4 ms·

That's not the issue. You can already disable pretty much all of the ME's functions post-boot with HAP and me_cleaner. But for people who take an interest in fu

That's not the issue. You can already disable pretty much all of the ME's functions post-boot with HAP and me_cleaner. But for people who take an interest in fully-open source firmware (coreboot, libreboot), it would be nice to be able to replace the ME firmware with something open source. But this is impossible because the hardware will only run Intel-signed blobs. By "owner control", I mean the freedom to run whatever you like on the ME. It's likely that Intel is not only unwilling, but contractually precluded from letting people do so, for the reasons I gave. Hence the claim that Intel will never let people control what runs on the ME.

yayana 8y ago
Unless they have forgotten the last 2 decades, Intel only has to not let you have access to specific keys that are only available to a securely booted Intel ME. Trying to prevent you from running something else is pointless posturing for that purpose as it is only useful to decoding DRM if you already have some means to compromise Intel MEs and extract key information. Not allowing anyone to build an alternate system with ME's capabilities is not pointless posturing when it comes to getting the NSA to bless your export of higher performance chips than the US wants many states to have. To put it a different way, they want Hollywood to have strong low layer encryption on your computer but they don't want you to have it, especially if you might be outside the US.
- ghthor 8y ago
  Sounds like the real truth, I hope it isn't more neferious then this though.
close04 8y ago
The reasoning presented by this article is very "conspiracy-style". The arguments revolve around GPUs which are a more natural fit for DRM mechanisms: they display the image, and are more apt at decoding/encoding that protected stream than the CPU. But using ME for DRM in the near future is highly unlikely since it would just be a boon for ARM based systems. With CPUs that can be designed and sold at far lower cost (and performance) by manufacturers that are willing to forego such lunacies as DRM embedded in x86 CPUs and get a foothold in the market. And x86 already feels past its prime given that many usage scenarios already migrated to ARM devices. At some point the CPU, GPU, and a hypothetical VPU might share the same die in a heterogeneous chip, and this might include such DRM protection for the reasons GPUs have them now. But the x86 CPU part having built-in DRM? I'm not buying it without someone making a better case than this article. The ME is just Intel's pi*s-poor attempt at securing the system. But it's mostly security through obscurity so basically almost none at all. The more "conspiracy" version is that it serves specifically as a back door for certain agency type actors. Which is not unlikely. But the more obvious reason is that at this point opening it up is no longer an option. It would mean opening the door widely to an avalanche of exploits capable of hitting systems 12 years back. Something that would make Meltdown/Spectre look tame since there is no OS fix for ME. Also, in Intel's vision letting you control the ME is like giving you the keys to the kingdom. They can't admit to themselves that the ME is not a locked gate, it's a moat. And if you're willing to get dirty you will get through it.
- TaylorAlexander 8y ago
  My takeaway was that the industry attitude towards DRM in CPUs and GPUs has been the same “lock it down and obscure it”, and the reference to GPU contractual obligations was considered relevant based on the assumption that industry agreements for both CPU lockdown and GPU lockdown would be similar. It’s clear Intel is motivated to provide user lockouts on its critical regions, so it stands to reason they may have a contract similar to the known GPU contracts. I didn’t find it very conspiracy style. It seemed to me a well thought out and rational article. It reminded me of how Facebook can never truly “protect user data” because they build a business reliant on collecting and distributing user data.
- comex 8y ago
  The ME has in fact been used for video DRM for a long time; Google for Intel PAVP (Protected Audio-Video Path).
  - close04 8y ago
    The important fact being that it only applied to the Intel iGPU. You also had the option to disable that and the HW decoding with the iGPU was also disabled. The successor is called Intel Insider and it's still aimed at the GPU. Basically it's there to make sure the stream goes to the GPU (which has DRM) to be decrypted not to the CPU. That's because nobody was "courageous" enough until now to put the DRM label on a CPU. https://blogs.intel.com/technology/2011/01/intel_insider_-_what_is_it_no/ https://blogs.intel.com/technology/2011/01/intel_insider_-_w...

yayana 8y ago

Unless they have forgotten the last 2 decades, Intel only has to not let you have access to specific keys that are only available to a securely booted Intel ME. Trying to prevent you from running something else is pointless posturing for that purpose as it is only useful to decoding DRM if you already have some means to compromise Intel MEs and extract key information. Not allowing anyone to build an alternate system with ME's capabilities is not pointless posturing when it comes to getting the NSA to bless your export of higher performance chips than the US wants many states to have. To put it a different way, they want Hollywood to have strong low layer encryption on your computer but they don't want you to have it, especially if you might be outside the US.

ghthor 8y ago
Sounds like the real truth, I hope it isn't more neferious then this though.

close04 8y ago

The reasoning presented by this article is very "conspiracy-style". The arguments revolve around GPUs which are a more natural fit for DRM mechanisms: they display the image, and are more apt at decoding/encoding that protected stream than the CPU. But using ME for DRM in the near future is highly unlikely since it would just be a boon for ARM based systems. With CPUs that can be designed and sold at far lower cost (and performance) by manufacturers that are willing to forego such lunacies as DRM embedded in x86 CPUs and get a foothold in the market. And x86 already feels past its prime given that many usage scenarios already migrated to ARM devices. At some point the CPU, GPU, and a hypothetical VPU might share the same die in a heterogeneous chip, and this might include such DRM protection for the reasons GPUs have them now. But the x86 CPU part having built-in DRM? I'm not buying it without someone making a better case than this article. The ME is just Intel's pi*s-poor attempt at securing the system. But it's mostly security through obscurity so basically almost none at all. The more "conspiracy" version is that it serves specifically as a back door for certain agency type actors. Which is not unlikely. But the more obvious reason is that at this point opening it up is no longer an option. It would mean opening the door widely to an avalanche of exploits capable of hitting systems 12 years back. Something that would make Meltdown/Spectre look tame since there is no OS fix for ME. Also, in Intel's vision letting you control the ME is like giving you the keys to the kingdom. They can't admit to themselves that the ME is not a locked gate, it's a moat. And if you're willing to get dirty you will get through it.

TaylorAlexander 8y ago
My takeaway was that the industry attitude towards DRM in CPUs and GPUs has been the same “lock it down and obscure it”, and the reference to GPU contractual obligations was considered relevant based on the assumption that industry agreements for both CPU lockdown and GPU lockdown would be similar. It’s clear Intel is motivated to provide user lockouts on its critical regions, so it stands to reason they may have a contract similar to the known GPU contracts. I didn’t find it very conspiracy style. It seemed to me a well thought out and rational article. It reminded me of how Facebook can never truly “protect user data” because they build a business reliant on collecting and distributing user data.
comex 8y ago
The ME has in fact been used for video DRM for a long time; Google for Intel PAVP (Protected Audio-Video Path).
- close04 8y ago
  The important fact being that it only applied to the Intel iGPU. You also had the option to disable that and the HW decoding with the iGPU was also disabled. The successor is called Intel Insider and it's still aimed at the GPU. Basically it's there to make sure the stream goes to the GPU (which has DRM) to be decrypted not to the CPU. That's because nobody was "courageous" enough until now to put the DRM label on a CPU. https://blogs.intel.com/technology/2011/01/intel_insider_-_what_is_it_no/ https://blogs.intel.com/technology/2011/01/intel_insider_-_w...