the latter assumes you trust the toolchain too.

kazagistar 9y ago

Auditability and modifyability are different.

timonovici 9y ago

The source code won't give you shit. Even if you have it all, right here, right now: 1. you cannot disable it completely - there's an image of Intel ME, burned into the chipset, which checks for the presence of the ME + AMT in the SPI flash, and it checks for signature. (There's an exception to this, with skylake and above) 2. you cannot run a modified or reverse engineered version of it, unless you have Intel's private key to sign your own binary. Basically the hardware is tivoized.

jordigh 9y ago
Well, source code under GPLv3 would prevent this too. The source code is one building block, but it's not the only one. It does seem like a necessary building block to begin with, though. Otherwise, how could you make the hardware do what you want it to do if you don't even have access to modify what it's currently doing?