6 ms·

I would gladly trade in raw 30% performance from my Intel chip for some other platform that did not have American corporate/Deep State/NSA interests behind it.

I would gladly trade in raw 30% performance from my Intel chip for some other platform that did not have American corporate/Deep State/NSA interests behind it. I just want a minimum bootloader (open source) that boots into Linux - that's it. No "Enteprise management" crap, no NSA crap. I don't think I have any options. I certainly wouldn't buy Chinese or Russian, and I'm not aware of any EU member state having anything in the works either - but I think it's time we started seriously considering this. Google/Amazon/Microsoft have the muscle to actually do something about this, but no motivation. I'm surprised that they even trust Intel - it would take one high-profile security breach to turn their respective Cloud Computing businesses upside down - people are already jittery. I don't know if IBM Power is the solution, or ARM, but it's become abundantly clear that you can't trust Intel or AMD, or the x86 platform, anymore.

hugelgupf 9y ago
I would challenge the "no motivation" part given that the speaker that gave this talk works at Google.
eeZah7Ux 9y ago
Both Facebook and Google are working at disabling ME. They make no secret that they not trust it. NSA & other US orgs receive hardware without ME already. Surveillance is for the rest of us.
- ksk 9y ago
  >Surveillance is for the rest of us. Who has been spied on using Intel ME?
  - AstralStorm 9y ago
    It requires some serious web traffic analysis and honeypot to detect the attempt. That is assuming they would use remote access and not use ME locally. That would be even harder to prove once the malware uninstall itself.
    - ksk 9y ago
      Yeah, I fully understand that its not easy to detect this. But I'd also like to make an informed decision based on evidence, not speculation. So far I've seen bugs being reported that require the user to enable and provision AMT, which are quite serious, but entirely avoidable by keeping it disabled. Anyway, I'm happy to read more about it if you have any additional info.
      - eeZah7Ux 9y ago
        In security we work on addressing vulnerabilities, reducing the attack surface, prevention and so on. We don't wait for evidence that a vulnerability is being exploited. This is especially true for cryptography where a cryptosystem used today has to resist theoretical attackers that can use hardware that will exists in decades from now.
        ksk 9y ago
        Sorry, I can't understand what point you're replying to. To me, it sounded like you claimed it was being used for surveillance. I'm happy to go through the evidence if you have any.
- confounded 9y ago
  > Both Facebook and Google are working at disabling ME. They make no secret that they not trust it. I'm aware of Google's work with Coreboot and Chromebooks, but not Facebook's. Can you tell us anything?
  - bonzini 9y ago
    I think he's referring to the Open Compute Project.
  - bubblethink 9y ago
    I don't know of fb's direct involvement in any ME related stuff, but they do develop openbmc which is a replacement for proprietary bmc firmware. BMC isn't quite as nefarious as ME though, and is optional anyway.
Fnoord 9y ago
TWRP is open source, and allows you to boot into Linux. There's ChromeOS (Linux). Samsung's busy with DeX and Linux on Galaxy. There's some experimentation done with convergence elsewhere at Microsoft (Continuum) and Ubuntu. It all depends what you want to run on it. If you want a POWER workstation and are OK with not running on x86-64 (or x86-32) then there's the Talos II workstation [1] [2]. It comes with a hefty price tag (IIRC 3,7k USD). Peanuts for a lot of US-based developers, but for many others in the world it just isn't affordable. You say 30% raw performance would be OK. This is not 1,3x more expensive than a x86-64 workstation. It is a lot more... It also depends on your threat modelling. If you believe that Intel ME is out there, remotely exploitable by XYZ (NSA, evil hackers, ???), then a number of people and groups have a lot to worry about. Groups and people high up in chains. We're talking about developers of software, developers who build software in end user products (those are 2 large groups already), and a whole plethora of other groups which are the foundation of our society. And it is locally and remotely vulnerable which Intel patched yesterday [3]. What I don't know is if this patch should be applied, or if it should be used to get rid of Intel ME. [1] https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/ [2] https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation https://www.crowdsupply.com/raptor-computing-systems/talos-s... [3] https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...
- reirob 9y ago
  I'm interested in the computers from Talos, but so far I did not hear from anybody having it. On their web-site it says that it is not yet shipping, you can just pre-order.
sjellis 9y ago
"Google/Amazon/Microsoft have the muscle to actually do something about this, but no motivation. I'm surprised that they even trust Intel - it would take one high-profile security breach to turn their respective Cloud Computing businesses upside down - people are already jittery." We know that Google don't have unlimited trust in Intel: they replace the firmware, are talking about how they are trying to defang IME, and continue to maintain investments in the POWER architecture, even though AFAIK they have no public products that use it.

hugelgupf 9y ago

I would challenge the "no motivation" part given that the speaker that gave this talk works at Google.

eeZah7Ux 9y ago

Both Facebook and Google are working at disabling ME. They make no secret that they not trust it. NSA & other US orgs receive hardware without ME already. Surveillance is for the rest of us.

ksk 9y ago
>Surveillance is for the rest of us. Who has been spied on using Intel ME?
- AstralStorm 9y ago
  It requires some serious web traffic analysis and honeypot to detect the attempt. That is assuming they would use remote access and not use ME locally. That would be even harder to prove once the malware uninstall itself.
  - ksk 9y ago
    Yeah, I fully understand that its not easy to detect this. But I'd also like to make an informed decision based on evidence, not speculation. So far I've seen bugs being reported that require the user to enable and provision AMT, which are quite serious, but entirely avoidable by keeping it disabled. Anyway, I'm happy to read more about it if you have any additional info.
    - eeZah7Ux 9y ago
      In security we work on addressing vulnerabilities, reducing the attack surface, prevention and so on. We don't wait for evidence that a vulnerability is being exploited. This is especially true for cryptography where a cryptosystem used today has to resist theoretical attackers that can use hardware that will exists in decades from now.
      - ksk 9y ago
        Sorry, I can't understand what point you're replying to. To me, it sounded like you claimed it was being used for surveillance. I'm happy to go through the evidence if you have any.
confounded 9y ago
> Both Facebook and Google are working at disabling ME. They make no secret that they not trust it. I'm aware of Google's work with Coreboot and Chromebooks, but not Facebook's. Can you tell us anything?
- bonzini 9y ago
  I think he's referring to the Open Compute Project.
- bubblethink 9y ago
  I don't know of fb's direct involvement in any ME related stuff, but they do develop openbmc which is a replacement for proprietary bmc firmware. BMC isn't quite as nefarious as ME though, and is optional anyway.

Fnoord 9y ago

TWRP is open source, and allows you to boot into Linux. There's ChromeOS (Linux). Samsung's busy with DeX and Linux on Galaxy. There's some experimentation done with convergence elsewhere at Microsoft (Continuum) and Ubuntu. It all depends what you want to run on it. If you want a POWER workstation and are OK with not running on x86-64 (or x86-32) then there's the Talos II workstation [1] [2]. It comes with a hefty price tag (IIRC 3,7k USD). Peanuts for a lot of US-based developers, but for many others in the world it just isn't affordable. You say 30% raw performance would be OK. This is not 1,3x more expensive than a x86-64 workstation. It is a lot more... It also depends on your threat modelling. If you believe that Intel ME is out there, remotely exploitable by XYZ (NSA, evil hackers, ???), then a number of people and groups have a lot to worry about. Groups and people high up in chains. We're talking about developers of software, developers who build software in end user products (those are 2 large groups already), and a whole plethora of other groups which are the foundation of our society. And it is locally and remotely vulnerable which Intel patched yesterday [3]. What I don't know is if this patch should be applied, or if it should be used to get rid of Intel ME. [1] https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/ [2] https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation https://www.crowdsupply.com/raptor-computing-systems/talos-s... [3] https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...

reirob 9y ago
I'm interested in the computers from Talos, but so far I did not hear from anybody having it. On their web-site it says that it is not yet shipping, you can just pre-order.

sjellis 9y ago

"Google/Amazon/Microsoft have the muscle to actually do something about this, but no motivation. I'm surprised that they even trust Intel - it would take one high-profile security breach to turn their respective Cloud Computing businesses upside down - people are already jittery." We know that Google don't have unlimited trust in Intel: they replace the firmware, are talking about how they are trying to defang IME, and continue to maintain investments in the POWER architecture, even though AFAIK they have no public products that use it.