5 ms·

Do you really think enough people care about the ME / control of hardware in general / hardware that spies on you or is out of your control to influence the sto

by zanny 9y ago

Do you really think enough people care about the ME / control of hardware in general / hardware that spies on you or is out of your control to influence the stock price of a company the size of Intel?

IgorPartola 9y ago
No. That's exactly what I'm saying. Most people don't care. Enterprise users do care because ME is useful for them. It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. They'll see this as a small problem that should be fixed and will ask Intel to do so. Intel will fix it, most everyone will move on. I don't think ME will take down Intel stock, and neither will this page isolation bug. Intel's value is 99% engineering + manufacturing ability + customer relations. It would be a poor CEO indeed who'd direct their IT to start buying AMD because of this alone.
- uhhhhhhh 9y ago
  If my recollection serves, when Intel had what was the largest/most expensive recall in the world in the 90's (at that time anyways), their stock still nearly doubled that year.
- Sir_Substance 9y ago
  >It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. Let's be clear: It's both.
  - IgorPartola 9y ago
    Is it? Again, that a big claim to make in five words and drop the mic. Can you cite anything to back it up?
    - Sir_Substance 9y ago
      If Intel weren't under pressure to keep a negative-ring network enabled snoopstack open by an external entity, they would by now definitely have released an update that allowed people to disable the networking aspect of IME. Major system vendors are now offering to apply bootleg removal situations at the factory on customer request[1]. That request is not free. People are willing to /pay extra/ for no-IME laptops. Either Intels marketing and public relations department are asleep at the wheel, or they've gone to the top to request a friendly switch to disable this and been told by the legal department that they can't have one. [1]https://liliputing.com/2017/12/dell-also-sells-laptops-intel-management-engine-disabled.html https://liliputing.com/2017/12/dell-also-sells-laptops-intel...
      - IgorPartola 9y ago
        OK, but that's (a) 100% speculation and (b) fails Hanlon's razor. I don't like the fact that you can't disable ME, that it's not open source, and that it's vulnerable any more than anyone else. But this does seem like hyperbole much more than fact.
        Sir_Substance 9y ago
        >OK, but that's (a) 100% speculation 95% speculation. The last 5% comes from exercising basic pattern recognition. I remind you that we're probably talking about interference from the organization that arranged this: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... The existence of that program was pure speculation, until it turned out to be totally real. >(b) fails Hanlon's razor. This is completely irrelevant to any argument made between two informed participants. It's worse than speculation, it's a plea to glib colloquialisms. Any chance you've got evidence or even reasoned speculation supporting the theory that the worlds most successful CPU manufacturer has an incompetent marketing department?
        IgorPartola 9y ago
        I think they have an incompetent management department that decided that no open sourcing ME is a good idea. Marketing is may also be incompetent at picking up the pieces after the bugs were discovered. > 95% speculation. The last 5% comes from exercising basic pattern recognition. No, it's all speculation because pattern recognition is not evidence, as applied here. Like, is it possible that I am an NSA agent trying to persuade you that you are safe and shouldn't worry about ME? Of course it's possible. But do you have any evidence of that? No. "Well, in the past the NSA has asked big companies for backdoors into their products" is a true statement with evidence. "That implies that in this case there is a 5% chance that is exactly what's happening" is 100% speculation because again there is no evidence. If you can find any, I am all ears because honestly I am not a fan of Intel, Intel ME, the NSA, government spying, big corporations taking advantage of consumers, or a number of other things I imagine you and I agree on. But I think I am being rational when I say that chances are this is a stupid bug or number of bugs, plus bad old school thinking on the part of the management team, and not a deliberate NSA feature. Here is my bit of speculation: if the NSA asked Intel to include a backdoor, wouldn't they both have done a better job of creating it? Why introduce a bug when you can include whatever code you want in a closed source firmware? You can literally add any kind of C&C mechanism you want because nobody can see what you are doing and nobody would ever know. Is the NSA that stupid to to ask for a bug that can be found and exploited? Is Intel not able to offer a better technical solution? Wouldn't it be to both of their benefits to do this right from the start? Also, why only approach Intel and not AMD? AMD is not as popular but surely has enough market share to warrant spying on.
    - boomboomsubban 9y ago
      It creates a huge attack vector on most computers that the user has almost no control over. Even if Intel are completely uninvolved, some intelligence agency will try to exploit it.
      - JdeBP 9y ago
        The claim at hand, however, was that the NSA made Intel include it.
        boomboomsubban 9y ago
        No, the claim being made is that ME is being added as a feature, with a hyperbolic version of the other argument tacked on. Whether they were forced to include it doesn't matter, the way they included it benefits the intelligence agencies.
    - pdimitar 9y ago
      How can you request a citation about things relating to possible intelligence agencies efforts with a straight face? It's literally their job to make sure such material doesn't exist or sees the light of day if it does. It's not exactly publicly-funded science now, is it? You request a proof that's impossible to procure. Are you now gonna claim the lack of this proof supports your thesis?
      - IgorPartola 9y ago
        Yes? Because acting on pure unvarnished unburdened by critical thinking speculation is not a good idea?
        Karunamon 9y ago
        Critical thinking would demand recognition of the fact that intelligence agencies compromising security isn't a hypothetical anymore, it's a fact, and it would further demand intense skepticism of unauditable and hostile (resists attempts to disable it) code running below ring 0.
        IgorPartola 9y ago
        I never said they don't. Simply that in this case there is no evidence, direct or circumstantial, pointing to Intel ME being born out of an order by an intelligence agency. Could it be? Sure. But critical thinking demands facts, not speculation. Facts are: 1. Intelligence agencies have been known to force companies to give them access to their products. 2. Companies have been known to comply, if reluctantly, at least until a whistleblower exposes the program. 3. Intel ME was developed as an on-chip version of an external card that is actually useful. 4. Intel has made poorly engineered products before. 5. Intel isn't in a habit of open sourcing firmware. 6. From a technical standpoint, Intel is fully capable of creating a system that doesn't allow C&C through a bug and an exploit. 7. AMD, the second largest computer chip maker does not have a matching system that can't be disabled and that has similar bugs. Based on this, I'd say it's possible that the NSA (or equivalent) asked Intel to develop ME and add a bug to allow C&C, but very unlikely. It's also possible that the NSA (or equivalent) asked Intel to develop ME and add C&C and Intel did it through a deliberate bug, but very unlikely. It's also possible that Intel tried to develop a feature the market might want, and screwed up the implementation. This seems to me to be very likely. It's the simplest explanation (Occam's razor) and it requires only incompetence, not malice (Hanlan's razor), so it's sort of by default most likely. If someone can produce an iota of evidence to the contrary I will change my allocation of probabilities appropriately, but so far the evidence is "it could have been done" and "they've been known to spy on people in the past". In my book that's not a strong enough argument.
- technion 9y ago
  That's the narrative, but consulted to a lot of enterprises, and I've never once seen ME in use. Servers have hardware like HPE iLO, and desktops will use OS based agents. And failing that they'll use PXE boot and get rebuilt. The only discussion I've ever seen an Enterprise have about ME was the debate about how you deal with HPE's latest laptop security update.
  - myrandomcomment 9y ago
    And the sad part is the current LOM stuff is not better (even somewhat worse) then the stuff on Sun gear from the late 90s. Oh well.

by zanny 9y ago

IgorPartola 9y ago

No. That's exactly what I'm saying. Most people don't care. Enterprise users do care because ME is useful for them. It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. They'll see this as a small problem that should be fixed and will ask Intel to do so. Intel will fix it, most everyone will move on. I don't think ME will take down Intel stock, and neither will this page isolation bug. Intel's value is 99% engineering + manufacturing ability + customer relations. It would be a poor CEO indeed who'd direct their IT to start buying AMD because of this alone.

uhhhhhhh 9y ago
If my recollection serves, when Intel had what was the largest/most expensive recall in the world in the 90's (at that time anyways), their stock still nearly doubled that year.
Sir_Substance 9y ago
>It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. Let's be clear: It's both.
- IgorPartola 9y ago
  Is it? Again, that a big claim to make in five words and drop the mic. Can you cite anything to back it up?
  - Sir_Substance 9y ago
    If Intel weren't under pressure to keep a negative-ring network enabled snoopstack open by an external entity, they would by now definitely have released an update that allowed people to disable the networking aspect of IME. Major system vendors are now offering to apply bootleg removal situations at the factory on customer request[1]. That request is not free. People are willing to /pay extra/ for no-IME laptops. Either Intels marketing and public relations department are asleep at the wheel, or they've gone to the top to request a friendly switch to disable this and been told by the legal department that they can't have one. [1]https://liliputing.com/2017/12/dell-also-sells-laptops-intel-management-engine-disabled.html https://liliputing.com/2017/12/dell-also-sells-laptops-intel...
    - IgorPartola 9y ago
      OK, but that's (a) 100% speculation and (b) fails Hanlon's razor. I don't like the fact that you can't disable ME, that it's not open source, and that it's vulnerable any more than anyone else. But this does seem like hyperbole much more than fact.
      - Sir_Substance 9y ago
        >OK, but that's (a) 100% speculation 95% speculation. The last 5% comes from exercising basic pattern recognition. I remind you that we're probably talking about interference from the organization that arranged this: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... The existence of that program was pure speculation, until it turned out to be totally real. >(b) fails Hanlon's razor. This is completely irrelevant to any argument made between two informed participants. It's worse than speculation, it's a plea to glib colloquialisms. Any chance you've got evidence or even reasoned speculation supporting the theory that the worlds most successful CPU manufacturer has an incompetent marketing department?
        IgorPartola 9y ago
        I think they have an incompetent management department that decided that no open sourcing ME is a good idea. Marketing is may also be incompetent at picking up the pieces after the bugs were discovered. > 95% speculation. The last 5% comes from exercising basic pattern recognition. No, it's all speculation because pattern recognition is not evidence, as applied here. Like, is it possible that I am an NSA agent trying to persuade you that you are safe and shouldn't worry about ME? Of course it's possible. But do you have any evidence of that? No. "Well, in the past the NSA has asked big companies for backdoors into their products" is a true statement with evidence. "That implies that in this case there is a 5% chance that is exactly what's happening" is 100% speculation because again there is no evidence. If you can find any, I am all ears because honestly I am not a fan of Intel, Intel ME, the NSA, government spying, big corporations taking advantage of consumers, or a number of other things I imagine you and I agree on. But I think I am being rational when I say that chances are this is a stupid bug or number of bugs, plus bad old school thinking on the part of the management team, and not a deliberate NSA feature. Here is my bit of speculation: if the NSA asked Intel to include a backdoor, wouldn't they both have done a better job of creating it? Why introduce a bug when you can include whatever code you want in a closed source firmware? You can literally add any kind of C&C mechanism you want because nobody can see what you are doing and nobody would ever know. Is the NSA that stupid to to ask for a bug that can be found and exploited? Is Intel not able to offer a better technical solution? Wouldn't it be to both of their benefits to do this right from the start? Also, why only approach Intel and not AMD? AMD is not as popular but surely has enough market share to warrant spying on.
  - boomboomsubban 9y ago
    It creates a huge attack vector on most computers that the user has almost no control over. Even if Intel are completely uninvolved, some intelligence agency will try to exploit it.
    - JdeBP 9y ago
      The claim at hand, however, was that the NSA made Intel include it.
      - boomboomsubban 9y ago
        No, the claim being made is that ME is being added as a feature, with a hyperbolic version of the other argument tacked on. Whether they were forced to include it doesn't matter, the way they included it benefits the intelligence agencies.
  - pdimitar 9y ago
    How can you request a citation about things relating to possible intelligence agencies efforts with a straight face? It's literally their job to make sure such material doesn't exist or sees the light of day if it does. It's not exactly publicly-funded science now, is it? You request a proof that's impossible to procure. Are you now gonna claim the lack of this proof supports your thesis?
    - IgorPartola 9y ago
      Yes? Because acting on pure unvarnished unburdened by critical thinking speculation is not a good idea?
      - Karunamon 9y ago
        Critical thinking would demand recognition of the fact that intelligence agencies compromising security isn't a hypothetical anymore, it's a fact, and it would further demand intense skepticism of unauditable and hostile (resists attempts to disable it) code running below ring 0.
        IgorPartola 9y ago
        I never said they don't. Simply that in this case there is no evidence, direct or circumstantial, pointing to Intel ME being born out of an order by an intelligence agency. Could it be? Sure. But critical thinking demands facts, not speculation. Facts are: 1. Intelligence agencies have been known to force companies to give them access to their products. 2. Companies have been known to comply, if reluctantly, at least until a whistleblower exposes the program. 3. Intel ME was developed as an on-chip version of an external card that is actually useful. 4. Intel has made poorly engineered products before. 5. Intel isn't in a habit of open sourcing firmware. 6. From a technical standpoint, Intel is fully capable of creating a system that doesn't allow C&C through a bug and an exploit. 7. AMD, the second largest computer chip maker does not have a matching system that can't be disabled and that has similar bugs. Based on this, I'd say it's possible that the NSA (or equivalent) asked Intel to develop ME and add a bug to allow C&C, but very unlikely. It's also possible that the NSA (or equivalent) asked Intel to develop ME and add C&C and Intel did it through a deliberate bug, but very unlikely. It's also possible that Intel tried to develop a feature the market might want, and screwed up the implementation. This seems to me to be very likely. It's the simplest explanation (Occam's razor) and it requires only incompetence, not malice (Hanlan's razor), so it's sort of by default most likely. If someone can produce an iota of evidence to the contrary I will change my allocation of probabilities appropriately, but so far the evidence is "it could have been done" and "they've been known to spy on people in the past". In my book that's not a strong enough argument.
technion 9y ago
That's the narrative, but consulted to a lot of enterprises, and I've never once seen ME in use. Servers have hardware like HPE iLO, and desktops will use OS based agents. And failing that they'll use PXE boot and get rebuilt. The only discussion I've ever seen an Enterprise have about ME was the debate about how you deal with HPE's latest laptop security update.
- myrandomcomment 9y ago
  And the sad part is the current LOM stuff is not better (even somewhat worse) then the stuff on Sun gear from the late 90s. Oh well.