5 ms·

I think there is a huge architectural philosophy divide here. Some think ME has it's place if done right,but surely many would agree with me when saying all of

I think there is a huge architectural philosophy divide here. Some think ME has it's place if done right,but surely many would agree with me when saying all of ME's functionality should be implemented by the OS. ring -1 should not exist. Period.

isostatic 8y ago
How does ME contrast with things like ilo/ipmi?
- amelius 8y ago
  As an aside, we recently experienced a server hack through a vulnerability in iLO (a system we didn't even use other than for rebooting the machine) Thanks, HP! /s
  - crankylinuxuser 8y ago
    To build on this, we distrusted the actual servers in the rack for the following: 1. Out of band devices to administer boot fail incidents, serially controlled 2. PDU (Power distribution Unit). Supplied with 2 different power sources. Provides dual power per server on rack. Controlled by ethernet. 3. Firewall rules that prevent the managed crap (iLO and the like) from working. The only recent issue my previous job had, was in a junior sysad installed apache tomcat with default creds. Can't really fix user error - but the above rules at least stop malicious intent from manufacturers. Mostly.
  - badrabbit 8y ago
    ME is like that except it ships with the CPU.
zvrba 8y ago
> many would agree with me when saying all of ME's functionality should be implemented by the OS. ME's use case is to be able to manage the machine when there is no OS installed, is unbootable or unresponsive. So somebody doesn't have to physically visit a datacenter and find the machine in a rack. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...
- Filligree 8y ago
  This could also be implemented using a few BIOS modifications and, this is important, a separate computer connected to an internal serial port. Basically the same setup, except the management engine is a detachable, five-dollar device.
- ethbro 8y ago
  How are the two mutually exclusive? There's no technical reason I can think of that Intel couldn't separate the "initialize" and "management" functions of ME. If an OS is installed, it has rights to write into the "management" storage area, remove everything there, or install alternative functionality. If no OS is installed, and remote features like power-off-network-login need to work, have the NIC jump straight into the storage area and start executing. If there's nothing there / corrupt data because the OS / user screwed it up... well, that's their fault. There's no non-DRM case for precluding users from being able to overwrite the ME of their own hardware.
- badrabbit 8y ago
  Right,what is needed is a management OS(think efi-like). Also,kvm+ipmi[1] is used for that mostly,not ME. [1] https://en.m.wikipedia.org/wiki/Intelligent_Platform_Management_Interface https://en.m.wikipedia.org/wiki/Intelligent_Platform_Managem...
  - isostatic 8y ago
    So ME isn't a cheap on-chip version of ipmi then?

isostatic 8y ago

How does ME contrast with things like ilo/ipmi?

amelius 8y ago
As an aside, we recently experienced a server hack through a vulnerability in iLO (a system we didn't even use other than for rebooting the machine) Thanks, HP! /s
- crankylinuxuser 8y ago
  To build on this, we distrusted the actual servers in the rack for the following: 1. Out of band devices to administer boot fail incidents, serially controlled 2. PDU (Power distribution Unit). Supplied with 2 different power sources. Provides dual power per server on rack. Controlled by ethernet. 3. Firewall rules that prevent the managed crap (iLO and the like) from working. The only recent issue my previous job had, was in a junior sysad installed apache tomcat with default creds. Can't really fix user error - but the above rules at least stop malicious intent from manufacturers. Mostly.
- badrabbit 8y ago
  ME is like that except it ships with the CPU.

zvrba 8y ago

> many would agree with me when saying all of ME's functionality should be implemented by the OS. ME's use case is to be able to manage the machine when there is no OS installed, is unbootable or unresponsive. So somebody doesn't have to physically visit a datacenter and find the machine in a rack. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

Filligree 8y ago
This could also be implemented using a few BIOS modifications and, this is important, a separate computer connected to an internal serial port. Basically the same setup, except the management engine is a detachable, five-dollar device.
ethbro 8y ago
How are the two mutually exclusive? There's no technical reason I can think of that Intel couldn't separate the "initialize" and "management" functions of ME. If an OS is installed, it has rights to write into the "management" storage area, remove everything there, or install alternative functionality. If no OS is installed, and remote features like power-off-network-login need to work, have the NIC jump straight into the storage area and start executing. If there's nothing there / corrupt data because the OS / user screwed it up... well, that's their fault. There's no non-DRM case for precluding users from being able to overwrite the ME of their own hardware.
badrabbit 8y ago
Right,what is needed is a management OS(think efi-like). Also,kvm+ipmi[1] is used for that mostly,not ME. [1] https://en.m.wikipedia.org/wiki/Intelligent_Platform_Management_Interface https://en.m.wikipedia.org/wiki/Intelligent_Platform_Managem...
- isostatic 8y ago
  So ME isn't a cheap on-chip version of ipmi then?