6 ms·

> IME exists because Intel’s big customers want it and the people who don’t want it don’t have enough money for a custom SKU I addressed this - systems without

> IME exists because Intel’s big customers want it and the people who don’t want it don’t have enough money for a custom SKU I addressed this - systems without IME exist, but are not available for purchase, for any price, except for governments. That's not economics. > TPM exists just because it’s a good security feature that the industry has demanded Industry demands it, and OS and CPU manufacturers collude to make sure every user gets it, whether they want it or not, so that when they start pushing remote-attestation and other user-hostile technologies in the future, they won't lose any market. > Mainstream phones run non-privileged I specifically said "non-rootable", i.e. non-privileged by default, but that can be unlocked. So mainstream phones would remain non-privileged except for those motivated enough to follow an unlock procedure. But it's a common tactic to excuse deliberate lock-down with "few need it, so we will invest resources into making sure they can't have it, when our previous models allowed it". If MS prevented users from running any compiler except Visual Studio on Windows, would you excuse it because those that need it are a niche market, for whom the more expensive Windows Pro licenses are made? > subsidized TV with more features sell better than more expensive TV with fewer features There are no non-smart TVs on store shelves next to smart ones, just for a higher price, despite demand [1]. In fact it's a challenge to find one at all. Saying it's just about money is technically correct in most cases, but very misleading. It hides the fact that in most cases it's not just about offering a cheaper product, but involves backroom lobbying from other interests to restrict consumer options, like forcing them to watch ads on DVDs [2]. It's "about money" in the same way that robbery is about money. [1] "This question of smart-TV data privacy and security is by far the most-asked among Ask Wirecutter readers." - https://news.ycombinator.com/item?id=35484594 https://news.ycombinator.com/item?id=35484594 [2] https://en.wikipedia.org/wiki/User_operation_prohibition https://en.wikipedia.org/wiki/User_operation_prohibition

kube-system 3y ago
> I addressed this - systems without IME exist, but are not available for purchase, for any price, except for governments. That's not economics. As I understand governments just set a bit to disable IME on already existing processors. But if you want a feature and are willing to give them billions of dollars, Intel or anyone else absolutely will add a feature for you. You can call up any fab and have them make whatever you want. Custom silicon is absolutely a thing, but it requires big bucks. Nobody makes bleeding-edge node processors for applications with tiny markets precisely because of economics. They are made for the only market with enough revenue to support the R&D cost: the mass market. > I specifically said "non-rootable", i.e. non-privileged by default, but that can be unlocked. So mainstream phones would remain non-privileged except for those motivated enough to follow an unlock procedure. Mainstream phones don't do this. They still sell. Therefore it is proven that the market DGAF. The largest customers for a company like Samsung are businesses who don't want the phones to be unlockable. They want that shit locked down and surveilled like Fort Knox. Pun intended. https://samsungknox.com/en https://samsungknox.com/en > If MS prevented users from running any compiler except Visual Studio on Windows, would you excuse it because those that need it are a niche market, for whom the more expensive Windows Pro licenses are made? I don't think they have a reason to expend resources to affirmatively make this change -- but the few products they've released for which it was inconvenient to add support for things like this, they absolutely have. eg: S mode. > There are no non-smart TVs on store shelves next to smart ones, just for a higher price, despite demand [1]. In fact it's a challenge to find one at all. You can find sometimes find Spectre dumb TVs at walmart. Know why the they're hard to find? Because TVs have large fixed costs to produce, and if you don't move enough units to cover both the marginal and fixed costs, you cannot afford to offer the product at all. > "This question of smart-TV data privacy and security is by far the most-asked among Ask Wirecutter readers." I don't doubt that Wirecutter has received maybe hundreds of questions about this topic. But almost 225 million TVs sell annually. People buy smart TVs. It's just the reality that privacy is not a primary purchasing consideration for mass market customers. The mass market doesn't care. If you even read a privacy policy, people will think you're weird. I wish it weren't the case, but it plainly is. It really won't change until people stop buying these products.
- Bran_son 3y ago
  > But almost 225 million TVs sell annually. People buy smart TVs. There's literally nothing else on the consumer market. Edit: There may be a dumb Sceptre TV hidden in a Walmart warehouse somewhere, but I checked and there are none available in my entire EU country. Meanwhile the smart TVs sure don't advertise their spyware as prominently as their price, so we can add fraud in addition to robbery. > As I understand governments just set a bit to disable IME on already existing processors. But if you want a feature and are willing to give them billions of dollars, Intel or anyone else absolutely will add a feature for you. [..] Custom silicon is absolutely a thing If all it takes is setting a bit, I don't see why you'd invoke custom silicon except to muddy the waters.
  - kube-system 3y ago
    That's not even true, as I mentioned. Examples: https://www.sceptre.com/TV/4K-UHD-TV-category1category73.html https://www.sceptre.com/TV/4K-UHD-TV-category1category73.htm... https://www.walmart.com/ip/Sceptre-55-Class-4K-UHD-LED-TV-HDR-U550CV-U/46784939 https://www.walmart.com/ip/Sceptre-55-Class-4K-UHD-LED-TV-HD... Also, it's besides my point. The fact that people buy smart TVs in large numbers is proof of the fact that the privacy concerns are not a factor in the mass market's buying decisions. Do you own a TV? Did you buy a Sceptre? Why not? Did you not care enough about the privacy consideration to do a quick search to see that they exist? Most people don't. > If all it takes is setting a bit, I don't see why you'd invoke custom silicon except to muddy the waters. Because I was responding precisely to your gripe about "impossibility of buying a CPU without Intel Management Engine (or AMD equivalent)". If you are happy setting that bit, then the problem you are complaining about doesn't exist: https://hackaday.com/2020/01/28/factory-laptop-with-ime-disabled/ https://hackaday.com/2020/01/28/factory-laptop-with-ime-disa... https://hackaday.com/2023/04/12/disabling-intels-backdoors-on-modern-laptops/ https://hackaday.com/2023/04/12/disabling-intels-backdoors-o...
    - Bran_son 3y ago
      > Do you own a TV? Did you buy a Sceptre? Why not? I do, I did not, because my TV is old enough to not yet be "smart", and because Sceptres are literally not available anywhere in my country. Am I now virtuous enough by your standards to point out how hostile manufacturers are to users? > The fact that people buy smart TVs in large numbers is proof Hey I wonder if you asked ten random people if they knew their smart TV was reporting the contents of their USB sticks and their viewing habits to 3rd parties, how many would answer yes? This is the same revealed preference tortured logic that concludes people don't care about child labor because they still buy chocolate. Out of sight out of mind. > If you are happy setting that bit, then the problem you are complaining about doesn't exist Then this is a recent development, because in 2017 even Google was unable to get rid of IME: As of 2017, Google was attempting to eliminate proprietary firmware from its servers and found that the ME was a hurdle to that. - https://en.wikipedia.org/wiki/Intel_Management_Engine#By_Google https://en.wikipedia.org/wiki/Intel_Management_Engine#By_Goo...
mjg59 3y ago
> systems without IME exist Not if you're buying Intel, they don't. The IME reads the HAP bit during boot, and if that's set will set its state to disabled, but it's still there and you're still relying on the software to actually behave as it's supposed to. The same applies to the hardware disable mechanism which involves doing fucky stuff with some of the HDA pins.
charcircuit 3y ago
>systems without IME exist, but are not available for purchase, for any price, except for governments There isn't much of a point for Intel to make one without it. It's easier to support less SKUs. There are many other CPU manufacturers out there if IME is specifically something you don't want. >OS and CPU manufacturers collude to make sure every user gets it, whether they want it or not Because application developers want >90% of the userbase to support it. If only 5% of users have it then it limits the apps that can use it. >they start pushing remote-attestation and other user-hostile technologies in the future, they won't lose any market. Remote attestation isn't user hostile. It is a security feature that protects platforms that the software uses. Users benefit from the platforms they are using being secure. Users don't like playing against cheaters in muliplayer games. Users don't like receiving spam messages. Users don't like their accounts being hacked.
ndsipa_pomu 3y ago
> systems without IME exist, but are not available for purchase, for any price, except for governments. How about RISC-V?
- survirtual 3y ago
  If RISC-V has a company behind it akin to Raspberry Pi, along with another org pumping out high-perf SoC, it might be more mainstream relevant. ...wait a sec. You're just referring to an ungimped system. Carry on.
  - 1827162 3y ago
    China's T-Head TH1520 is coming close, it's RISC-V and supposedly faster than the Raspberry Pi. And they have a 64-core version in the works: https://twitter.com/SipeedIO/status/1620011141639581698 https://twitter.com/SipeedIO/status/1620011141639581698 What's surprising is that this unencumbered hardware is coming from a country that's a dictatorship.
    - survirtual 3y ago
      We may have different ideas of "close." What makes the Raspi special is a vast repository of documentation, a community of people offering support, and extremely well supported peripherals with tight integration. This is a lot of work to do well and to maintain.
      - 1827162 3y ago
        One of those things is mainline kernel support the TH1520, which it may well end up lacking, at least for a considerable length of time.
K0balt 3y ago
I have a few smart TVs. I use them as monitors and do not give them access to my networks. Aside from some “magic” SSID that provokes an automatic covert connection by my device from a wardriving van/drone, I don’t understand what the other security risks could be? It sucks that you can’t just turn that connectivity off with a physical switch, but it’s hard to see this as a deal breaker. If I get really paranoid I’ll just solder a 50 ohm resistor from the wifi antenna lead (on the motherboard)to ground. Is there some reason that people are compelled to connect their smart tvs to their networks?
- brokenmachine 3y ago
  I do the same thing, TV is blocked from WAN access. But I have a HTPC/NAS. Most people probably don't have that. I'd say most people just use the apps on the TV. >Is there some reason that people are compelled to connect their smart tvs to their networks? They want to use the inbuilt features that they've "paid" for, youtube, netflix, etc. There are literally buttons on the remotes to access those apps.

kube-system 3y ago

> I addressed this - systems without IME exist, but are not available for purchase, for any price, except for governments. That's not economics. As I understand governments just set a bit to disable IME on already existing processors. But if you want a feature and are willing to give them billions of dollars, Intel or anyone else absolutely will add a feature for you. You can call up any fab and have them make whatever you want. Custom silicon is absolutely a thing, but it requires big bucks. Nobody makes bleeding-edge node processors for applications with tiny markets precisely because of economics. They are made for the only market with enough revenue to support the R&D cost: the mass market. > I specifically said "non-rootable", i.e. non-privileged by default, but that can be unlocked. So mainstream phones would remain non-privileged except for those motivated enough to follow an unlock procedure. Mainstream phones don't do this. They still sell. Therefore it is proven that the market DGAF. The largest customers for a company like Samsung are businesses who don't want the phones to be unlockable. They want that shit locked down and surveilled like Fort Knox. Pun intended. https://samsungknox.com/en https://samsungknox.com/en > If MS prevented users from running any compiler except Visual Studio on Windows, would you excuse it because those that need it are a niche market, for whom the more expensive Windows Pro licenses are made? I don't think they have a reason to expend resources to affirmatively make this change -- but the few products they've released for which it was inconvenient to add support for things like this, they absolutely have. eg: S mode. > There are no non-smart TVs on store shelves next to smart ones, just for a higher price, despite demand [1]. In fact it's a challenge to find one at all. You can find sometimes find Spectre dumb TVs at walmart. Know why the they're hard to find? Because TVs have large fixed costs to produce, and if you don't move enough units to cover both the marginal and fixed costs, you cannot afford to offer the product at all. > "This question of smart-TV data privacy and security is by far the most-asked among Ask Wirecutter readers." I don't doubt that Wirecutter has received maybe hundreds of questions about this topic. But almost 225 million TVs sell annually. People buy smart TVs. It's just the reality that privacy is not a primary purchasing consideration for mass market customers. The mass market doesn't care. If you even read a privacy policy, people will think you're weird. I wish it weren't the case, but it plainly is. It really won't change until people stop buying these products.

Bran_son 3y ago
> But almost 225 million TVs sell annually. People buy smart TVs. There's literally nothing else on the consumer market. Edit: There may be a dumb Sceptre TV hidden in a Walmart warehouse somewhere, but I checked and there are none available in my entire EU country. Meanwhile the smart TVs sure don't advertise their spyware as prominently as their price, so we can add fraud in addition to robbery. > As I understand governments just set a bit to disable IME on already existing processors. But if you want a feature and are willing to give them billions of dollars, Intel or anyone else absolutely will add a feature for you. [..] Custom silicon is absolutely a thing If all it takes is setting a bit, I don't see why you'd invoke custom silicon except to muddy the waters.
- kube-system 3y ago
  That's not even true, as I mentioned. Examples: https://www.sceptre.com/TV/4K-UHD-TV-category1category73.html https://www.sceptre.com/TV/4K-UHD-TV-category1category73.htm... https://www.walmart.com/ip/Sceptre-55-Class-4K-UHD-LED-TV-HDR-U550CV-U/46784939 https://www.walmart.com/ip/Sceptre-55-Class-4K-UHD-LED-TV-HD... Also, it's besides my point. The fact that people buy smart TVs in large numbers is proof of the fact that the privacy concerns are not a factor in the mass market's buying decisions. Do you own a TV? Did you buy a Sceptre? Why not? Did you not care enough about the privacy consideration to do a quick search to see that they exist? Most people don't. > If all it takes is setting a bit, I don't see why you'd invoke custom silicon except to muddy the waters. Because I was responding precisely to your gripe about "impossibility of buying a CPU without Intel Management Engine (or AMD equivalent)". If you are happy setting that bit, then the problem you are complaining about doesn't exist: https://hackaday.com/2020/01/28/factory-laptop-with-ime-disabled/ https://hackaday.com/2020/01/28/factory-laptop-with-ime-disa... https://hackaday.com/2023/04/12/disabling-intels-backdoors-on-modern-laptops/ https://hackaday.com/2023/04/12/disabling-intels-backdoors-o...
  - Bran_son 3y ago
    > Do you own a TV? Did you buy a Sceptre? Why not? I do, I did not, because my TV is old enough to not yet be "smart", and because Sceptres are literally not available anywhere in my country. Am I now virtuous enough by your standards to point out how hostile manufacturers are to users? > The fact that people buy smart TVs in large numbers is proof Hey I wonder if you asked ten random people if they knew their smart TV was reporting the contents of their USB sticks and their viewing habits to 3rd parties, how many would answer yes? This is the same revealed preference tortured logic that concludes people don't care about child labor because they still buy chocolate. Out of sight out of mind. > If you are happy setting that bit, then the problem you are complaining about doesn't exist Then this is a recent development, because in 2017 even Google was unable to get rid of IME: As of 2017, Google was attempting to eliminate proprietary firmware from its servers and found that the ME was a hurdle to that. - https://en.wikipedia.org/wiki/Intel_Management_Engine#By_Google https://en.wikipedia.org/wiki/Intel_Management_Engine#By_Goo...

mjg59 3y ago

> systems without IME exist Not if you're buying Intel, they don't. The IME reads the HAP bit during boot, and if that's set will set its state to disabled, but it's still there and you're still relying on the software to actually behave as it's supposed to. The same applies to the hardware disable mechanism which involves doing fucky stuff with some of the HDA pins.

charcircuit 3y ago

>systems without IME exist, but are not available for purchase, for any price, except for governments There isn't much of a point for Intel to make one without it. It's easier to support less SKUs. There are many other CPU manufacturers out there if IME is specifically something you don't want. >OS and CPU manufacturers collude to make sure every user gets it, whether they want it or not Because application developers want >90% of the userbase to support it. If only 5% of users have it then it limits the apps that can use it. >they start pushing remote-attestation and other user-hostile technologies in the future, they won't lose any market. Remote attestation isn't user hostile. It is a security feature that protects platforms that the software uses. Users benefit from the platforms they are using being secure. Users don't like playing against cheaters in muliplayer games. Users don't like receiving spam messages. Users don't like their accounts being hacked.

ndsipa_pomu 3y ago

> systems without IME exist, but are not available for purchase, for any price, except for governments. How about RISC-V?

survirtual 3y ago
If RISC-V has a company behind it akin to Raspberry Pi, along with another org pumping out high-perf SoC, it might be more mainstream relevant. ...wait a sec. You're just referring to an ungimped system. Carry on.
- 1827162 3y ago
  China's T-Head TH1520 is coming close, it's RISC-V and supposedly faster than the Raspberry Pi. And they have a 64-core version in the works: https://twitter.com/SipeedIO/status/1620011141639581698 https://twitter.com/SipeedIO/status/1620011141639581698 What's surprising is that this unencumbered hardware is coming from a country that's a dictatorship.
  - survirtual 3y ago
    We may have different ideas of "close." What makes the Raspi special is a vast repository of documentation, a community of people offering support, and extremely well supported peripherals with tight integration. This is a lot of work to do well and to maintain.
    - 1827162 3y ago
      One of those things is mainline kernel support the TH1520, which it may well end up lacking, at least for a considerable length of time.

K0balt 3y ago

I have a few smart TVs. I use them as monitors and do not give them access to my networks. Aside from some “magic” SSID that provokes an automatic covert connection by my device from a wardriving van/drone, I don’t understand what the other security risks could be? It sucks that you can’t just turn that connectivity off with a physical switch, but it’s hard to see this as a deal breaker. If I get really paranoid I’ll just solder a 50 ohm resistor from the wifi antenna lead (on the motherboard)to ground. Is there some reason that people are compelled to connect their smart tvs to their networks?

brokenmachine 3y ago
I do the same thing, TV is blocked from WAN access. But I have a HTPC/NAS. Most people probably don't have that. I'd say most people just use the apps on the TV. >Is there some reason that people are compelled to connect their smart tvs to their networks? They want to use the inbuilt features that they've "paid" for, youtube, netflix, etc. There are literally buttons on the remotes to access those apps.