5 ms·

Its not a Intel platform (trust issues due to IME) See, this is what I don't understand, the pi's GPU is running a huge pile of closed source proprietary code

Its not a Intel platform (trust issues due to IME) See, this is what I don't understand, the pi's GPU is running a huge pile of closed source proprietary code as well, and at a first approximation has full system visibility too (ignoring it apparently has a bug limiting its actual view of all system ram on the higher capacity models). It could in theory be injecting/monitoring the nic as well. AKA, its just as privileged as the ME. So why do you "trust" it more than the intel? If anything the intel probably has 100x as many security researchers analyzing it. Also RE power, the pi idle power tends to be quite poor. Mine idles at ~4W, which is worse than a number of low end intel machines I have, so for something that might sit idle for >12H a day, it might be less efficient than recent intel machines.

blueflow 4y ago
> It could in theory be injecting/monitoring the nic as well. Intel is known to do this shit, Broadcom isn't, yet. I'd always prefer a blob on the boot partition over an EEPROM that i can't access without disassembly.
- StillBored 4y ago
  When the machine owner asks for it, has there been a case where its been caught sending packets otherwise? I mean its a "feature" being sold, if you get a vpro/amt machine it still needs to be turned on (the couple I have, have bios options for enabling/disabling the management features).
  - blueflow 4y ago
    There was no proof of the whole NSA Prism thing either, but we still "knew" it would be there and acted as if it was there. Until Snowden leaked the stuff and we learned its name. I'm not going to wait until the next Snowden uncovers whatever the IME is for.
Sirened 4y ago
>ignoring it apparently has a bug limiting its actual view of all system ram on the higher capacity models AFAIK that SoC had big and little DMA engines. The little engines can't reach the upper half of memory but the bigger ones can, which means you can just use the big DMA engines to muck with any RAM you yourself can't directly see. It's annoying for practical purposes but it doesn't have any security value.

blueflow 4y ago

> It could in theory be injecting/monitoring the nic as well. Intel is known to do this shit, Broadcom isn't, yet. I'd always prefer a blob on the boot partition over an EEPROM that i can't access without disassembly.

StillBored 4y ago
When the machine owner asks for it, has there been a case where its been caught sending packets otherwise? I mean its a "feature" being sold, if you get a vpro/amt machine it still needs to be turned on (the couple I have, have bios options for enabling/disabling the management features).
- blueflow 4y ago
  There was no proof of the whole NSA Prism thing either, but we still "knew" it would be there and acted as if it was there. Until Snowden leaked the stuff and we learned its name. I'm not going to wait until the next Snowden uncovers whatever the IME is for.

Sirened 4y ago

>ignoring it apparently has a bug limiting its actual view of all system ram on the higher capacity models AFAIK that SoC had big and little DMA engines. The little engines can't reach the upper half of memory but the bigger ones can, which means you can just use the big DMA engines to muck with any RAM you yourself can't directly see. It's annoying for practical purposes but it doesn't have any security value.