6 ms·

"Uncompromisingly secure", yet contains an Intel CPU with an unpatchable mystery blob. Just put an unlocked ARM CPU in there already.

AshamedCaptain 3y ago
> Just put an unlocked ARM CPU in there already. As if that existed. Also, I ponder what is the threat vector presented by an "unpatchable mystery blob" that is not already present without one.
- rhn_mk1 3y ago
  i.MX8 series, as used in MNT Reform and the Librem 5. Rockhip chips as used in the PinePhone. Mediatek chips from some Chromebooks. Those let the OEM choose whether they want to lock TrustZone or not. Let me explain what unique threat the blob poses: https://securityaffairs.co/58656/hacking/intel-management-engine.html https://securityaffairs.co/58656/hacking/intel-management-en...
  - AshamedCaptain 3y ago
    For the record, these chips do not have AMT in the first place, and even then they come with coreboot, for which ME is not really a concern. I thought you were talking about proprietary microcode, which all of these chips you mention do come with. Or even worse, since they are all SoCs.... You'd have to e.g. avoid using the Ethernet controller on them (which generally has flashable eeproms with code) which would also happen to be an effective prevention of any ME issues even if were running an ancient version of ME. I.e. the only threat vector you mentioned does not apply and can't possibly apply. A mac shares more firmware with your average intel laptop than this.
    - rhn_mk1 3y ago
      Which is exactly the point. No AMT, one less problem.
      - AshamedCaptain 3y ago
        These chips as in non-laptop non-vpro intel chips like the one used here.
scarface_74 3y ago
Are there any good ARM processors and related hardware that you can buy that are available on the open market for use by OEMs?
- adrian_b 3y ago
  The only boards or computers with non-obsolete ARM CPUs and that are cheaper than the boards or computers made with Intel Alder Lake N CPUs, like this N200 or like the cheaper N100 CPU, are made by various smaller Chinese companies (Raspberry Pi have always been using obsolete ARM CPUs). There are good ARM CPUs, like in the NVIDIA Orin modules, or in some boards offered by MediaTek and Qualcomm, which are derived from their smartphone products, but all these are very expensive in comparison with the Intel products. If you are not scared by much higher than Intel prices, you can look e.g. for products including these: https://www.mediatek.com/iot/products/genio1200-devkits https://www.mediatek.com/iot/products/genio1200-devkits https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-orin/ https://www.nvidia.com/en-us/autonomous-machines/embedded-sy... (at the NVIDIA site you must ignore any module or devkit that does not include the word "Orin" in the name, everything else is too old junk, even if it appears to be cheaper) For cheaper than Intel, but with performance at the level of the previous Intel Atom CPUs (i.e. Tremont-based, like Jasper Lake and Elkhart Lake) there are many products using the Chinese Rockchip CPU RK3588, for which much more public information is provided than for any Intel or AMD CPU, so I would trust it much more for implementing a secure appliance like a firewall, but not all of those products are well designed and some are overpriced (i.e. anything more than $200 for a complete computer with RK3588 is grossly overpriced).
  - scarface_74 3y ago
    Then that begs the question, what is the advantage of ARM for the type of consumer who would be in the market for this PC or for a desktop in general? The advantage of ARM in laptops are clear - the battery life/performance/heat tradeoff is better. It’s also clear for server farms. But if I’m just running Linux on a desktop anyway, why would I care about ARM vs x86 unless I’m targeting my builds for other ARM computers.

AshamedCaptain 3y ago

> Just put an unlocked ARM CPU in there already. As if that existed. Also, I ponder what is the threat vector presented by an "unpatchable mystery blob" that is not already present without one.

rhn_mk1 3y ago
i.MX8 series, as used in MNT Reform and the Librem 5. Rockhip chips as used in the PinePhone. Mediatek chips from some Chromebooks. Those let the OEM choose whether they want to lock TrustZone or not. Let me explain what unique threat the blob poses: https://securityaffairs.co/58656/hacking/intel-management-engine.html https://securityaffairs.co/58656/hacking/intel-management-en...
- AshamedCaptain 3y ago
  For the record, these chips do not have AMT in the first place, and even then they come with coreboot, for which ME is not really a concern. I thought you were talking about proprietary microcode, which all of these chips you mention do come with. Or even worse, since they are all SoCs.... You'd have to e.g. avoid using the Ethernet controller on them (which generally has flashable eeproms with code) which would also happen to be an effective prevention of any ME issues even if were running an ancient version of ME. I.e. the only threat vector you mentioned does not apply and can't possibly apply. A mac shares more firmware with your average intel laptop than this.
  - rhn_mk1 3y ago
    Which is exactly the point. No AMT, one less problem.
    - AshamedCaptain 3y ago
      These chips as in non-laptop non-vpro intel chips like the one used here.

scarface_74 3y ago

Are there any good ARM processors and related hardware that you can buy that are available on the open market for use by OEMs?

adrian_b 3y ago
The only boards or computers with non-obsolete ARM CPUs and that are cheaper than the boards or computers made with Intel Alder Lake N CPUs, like this N200 or like the cheaper N100 CPU, are made by various smaller Chinese companies (Raspberry Pi have always been using obsolete ARM CPUs). There are good ARM CPUs, like in the NVIDIA Orin modules, or in some boards offered by MediaTek and Qualcomm, which are derived from their smartphone products, but all these are very expensive in comparison with the Intel products. If you are not scared by much higher than Intel prices, you can look e.g. for products including these: https://www.mediatek.com/iot/products/genio1200-devkits https://www.mediatek.com/iot/products/genio1200-devkits https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-orin/ https://www.nvidia.com/en-us/autonomous-machines/embedded-sy... (at the NVIDIA site you must ignore any module or devkit that does not include the word "Orin" in the name, everything else is too old junk, even if it appears to be cheaper) For cheaper than Intel, but with performance at the level of the previous Intel Atom CPUs (i.e. Tremont-based, like Jasper Lake and Elkhart Lake) there are many products using the Chinese Rockchip CPU RK3588, for which much more public information is provided than for any Intel or AMD CPU, so I would trust it much more for implementing a secure appliance like a firewall, but not all of those products are well designed and some are overpriced (i.e. anything more than $200 for a complete computer with RK3588 is grossly overpriced).
- scarface_74 3y ago
  Then that begs the question, what is the advantage of ARM for the type of consumer who would be in the market for this PC or for a desktop in general? The advantage of ARM in laptops are clear - the battery life/performance/heat tradeoff is better. It’s also clear for server farms. But if I’m just running Linux on a desktop anyway, why would I care about ARM vs x86 unless I’m targeting my builds for other ARM computers.