4 ms·

I seriously doubt either Intel or AMD ship different silicon to the NSA or whoever else. At least from what I've read, the only difference (at least on Intel) i

by franga2000 6y ago

I seriously doubt either Intel or AMD ship different silicon to the NSA or whoever else. At least from what I've read, the only difference (at least on Intel) is the "NSA bit", that can actually be turned on on any chip these days. System76 actually ships machines with it enabled by default.

pmontra 6y ago
The NSA bit? Do you mean this setting to toggle Intel ME? https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...
- franga2000 6y ago
  Yep, that's the one. I've heard people referring to it as "the NSA bit" because it was supposedly implemented at the request/demand of the NSA.
  - colejohnson66 6y ago
    If true, the irony of the NSA asking not for their hardware to (possibly) spy on them is rich.
    - kube-system 6y ago
      What is ironic about it? All spy agencies, everywhere on the planet, do two things: * spy on others * try not to get spied on
      - deleted 6y ago
        [deleted]
chasil 6y ago
The Intel Core 2 Duo/Quad was the last CPU where the "Management Engine" could be completely wiped and disabled. This is my experience in removing the ARC firmware code from two different HP desktops (I attached both BIOS images): https://github.com/corna/me_cleaner/issues/233 https://github.com/corna/me_cleaner/issues/233 These PCs are quite inexpensive. I run OpenBSD with hardened Chrome on one of them, for all of my finances.
- Zetaphor 6y ago
  If you're going through all that effort, then why bothering with hardening Chrome? Why wouldn't you start with Firefox, which doesn't require unGoogling to be considered secure?
  - chasil 6y ago
    OpenBSD's Chrome had pledge() first, but you're right, I should consider Firefox. However, there was a recent Firefox bug in OpenBSD, and the patches weren't applied uniformly. It does seem that Chrome is more consistent, and gets more attention. https://undeadly.org/cgi?action=article;sid=20200109141600 https://undeadly.org/cgi?action=article;sid=20200109141600

pmontra 6y ago

The NSA bit? Do you mean this setting to toggle Intel ME? https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...

franga2000 6y ago
Yep, that's the one. I've heard people referring to it as "the NSA bit" because it was supposedly implemented at the request/demand of the NSA.
- colejohnson66 6y ago
  If true, the irony of the NSA asking not for their hardware to (possibly) spy on them is rich.
  - kube-system 6y ago
    What is ironic about it? All spy agencies, everywhere on the planet, do two things: * spy on others * try not to get spied on
    - deleted 6y ago
      [deleted]

chasil 6y ago

The Intel Core 2 Duo/Quad was the last CPU where the "Management Engine" could be completely wiped and disabled. This is my experience in removing the ARC firmware code from two different HP desktops (I attached both BIOS images): https://github.com/corna/me_cleaner/issues/233 https://github.com/corna/me_cleaner/issues/233 These PCs are quite inexpensive. I run OpenBSD with hardened Chrome on one of them, for all of my finances.

Zetaphor 6y ago
If you're going through all that effort, then why bothering with hardening Chrome? Why wouldn't you start with Firefox, which doesn't require unGoogling to be considered secure?
- chasil 6y ago
  OpenBSD's Chrome had pledge() first, but you're right, I should consider Firefox. However, there was a recent Firefox bug in OpenBSD, and the patches weren't applied uniformly. It does seem that Chrome is more consistent, and gets more attention. https://undeadly.org/cgi?action=article;sid=20200109141600 https://undeadly.org/cgi?action=article;sid=20200109141600