16 ms·

AMD Ryzen 6000 Series Mobile CPUs Feature Microsoft's Pluton Security

107 points by no_time 5y ago

NotVerstappen 5y ago
I don't want any hardware designed by Microsoft in my machine. The concept might be good, but I don't trust them not to ruin my experience when using Linux. This will force me towards using a smaller number of niche vendors (good, if they survive that long) or just switching to a Mac (bad).
- Tsiklon 5y ago
  If I recall, a good portion of the UEFI Secure Boot system is entirely of Microsoft’s design, albeit this is thankfully an optional system in most cases but one that has definitely caused headaches for Linux users.
  - MisterTea 5y ago
    The usual Microsoft/Intel collusion/mono-culture. I am so tired of this duopoly. AMD just tows the same lines to sell hardware.
    - Datagenerator 5y ago
      Would KVM with virtual TPM isolate Win11 enough?
  - lostmsu 5y ago
    What were the headaches? That you had to sign your kernel and add pubkey to BIOS to use the feature?
- tempfs 5y ago
  Even if you ignore the fact that they'll find a way to shit on Linux[to push WSL] I simply do not trust Microsoft to get anything right in terms of security.[1] [1] Being alive and security aware for the last few decades.
lkxijlewlf 5y ago
Well, this just sucks. This means Microsoft owns my computer. They can access parts of my CPU without my knowledge. WTF, AMD!
- Cloudef 5y ago
  Don't they own it already by taking advantage of TPM? Or well, at least control what software it can run, and whether your installation is "legit".
  - no_time 5y ago
    The TPM is a step in that direction but still misses a couple of puzzle pieces to truly control your machine. For example it may sign the boot measurements but has no introspection into what runs on the machine afterwards.
    - d_tr 5y ago
      What about the Intel Management Engine that is more than ten years old? It is a full OS with maximum privileges.
      - no_time 5y ago
        ME was always sold of as a sort of Premium enterprise feature with no uses on the consumer front. However Intel dabbled with technology much more sinister (SGX) that did exactly what it said exactly on the tin, protecting data from the user of the machine. Unlike MS's track record with Pluton, it was always horribly broken,required a license to attest victim machines and only covered the Intel half of the PC market. The only commercial software I'm aware of that ever mandated SGX is some blu ray player for windows
- AdrianB1 5y ago
  No, that happens only if you reward them with your money (buy that CPU).
trelane 5y ago
I wonder how this is similar/different to the Qualcomm take on it? Semis curate seems to not be a fan: https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-dangerous-to-deploy/ https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-d...
- no_time 5y ago
  No wonder they are not a fan. We are rapidly accelerating towards a worst case dystopia where a handful of companies backed by state power control what you hear,say and execute on your machine. I predict atleast one major world power will mandate this technology in consumer electronics to be able to connect to the internet by 2030 in its current rate of adoption.
- mastax 5y ago
  They say it is remotely accessible but present no evidence. They present device-unique keys as impossible with no evidence despite that being exactly how TPMs have worked for decades. They didn't even mention what is the biggest concern: firmware. This thing is basically a secure microcontroller, and MS has implied that it can run different software to achieve different use cases (at launch it emulates a TPM). The important question is: does it only load firmware signed by Microsoft. If not, I don't have a big issue with it.
  - judge2020 5y ago
    Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.
    - AnthonyMouse 5y ago
      Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.
idop 5y ago
Oh well, looks like I'll be going for an ARM machine.
- no_time 5y ago
  We are past the stage where it can be solved by technological means. This issue is strictly political and economical. Once this tech reaches critical mass of adoption, you might have trouble participating in the modern world since your device is not "trusted". Much like how Android's safetynet prevents running banking apps if boot time signatures do not mach an approved list.
  - sounds 5y ago
    The Raspberry Pi foundation is working on adding a signed bootloader and trusted computing to their next chip. I'm looking for the source I found, and I thought it was [1] but don't see the text there anymore. [1] https://www.raspberrypi.com/news/bullseye-bonus-1-8ghz-raspberry-pi-4/ https://www.raspberrypi.com/news/bullseye-bonus-1-8ghz-raspb...
    - no_time 5y ago
      Wayback machine does not show any such changes on a cursory glance.
- trynumber9 5y ago
  Qualcomm's ARM machines will have this too.
- MangoCoffee 5y ago
  Qualcomm said they going to be partner with Microsoft. RISC-V is the future for no backdoor.
  - Narishma 5y ago
    What's to stop RISC-V CPU manufacturers doing the same?
underscore_ku 5y ago
i don't want microsoft in my cpu!
- no_time 5y ago
  Should've made some noise a year ago when this was first announced lol A similar story unfolding in the early 00's was thwarted by the tech community shaming microsoft into dropping the plans (name Palladium back then). I have a feeling people were much more vigilant and better informed back then.
  - Tostino 5y ago
    It was simply a smaller field at the time. Easier to stay informed when there is just "less" all around you.
pdimitar 5y ago
Extremely disappointing. Also the CES didn't say anything about the next Threadrippers. :( They did tease the next Zen architecture but not much details sadly. But having Microsoft-designed hardware as a backdoor in my system? Absolutely not.
- andreime 5y ago
  While listening to the podcast "Moore's law is dead", I heard repeatedly that AMD has no interest in launching new Threadrippers, ever again.
  - pdimitar 5y ago
    ...What? But why! Sigh, less and less choice every day. EDIT: What about this potential leak? https://www.digitaltrends.com/computing/amd-to-release-ryzen-threadripper-pro-5000-processor-march-2022/ https://www.digitaltrends.com/computing/amd-to-release-ryzen...
    - lillecarl 5y ago
      Probably because they're server cpus that can be sold for more, it's too bad if this is true, I really want more PCIe lanes, though the threadripper 128 lanes are overkill, I'd be fine with 40. Other than that, performance is plenty on a 5950x for all my imaginable use cases.
      - pdimitar 5y ago
        Sure but I'd be paranoid about not having ECC RAM whereas Threadrippers support it officially. But I am sure there's a curated list of Ryzen motherboards that do in fact support ECC...
        judge2020 5y ago
        Pretty much. https://hardwarecanucks.com/cpu-motherboard/ecc-memory-amds-ryzen-deep-dive/5/ https://hardwarecanucks.com/cpu-motherboard/ecc-memory-amds-...
AshamedCaptain 5y ago
Previously on HN https://news.ycombinator.com/item?id=25191319 https://news.ycombinator.com/item?id=25191319 “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm (156 comments)
no_time 5y ago
Recommended reading for anyone interested in this tecnology. https://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi... https://secret.club/2021/06/28/windows11-tpms.html https://secret.club/2021/06/28/windows11-tpms.html https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT01.pdf https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT0...
- judge2020 5y ago
  > secret.club > Imagine you want to watch your favorite show on Netflix in 4k, but your hardware trust factor is low? Too bad you’ll have to settle for the 720p stream. Untrusted devices could be watching in an instance of Linux KVM, and we can’t risk your pirating tools running in the background! Oh no, video platforms don't want me pirating their stuff. Video game companies don't want me to cheat with aimbots and wallhacks. And all it needs is "has this user tampered with the OS to the point that I can't figure out if they've tampered with my process". This is 1984 at long last.
  - no_time 5y ago
    I admit that's the weakest article out of the ones I posted but still makes still makes a few good points defusing commonly repeated sentences like "I can just patch out the bad stuff" like we all read during the W11 announcement.
    - judge2020 5y ago
      I think it's the point that trusted computing is optional. If you don't want to provide that trust by running W11 with the appropriate chain of cryptographic assurances, you're not going to be able to experience services and products that require it - why should Netflix give you a full 4k stream when you've chosen to disable the widevine extension in your browser? They can't tell their media provider "we try our best to prevent piracy" if they do that. The same goes for things like Valorant and the inevitable age where online games require TPM attestation - if someone runs their computer in an untrusted state that makes it nigh impossible for the anti-cheat to figure out they're running aimbot/wallhacks (or other cheats that do best by reading the process's memory), why should they let that computer play, when it could ruin the experience for other players?
bigyellow 5y ago
Anytime Microsoft does something for "security" you know it's really about control and surveillance.
- npteljes 5y ago
  Yeah, definitely not the end user's security.
tw04 5y ago
I think everyone should pump the brakes on being upset until the details actually come out. Presumably this chip is the same that they use on their "cloud" servers, including the stuff that runs bare metal linux so there should be drivers for Linux. That's a ton of assumptions, all probably wrong, but do we always have to immediately jump to the negative assumptions? Especially when it's meant to interface with the cerberus OCP project.
- xdennis 5y ago
  Given Microsoft's history I think it's safe to assume the worse until proven otherwise.
- dannyw 5y ago
  I think it's quite obvious what "chip-to-cloud security" [1, official MS Blog] and "remote attestation" [2, Azure blog] is. To quote Microsoft: > However, AS3 must also authenticate the device itself. It does that via a protocol called remote attestation: > [...] 2. The device signs these values with Pluton’s private ECC attestation key and sends them back to AS3. > 3. AS3 already has the device’s public ECC attestation key and can therefore determine whether the device is authentic, was booted with genuine software, and if the genuine software is trusted. [...] It is OBVIOUS exactly what this is. This is technology that will progress as follows: 1. Your streaming platform will only work if you are using a Microsoft Pluton hardware-backdoor agent. The blog post literally talks about verifying "genuine" and "trusted" software. That's as close as you can say 'DRM' without explicitly saying 'DRM'. 2. Your banking apps, and eventually websites, will not work unless your device features a Microsoft Pluton hardware-backdoor agent; just like Google's "SafetyNet". 3. Your government is going to introduce QR code check-ins (like those here in Sydney, Australia; which technically carry a prison sentence if you don't comply), and the government QR scanner app will only work on devices with SafetyNet, Microsoft Pluton, etc. 4. Eventually, it will technically be impossible to connect to the internet, or your ISP, unless you are running ring -1 backdoored hardware. Your ISP will 'remotely attest' that your hardware and software is 'trusted'. 5. Think Apple's client-side CSAM scanning is bad? Just wait for governments to require all OS vendors scan local content (photos, soon text) are scanned against a government-controlled secret database of 'illegal' material. To protect the kids, and stop terrorism, or course. 6. Much like DMCA's anti-circumvention clause, attempting to disable Microsoft Pluton, or comparable agents, will become a felony, because you are circumventing a 'control measure'. [1]: https://blogs.windows.com/windowsexperience/2022/01/04/ces-2022-chip-to-cloud-security-pluton-powered-windows-11-pcs-are-coming/ https://blogs.windows.com/windowsexperience/2022/01/04/ces-2... [2] : https://azure.microsoft.com/en-au/blog/anatomy-of-a-secured-mcu/ https://azure.microsoft.com/en-au/blog/anatomy-of-a-secured-... P.S: 'The Pluton security processor’s firmware will be updateable through Windows Update along with standard industry control'.
tibbydudeza 5y ago
So it is like next gen TPM to lock down what OS is blessed to be booted ???. I guess mainstream Linux distro's will be okay but probably not homebrew stuff you see pop up on HN every now and again. Apple does the same for the T2 so why the pitchforks ???.
jimbob45 5y ago
> AMD is refreshing it’s mobile processor lineup with the launch of new chips including high-power models aimed at high-performance gaming laptops and mobile workstations and more energy-efficient chips designed for thin and light laptops. Is it just me or did “mobile” get redefined while I wasn’t looking? To me, a mobile device is a phone. This seems to imply that a mobile device is anything that isn’t a desktop. Above quote from another site btw.
- witty_username 5y ago
  In the context of PCs, mobile processor means laptop processor, for example: https://www.intel.com/content/www/us/en/products/docs/processors/core/11th-gen-core-mobile-processors-brief.html https://www.intel.com/content/www/us/en/products/docs/proces...

107 points by no_time 5y ago

I don't want any hardware designed by Microsoft in my machine. The concept might be good, but I don't trust them not to ruin my experience when using Linux. This will force me towards using a smaller number of niche vendors (good, if they survive that long) or just switching to a Mac (bad).

Tsiklon 5y ago
If I recall, a good portion of the UEFI Secure Boot system is entirely of Microsoft’s design, albeit this is thankfully an optional system in most cases but one that has definitely caused headaches for Linux users.
- MisterTea 5y ago
  The usual Microsoft/Intel collusion/mono-culture. I am so tired of this duopoly. AMD just tows the same lines to sell hardware.
  - Datagenerator 5y ago
    Would KVM with virtual TPM isolate Win11 enough?
- lostmsu 5y ago
  What were the headaches? That you had to sign your kernel and add pubkey to BIOS to use the feature?
tempfs 5y ago
Even if you ignore the fact that they'll find a way to shit on Linux[to push WSL] I simply do not trust Microsoft to get anything right in terms of security.[1] [1] Being alive and security aware for the last few decades.

lkxijlewlf 5y ago

Well, this just sucks. This means Microsoft owns my computer. They can access parts of my CPU without my knowledge. WTF, AMD!

Cloudef 5y ago
Don't they own it already by taking advantage of TPM? Or well, at least control what software it can run, and whether your installation is "legit".
- no_time 5y ago
  The TPM is a step in that direction but still misses a couple of puzzle pieces to truly control your machine. For example it may sign the boot measurements but has no introspection into what runs on the machine afterwards.
  - d_tr 5y ago
    What about the Intel Management Engine that is more than ten years old? It is a full OS with maximum privileges.
    - no_time 5y ago
      ME was always sold of as a sort of Premium enterprise feature with no uses on the consumer front. However Intel dabbled with technology much more sinister (SGX) that did exactly what it said exactly on the tin, protecting data from the user of the machine. Unlike MS's track record with Pluton, it was always horribly broken,required a license to attest victim machines and only covered the Intel half of the PC market. The only commercial software I'm aware of that ever mandated SGX is some blu ray player for windows
AdrianB1 5y ago
No, that happens only if you reward them with your money (buy that CPU).

trelane 5y ago

I wonder how this is similar/different to the Qualcomm take on it? Semis curate seems to not be a fan: https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-dangerous-to-deploy/ https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-d...

no_time 5y ago
No wonder they are not a fan. We are rapidly accelerating towards a worst case dystopia where a handful of companies backed by state power control what you hear,say and execute on your machine. I predict atleast one major world power will mandate this technology in consumer electronics to be able to connect to the internet by 2030 in its current rate of adoption.
mastax 5y ago
They say it is remotely accessible but present no evidence. They present device-unique keys as impossible with no evidence despite that being exactly how TPMs have worked for decades. They didn't even mention what is the biggest concern: firmware. This thing is basically a secure microcontroller, and MS has implied that it can run different software to achieve different use cases (at launch it emulates a TPM). The important question is: does it only load firmware signed by Microsoft. If not, I don't have a big issue with it.
- judge2020 5y ago
  Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.
  - AnthonyMouse 5y ago
    Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.

idop 5y ago

Oh well, looks like I'll be going for an ARM machine.

no_time 5y ago
We are past the stage where it can be solved by technological means. This issue is strictly political and economical. Once this tech reaches critical mass of adoption, you might have trouble participating in the modern world since your device is not "trusted". Much like how Android's safetynet prevents running banking apps if boot time signatures do not mach an approved list.
- sounds 5y ago
  The Raspberry Pi foundation is working on adding a signed bootloader and trusted computing to their next chip. I'm looking for the source I found, and I thought it was [1] but don't see the text there anymore. [1] https://www.raspberrypi.com/news/bullseye-bonus-1-8ghz-raspberry-pi-4/ https://www.raspberrypi.com/news/bullseye-bonus-1-8ghz-raspb...
  - no_time 5y ago
    Wayback machine does not show any such changes on a cursory glance.
trynumber9 5y ago
Qualcomm's ARM machines will have this too.
MangoCoffee 5y ago
Qualcomm said they going to be partner with Microsoft. RISC-V is the future for no backdoor.
- Narishma 5y ago
  What's to stop RISC-V CPU manufacturers doing the same?

underscore_ku 5y ago

i don't want microsoft in my cpu!

no_time 5y ago
Should've made some noise a year ago when this was first announced lol A similar story unfolding in the early 00's was thwarted by the tech community shaming microsoft into dropping the plans (name Palladium back then). I have a feeling people were much more vigilant and better informed back then.
- Tostino 5y ago
  It was simply a smaller field at the time. Easier to stay informed when there is just "less" all around you.

pdimitar 5y ago

Extremely disappointing. Also the CES didn't say anything about the next Threadrippers. :( They did tease the next Zen architecture but not much details sadly. But having Microsoft-designed hardware as a backdoor in my system? Absolutely not.

andreime 5y ago
While listening to the podcast "Moore's law is dead", I heard repeatedly that AMD has no interest in launching new Threadrippers, ever again.
- pdimitar 5y ago
  ...What? But why! Sigh, less and less choice every day. EDIT: What about this potential leak? https://www.digitaltrends.com/computing/amd-to-release-ryzen-threadripper-pro-5000-processor-march-2022/ https://www.digitaltrends.com/computing/amd-to-release-ryzen...
  - lillecarl 5y ago
    Probably because they're server cpus that can be sold for more, it's too bad if this is true, I really want more PCIe lanes, though the threadripper 128 lanes are overkill, I'd be fine with 40. Other than that, performance is plenty on a 5950x for all my imaginable use cases.
    - pdimitar 5y ago
      Sure but I'd be paranoid about not having ECC RAM whereas Threadrippers support it officially. But I am sure there's a curated list of Ryzen motherboards that do in fact support ECC...
      - judge2020 5y ago
        Pretty much. https://hardwarecanucks.com/cpu-motherboard/ecc-memory-amds-ryzen-deep-dive/5/ https://hardwarecanucks.com/cpu-motherboard/ecc-memory-amds-...

AshamedCaptain 5y ago

Previously on HN https://news.ycombinator.com/item?id=25191319 https://news.ycombinator.com/item?id=25191319 “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm (156 comments)

no_time 5y ago

Recommended reading for anyone interested in this tecnology. https://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi... https://secret.club/2021/06/28/windows11-tpms.html https://secret.club/2021/06/28/windows11-tpms.html https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT01.pdf https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT0...

judge2020 5y ago
> secret.club > Imagine you want to watch your favorite show on Netflix in 4k, but your hardware trust factor is low? Too bad you’ll have to settle for the 720p stream. Untrusted devices could be watching in an instance of Linux KVM, and we can’t risk your pirating tools running in the background! Oh no, video platforms don't want me pirating their stuff. Video game companies don't want me to cheat with aimbots and wallhacks. And all it needs is "has this user tampered with the OS to the point that I can't figure out if they've tampered with my process". This is 1984 at long last.
- no_time 5y ago
  I admit that's the weakest article out of the ones I posted but still makes still makes a few good points defusing commonly repeated sentences like "I can just patch out the bad stuff" like we all read during the W11 announcement.
  - judge2020 5y ago
    I think it's the point that trusted computing is optional. If you don't want to provide that trust by running W11 with the appropriate chain of cryptographic assurances, you're not going to be able to experience services and products that require it - why should Netflix give you a full 4k stream when you've chosen to disable the widevine extension in your browser? They can't tell their media provider "we try our best to prevent piracy" if they do that. The same goes for things like Valorant and the inevitable age where online games require TPM attestation - if someone runs their computer in an untrusted state that makes it nigh impossible for the anti-cheat to figure out they're running aimbot/wallhacks (or other cheats that do best by reading the process's memory), why should they let that computer play, when it could ruin the experience for other players?

bigyellow 5y ago

Anytime Microsoft does something for "security" you know it's really about control and surveillance.

npteljes 5y ago
Yeah, definitely not the end user's security.

tw04 5y ago

I think everyone should pump the brakes on being upset until the details actually come out. Presumably this chip is the same that they use on their "cloud" servers, including the stuff that runs bare metal linux so there should be drivers for Linux. That's a ton of assumptions, all probably wrong, but do we always have to immediately jump to the negative assumptions? Especially when it's meant to interface with the cerberus OCP project.

xdennis 5y ago
Given Microsoft's history I think it's safe to assume the worse until proven otherwise.
dannyw 5y ago
I think it's quite obvious what "chip-to-cloud security" [1, official MS Blog] and "remote attestation" [2, Azure blog] is. To quote Microsoft: > However, AS3 must also authenticate the device itself. It does that via a protocol called remote attestation: > [...] 2. The device signs these values with Pluton’s private ECC attestation key and sends them back to AS3. > 3. AS3 already has the device’s public ECC attestation key and can therefore determine whether the device is authentic, was booted with genuine software, and if the genuine software is trusted. [...] It is OBVIOUS exactly what this is. This is technology that will progress as follows: 1. Your streaming platform will only work if you are using a Microsoft Pluton hardware-backdoor agent. The blog post literally talks about verifying "genuine" and "trusted" software. That's as close as you can say 'DRM' without explicitly saying 'DRM'. 2. Your banking apps, and eventually websites, will not work unless your device features a Microsoft Pluton hardware-backdoor agent; just like Google's "SafetyNet". 3. Your government is going to introduce QR code check-ins (like those here in Sydney, Australia; which technically carry a prison sentence if you don't comply), and the government QR scanner app will only work on devices with SafetyNet, Microsoft Pluton, etc. 4. Eventually, it will technically be impossible to connect to the internet, or your ISP, unless you are running ring -1 backdoored hardware. Your ISP will 'remotely attest' that your hardware and software is 'trusted'. 5. Think Apple's client-side CSAM scanning is bad? Just wait for governments to require all OS vendors scan local content (photos, soon text) are scanned against a government-controlled secret database of 'illegal' material. To protect the kids, and stop terrorism, or course. 6. Much like DMCA's anti-circumvention clause, attempting to disable Microsoft Pluton, or comparable agents, will become a felony, because you are circumventing a 'control measure'. [1]: https://blogs.windows.com/windowsexperience/2022/01/04/ces-2022-chip-to-cloud-security-pluton-powered-windows-11-pcs-are-coming/ https://blogs.windows.com/windowsexperience/2022/01/04/ces-2... [2] : https://azure.microsoft.com/en-au/blog/anatomy-of-a-secured-mcu/ https://azure.microsoft.com/en-au/blog/anatomy-of-a-secured-... P.S: 'The Pluton security processor’s firmware will be updateable through Windows Update along with standard industry control'.

tibbydudeza 5y ago

So it is like next gen TPM to lock down what OS is blessed to be booted ???. I guess mainstream Linux distro's will be okay but probably not homebrew stuff you see pop up on HN every now and again. Apple does the same for the T2 so why the pitchforks ???.

jimbob45 5y ago

> AMD is refreshing it’s mobile processor lineup with the launch of new chips including high-power models aimed at high-performance gaming laptops and mobile workstations and more energy-efficient chips designed for thin and light laptops. Is it just me or did “mobile” get redefined while I wasn’t looking? To me, a mobile device is a phone. This seems to imply that a mobile device is anything that isn’t a desktop. Above quote from another site btw.

witty_username 5y ago
In the context of PCs, mobile processor means laptop processor, for example: https://www.intel.com/content/www/us/en/products/docs/processors/core/11th-gen-core-mobile-processors-brief.html https://www.intel.com/content/www/us/en/products/docs/proces...