4 ms·

> Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). It doesn't suggest anything

> Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). It doesn't suggest anything without evidence.

BlueTemplar 6y ago
I'm not sure that we have the same definition of 'suggest'... If we're lucky, we'll only get actual evidence after many decades, like with Crypto AG. (But of course we already have some evidence, for instance about ECHELON and PRISM (Skype...)) If we're unlucky, black hats (criminals and/or anti-West countries) are going to lay their hands on those backdoors first, like with the NSA/Shadow Brokers leak : https://news.ycombinator.com/item?id=12302085 https://news.ycombinator.com/item?id=12302085
roenxi 6y ago
> It doesn't suggest anything without evidence. We have substantial evidence from this very article: * There exist agencies that are trying to compromise your communications. * They have no scruples. * They are actively causing people to lie about what products do. * They are willing to act through corporations. Waiting until there is overwhelming evidence of a specific act of wrongdoing is a strategy so ineffective it may as well just be saying "I don't care about securing my communications". Not to say that no strategy is unreasonable, maybe people don't care. Assuming everyone is telling the truth about being honest and ruling them out one by one when there is a large report or a Snowden-style leak is all but guaranteed to have the same result as ignoring the problem. Evidence is coming to light years after the event, and the spies in this article used Switzerland as part of a strategy of targeting the most trusted places for corruption.
pjc50 6y ago
Quite right. Remember the supermicro fiasco? HN tore the non-evidence apart on that one.
freeflight 6y ago
Huawei products have been banned in a number of countries without any evidence, while US manufacturers like CISCO [0] have a pretty rich and regular history of weird backdoors in their products and actively harassing security researchers to suppress the reveal of that information [1]. Now consider the fact how one of the top search results for "Intel me NSA" is this article [2] telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful, but I'm sure as hell skeptical enough when a burglar wants to tell me how to best secure my home from break-ins. [0] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... [1] https://www.schneier.com/blog/archives/2005/07/cisco_harasses.html https://www.schneier.com/blog/archives/2005/07/cisco_harasse... [2] https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...
- BlueTemplar 6y ago
  > telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. > I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful Why do you think that it's thanks to the NSA, and not despite what the NSA wanted ? What NSA advice ? Also, Dell supposedly can sell you IME-disabled (?) (thanks to this?) Intel CPU computers if you're a large enough organization. Of course it could be that it's actually a fake way to disable IME – can we really know without having the firmware source and checking the hardware, which is likely to be a monumental task considering the level of miniaturization these days ..?

> Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). It doesn't suggest anything without evidence.

BlueTemplar 6y ago

I'm not sure that we have the same definition of 'suggest'... If we're lucky, we'll only get actual evidence after many decades, like with Crypto AG. (But of course we already have some evidence, for instance about ECHELON and PRISM (Skype...)) If we're unlucky, black hats (criminals and/or anti-West countries) are going to lay their hands on those backdoors first, like with the NSA/Shadow Brokers leak : https://news.ycombinator.com/item?id=12302085 https://news.ycombinator.com/item?id=12302085

roenxi 6y ago

> It doesn't suggest anything without evidence. We have substantial evidence from this very article: * There exist agencies that are trying to compromise your communications. * They have no scruples. * They are actively causing people to lie about what products do. * They are willing to act through corporations. Waiting until there is overwhelming evidence of a specific act of wrongdoing is a strategy so ineffective it may as well just be saying "I don't care about securing my communications". Not to say that no strategy is unreasonable, maybe people don't care. Assuming everyone is telling the truth about being honest and ruling them out one by one when there is a large report or a Snowden-style leak is all but guaranteed to have the same result as ignoring the problem. Evidence is coming to light years after the event, and the spies in this article used Switzerland as part of a strategy of targeting the most trusted places for corruption.

pjc50 6y ago

Quite right. Remember the supermicro fiasco? HN tore the non-evidence apart on that one.

freeflight 6y ago

Huawei products have been banned in a number of countries without any evidence, while US manufacturers like CISCO [0] have a pretty rich and regular history of weird backdoors in their products and actively harassing security researchers to suppress the reveal of that information [1]. Now consider the fact how one of the top search results for "Intel me NSA" is this article [2] telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful, but I'm sure as hell skeptical enough when a burglar wants to tell me how to best secure my home from break-ins. [0] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... [1] https://www.schneier.com/blog/archives/2005/07/cisco_harasses.html https://www.schneier.com/blog/archives/2005/07/cisco_harasse... [2] https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...

BlueTemplar 6y ago
> telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. > I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful Why do you think that it's thanks to the NSA, and not despite what the NSA wanted ? What NSA advice ? Also, Dell supposedly can sell you IME-disabled (?) (thanks to this?) Intel CPU computers if you're a large enough organization. Of course it could be that it's actually a fake way to disable IME – can we really know without having the firmware source and checking the hardware, which is likely to be a monumental task considering the level of miniaturization these days ..?