3 ms·
Compared to the iME, not much, since at least the secure enclave subsystem won't run any non-Apple code. The scary difference about the iME is that it is direct
by als0 4y ago
Compared to the iME, not much, since at least the secure enclave subsystem won't run any non-Apple code. The scary difference about the iME is that it is directly connected to the network.
- vetinari 4y agoIntel ME is not connected to the network. Intel AMT (vPro) is. You have to pay extra to get it, and there are extra conditions to be fulfilled (LAN or Wifi must be Intel). The difference wrt. Apple Silicon is, that AS firmware blobs run on separate chips and 1) cannot access the main memory freely; they are gated behind IOMMU and 2) there's no SMM equivalent for any of them, so the main CPU time cannot be stolen by firmware.
- dapids 4y ago100% this
- duskwuff 4y agoEh, I'd say the differences go deeper than that. Secure Enclave doesn't appear to have any special access to other resources on the system (like memory), it's initialized by the operating system, not by pre-boot firmware, and the rest of the system works perfectly fine if you leave the SEP uninitialized.