3 ms·

well, like it or not that's a real use-case - and not just DRM/anti-cheat but also things like homomorphic encryption. there's lots of interest in being able t

by paulmd 2y ago

well, like it or not that's a real use-case - and not just DRM/anti-cheat but also things like homomorphic encryption. there's lots of interest in being able to do useful things when the owner of the machine might be an attacker, that is an extremely broad and useful primitive to build upon. secure encrypted virtualization is supposed to be "homomorphic encryption, but in a system we can actually implement/that actually performs decently". obviously it would be reassuring to know that hetzner can't look at your data that you put into the hardware they own, right? how do you accomplish that if not creating a root-of-trust that's not controlled by the owner of the machine? I don't trust Hetzner to not see my data, but I might be willing to trust AMD. Let AMD hold the key to my VM memory partition, and the hypervisor exists in a different VM memory partition, and its keys don't work in my partition. Things which break that security model are obviously of huge concern and it feels borderline intentionally-misleading to phrase it as "why would you be concerned about that". The answer is because it's a foundational break in the security model of SEV and the PSP.

ndriscoll 2y ago
I suppose the cloud use-case makes sense, and my reaction was more to the people saying it mattered that they wouldn't fix consumer/desktop processors, where this thing is primarily if not almost exclusively used to undermine the owner.
- paulmd 2y ago
  even for consumers, the existence of a PSP implies that you don’t want that PSP to become compromised. It has the complete ability to fuck with your container instance in any way it wants with no mitigations possible. You immediately fall into trusting-trust problems around working in an inherently compromised environment where an attacker can manipulate you in arbitrary ways. You think reading a file twice produces the same results? You think adding two numbers or doing an if-statement returns the proper result? Not if the hardware is malicious. Beyond the broader “should this exist”, once it is a given that it exists, it’s an incredibly powerful weapon and it certainly shouldn’t be left unsecured. This is the thing that can see the true state of memory, hold all the keys, and even just arbitrarily rewrite memory state or processor state. This is god on this system. The fact that people see that and say “well you’d have to type sudo to permanently own the machine!” as some kind of excuse or downplaying is nuts and wouldn’t be tolerated from any other brand. But AMD always gets extra benefit-of-the-doubt and kid-glove treatment. When intel gets compromised nobody does the “ok but should we really have a hypervisor ring anyway???” shit. The amount of special pleading people do on behalf of AMD is insane. And people would never tolerate intel leaving a bunch of hardware exploits unpatched like some of AMD’s exploits have been.
  - ndriscoll 2y ago
    I think people's reaction to e.g. Intel ME and SGX is also "this shouldn't exist on consumer hardware", and it makes perfect sense to be happy about being able to control both as the owner. The owner is supposed to be god on the system. They're supposed to have a sudo that really gives them full power over everything. sudo (on the bare metal ring) is supposed to let the user see the true state of everything, hold all the keys, arbitrarily rewrite memory, etc.
    - paulmd 2y ago
      thank you for exemplifying the mindset to which I was referring. yes, that’s the weird sickly affection for AMD, and the weird sickly philosophical defense of a high-severity CVE on pseudointellectual principles. people would really rather we rethink the whole of secure-boot rather than admit AMD has a serious bug they won’t fix, lol
      - ndriscoll 2y ago
        It has nothing to do with AMD vs Intel. I'm glad if these things become "compromised" in both cases because they're designed to undermine the owner. They shouldn't be on consumer chips, and if they don't actually do what they say, great! Control can be restored to the person to whom it belongs. I'm also happy that you can get a cheap converter to plug your Ryobi batteries into your DeWalt drill, breaking their anti-consumer "features". Likewise with third party printer ink. All good stuff.
      - panzi 2y ago
        Ever since I heard of TCPA in the early 2000s I was of the opinion that this is technology that undermines the owner's control of their own computer. Back then it even seemed as if that is a move by Microsoft to get rid of Linux, which gladly didn't happen. It has nothing to do wit Intel Vs AMD. At all.

by paulmd 2y ago

ndriscoll 2y ago

I suppose the cloud use-case makes sense, and my reaction was more to the people saying it mattered that they wouldn't fix consumer/desktop processors, where this thing is primarily if not almost exclusively used to undermine the owner.

paulmd 2y ago
even for consumers, the existence of a PSP implies that you don’t want that PSP to become compromised. It has the complete ability to fuck with your container instance in any way it wants with no mitigations possible. You immediately fall into trusting-trust problems around working in an inherently compromised environment where an attacker can manipulate you in arbitrary ways. You think reading a file twice produces the same results? You think adding two numbers or doing an if-statement returns the proper result? Not if the hardware is malicious. Beyond the broader “should this exist”, once it is a given that it exists, it’s an incredibly powerful weapon and it certainly shouldn’t be left unsecured. This is the thing that can see the true state of memory, hold all the keys, and even just arbitrarily rewrite memory state or processor state. This is god on this system. The fact that people see that and say “well you’d have to type sudo to permanently own the machine!” as some kind of excuse or downplaying is nuts and wouldn’t be tolerated from any other brand. But AMD always gets extra benefit-of-the-doubt and kid-glove treatment. When intel gets compromised nobody does the “ok but should we really have a hypervisor ring anyway???” shit. The amount of special pleading people do on behalf of AMD is insane. And people would never tolerate intel leaving a bunch of hardware exploits unpatched like some of AMD’s exploits have been.
- ndriscoll 2y ago
  I think people's reaction to e.g. Intel ME and SGX is also "this shouldn't exist on consumer hardware", and it makes perfect sense to be happy about being able to control both as the owner. The owner is supposed to be god on the system. They're supposed to have a sudo that really gives them full power over everything. sudo (on the bare metal ring) is supposed to let the user see the true state of everything, hold all the keys, arbitrarily rewrite memory, etc.
  - paulmd 2y ago
    thank you for exemplifying the mindset to which I was referring. yes, that’s the weird sickly affection for AMD, and the weird sickly philosophical defense of a high-severity CVE on pseudointellectual principles. people would really rather we rethink the whole of secure-boot rather than admit AMD has a serious bug they won’t fix, lol
    - ndriscoll 2y ago
      It has nothing to do with AMD vs Intel. I'm glad if these things become "compromised" in both cases because they're designed to undermine the owner. They shouldn't be on consumer chips, and if they don't actually do what they say, great! Control can be restored to the person to whom it belongs. I'm also happy that you can get a cheap converter to plug your Ryobi batteries into your DeWalt drill, breaking their anti-consumer "features". Likewise with third party printer ink. All good stuff.
    - panzi 2y ago
      Ever since I heard of TCPA in the early 2000s I was of the opinion that this is technology that undermines the owner's control of their own computer. Back then it even seemed as if that is a move by Microsoft to get rid of Linux, which gladly didn't happen. It has nothing to do wit Intel Vs AMD. At all.