4 ms·

Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it. Purism[0] sell nice MBP-style,

Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it. Purism[0] sell nice MBP-style, Debian-based laptops with modern Intel processors with the NSA's 'High Assurance Platform' bit set, and as much of the ME code removed as possible. It still runs briefly at boot, but this is the most-disabled you can currently get on any i3/i5/i7 processor[1]. [0]: https://puri.sm/ https://puri.sm/ [1]: https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/ System76 are planning to do something similar[2]. [2]: http://blog.system76.com/post/168050597573/system76-me-firmware-updates-plan http://blog.system76.com/post/168050597573/system76-me-firmw... The last Intel processors where the ME could be removed entirely without bricking, were the non-AMT Core Duos (2008ish), which were used on the Thinkpad T400 (good for your biceps) and the X200/X200T (thick, but compact, even by today's standards). Various companies (most prominently the Ministry of Freedom in the UK) sell these models with the ME completely removed, and a completely Free Software boot process via LibreBoot (a subset of coreboot). You can find a full list of suppliers on the FSF's 'Respects Your Freedom' hardware page[3]. Most of them will also remove the ME from a compatible laptop you send them, as a service. [3]: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/resources/hw/endorsement/respects-your-f... These machines are also 'naturally' resistant to both Spectre and Meltdown, and obviously have no ME to exploit. None of the Intel horror-shows of the last few years seem to have touched them. I previously thought that running an old-machine for largely hypothetical freedoms was bizarre. After these CVEs, I'm beginning to re-examine how bizarre it really is. And I do miss those old ThinkPad keyboards :)

casefields 8y ago
Never heard of these. Thanks for the pointer.
- BanazirGalbasi 8y ago
  System76 is probably the most well-known Linux laptop distributor in the US, their offerings are pretty popular. I know a few people with one of their laptops and all of them are pretty satisfied. Purism is a bit more "extreme", trying to create an all-libre laptop that avoids proprietary software and hardware. Once their equipment is a bit more stable it's something I'm going to look into more, for now they're still in development though.
matheusmoreira 8y ago
Purism published some reverse engineering information and received a "polite request" to remove the post. Hmm... https://web.archive.org/web/20180407232908/https://puri.sm/posts/intel-fsp-reverse-engineering-finding-the-real-entry-point/ https://web.archive.org/web/20180407232908/https://puri.sm/p...
urza 8y ago
This comment should be on top.
yAnonymous 8y ago
At that point you should just buy AMD, if only to not support a company like Intel with such a bad security track record.
- confounded 8y ago
  AMD has an ME equivalent, which is approximately as prevalent. It’s still a DRM/DMCA-protected remote access CPU on your CPU. What could go wrong? Buying Librebooted machines isn’t directly supporting Intel.
  - floatboth 8y ago
    Sure it's not good that we still have a coprocessor running a proprietary blob, but it's not known to have the ability to use your network card.
  - 153791098c 8y ago
    But not on AMD machines from 2012 and before. You can buy a high-end motherboard (KGPE-D16) that can run libreboot and 2 16core Opteron 62xx cpu's with 192GB ram. You don't have to go the old and relatively slow thinkpad route to achieve freedom.
    - confounded 8y ago
      Thank you for this information! I’m interested in something like this (though maybe not as beefy) for self-hosting. Are there any companies that sell the gear you describe, or guides/wikis on getting set up?
      - confounded 8y ago
        Answering my own question, suppliers of boards are available on the FSF's site (these are the boards which the FSF use themselves): https://fsf.org/ryf https://fsf.org/ryf
        8y ago
mmjaa 8y ago
This is a great reference - but I confess to being mightily disappointed at the state of the industry with regards to this issue. Sadly, it seems like its going to need a major incident before people start to pay attention. I can't believe I'm actually rooting for the black-hats to do something so terrible, it wakes us all up.

casefields 8y ago

Never heard of these. Thanks for the pointer.

BanazirGalbasi 8y ago
System76 is probably the most well-known Linux laptop distributor in the US, their offerings are pretty popular. I know a few people with one of their laptops and all of them are pretty satisfied. Purism is a bit more "extreme", trying to create an all-libre laptop that avoids proprietary software and hardware. Once their equipment is a bit more stable it's something I'm going to look into more, for now they're still in development though.

matheusmoreira 8y ago

Purism published some reverse engineering information and received a "polite request" to remove the post. Hmm... https://web.archive.org/web/20180407232908/https://puri.sm/posts/intel-fsp-reverse-engineering-finding-the-real-entry-point/ https://web.archive.org/web/20180407232908/https://puri.sm/p...

urza 8y ago

This comment should be on top.

yAnonymous 8y ago

At that point you should just buy AMD, if only to not support a company like Intel with such a bad security track record.

confounded 8y ago
AMD has an ME equivalent, which is approximately as prevalent. It’s still a DRM/DMCA-protected remote access CPU on your CPU. What could go wrong? Buying Librebooted machines isn’t directly supporting Intel.
- floatboth 8y ago
  Sure it's not good that we still have a coprocessor running a proprietary blob, but it's not known to have the ability to use your network card.
- 153791098c 8y ago
  But not on AMD machines from 2012 and before. You can buy a high-end motherboard (KGPE-D16) that can run libreboot and 2 16core Opteron 62xx cpu's with 192GB ram. You don't have to go the old and relatively slow thinkpad route to achieve freedom.
  - confounded 8y ago
    Thank you for this information! I’m interested in something like this (though maybe not as beefy) for self-hosting. Are there any companies that sell the gear you describe, or guides/wikis on getting set up?
    - confounded 8y ago
      Answering my own question, suppliers of boards are available on the FSF's site (these are the boards which the FSF use themselves): https://fsf.org/ryf https://fsf.org/ryf
      - 8y ago

mmjaa 8y ago

This is a great reference - but I confess to being mightily disappointed at the state of the industry with regards to this issue. Sadly, it seems like its going to need a major incident before people start to pay attention. I can't believe I'm actually rooting for the black-hats to do something so terrible, it wakes us all up.