13 ms·

System76 ME Firmware Updates Plan

703 points by jcastro 9y ago

freedomben 9y ago
This is awesome. System76 does a lot for the Linux community. Everyone reaps the benefits of their work, even people that aren't customers. One example from just this blog post: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.
- phaus 9y ago
  They sell re-branded clevos with marginal build quality. Some models have been unusably defecitve. I wish they were the Linux-laptop company that many hackers dream about, but they just aren't.
  - colordrops 9y ago
    I'm pretty happy with my Dell XPS laptop with Linux.
    - freedomben 9y ago
      Me too. I'm running the Dell Precision 5520 right now and I've been pretty happy. Tho, deviating from the stock OS (Ubuntu 16.04) is not a very easy path. For that reason I may go back to System76 for my next buy.
      - colordrops 9y ago
        What does stock ubuntu provide that other linux distros do not, and why would going with System76 solve this?
      - sapphire_tomb 9y ago
        I have a 5520 too, but one I got via the outlet store, and which came with Windows 10, not Ubuntu. I've since partitioned it and have Arch running on it too. Was completely painless, and everything works. Which distro are you having issues with, and what are the issues?
  - djsumdog 9y ago
    There was another comment on another threat that said that, although they do buy Clevos, the cheaper ones Clevos sells aren't up to the same specs. They also order really specific hardware for their branded laptops that have known working drivers. Either that or they work on getting the correct binary blobs working and merged into the official linux-firmware package. Things like getting newer drivers working (and contributing that openly back to the community) plus getting ME disabled are some pretty big value added. If they had a 4k model I might be more interested.
    - phaus 9y ago
      Things may have changed in the last year or so, but plenty of System 76 Clevos have been notorious for problems in the past. I'd be interested in knowing that things have improved significantly because I'll probably be upgrading to a new laptop around the middle of next year. For me probably the biggest issue is that they usually have mediocre keyboards and sometimes they even have keyboards that drop keystrokes. It seems like every model they release should have a top-notch keyboard because their target market is mostly developers.
    - cassidyjames 9y ago
      System76 employee here! We do have a number of HiDPI models. Galago Pro (https://system76.com/laptops/galago https://system76.com/laptops/galago) is probably our most popular, and its resolution is 3200×1800—not technically 4K, but the right resolution for that small of display. Oryx Pro usually has a 4K HiDPI option, but it looks like it's currently sold out. Our WS models also have 4K options, but they're pretty specialized machines.
  - freedomben 9y ago
    I agree they aren't the dream company, but I do think they are helping us all. Here's a good response from them regarding the Clevo rebranding: https://www.reddit.com/r/linux/comments/5umefi/system76_refreshes_ubuntu_linux_laptops_with/ddvcx45/ https://www.reddit.com/r/linux/comments/5umefi/system76_refr...
    - mmirate 9y ago
      Yet as usual, the clarity is provided by responses that got downvote-bombed.
- fkooman 9y ago
  This already exists, https://fwupd.org/ https://fwupd.org/ It is strange they don't mention this and use it. fwupd updated my Logitech "Unifying" receiver firmware :-) And Dell uses it to provide updates of some of their laptops and servers.
- hughsient 9y ago
  It's disappointing System76 can't just use LVFS and fwupd like all the other vendors: https://fwupd.org/lvfs/vendorlist https://fwupd.org/lvfs/vendorlist
  - jacquesm 9y ago
    You're missing a bit of disclosure here.
jlgaddis 9y ago
I hope other vendors will follow their lead but I'm certainly not holding my breath.
- jstanley 9y ago
  Purism have already been doing this. I think this is system76 following purism's lead. https://puri.sm/products/ https://puri.sm/products/ Edit: not to detract from system76! It's excellent that they're doing this too.
  - prophesi 9y ago
    Yeah, Purism is awesome with their privacy, security, and libre focus. I'm really hoping their Librem phone is a success.
    - jstanley 9y ago
      I'm thinking of buying a Purism laptop. The only thing stopping me is that I just bought a ThinkPad a few months ago and it feels wasteful to buy another laptop so soon...
    - allemagne 9y ago
      I've heard a lot of great things about them and I love their mission statement, but I've also heard a lot of bad things about availability, shipping, and spotty customer service (but again, occasionally great customer service). I'm not sure what to think and whether to get my next laptop from them. It also makes me nervous that they're putting resources into phones when they obviously haven't solved all the issues with non-free components of laptops. It gives me Firefox OS and mobile Ubuntu vibes.
      - cyphar 9y ago
        > It also makes me nervous that they're putting resources into phones when they obviously haven't solved all the issues with non-free components of laptops. By not using x86 (the board is going to use i.MX8), they remove a whole series of issues that plague modern laptops (no ME, no EMC, etc). They have a very long run-down on why they chose i.MX8, and the freedom status of the components[1]. [1]: https://puri.sm/posts/librem-5-roadmap-to-imx8/ https://puri.sm/posts/librem-5-roadmap-to-imx8/
nkkollaw 9y ago
system76 are cool, but their laptops IMO should be better for the money they cost. I'd still like to get one, but there's better stuff around at those prices.
- TazeTSchnitzel 9y ago
  cheap, good, small vendor pick two
  - nkkollaw 9y ago
    Well, for $1000 I can get a Surface Book 1 and run Ubuntu on it, and it's absolutely perfect. The Galago Pro is almost something I'd get, but I really dislike actual buttons on the trackpad: most of them are (rightfully) clickable anywhere on the trackpad.
    - r3bl 9y ago
      I believe nobody in this entire thread claimed that you can't get something cheaper and slap Ubuntu on top of it. I would pay more for a premium Ubuntu support. Unfortunately, System76 doesn't ship to my country.
      - nkkollaw 9y ago
        I'm not saying there are cheaper options, I'm saying that for the same amount of money you get much, better hardware and design.
    - AdmiralAsshat 9y ago
      > Well, for $1000 I can get a Surface Book 1 and run Ubuntu on it, and it's absolutely perfect. Are you referring to installing Ubuntu on the WSL, or actually wiping out Win10 and installing Ubuntu natively? Because to my knowledge, Linux support on the Surface/Pro/Book line is still wobbly at best. I've seen some people running Arch, but problems with battery life and sleep mode abound. I can't imagine the Surface Book's detachable base in tablet mode would be working yet.
LeoPanthera 9y ago
> You must run Ubuntu 16.04 LTS, Ubuntu 17.04, Ubuntu 17.10, Pop!_OS 17.10, or an Ubuntu derivative and have the System76 driver installed to receive the latest firmware and disabled ME on laptops* Ubuntu is the distribution that once sent everything you typed into the desktop search box to Amazon so that it could deliver you ads. Current versions may not do that but it's clear that Canonical prioritizes profit over privacy. It's disappointing that if you choose not to run Ubuntu you can't take advantage of their firmware update tool.
- orblivion 9y ago
  But, the very next line gives hope: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.
  - djsumdog 9y ago
    Yea I'm sure we'll see a more generic command. This was probably just to get things out the door, quickly, with the default operation systems they have installed. Keep in mind, testing this type of update is pretty important. I'm sure they went through this several times with multiple versions of all their hardware. Honestly for the sake of not bricking a laptop, I think they should release a bootable USB image for other Linux distros and operating systems. Flash it to a USB stick and now you have a completely stable environment, with the kernel you've tested against, and remove potential unknowns.
- ythn 9y ago
  So? Install Ubuntu, receive updated firmware/disabled ME, reinstall distro of choice. Also: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.
  - orblivion 9y ago
    > Install Ubuntu, receive updated firmware/disabled ME, reinstall distro of choice. For a single software update? With whatever else a normal human has going on in life? There's no way.
ef4 9y ago
This is a strong contrast with my experience in trying to patch the vulnerability on an Asus desktop motherboard. The process was so byzantine that I very much doubt more than a small fraction of home users would get through it, or even bother starting. The correct steps were (1) flash a newer bios, (2) install the Intel ME driver for windows, (3) run the actual vulnerability patching tool. Discovering those steps required a bunch of trial and error and navigating Asus's really terrible website full of badly named downloads.
- mykull 9y ago
  Removing ME [almost] entirely by editing the official bios image with me_cleaner.py and then updating the bios the normal way sounds like it is simpler, if you don't need the extra network-connected ME features there. I'll admit I was a little afraid of bricking the PC, as with any kind of BIOS modification, but it worked like a charm.
- flukus 9y ago
  > This is a strong contrast with my experience in trying to patch the vulnerability on an Asus desktop motherboard. This is why I don't buy "enterprise users" as a reason for having IME. I've never once worked in a company that patched firmware, even though they have specialists capable of it. They want the option to perform enterprise wide upgrades with ease but they aren't willing to pay the true cost of having this ability. > Discovering those steps required a bunch of trial and error and navigating Asus's really terrible website full of badly named downloads. Gets even worse when your international. Half the links will be to a US address that will then try to redirect you to a localized one which will then not have the resource you were looking for. Then you've got some really byzantine export restriction procedures and you have to create an account but it still probably won't work. I've had these issues with ordinary drivers too, it's the biggest reason I support the linux in kernel tree and no stable ABI model, it's better for users.
horsecaptin 9y ago
Do AMD chips have a "management engine"?
- TazeTSchnitzel 9y ago
  Yes, it's called the Platform Security Processor: https://libreboot.org/faq.html#amd-platform-security-processor-psp https://libreboot.org/faq.html#amd-platform-security-process... The system won't boot without it.
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
jimmies 9y ago
You don't need to buy branded laptops to be able to disable Intel ME. Thanks to me_cleaner, I have been running my Chromebooks with Intel ME disabled for years. You can do it too if you have 30 minutes and a raspberry pi. Here is what the intelmetool [1] says on my laptop: https://i.imgur.com/yKTt5ga.png https://i.imgur.com/yKTt5ga.png What's even more interesting is that there is a simple, automatic, no-frills method to clamp a SOIC clip connected to a Raspberry Pi zero to any Chromebook and it will clear out the Intel ME automatically with no user interaction. It's not even hard, all you have to do is to configure the Pi to enable SPI, and then make the pi automatically run flashrom to pull out the ROM from the Chromebook's flash chip, run ./me_cleaner on the ROM image, and then flash it back. It can be done safely and automatically, and you wouldn't have to risk frying your laptop, so everyone could do it provided they can open their laptop. However, I'm too lazy to document it properly: either by providing the image tool to create the said Raspberry Pi Zero image + h/w instruction or by providing a premade hardware to do it. I have reasons to believe that downloading a random binary image from a random guy nicknamed jimmies and use it to flash the firmware to your laptop because you don't trust Intel is probably not a great idea. The act of creating such a script to customize Raspbian, and testing out to make sure that it works for every Chromebook or laptop, and make a hardware compatibility list is quite a daunting task. I was talking about that briefly to some of the security people, but then as a grad student trying to graduate it got to the pile of TODOs. So if anyone is interested in it, let me know and I can provide some more details. Currently, I'm running a Dell 13 inches Chromebook that can be had for $300 and does everything I need. 1: https://github.com/coreboot/coreboot/tree/master/util/intelmetool https://github.com/coreboot/coreboot/tree/master/util/intelm... - disclaimer: I contributed a patch to the intelmetool to make it work on the Chromebook.
- korethr 9y ago
  While this is great, and I'm glad it exists, not everyone is like you and I: willing and able to open a computer and use a SOIC clip and a Raspberry Pi to purge the ME from the computer's firmware. You and I are what the normals tend to call geeks or nerds, and from my experience amongst geeks and nerds, one of the less common subtypes. That's a depressing way to look at it, and one could argue that it's a condescendingly elitist view, but that doesn't change the truth of it. I'm confident most other posters here could immediately think of a half-dozen friends and family members for whom even opening the computer was deep magic, nevermind going after the ME with a SOIC clip. For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons.
shmerl 9y ago
Is there some way to disable this for AMD CPUs?
- kevindqc 9y ago
  Intel Management Engine
  - yjftsjthsd-h 9y ago
    AMD PSP ARM TrustZone
    - deleted 9y ago
      [deleted]
- Joakal 9y ago
  Intel Management Engine is already disabled for AMD CPUs.
  - shmerl 9y ago
    It's not, it's just called differently.
- jordigh 9y ago
  You mean AMD PSP. And I don't think it has received the same attention as ME, even though it's more or less the same backdoor. Which they minitruthfuly advertise as For Your Own Safety: http://www.amd.com/en-us/innovations/software-technologies/security http://www.amd.com/en-us/innovations/software-technologies/s...
- craftkiller 9y ago
  The PSP on AMD processors has not been disabled yet.
lottin 9y ago
Shouldn't the news be that the ME can be disabled? From what I heard the consensus was that it couldn't be turned off.
- zamalek 9y ago
  It happened more than a year ago[1]. It doesn't remove ME entirely, but drastically reduces the attack surface in the currently accessible ring - the GitHub project has more details. Ultimately, the network-enabled bits that keep getting exploited are removed. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
jackpot51 9y ago
I am the engineer at System76 currently working on this. We are using ME cleaner with -S on all systems where possible - HAP bit will be set AND code removed. All systems will then be tested thoroughly in this configuration before it is released to customers. Relevant source code can be found in the following places, keep in mind that it is still work in progress: - System76 Driver with Firmware Update support: https://github.com/pop-os/system76-driver/tree/firmware_artful https://github.com/pop-os/system76-driver/tree/firmware_artf... - Firmware Update Frontend: https://github.com/system76/firmware-update https://github.com/system76/firmware-update Please ask me anything
- deleted 9y ago
  [deleted]
- Sir_Substance 9y ago
  I have so much respect and a little envy for the work you're doing at the moment. You're working on one of the most far-reaching and undeniably positive software projects I've heard of in years. Best of luck! It's possible that at some point (depending on if it gets open sourced) I'll be grabbing some of your work and trying to wrangle it to work on my desktop. Is this an area where I seriously risk bricking my CPU, or are there safeguards that cause these kinds of instructions to either work or safely fail?
  - jackpot51 9y ago
    Yes, you risk bricking your computer. You can create a Raspberry Pi with a SPI clip for fixing bricked computers. If you have BootGuard, you will brick your machine, unless you have the manufacturer signing key. We have the signing key for our laptops, so we are able to sign updates for the four systems with BootGuard: galp2, galp3, lemu7, and lemu8.
  - microcolonel 9y ago
    > Is this an area where I seriously risk bricking my CPU As far as I'm aware, there's no particular state involved for you to brick the CPU, but you can easily write a firmware which will prevent boot, or fail some time after boot (In the case of removing critical ME blobs). You could brick your board temporarily, but you're going to be using an external flasher (with a convenient little SOIC clip :- ) anyway, so fixing it is a matter of writing back the old/working image. This is, of course, assuming you are able to write anything that works to the flash, which you might not be able to thanks to BootGuard.
cjbprime 9y ago
> System76 will automatically deliver updated firmware with a disabled ME Having the ability to automatically push new firmware of your own creation to customers' machines is more power than you ought to want. My security threat model as a System76 customer shouldn't have to include you (perhaps with you being hacked or coerced) pushing me malware that's undetectable to my OS after it's been installed. Please reconsider this feature (of automatic firmware updates). Firmware updates are rare enough that it should be fine for them to be explicitly opt-in. It's great to want to make Intel's firmware more secure. But replacing Intel as a possible attack vector with yourselves is strictly worse for the machine's security.
- cassidyjames 9y ago
  System76 employee here. I suppose the "automatic" could be re-worded; the data is automatically pushed to the machine but then the user always opts into the actual install. But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place. These updates are signed and verified with industry best practices. jackpot51 (the System76 engineer currently working on this) could probably detail it better than I can, though.
  - mulmen 9y ago
    Is the user intervention required to install the firmware or do you still have the capability to install it without asking? Just because you ask for permission now does not mean that you have to. Why push the firmware before asking?
    - cassidyjames 9y ago
      I asked David Jordan, the engineer working on the firmware updater. >Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code. The code is available at https://github.com/pop-os/system76-driver https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update https://github.com/system76/firmware-update
filereaper 9y ago
If anyone's interested, here's the full article from Positive Technologies on how they went about discovering reserve_hap and disabling it. http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
mykull 9y ago
I used me_cleaner on my old as heck gigabyte sandybridge desktop and was surprised how straight-forward it was. I ran the python script against latest rom, reflashed, everything works and I confirmed it's disabled.
- deleted 9y ago
  [deleted]
brightball 9y ago
This will actually give people a way to vote with their wallet. Thank you!
- aaronmdjones 9y ago
  How so? You're still buying a system with an Intel CPU. Intel still gets their "dues". The number of people that care about this is a fraction of 1 percent of their user base. Just so you don't misunderstand me, I am one of those people, and what Purism and System76 are doing is great. I just don't think it's going to affect Intel in any way whatsoever.
  - brightball 9y ago
    It probably won't but if it shows an uptick for System76's business then you might see the other companies who actively ship systems that devs pay attention to doing the same. If the action ever gets Dell or Lenovo to follow, it's still progress.
- torgard 9y ago
  I can't buy System76 laptops, because they only have US keyboards. UK and Scandinavian (the one I'm using) have more buttons, so I can't just fix it with stickers. Sad, because I reeeeally want a System76 laptop.
justinjlynn 9y ago
I wonder if system76 might consider laptops with alternative architectures like POWER9. A number of them are open all the way down to and including their concept of microcode.
tomkat0789 9y ago
Hi I'm a mostly average Linux user just now learning about these hardware back doors as I'm planning on building a new computer. Can I avoid the disadvantages of ME et al by building my own computer from a separate motherboard and CPU? I remember reading that somewhere but I haven't see it explored again. My first thought was "Ah ha! AMD CPU!", but they seem to be in on it too. What's a "normal person" to do?
- yjftsjthsd-h 9y ago
  Today: Buy really old systems and/or patch the firmware. Soon™: RISC-V, we hope:) Or Talos, or probably a handful of others.
  - jackpot51 9y ago
    Yep - RISC-V is the best bet for full freedom
- forapurpose 9y ago
  A few suggestions: * It might be worth looking into: ARM, Intel Atom, or POWER9 processors * Intel chips without VPro seem to omit much of the ME functionality, including AMT which provides (all of?) the remote access capability. AFAICT, chips with the Small Business Technology implementation of ME are purposely designed to not have remote access. Maybe use one of those. * Flash the chip to enable HAP
lorenzhs 9y ago
I pieced together how to update a ThinkPad's ME firmware without Windows last week: https://news.ycombinator.com/item?id=15744152 https://news.ycombinator.com/item?id=15744152 - the process is a pain, as Lenovo only provides a Windows binary for installing the update, so you have to piece together a WinPE image that contains the ME driver and firmware update tool, boot it, load the driver, and then execute the firmware update. The process is probably the same for most other vendors, so if your vendor provides a Windows ME firmware updater (no pun intended :P) you might be able to make it work that way.
znpy 9y ago
Unrelated: any plans about integrating a trackpoint/ultranav solution in System76 laptops?
EdSharkey 9y ago
Is there any appliance or software that can passively monitor a network to see if any ME commands and related data flow back and forth from an attacker? It seems to me that using ME as an _actual_ backdoor would be only an occasional thing, (maybe once in a lifetime thing), but it would be so cool to at least know when it is happening and maybe capture some packets.
deleted 9y ago
[deleted]
knodi 9y ago
Just stop buying Intel.
silur 9y ago
Great to hear that you kill ME but I'll still stick with puri.sm or alpha.store because systen76 machines are just too freakin overpriced. They talk about freedom and FOSS yet their machines can cost 1.5 times a macbook, with free OS and rebranded chineese 200$ clevo cases. Available price is an essential part of FOSS and OSHW phylosophy, greed never had any place in this community
cement_head 9y ago
Just to be clear, the firmware upgrade tool is the same as the System75 Driver (pre-installed on System76 laptops)?

703 points by jcastro 9y ago

This is awesome. System76 does a lot for the Linux community. Everyone reaps the benefits of their work, even people that aren't customers. One example from just this blog post: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.

phaus 9y ago
They sell re-branded clevos with marginal build quality. Some models have been unusably defecitve. I wish they were the Linux-laptop company that many hackers dream about, but they just aren't.
- colordrops 9y ago
  I'm pretty happy with my Dell XPS laptop with Linux.
  - freedomben 9y ago
    Me too. I'm running the Dell Precision 5520 right now and I've been pretty happy. Tho, deviating from the stock OS (Ubuntu 16.04) is not a very easy path. For that reason I may go back to System76 for my next buy.
    - colordrops 9y ago
      What does stock ubuntu provide that other linux distros do not, and why would going with System76 solve this?
    - sapphire_tomb 9y ago
      I have a 5520 too, but one I got via the outlet store, and which came with Windows 10, not Ubuntu. I've since partitioned it and have Arch running on it too. Was completely painless, and everything works. Which distro are you having issues with, and what are the issues?
- djsumdog 9y ago
  There was another comment on another threat that said that, although they do buy Clevos, the cheaper ones Clevos sells aren't up to the same specs. They also order really specific hardware for their branded laptops that have known working drivers. Either that or they work on getting the correct binary blobs working and merged into the official linux-firmware package. Things like getting newer drivers working (and contributing that openly back to the community) plus getting ME disabled are some pretty big value added. If they had a 4k model I might be more interested.
  - phaus 9y ago
    Things may have changed in the last year or so, but plenty of System 76 Clevos have been notorious for problems in the past. I'd be interested in knowing that things have improved significantly because I'll probably be upgrading to a new laptop around the middle of next year. For me probably the biggest issue is that they usually have mediocre keyboards and sometimes they even have keyboards that drop keystrokes. It seems like every model they release should have a top-notch keyboard because their target market is mostly developers.
  - cassidyjames 9y ago
    System76 employee here! We do have a number of HiDPI models. Galago Pro (https://system76.com/laptops/galago https://system76.com/laptops/galago) is probably our most popular, and its resolution is 3200×1800—not technically 4K, but the right resolution for that small of display. Oryx Pro usually has a 4K HiDPI option, but it looks like it's currently sold out. Our WS models also have 4K options, but they're pretty specialized machines.
- freedomben 9y ago
  I agree they aren't the dream company, but I do think they are helping us all. Here's a good response from them regarding the Clevo rebranding: https://www.reddit.com/r/linux/comments/5umefi/system76_refreshes_ubuntu_linux_laptops_with/ddvcx45/ https://www.reddit.com/r/linux/comments/5umefi/system76_refr...
  - mmirate 9y ago
    Yet as usual, the clarity is provided by responses that got downvote-bombed.
fkooman 9y ago
This already exists, https://fwupd.org/ https://fwupd.org/ It is strange they don't mention this and use it. fwupd updated my Logitech "Unifying" receiver firmware :-) And Dell uses it to provide updates of some of their laptops and servers.
hughsient 9y ago
It's disappointing System76 can't just use LVFS and fwupd like all the other vendors: https://fwupd.org/lvfs/vendorlist https://fwupd.org/lvfs/vendorlist
- jacquesm 9y ago
  You're missing a bit of disclosure here.

jlgaddis 9y ago

I hope other vendors will follow their lead but I'm certainly not holding my breath.

jstanley 9y ago
Purism have already been doing this. I think this is system76 following purism's lead. https://puri.sm/products/ https://puri.sm/products/ Edit: not to detract from system76! It's excellent that they're doing this too.
- prophesi 9y ago
  Yeah, Purism is awesome with their privacy, security, and libre focus. I'm really hoping their Librem phone is a success.
  - jstanley 9y ago
    I'm thinking of buying a Purism laptop. The only thing stopping me is that I just bought a ThinkPad a few months ago and it feels wasteful to buy another laptop so soon...
  - allemagne 9y ago
    I've heard a lot of great things about them and I love their mission statement, but I've also heard a lot of bad things about availability, shipping, and spotty customer service (but again, occasionally great customer service). I'm not sure what to think and whether to get my next laptop from them. It also makes me nervous that they're putting resources into phones when they obviously haven't solved all the issues with non-free components of laptops. It gives me Firefox OS and mobile Ubuntu vibes.
    - cyphar 9y ago
      > It also makes me nervous that they're putting resources into phones when they obviously haven't solved all the issues with non-free components of laptops. By not using x86 (the board is going to use i.MX8), they remove a whole series of issues that plague modern laptops (no ME, no EMC, etc). They have a very long run-down on why they chose i.MX8, and the freedom status of the components[1]. [1]: https://puri.sm/posts/librem-5-roadmap-to-imx8/ https://puri.sm/posts/librem-5-roadmap-to-imx8/

nkkollaw 9y ago

system76 are cool, but their laptops IMO should be better for the money they cost. I'd still like to get one, but there's better stuff around at those prices.

TazeTSchnitzel 9y ago
cheap, good, small vendor pick two
- nkkollaw 9y ago
  Well, for $1000 I can get a Surface Book 1 and run Ubuntu on it, and it's absolutely perfect. The Galago Pro is almost something I'd get, but I really dislike actual buttons on the trackpad: most of them are (rightfully) clickable anywhere on the trackpad.
  - r3bl 9y ago
    I believe nobody in this entire thread claimed that you can't get something cheaper and slap Ubuntu on top of it. I would pay more for a premium Ubuntu support. Unfortunately, System76 doesn't ship to my country.
    - nkkollaw 9y ago
      I'm not saying there are cheaper options, I'm saying that for the same amount of money you get much, better hardware and design.
  - AdmiralAsshat 9y ago
    > Well, for $1000 I can get a Surface Book 1 and run Ubuntu on it, and it's absolutely perfect. Are you referring to installing Ubuntu on the WSL, or actually wiping out Win10 and installing Ubuntu natively? Because to my knowledge, Linux support on the Surface/Pro/Book line is still wobbly at best. I've seen some people running Arch, but problems with battery life and sleep mode abound. I can't imagine the Surface Book's detachable base in tablet mode would be working yet.

LeoPanthera 9y ago

> You must run Ubuntu 16.04 LTS, Ubuntu 17.04, Ubuntu 17.10, Pop!_OS 17.10, or an Ubuntu derivative and have the System76 driver installed to receive the latest firmware and disabled ME on laptops* Ubuntu is the distribution that once sent everything you typed into the desktop search box to Amazon so that it could deliver you ads. Current versions may not do that but it's clear that Canonical prioritizes profit over privacy. It's disappointing that if you choose not to run Ubuntu you can't take advantage of their firmware update tool.

orblivion 9y ago
But, the very next line gives hope: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.
- djsumdog 9y ago
  Yea I'm sure we'll see a more generic command. This was probably just to get things out the door, quickly, with the default operation systems they have installed. Keep in mind, testing this type of update is pretty important. I'm sure they went through this several times with multiple versions of all their hardware. Honestly for the sake of not bricking a laptop, I think they should release a bootable USB image for other Linux distros and operating systems. Flash it to a USB stick and now you have a completely stable environment, with the kernel you've tested against, and remove potential unknowns.
ythn 9y ago
So? Install Ubuntu, receive updated firmware/disabled ME, reinstall distro of choice. Also: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates.
- orblivion 9y ago
  > Install Ubuntu, receive updated firmware/disabled ME, reinstall distro of choice. For a single software update? With whatever else a normal human has going on in life? There's no way.

ef4 9y ago

This is a strong contrast with my experience in trying to patch the vulnerability on an Asus desktop motherboard. The process was so byzantine that I very much doubt more than a small fraction of home users would get through it, or even bother starting. The correct steps were (1) flash a newer bios, (2) install the Intel ME driver for windows, (3) run the actual vulnerability patching tool. Discovering those steps required a bunch of trial and error and navigating Asus's really terrible website full of badly named downloads.

mykull 9y ago
Removing ME [almost] entirely by editing the official bios image with me_cleaner.py and then updating the bios the normal way sounds like it is simpler, if you don't need the extra network-connected ME features there. I'll admit I was a little afraid of bricking the PC, as with any kind of BIOS modification, but it worked like a charm.
flukus 9y ago
> This is a strong contrast with my experience in trying to patch the vulnerability on an Asus desktop motherboard. This is why I don't buy "enterprise users" as a reason for having IME. I've never once worked in a company that patched firmware, even though they have specialists capable of it. They want the option to perform enterprise wide upgrades with ease but they aren't willing to pay the true cost of having this ability. > Discovering those steps required a bunch of trial and error and navigating Asus's really terrible website full of badly named downloads. Gets even worse when your international. Half the links will be to a US address that will then try to redirect you to a localized one which will then not have the resource you were looking for. Then you've got some really byzantine export restriction procedures and you have to create an account but it still probably won't work. I've had these issues with ordinary drivers too, it's the biggest reason I support the linux in kernel tree and no stable ABI model, it's better for users.

horsecaptin 9y ago

Do AMD chips have a "management engine"?

TazeTSchnitzel 9y ago
Yes, it's called the Platform Security Processor: https://libreboot.org/faq.html#amd-platform-security-processor-psp https://libreboot.org/faq.html#amd-platform-security-process... The system won't boot without it.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]

jimmies 9y ago

You don't need to buy branded laptops to be able to disable Intel ME. Thanks to me_cleaner, I have been running my Chromebooks with Intel ME disabled for years. You can do it too if you have 30 minutes and a raspberry pi. Here is what the intelmetool [1] says on my laptop: https://i.imgur.com/yKTt5ga.png https://i.imgur.com/yKTt5ga.png What's even more interesting is that there is a simple, automatic, no-frills method to clamp a SOIC clip connected to a Raspberry Pi zero to any Chromebook and it will clear out the Intel ME automatically with no user interaction. It's not even hard, all you have to do is to configure the Pi to enable SPI, and then make the pi automatically run flashrom to pull out the ROM from the Chromebook's flash chip, run ./me_cleaner on the ROM image, and then flash it back. It can be done safely and automatically, and you wouldn't have to risk frying your laptop, so everyone could do it provided they can open their laptop. However, I'm too lazy to document it properly: either by providing the image tool to create the said Raspberry Pi Zero image + h/w instruction or by providing a premade hardware to do it. I have reasons to believe that downloading a random binary image from a random guy nicknamed jimmies and use it to flash the firmware to your laptop because you don't trust Intel is probably not a great idea. The act of creating such a script to customize Raspbian, and testing out to make sure that it works for every Chromebook or laptop, and make a hardware compatibility list is quite a daunting task. I was talking about that briefly to some of the security people, but then as a grad student trying to graduate it got to the pile of TODOs. So if anyone is interested in it, let me know and I can provide some more details. Currently, I'm running a Dell 13 inches Chromebook that can be had for $300 and does everything I need. 1: https://github.com/coreboot/coreboot/tree/master/util/intelmetool https://github.com/coreboot/coreboot/tree/master/util/intelm... - disclaimer: I contributed a patch to the intelmetool to make it work on the Chromebook.

korethr 9y ago
While this is great, and I'm glad it exists, not everyone is like you and I: willing and able to open a computer and use a SOIC clip and a Raspberry Pi to purge the ME from the computer's firmware. You and I are what the normals tend to call geeks or nerds, and from my experience amongst geeks and nerds, one of the less common subtypes. That's a depressing way to look at it, and one could argue that it's a condescendingly elitist view, but that doesn't change the truth of it. I'm confident most other posters here could immediately think of a half-dozen friends and family members for whom even opening the computer was deep magic, nevermind going after the ME with a SOIC clip. For the rest of the population, there's value in there being a vendor who sells magic black boxes, certified to be freshly purged of all known evil demons.

shmerl 9y ago

Is there some way to disable this for AMD CPUs?

kevindqc 9y ago
Intel Management Engine
- yjftsjthsd-h 9y ago
  AMD PSP ARM TrustZone
  - deleted 9y ago
    [deleted]
Joakal 9y ago
Intel Management Engine is already disabled for AMD CPUs.
- shmerl 9y ago
  It's not, it's just called differently.
jordigh 9y ago
You mean AMD PSP. And I don't think it has received the same attention as ME, even though it's more or less the same backdoor. Which they minitruthfuly advertise as For Your Own Safety: http://www.amd.com/en-us/innovations/software-technologies/security http://www.amd.com/en-us/innovations/software-technologies/s...
craftkiller 9y ago
The PSP on AMD processors has not been disabled yet.

lottin 9y ago

Shouldn't the news be that the ME can be disabled? From what I heard the consensus was that it couldn't be turned off.

zamalek 9y ago
It happened more than a year ago[1]. It doesn't remove ME entirely, but drastically reduces the attack surface in the currently accessible ring - the GitHub project has more details. Ultimately, the network-enabled bits that keep getting exploited are removed. [1]: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner

jackpot51 9y ago

I am the engineer at System76 currently working on this. We are using ME cleaner with -S on all systems where possible - HAP bit will be set AND code removed. All systems will then be tested thoroughly in this configuration before it is released to customers. Relevant source code can be found in the following places, keep in mind that it is still work in progress: - System76 Driver with Firmware Update support: https://github.com/pop-os/system76-driver/tree/firmware_artful https://github.com/pop-os/system76-driver/tree/firmware_artf... - Firmware Update Frontend: https://github.com/system76/firmware-update https://github.com/system76/firmware-update Please ask me anything

deleted 9y ago
[deleted]
Sir_Substance 9y ago
I have so much respect and a little envy for the work you're doing at the moment. You're working on one of the most far-reaching and undeniably positive software projects I've heard of in years. Best of luck! It's possible that at some point (depending on if it gets open sourced) I'll be grabbing some of your work and trying to wrangle it to work on my desktop. Is this an area where I seriously risk bricking my CPU, or are there safeguards that cause these kinds of instructions to either work or safely fail?
- jackpot51 9y ago
  Yes, you risk bricking your computer. You can create a Raspberry Pi with a SPI clip for fixing bricked computers. If you have BootGuard, you will brick your machine, unless you have the manufacturer signing key. We have the signing key for our laptops, so we are able to sign updates for the four systems with BootGuard: galp2, galp3, lemu7, and lemu8.
- microcolonel 9y ago
  > Is this an area where I seriously risk bricking my CPU As far as I'm aware, there's no particular state involved for you to brick the CPU, but you can easily write a firmware which will prevent boot, or fail some time after boot (In the case of removing critical ME blobs). You could brick your board temporarily, but you're going to be using an external flasher (with a convenient little SOIC clip :- ) anyway, so fixing it is a matter of writing back the old/working image. This is, of course, assuming you are able to write anything that works to the flash, which you might not be able to thanks to BootGuard.

cjbprime 9y ago

> System76 will automatically deliver updated firmware with a disabled ME Having the ability to automatically push new firmware of your own creation to customers' machines is more power than you ought to want. My security threat model as a System76 customer shouldn't have to include you (perhaps with you being hacked or coerced) pushing me malware that's undetectable to my OS after it's been installed. Please reconsider this feature (of automatic firmware updates). Firmware updates are rare enough that it should be fine for them to be explicitly opt-in. It's great to want to make Intel's firmware more secure. But replacing Intel as a possible attack vector with yourselves is strictly worse for the machine's security.

cassidyjames 9y ago
System76 employee here. I suppose the "automatic" could be re-worded; the data is automatically pushed to the machine but then the user always opts into the actual install. But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place. These updates are signed and verified with industry best practices. jackpot51 (the System76 engineer currently working on this) could probably detail it better than I can, though.
- mulmen 9y ago
  Is the user intervention required to install the firmware or do you still have the capability to install it without asking? Just because you ask for permission now does not mean that you have to. Why push the firmware before asking?
  - cassidyjames 9y ago
    I asked David Jordan, the engineer working on the firmware updater. >Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code. The code is available at https://github.com/pop-os/system76-driver https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update https://github.com/system76/firmware-update

filereaper 9y ago

If anyone's interested, here's the full article from Positive Technologies on how they went about discovering reserve_hap and disabling it. http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

mykull 9y ago

I used me_cleaner on my old as heck gigabyte sandybridge desktop and was surprised how straight-forward it was. I ran the python script against latest rom, reflashed, everything works and I confirmed it's disabled.

deleted 9y ago
[deleted]

brightball 9y ago

This will actually give people a way to vote with their wallet. Thank you!

aaronmdjones 9y ago
How so? You're still buying a system with an Intel CPU. Intel still gets their "dues". The number of people that care about this is a fraction of 1 percent of their user base. Just so you don't misunderstand me, I am one of those people, and what Purism and System76 are doing is great. I just don't think it's going to affect Intel in any way whatsoever.
- brightball 9y ago
  It probably won't but if it shows an uptick for System76's business then you might see the other companies who actively ship systems that devs pay attention to doing the same. If the action ever gets Dell or Lenovo to follow, it's still progress.
torgard 9y ago
I can't buy System76 laptops, because they only have US keyboards. UK and Scandinavian (the one I'm using) have more buttons, so I can't just fix it with stickers. Sad, because I reeeeally want a System76 laptop.

justinjlynn 9y ago

I wonder if system76 might consider laptops with alternative architectures like POWER9. A number of them are open all the way down to and including their concept of microcode.

tomkat0789 9y ago

Hi I'm a mostly average Linux user just now learning about these hardware back doors as I'm planning on building a new computer. Can I avoid the disadvantages of ME et al by building my own computer from a separate motherboard and CPU? I remember reading that somewhere but I haven't see it explored again. My first thought was "Ah ha! AMD CPU!", but they seem to be in on it too. What's a "normal person" to do?

yjftsjthsd-h 9y ago
Today: Buy really old systems and/or patch the firmware. Soon™: RISC-V, we hope:) Or Talos, or probably a handful of others.
- jackpot51 9y ago
  Yep - RISC-V is the best bet for full freedom
forapurpose 9y ago
A few suggestions: * It might be worth looking into: ARM, Intel Atom, or POWER9 processors * Intel chips without VPro seem to omit much of the ME functionality, including AMT which provides (all of?) the remote access capability. AFAICT, chips with the Small Business Technology implementation of ME are purposely designed to not have remote access. Maybe use one of those. * Flash the chip to enable HAP

lorenzhs 9y ago

I pieced together how to update a ThinkPad's ME firmware without Windows last week: https://news.ycombinator.com/item?id=15744152 https://news.ycombinator.com/item?id=15744152 - the process is a pain, as Lenovo only provides a Windows binary for installing the update, so you have to piece together a WinPE image that contains the ME driver and firmware update tool, boot it, load the driver, and then execute the firmware update. The process is probably the same for most other vendors, so if your vendor provides a Windows ME firmware updater (no pun intended :P) you might be able to make it work that way.

znpy 9y ago

Unrelated: any plans about integrating a trackpoint/ultranav solution in System76 laptops?

EdSharkey 9y ago

Is there any appliance or software that can passively monitor a network to see if any ME commands and related data flow back and forth from an attacker? It seems to me that using ME as an _actual_ backdoor would be only an occasional thing, (maybe once in a lifetime thing), but it would be so cool to at least know when it is happening and maybe capture some packets.

deleted 9y ago

[deleted]

knodi 9y ago

Just stop buying Intel.

silur 9y ago

Great to hear that you kill ME but I'll still stick with puri.sm or alpha.store because systen76 machines are just too freakin overpriced. They talk about freedom and FOSS yet their machines can cost 1.5 times a macbook, with free OS and rebranded chineese 200$ clevo cases. Available price is an essential part of FOSS and OSHW phylosophy, greed never had any place in this community

cement_head 9y ago

Just to be clear, the firmware upgrade tool is the same as the System75 Driver (pre-installed on System76 laptops)?