7 ms·

It looks like finally users may have complete control over their Intel computers without Intel having the final say. I, for one, am quite happy about this.

shiblukhan 7y ago
"the scenario that they feared most", yet the scenario everyone was sure would happen.
- jjoonathan 7y ago
  I wasn't sure it would happen, but I'm sure happy it has!
ghostpepper 7y ago
Does this announcement mean it's finally possible to run FOSS firmware like Coreboot on modern Intel hardware? If so, this is a huge finding
- gentleman11 7y ago
  Looks like it could make it easier to get around DRM also?
- zelphirkalt 7y ago
  That's what I am wondering too! Perhaps Libreboot can make progress and we could have completely free systems with more up to date hardware after all? That would be so great.
- wmf 7y ago
  Coreboot already runs on modern Intel hardware. This vulnerability doesn't eliminate the blobs or the need for the ME to initialize hardware before Coreboot runs if that's what you're thinking of.
  - ghostpepper 7y ago
    Could this vulnerability be used to bypass the ME? I'd like to run coreboot on my thinkpad X1 carbon gen7
    - bubblethink 7y ago
      The ME is irrelevant for you. It's bootguard that is preventing you from running coreboot.
  - bubblethink 7y ago
    Well, I think people care about whether this can be used to bypass bootguard. If yes, it would enable coreboot support on every laptop.
lxgr 7y ago
This sentiment seems to be rooted in a misunderstanding of what trusted computing is trying to achieve on a fundamental level. The idea is not to "take control over people's computers", i.e. your trust in your own computer. It is rather to enable somebody to gain some level of trust in the computations that are happening on somebody else's computer. Yes, this technology is commonly used for DRM, and that was one of its earliest applications. But it's not limited to that. Trusted computing can switch the roles and give you as a user certainty over the computations a third party provider performs in the cloud on your behalf. The Signal team is doing a lot of very interesting experiments there [1]. If your concern is a hardware backdoor or something similar, this is less of a question of trusted computing, and rather one of trust in hardware vendors. Your hardware vendor can screw you over entirely without TPM, TEE, secure elements and the like. On the other hand, Intel's trusted computing platform being horribly broken does not magically give you FOSS replacements for all the firmware, ROMs and microcode running on the dozens of peripherals in your computer. [1] https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
- guerrilla 7y ago
  > Your hardware vendor can screw you over entirely without TPM, TEE, secure elements and the like. Yes they can, but as I understand it they are using TPM to screw us over, hence people celebrating its being popped. No misunderstanding of trusted computing necessary: there aren't, in practice, other vendors to choose from here.
  - lxgr 7y ago
    Could you elaborate on the ways that people are being screwed over by TPM? I do see that the existence of both trusted and untrusted systems could exert some pressure on consumers to adopt the latter, due to the unavailability of certain services on the former (e.g. DRM, banking apps on rooted Android phones etc). The danger here is a loss of "freedom to tinker", which I do appreciate very much, and I share that concern. But has that actually happened with TPM?
    - 7y ago

shiblukhan 7y ago

"the scenario that they feared most", yet the scenario everyone was sure would happen.

jjoonathan 7y ago
I wasn't sure it would happen, but I'm sure happy it has!

ghostpepper 7y ago

Does this announcement mean it's finally possible to run FOSS firmware like Coreboot on modern Intel hardware? If so, this is a huge finding

gentleman11 7y ago
Looks like it could make it easier to get around DRM also?
zelphirkalt 7y ago
That's what I am wondering too! Perhaps Libreboot can make progress and we could have completely free systems with more up to date hardware after all? That would be so great.
wmf 7y ago
Coreboot already runs on modern Intel hardware. This vulnerability doesn't eliminate the blobs or the need for the ME to initialize hardware before Coreboot runs if that's what you're thinking of.
- ghostpepper 7y ago
  Could this vulnerability be used to bypass the ME? I'd like to run coreboot on my thinkpad X1 carbon gen7
  - bubblethink 7y ago
    The ME is irrelevant for you. It's bootguard that is preventing you from running coreboot.
- bubblethink 7y ago
  Well, I think people care about whether this can be used to bypass bootguard. If yes, it would enable coreboot support on every laptop.

lxgr 7y ago

This sentiment seems to be rooted in a misunderstanding of what trusted computing is trying to achieve on a fundamental level. The idea is not to "take control over people's computers", i.e. your trust in your own computer. It is rather to enable somebody to gain some level of trust in the computations that are happening on somebody else's computer. Yes, this technology is commonly used for DRM, and that was one of its earliest applications. But it's not limited to that. Trusted computing can switch the roles and give you as a user certainty over the computations a third party provider performs in the cloud on your behalf. The Signal team is doing a lot of very interesting experiments there [1]. If your concern is a hardware backdoor or something similar, this is less of a question of trusted computing, and rather one of trust in hardware vendors. Your hardware vendor can screw you over entirely without TPM, TEE, secure elements and the like. On the other hand, Intel's trusted computing platform being horribly broken does not magically give you FOSS replacements for all the firmware, ROMs and microcode running on the dozens of peripherals in your computer. [1] https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/

guerrilla 7y ago
> Your hardware vendor can screw you over entirely without TPM, TEE, secure elements and the like. Yes they can, but as I understand it they are using TPM to screw us over, hence people celebrating its being popped. No misunderstanding of trusted computing necessary: there aren't, in practice, other vendors to choose from here.
- lxgr 7y ago
  Could you elaborate on the ways that people are being screwed over by TPM? I do see that the existence of both trusted and untrusted systems could exert some pressure on consumers to adopt the latter, due to the unavailability of certain services on the former (e.g. DRM, banking apps on rooted Android phones etc). The danger here is a loss of "freedom to tinker", which I do appreciate very much, and I share that concern. But has that actually happened with TPM?
  - 7y ago