6 ms·

Europe built sovereign clouds to escape US control. Forgot about the processors

121 points by beardyw 5mo ago

nasretdinov 5mo ago
Quite an odd thing for a British journal to pretend ARM doesn't exist...
- deleted 5mo ago
  [deleted]
- dijit 5mo ago
  ARM is: 1) An ISA licensor, with no capability to create its own CPUs and 2) Owned by Softbank in Japan, not European
  - shaokind 5mo ago
    Is 1) accurate with ARM creating their own CPUs directly? https://www.cnbc.com/amp/2026/03/24/arm-launches-its-own-cpu-with-meta-as-first-customer.html https://www.cnbc.com/amp/2026/03/24/arm-launches-its-own-cpu...
  - Aromasin 5mo ago
    They are pivoting to become a fabless chip company as of last year (the decision happened a few years back): https://www.wired.com/story/chip-design-firm-arm-is-making-its-own-ai-cpu/ https://www.wired.com/story/chip-design-firm-arm-is-making-i... I'd also argue that while Softbank has capital ownership of the company, the leadership structure and how that capital is allocated is still done within the UK with standard board oversight. I know a few of the leadership team personally, and they have a wide remit, almost more so than a public company might do.
  - dadoum 5mo ago
    ARM design IP blocks, they can make their own CPU (and now they are making one), eevn though that means competing with your customers.
    - wvbdmp 5mo ago
      They still don‘t fab them though, AFAIK they go through TSMC.
      - gehsty 5mo ago
        And where does TMSC go for the machines it uses to produce these chips?
      - mathisfun123 5mo ago
        There are literally only 2 "fabfull" processor companies (Intel and Samsung) so you're saying something completely meaningless.
        dadoum 5mo ago
        Actually there are more if you count the ones which are not at the cutting edge but your point still stands, most high-end silicon companies only do design.
- hannob 5mo ago
  As far as cloud service servers are concerned, I don't think ARM CPUs have any meaningful marketshare, right? You could start running things on ARM, but, almost certainly, that comes with a lot of extra friction. (Not saying that isn't a bad idea, it'd probably improve the ecosystem as a whole and flush out architecture-specific assumptions in server software. But it's not someting trivial to do.)
  - hanwenn 5mo ago
    AWS graviton, Google Axion? ARM has better performance per watt, which translates to better performance per $.
    - jandrewrogers 5mo ago
      The reality is more complicated than this. If the processor is mostly idle or running minimally optimized software, which is most software, then ARM offers better performance per watt. If the processor is running highly optimized code at max throughput all the time then x86 offers better performance per watt. This is an intrinsic tradeoff. To make low-utilization workloads more power efficient you have to make high-utilization workloads less power efficient and vice versa. ARM and x86 differentiate themselves by taking opposite ends of that tradeoff spectrum. It depends on the code.
  - therockhead 5mo ago
    AWS Graviton has been steadily gaining share, a quick Google search says it's up to 20% now.
  - Sytten 5mo ago
    AWS runs a lot of ARM server and they are pushed heavily since they are cheaper and faster. And with Apple running ARM it is just easier to fully transition now.
  - Hikikomori 5mo ago
    More than 50 % of new CPU capacity on AWS is arm. Most of their own stuff uses it, nitro co processors are also arm. Anyone caring about cost of AWS has or is transitioning.
- Aromasin 5mo ago
  The author is a Dutch journalist with no technology background. I wouldn't jump to get my information from this source. As a person who works in the UK semiconductor industry, I noticed 4 or 5 glaring holes in the article in just the first couple of paragraphs.
  - embedding-shape 5mo ago
    I got to the second sentence ("Europe is pouring more than €2 billion into sovereign cloud initiatives") before I realize the author either doesn't know and/or didn't care to research properly.
- anonym29 5mo ago
  ARM has the exact same problem via TrustZone. Different technical implementation, slightly different known capabilities, but fundamentally, still an unauditable, unremovable ring -3 subsystem that cannot be controlled by the legitimate, lawful owner of the hardware.
  - M95D 5mo ago
    It depends on the CPU. For Rockchip we have open source BL31 blob [1] and it's supported by mainline u-boot. And I think it's ring -2, because it's not a separate CPU. [1] https://www.collabora.com/news-and-blog/blog/2024/02/21/almost-a-fully-open-source-boot-chain-for-rockchips-rk3588/ https://www.collabora.com/news-and-blog/blog/2024/02/21/almo...
sauercrowd 5mo ago
So what's being proposed here? Why bother and just use US clouds?
- anonym29 5mo ago
  Don't let 'perfect' be the enemy of 'progress'.
- lstodd 5mo ago
  Exactly. Why bother and own yourself? I always snarked at clueless CEOs bent on forcing me to sign NDAs while the entire infra _and_ data was living in US from the get go. Like, what's so sensitive I'm going to disclose that wasn't voluntarily disclosed by yourself already?
  - brookst 5mo ago
    People are at least as concerned with who data is disclosed to as they are with what data is disclosed. I am sure the US government has everything from my banking records to my biometrics to my medical history. That does not mean I would be ok with all of those things being posted on the open web (yes, some / all may already be). Employers are generally more concerned with disclosure to competitors than they are with possible collection by US intelligence.
wood_spirit 5mo ago
So what is the solution? Can Europe start building the next gen fab now already? And if it can technically, and if it can politically, even at great expense, should it?
dijit 5mo ago
I think people miss the point about sovreignity. Part of what got Microsoft into this position in the first place is that they built and sold software. Now, they don't build and sell software, they sell services. Services means you're buying access to data. The data is the problem. There's a certain amount of soft power you have when you can disallow access to data and services for foreign officials[0] arbitrarily. The old world order would of course permit us to sanction new sales of things, but in the new world: this is crucially tied with current access to services. I think the easiest way to think about it is: Would you depend on another nation selling you the parts to build a power plant, or would you prefer to depend on them supplying you the power- in fact it's worse than that because not only are you buying power you're also giving up a lot of information on who uses it, how it's used, and enough control to cut it off for an individual person.. totally crazy. the EU itself was designed around the idea that if you are crucially tied in this way then war becomes unthinkable. But that only works when you're equivalently sized entities. The US uses this position to bully the world.
- leonidasrup 5mo ago
  EU is for example quite comfortable to be dependent on energy imports. The biggest share of imports to EU by value is "mineral fuels, oils, distillation products". It's 17% of all imports. https://tradingeconomics.com/european-union/imports-by-category https://tradingeconomics.com/european-union/imports-by-categ...
  - dijit 5mo ago
    1) that gave Russia a lot of leverage over us, so, lessons should be learned. 2) Tech dominance is almost at 100% for large companies and governments across europe. Much higher than 17%
    - leonidasrup 5mo ago
      Even after 2014 Russian annexation of Crimea, Europe didn't learn it lessons. After 2022 the leverage just shifted to other countries. 17% is the share of money spent on imports by category. The actual energy imports dependency rate is much higher. "The energy imports dependency rate in the EU was 57%, which means that nearly 60% of the EU’s energy needs were met by net imports. However, the dependency rate varied across EU countries. The highest levels were found in Malta (98%), Luxembourg (91%) and Cyprus (88%), while the lowest dependency was in Estonia (5%), Sweden (27%) and Latvia (29%)." https://ec.europa.eu/eurostat/web/products-eurostat-news/w/wdn-20260318-1 https://ec.europa.eu/eurostat/web/products-eurostat-news/w/w...
clearstack 5mo ago
The GPU situation is even more concentrated. NVDA data center was $39B last fiscal year — roughly 90% of their total revenue. No European alternative exists for AI compute workloads.
leonidasrup 5mo ago
Even if Europe could replace the dependence of Intel and AMD processor, for example with home grown RISC-V processor, where in Europe could such processor be manufacture in a secure and somehow cost effective way? Then there are other chips and components like memory chips, network components. How about secure European network routers which for networks and datacenters in Europe? https://www.techspot.com/news/107073-researchers-uncover-hidden-backdoor-widely-used-esp32-microchip.html https://www.techspot.com/news/107073-researchers-uncover-hid... Silicon level backdoors. https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/ https://www.wired.com/2016/06/demonically-clever-backdoor-hi...
- dhdueii18 5mo ago
  If they can make the EUV machines I doubt it’s beyond Europe to do the manufacturing at higher levels. And as commented elsewhere, ARM
  - cenamus 5mo ago
    Also Siemens/Infineon. Although that's a vastly different node size, but still, there's some expertise present
    - nereye 5mo ago
      And ST (with similar considerations for node size etc.).
  - jeffrallen 5mo ago
    As a European, enjoying the environmental quality of life our regulations provide, I'm ashamed to admit it might be impossible to make chips here, as it's probably a dirty industry that Europe prefers to keep offshore.
    - dadoum 5mo ago
      And you are wrong to think that in my opinion, chip manufacturing in Europe was huge 25-30 years ago (there was high-end memory chips manufacturers, high-end GPU manufacturing and cutting edge nodes in Europe at the time).
anonym29 5mo ago
Francillon seems very dismissive of the risk, citing his "castle walls", but there's a flaw in his thinking, partially described in the article. Francillon seems to anticipate adversarial traffic only flowing in, not out. Sure, he can block packets before they ever reach CSME or PSP. But there are several embedded assumptions in there which are unsupported: that the behavior of these systems is known, auditable, or understood well enough to assume that they're not sending outbound communications as a covert C2 channel, and that attackers reaching in need to send packets directly to these systems, rather than surreptitious delivery mechanisms to the main OS that CSME and PSP can observe, like a certain WLAN name broadcast from a wireless radio, or certain device firmware being present, or even a specific targeted ad being served to a browser running in the main OS. The claim that these criticisms make the entire framework he designed worthless is obviously untrue, but it's also a strawman. The true claim isn't that it makes the framework worthless, but rather, it makes the framework incomplete. This is inconvenient for Francillon because it tasks him with addressing a class of problem that may be partially possible to detect, but impossible to solve, in practice. And you can't have a conclusion that there is an unsolvable problem, even if it's true.
k4rnaj1k 5mo ago
[dead]
deleted 5mo ago
[deleted]
embedding-shape 5mo ago
I guess there are two types of "sovereignty" people talk about here. First is "data sovereignty", which is what the current (data) migrations are all about. As long as the data remains in place where it cannot be suddenly locked away by the US government, people don't care if the CPU was purchased from the US, as the government cannot suddenly disable those (as far as we know at least). Second is "hardware sovereignty", which is what this article talks about, about the geographical locations where the hardware is designed and built. This is obviously much harder, but also less important at this very moment. That's why you're not seeing people suddenly rushing to fund EU fabs for silicon, there are more important things to focus on right now, with real implications. The article kind of does everyone a disservice by mixing the two and not clearly separating which ones it's actually talking about. But to be fair, if they did that, then they've wouldn't have been able to publish this whole "Look how they aren't actually sovereign after all" article if they did so, here we are...
- masfuerte 5mo ago
  The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.
  - embedding-shape 5mo ago
    Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...
    - tinychair 5mo ago
      The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
    - deleted 5mo ago
netfortius 5mo ago
Now this is a perfect time to be just a little patient. After Trump literally threw Taiwan under the incoming Chinese bus, during his recent trip in the area, the chip design and building ought to change. And not in the direction of "build in America (as in MAGA one)" direction.
onemoresoop 5mo ago
Sovereignty is not necessarily about spying but about having control over their destiny.
DeathArrow 5mo ago
>Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. This is laughable, since US cloud platforms invested trillions. Also, US companies benefit from greater efficiency, know how, cheaper energy and less regulations. If EU wants to compete with the US, they have to do what US does.
- big85 5mo ago
  Not to mention that the UK thinks its legal reach extends beyond its borders, what with levying fines against 4chan, a US-based site with no legal requirement to obey foreign law.
486sx33 5mo ago
[dead]
neilv 5mo ago
> Goodacre told The Register he tested awareness of the Management Engine with various attendees at the CyberUK conference in April 2026. "Almost no one" knew about it, he reports. That's surprising. I would've expected most people at a cybersecurity conference to have heard of it, for over a decade. Is this conference not for people who understand the technology at all, but rather for purely management-track people who oversee the people who understand the technology?
hinata08 5mo ago
I'm surprised that nobody ever tells about Loongson China already produces government and business computers with their homemade LoongArch architecture. The run on homemade Linux as well. Their point was not only to not be worried as much about backdoors and sanctions, but also to get a platform that their own universities and engineers can maintain and develop This brand used to coproduce with the French, open source and Java apps work, it's under US sanctions for supplying the chinese government and military, export was restricted so that none land in Russia. It took decades to make, commercial value is uncertain, but they did master the entire computing stack now
deaux 5mo ago
These articles may as well be US industry plants. Clickbait title, useless content written to discourage people and hope they throw their hands up and abandon all efforts. Sovereign clouds are an incredibly meaningful first step. Full independence takes decades. China still uses plenty of AMD and Intel chips, does it mean the amount of independence they've achieved is meaningless? That their stacks are just as dependent on the US as those of the EU? Of course not and even a child could know that. You start with the very end of the chain and hopefully very gradually work your way upwards. Sovereignty is a float, not a bool. If it's a bool its valye is False for all of China, the US and Italy, where in reality each has very different degrees of tech sovereignty. So you do things in order of efficiency, i.e. compare effort needed and how much it moves the sovereignty needle and pick what has the best ratio at this time. Designing and producing your own processors is far down this list.
- dingaling 5mo ago
  > You start with the very end of the chain No, that's just taking a quick win and kicking the can down the road. Data migration and hosting is comparatively quick and easy. It can be done any time. What takes huge lead-times is re-establishing a chip-making industry; not just the fabs but also the raw material contracts, materials processing etc I'd argue that achieving data sovereignity first is counter-productive because we know the politicians will relax once the easy bit is done. The actual hardware hard-work will never get funded, especially after a new US President takes office in 2029. Europe will sigh in relief and go back to its wilfull ignorance of the risks of dependency'
kinow 5mo ago
My company is involved in research and production of RISC-V-based chips in Barcelona, with partners. There is or was a partnership with Intel at some point, and I think NVIDIA collaborated in some tasks in one of the projects. But the idea that I heard from the presentations is to produce chips in EU with little dependency on US, China, etc. https://catalonia.com/w/barcelona-supercomputing-center-launches-europe-s-most-advanced-open-source-chip https://catalonia.com/w/barcelona-supercomputing-center-laun... https://www.bsc.es/join-us/excellence-career-opportunities/dare https://www.bsc.es/join-us/excellence-career-opportunities/d... I think there is a partition in our supercomputing facility for these new types of technologies, but since my work is running climate models, I only hear news from other teams like our AI factory, the quantum computer, or people involved with these new chips and some emulators (that I think work together).
krisbolton 5mo ago
I don't think they "forgot" about processors. It was out of scope. Creating the pipeline to end up with a fully "sovereign" system end-to-end is a decades long process and hundreds of billions of euros. As others have pointed out, in this context "sovereign" meant data processing. This is also a fairly paranoid take. Not to say hardware isn't targeted, but there are other methods. So spending hundreds of billions and several decades to build the fabs to gain assurance... it's a waste of time.
- Fnoord 5mo ago
  Exactly, it was out of scope. You cannot in one go have a full-blown scope. It won't work. This is a sensationalist headline (CBA to RTFA). It isn't a case of all or nothing, it is about becoming less dependent. A country like China follows the same industry, and besides, in a globalist economy like ours we are dependant on each other. So, for example, a lot of hardware components come from China, and assembly happens there as well. That counts for EU (DE, FR, ...), US, CA, RU, UA, CN, IN, etc. But as the talk on 39c3 has shown [1]: we can DIY. [1] https://media.ccc.de/v/39c3-in-house-electronics-manufacturing-from-scratch-how-hard-can-it-be https://media.ccc.de/v/39c3-in-house-electronics-manufacturi...
- hinata08 5mo ago
  France's Scaleway already offers RISC-V bare metal servers. It's a first step that brings most of the value with close to no cost, as RISC-V is cheap nowadays This cloud provider is a for profit company, not a research institute, so they can see short term commercial value if they do it
pjmlp 5mo ago
Programming languages and operating systems as well. Even if open source, currently there is no European plan on how to take care of supply chain on those. Huawei came up with a full stack, after the ties were closed, as an example. OS and languages.
- graemep 5mo ago
  If is open source, why is there a problem?
  - pjmlp 5mo ago
    Depends if anyone actually bothers to read the code for supply chain attacks. Also it would be great not to depend on that poor fellow in Nebraska to keep it running, and being further developed.
    - graemep 5mo ago
      That would not immediately stop you using it, and state sponsored attacks using exploits from supply chain attacks would be a far more aggressive move than just stopping supplying services. I do not know whether it would be technically an act of war, but its certainly practically so.
  - wolvesechoes 5mo ago
    People finally learned that capital has nationality. They now need to learn that code has it as well. It doesn't matter that it's open source if most contributions and maintenance effort come from MS, Google, Oracle, Red Hat etc. These companies control these projects.
sunshine-o 5mo ago
I don't think the HN crowd realize how much the whole political EU Cloud is another edition of a money grab by a group of insiders that happen every few years. Please read about the previous initiatives like Cloudwatt involving the same actors (Thales, etc.) [0] I have been forced to consider them about 10 years ago and realized at the time that the French telco Orange (who acquired it in 2015) just transferred all control to Huawei (datacenters in France but controlled by Huawei). So all the organisations who put their precious data in a sovereign EU cloud was now in the hand of the Chinese. It took me a while to understand because they would hide it first and strangely the wikipedia article does not mention it. So it was fun while the initial public money was flowing but right after that they just throw their "client" under the train. If you want an European cloud, companies like Hetzner are good. But please do not get to excited by all the other announcements. - [0] https://en.wikipedia.org/wiki/Cloudwatt https://en.wikipedia.org/wiki/Cloudwatt
- inemesitaffia 5mo ago
  Is there anything like Elastic Beanstalk/Spanner/App Engine? Most of what I see are Kubernetes offerings and VPS
neya 5mo ago
The other day, I saw a clone of OpenRouter pitched as a "superior" alternative simply because they were "European" only to find out their entire stack was dependent on Cloudflare. That's why I'm always sceptical of providers who claim superiority just because they want to "escape" US control because that's rarely the case.
whage 5mo ago
Doesn't encryption protect against these low level network backdoors? I'd think that encryption happens in the upper layers so by the time traffic goes through the ME, it is just gibberish. Someone with expertise enlighten me, please!
- M95D 5mo ago
  ME has unrestricted access to everything in the system via PCI bus. It can read all memory via DMA, access any card, any USB, everything. I expect it can communicate with SMM too and it can stop the main CPU if it wants to.
ztcfegzgf 5mo ago
> Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. (not Europe, the EU) this is just sad. the US clouds did not happen because US poured billions into them. they happened because the financial/whatever situation was such that these businesses could happen. now the EU, instead of making it easy for companies to innovate, spends billion on trying to catch up to the US. not even catching up. getting to where the US clouds are today. the "skating to where the puck is going to be, not where it's been" quote comes to mind.
- embedding-shape 5mo ago
  Isn't this essentially the Apple playbook typically? Don't innovate, let others find what works or not, then once you have something, catch up with the rest, try to out-compete? Apple is almost never "first" with something, but once they release something, it's a good iteration on that thing, I don't think Apple would be the only ones able to pull something like that off.
- f33d5173 5mo ago
  The clouds are not really american, but they are subject to american laws. The money and ownership needn't be american, anybody all around the world can buy stock in america companies. And the work to build these clouds was not done exclusively by americans, as all these companies have offices in europe to hire european engineers (to say nothing of the foreigners they pay to come live in america). From the perspective of the market, the clouds being american is an irrelevant detail, since they can reap whatever benefits they like of the world outside the US, as well as whatever benefits they want within the US. I think this is an important thing to note in all these discussions of "why can't europe innovate": europeans in europe can and do innovate, but the processes to commercialize that innovation have been set up in the US, and have no market incentive to relocate or diversify. They can always take advantage of innovation wherever it lies. To make the market care about something it is otherwise indifferent to, you have to pay it. Whereas capital markets ordinarily don't care if a company serving europeans is domiciled in the US, if you pay them a couple billion suddenly they will. It may be expensive, but it's the only solution to the problem at hand.
- 5mo ago
graceful6800 5mo ago
I see you are making a critique of society, and yet you participate in that society! Isn't that strange? I am very smart. /s
abdelhousni 5mo ago
"Europe's frameworks certify the clouds. They don't assess the silicon." At least they show good intentions
tsoukase 5mo ago
Europe has a very long way to real digital sovereignty. It's not only the 3-4 cloud companies that have to be replaced. It's the whole stack, from CDNs down to the two US based mobile OSs, that will haunt European citizens for a long time as no replacement seems to come soon.

121 points by beardyw 5mo ago

nasretdinov 5mo ago

Quite an odd thing for a British journal to pretend ARM doesn't exist...

deleted 5mo ago
[deleted]
dijit 5mo ago
ARM is: 1) An ISA licensor, with no capability to create its own CPUs and 2) Owned by Softbank in Japan, not European
- shaokind 5mo ago
  Is 1) accurate with ARM creating their own CPUs directly? https://www.cnbc.com/amp/2026/03/24/arm-launches-its-own-cpu-with-meta-as-first-customer.html https://www.cnbc.com/amp/2026/03/24/arm-launches-its-own-cpu...
- Aromasin 5mo ago
  They are pivoting to become a fabless chip company as of last year (the decision happened a few years back): https://www.wired.com/story/chip-design-firm-arm-is-making-its-own-ai-cpu/ https://www.wired.com/story/chip-design-firm-arm-is-making-i... I'd also argue that while Softbank has capital ownership of the company, the leadership structure and how that capital is allocated is still done within the UK with standard board oversight. I know a few of the leadership team personally, and they have a wide remit, almost more so than a public company might do.
- dadoum 5mo ago
  ARM design IP blocks, they can make their own CPU (and now they are making one), eevn though that means competing with your customers.
  - wvbdmp 5mo ago
    They still don‘t fab them though, AFAIK they go through TSMC.
    - gehsty 5mo ago
      And where does TMSC go for the machines it uses to produce these chips?
    - mathisfun123 5mo ago
      There are literally only 2 "fabfull" processor companies (Intel and Samsung) so you're saying something completely meaningless.
      - dadoum 5mo ago
        Actually there are more if you count the ones which are not at the cutting edge but your point still stands, most high-end silicon companies only do design.
hannob 5mo ago
As far as cloud service servers are concerned, I don't think ARM CPUs have any meaningful marketshare, right? You could start running things on ARM, but, almost certainly, that comes with a lot of extra friction. (Not saying that isn't a bad idea, it'd probably improve the ecosystem as a whole and flush out architecture-specific assumptions in server software. But it's not someting trivial to do.)
- hanwenn 5mo ago
  AWS graviton, Google Axion? ARM has better performance per watt, which translates to better performance per $.
  - jandrewrogers 5mo ago
    The reality is more complicated than this. If the processor is mostly idle or running minimally optimized software, which is most software, then ARM offers better performance per watt. If the processor is running highly optimized code at max throughput all the time then x86 offers better performance per watt. This is an intrinsic tradeoff. To make low-utilization workloads more power efficient you have to make high-utilization workloads less power efficient and vice versa. ARM and x86 differentiate themselves by taking opposite ends of that tradeoff spectrum. It depends on the code.
- therockhead 5mo ago
  AWS Graviton has been steadily gaining share, a quick Google search says it's up to 20% now.
- Sytten 5mo ago
  AWS runs a lot of ARM server and they are pushed heavily since they are cheaper and faster. And with Apple running ARM it is just easier to fully transition now.
- Hikikomori 5mo ago
  More than 50 % of new CPU capacity on AWS is arm. Most of their own stuff uses it, nitro co processors are also arm. Anyone caring about cost of AWS has or is transitioning.
Aromasin 5mo ago
The author is a Dutch journalist with no technology background. I wouldn't jump to get my information from this source. As a person who works in the UK semiconductor industry, I noticed 4 or 5 glaring holes in the article in just the first couple of paragraphs.
- embedding-shape 5mo ago
  I got to the second sentence ("Europe is pouring more than €2 billion into sovereign cloud initiatives") before I realize the author either doesn't know and/or didn't care to research properly.
anonym29 5mo ago
ARM has the exact same problem via TrustZone. Different technical implementation, slightly different known capabilities, but fundamentally, still an unauditable, unremovable ring -3 subsystem that cannot be controlled by the legitimate, lawful owner of the hardware.
- M95D 5mo ago
  It depends on the CPU. For Rockchip we have open source BL31 blob [1] and it's supported by mainline u-boot. And I think it's ring -2, because it's not a separate CPU. [1] https://www.collabora.com/news-and-blog/blog/2024/02/21/almost-a-fully-open-source-boot-chain-for-rockchips-rk3588/ https://www.collabora.com/news-and-blog/blog/2024/02/21/almo...

sauercrowd 5mo ago

So what's being proposed here? Why bother and just use US clouds?

anonym29 5mo ago
Don't let 'perfect' be the enemy of 'progress'.
lstodd 5mo ago
Exactly. Why bother and own yourself? I always snarked at clueless CEOs bent on forcing me to sign NDAs while the entire infra _and_ data was living in US from the get go. Like, what's so sensitive I'm going to disclose that wasn't voluntarily disclosed by yourself already?
- brookst 5mo ago
  People are at least as concerned with who data is disclosed to as they are with what data is disclosed. I am sure the US government has everything from my banking records to my biometrics to my medical history. That does not mean I would be ok with all of those things being posted on the open web (yes, some / all may already be). Employers are generally more concerned with disclosure to competitors than they are with possible collection by US intelligence.

wood_spirit 5mo ago

So what is the solution? Can Europe start building the next gen fab now already? And if it can technically, and if it can politically, even at great expense, should it?

dijit 5mo ago

I think people miss the point about sovreignity. Part of what got Microsoft into this position in the first place is that they built and sold software. Now, they don't build and sell software, they sell services. Services means you're buying access to data. The data is the problem. There's a certain amount of soft power you have when you can disallow access to data and services for foreign officials[0] arbitrarily. The old world order would of course permit us to sanction new sales of things, but in the new world: this is crucially tied with current access to services. I think the easiest way to think about it is: Would you depend on another nation selling you the parts to build a power plant, or would you prefer to depend on them supplying you the power- in fact it's worse than that because not only are you buying power you're also giving up a lot of information on who uses it, how it's used, and enough control to cut it off for an individual person.. totally crazy. the EU itself was designed around the idea that if you are crucially tied in this way then war becomes unthinkable. But that only works when you're equivalently sized entities. The US uses this position to bully the world.

leonidasrup 5mo ago
EU is for example quite comfortable to be dependent on energy imports. The biggest share of imports to EU by value is "mineral fuels, oils, distillation products". It's 17% of all imports. https://tradingeconomics.com/european-union/imports-by-category https://tradingeconomics.com/european-union/imports-by-categ...
- dijit 5mo ago
  1) that gave Russia a lot of leverage over us, so, lessons should be learned. 2) Tech dominance is almost at 100% for large companies and governments across europe. Much higher than 17%
  - leonidasrup 5mo ago
    Even after 2014 Russian annexation of Crimea, Europe didn't learn it lessons. After 2022 the leverage just shifted to other countries. 17% is the share of money spent on imports by category. The actual energy imports dependency rate is much higher. "The energy imports dependency rate in the EU was 57%, which means that nearly 60% of the EU’s energy needs were met by net imports. However, the dependency rate varied across EU countries. The highest levels were found in Malta (98%), Luxembourg (91%) and Cyprus (88%), while the lowest dependency was in Estonia (5%), Sweden (27%) and Latvia (29%)." https://ec.europa.eu/eurostat/web/products-eurostat-news/w/wdn-20260318-1 https://ec.europa.eu/eurostat/web/products-eurostat-news/w/w...

clearstack 5mo ago

The GPU situation is even more concentrated. NVDA data center was $39B last fiscal year — roughly 90% of their total revenue. No European alternative exists for AI compute workloads.

leonidasrup 5mo ago

Even if Europe could replace the dependence of Intel and AMD processor, for example with home grown RISC-V processor, where in Europe could such processor be manufacture in a secure and somehow cost effective way? Then there are other chips and components like memory chips, network components. How about secure European network routers which for networks and datacenters in Europe? https://www.techspot.com/news/107073-researchers-uncover-hidden-backdoor-widely-used-esp32-microchip.html https://www.techspot.com/news/107073-researchers-uncover-hid... Silicon level backdoors. https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/ https://www.wired.com/2016/06/demonically-clever-backdoor-hi...

dhdueii18 5mo ago
If they can make the EUV machines I doubt it’s beyond Europe to do the manufacturing at higher levels. And as commented elsewhere, ARM
- cenamus 5mo ago
  Also Siemens/Infineon. Although that's a vastly different node size, but still, there's some expertise present
  - nereye 5mo ago
    And ST (with similar considerations for node size etc.).
- jeffrallen 5mo ago
  As a European, enjoying the environmental quality of life our regulations provide, I'm ashamed to admit it might be impossible to make chips here, as it's probably a dirty industry that Europe prefers to keep offshore.
  - dadoum 5mo ago
    And you are wrong to think that in my opinion, chip manufacturing in Europe was huge 25-30 years ago (there was high-end memory chips manufacturers, high-end GPU manufacturing and cutting edge nodes in Europe at the time).

anonym29 5mo ago

Francillon seems very dismissive of the risk, citing his "castle walls", but there's a flaw in his thinking, partially described in the article. Francillon seems to anticipate adversarial traffic only flowing in, not out. Sure, he can block packets before they ever reach CSME or PSP. But there are several embedded assumptions in there which are unsupported: that the behavior of these systems is known, auditable, or understood well enough to assume that they're not sending outbound communications as a covert C2 channel, and that attackers reaching in need to send packets directly to these systems, rather than surreptitious delivery mechanisms to the main OS that CSME and PSP can observe, like a certain WLAN name broadcast from a wireless radio, or certain device firmware being present, or even a specific targeted ad being served to a browser running in the main OS. The claim that these criticisms make the entire framework he designed worthless is obviously untrue, but it's also a strawman. The true claim isn't that it makes the framework worthless, but rather, it makes the framework incomplete. This is inconvenient for Francillon because it tasks him with addressing a class of problem that may be partially possible to detect, but impossible to solve, in practice. And you can't have a conclusion that there is an unsolvable problem, even if it's true.

k4rnaj1k 5mo ago

[dead]

deleted 5mo ago

[deleted]

embedding-shape 5mo ago

I guess there are two types of "sovereignty" people talk about here. First is "data sovereignty", which is what the current (data) migrations are all about. As long as the data remains in place where it cannot be suddenly locked away by the US government, people don't care if the CPU was purchased from the US, as the government cannot suddenly disable those (as far as we know at least). Second is "hardware sovereignty", which is what this article talks about, about the geographical locations where the hardware is designed and built. This is obviously much harder, but also less important at this very moment. That's why you're not seeing people suddenly rushing to fund EU fabs for silicon, there are more important things to focus on right now, with real implications. The article kind of does everyone a disservice by mixing the two and not clearly separating which ones it's actually talking about. But to be fair, if they did that, then they've wouldn't have been able to publish this whole "Look how they aren't actually sovereign after all" article if they did so, here we are...

masfuerte 5mo ago
The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.
- embedding-shape 5mo ago
  Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...
  - tinychair 5mo ago
    The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
  - deleted 5mo ago

netfortius 5mo ago

Now this is a perfect time to be just a little patient. After Trump literally threw Taiwan under the incoming Chinese bus, during his recent trip in the area, the chip design and building ought to change. And not in the direction of "build in America (as in MAGA one)" direction.

onemoresoop 5mo ago

Sovereignty is not necessarily about spying but about having control over their destiny.

DeathArrow 5mo ago

>Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. This is laughable, since US cloud platforms invested trillions. Also, US companies benefit from greater efficiency, know how, cheaper energy and less regulations. If EU wants to compete with the US, they have to do what US does.

big85 5mo ago
Not to mention that the UK thinks its legal reach extends beyond its borders, what with levying fines against 4chan, a US-based site with no legal requirement to obey foreign law.

486sx33 5mo ago

[dead]

neilv 5mo ago

> Goodacre told The Register he tested awareness of the Management Engine with various attendees at the CyberUK conference in April 2026. "Almost no one" knew about it, he reports. That's surprising. I would've expected most people at a cybersecurity conference to have heard of it, for over a decade. Is this conference not for people who understand the technology at all, but rather for purely management-track people who oversee the people who understand the technology?

hinata08 5mo ago

I'm surprised that nobody ever tells about Loongson China already produces government and business computers with their homemade LoongArch architecture. The run on homemade Linux as well. Their point was not only to not be worried as much about backdoors and sanctions, but also to get a platform that their own universities and engineers can maintain and develop This brand used to coproduce with the French, open source and Java apps work, it's under US sanctions for supplying the chinese government and military, export was restricted so that none land in Russia. It took decades to make, commercial value is uncertain, but they did master the entire computing stack now

deaux 5mo ago

These articles may as well be US industry plants. Clickbait title, useless content written to discourage people and hope they throw their hands up and abandon all efforts. Sovereign clouds are an incredibly meaningful first step. Full independence takes decades. China still uses plenty of AMD and Intel chips, does it mean the amount of independence they've achieved is meaningless? That their stacks are just as dependent on the US as those of the EU? Of course not and even a child could know that. You start with the very end of the chain and hopefully very gradually work your way upwards. Sovereignty is a float, not a bool. If it's a bool its valye is False for all of China, the US and Italy, where in reality each has very different degrees of tech sovereignty. So you do things in order of efficiency, i.e. compare effort needed and how much it moves the sovereignty needle and pick what has the best ratio at this time. Designing and producing your own processors is far down this list.

dingaling 5mo ago
> You start with the very end of the chain No, that's just taking a quick win and kicking the can down the road. Data migration and hosting is comparatively quick and easy. It can be done any time. What takes huge lead-times is re-establishing a chip-making industry; not just the fabs but also the raw material contracts, materials processing etc I'd argue that achieving data sovereignity first is counter-productive because we know the politicians will relax once the easy bit is done. The actual hardware hard-work will never get funded, especially after a new US President takes office in 2029. Europe will sigh in relief and go back to its wilfull ignorance of the risks of dependency'

kinow 5mo ago

My company is involved in research and production of RISC-V-based chips in Barcelona, with partners. There is or was a partnership with Intel at some point, and I think NVIDIA collaborated in some tasks in one of the projects. But the idea that I heard from the presentations is to produce chips in EU with little dependency on US, China, etc. https://catalonia.com/w/barcelona-supercomputing-center-launches-europe-s-most-advanced-open-source-chip https://catalonia.com/w/barcelona-supercomputing-center-laun... https://www.bsc.es/join-us/excellence-career-opportunities/dare https://www.bsc.es/join-us/excellence-career-opportunities/d... I think there is a partition in our supercomputing facility for these new types of technologies, but since my work is running climate models, I only hear news from other teams like our AI factory, the quantum computer, or people involved with these new chips and some emulators (that I think work together).

krisbolton 5mo ago

I don't think they "forgot" about processors. It was out of scope. Creating the pipeline to end up with a fully "sovereign" system end-to-end is a decades long process and hundreds of billions of euros. As others have pointed out, in this context "sovereign" meant data processing. This is also a fairly paranoid take. Not to say hardware isn't targeted, but there are other methods. So spending hundreds of billions and several decades to build the fabs to gain assurance... it's a waste of time.

Fnoord 5mo ago
Exactly, it was out of scope. You cannot in one go have a full-blown scope. It won't work. This is a sensationalist headline (CBA to RTFA). It isn't a case of all or nothing, it is about becoming less dependent. A country like China follows the same industry, and besides, in a globalist economy like ours we are dependant on each other. So, for example, a lot of hardware components come from China, and assembly happens there as well. That counts for EU (DE, FR, ...), US, CA, RU, UA, CN, IN, etc. But as the talk on 39c3 has shown [1]: we can DIY. [1] https://media.ccc.de/v/39c3-in-house-electronics-manufacturing-from-scratch-how-hard-can-it-be https://media.ccc.de/v/39c3-in-house-electronics-manufacturi...
hinata08 5mo ago
France's Scaleway already offers RISC-V bare metal servers. It's a first step that brings most of the value with close to no cost, as RISC-V is cheap nowadays This cloud provider is a for profit company, not a research institute, so they can see short term commercial value if they do it

pjmlp 5mo ago

Programming languages and operating systems as well. Even if open source, currently there is no European plan on how to take care of supply chain on those. Huawei came up with a full stack, after the ties were closed, as an example. OS and languages.

graemep 5mo ago
If is open source, why is there a problem?
- pjmlp 5mo ago
  Depends if anyone actually bothers to read the code for supply chain attacks. Also it would be great not to depend on that poor fellow in Nebraska to keep it running, and being further developed.
  - graemep 5mo ago
    That would not immediately stop you using it, and state sponsored attacks using exploits from supply chain attacks would be a far more aggressive move than just stopping supplying services. I do not know whether it would be technically an act of war, but its certainly practically so.
- wolvesechoes 5mo ago
  People finally learned that capital has nationality. They now need to learn that code has it as well. It doesn't matter that it's open source if most contributions and maintenance effort come from MS, Google, Oracle, Red Hat etc. These companies control these projects.

sunshine-o 5mo ago

I don't think the HN crowd realize how much the whole political EU Cloud is another edition of a money grab by a group of insiders that happen every few years. Please read about the previous initiatives like Cloudwatt involving the same actors (Thales, etc.) [0] I have been forced to consider them about 10 years ago and realized at the time that the French telco Orange (who acquired it in 2015) just transferred all control to Huawei (datacenters in France but controlled by Huawei). So all the organisations who put their precious data in a sovereign EU cloud was now in the hand of the Chinese. It took me a while to understand because they would hide it first and strangely the wikipedia article does not mention it. So it was fun while the initial public money was flowing but right after that they just throw their "client" under the train. If you want an European cloud, companies like Hetzner are good. But please do not get to excited by all the other announcements. - [0] https://en.wikipedia.org/wiki/Cloudwatt https://en.wikipedia.org/wiki/Cloudwatt

inemesitaffia 5mo ago
Is there anything like Elastic Beanstalk/Spanner/App Engine? Most of what I see are Kubernetes offerings and VPS

neya 5mo ago

The other day, I saw a clone of OpenRouter pitched as a "superior" alternative simply because they were "European" only to find out their entire stack was dependent on Cloudflare. That's why I'm always sceptical of providers who claim superiority just because they want to "escape" US control because that's rarely the case.

whage 5mo ago

Doesn't encryption protect against these low level network backdoors? I'd think that encryption happens in the upper layers so by the time traffic goes through the ME, it is just gibberish. Someone with expertise enlighten me, please!

M95D 5mo ago
ME has unrestricted access to everything in the system via PCI bus. It can read all memory via DMA, access any card, any USB, everything. I expect it can communicate with SMM too and it can stop the main CPU if it wants to.

ztcfegzgf 5mo ago

> Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. (not Europe, the EU) this is just sad. the US clouds did not happen because US poured billions into them. they happened because the financial/whatever situation was such that these businesses could happen. now the EU, instead of making it easy for companies to innovate, spends billion on trying to catch up to the US. not even catching up. getting to where the US clouds are today. the "skating to where the puck is going to be, not where it's been" quote comes to mind.

embedding-shape 5mo ago
Isn't this essentially the Apple playbook typically? Don't innovate, let others find what works or not, then once you have something, catch up with the rest, try to out-compete? Apple is almost never "first" with something, but once they release something, it's a good iteration on that thing, I don't think Apple would be the only ones able to pull something like that off.
f33d5173 5mo ago
The clouds are not really american, but they are subject to american laws. The money and ownership needn't be american, anybody all around the world can buy stock in america companies. And the work to build these clouds was not done exclusively by americans, as all these companies have offices in europe to hire european engineers (to say nothing of the foreigners they pay to come live in america). From the perspective of the market, the clouds being american is an irrelevant detail, since they can reap whatever benefits they like of the world outside the US, as well as whatever benefits they want within the US. I think this is an important thing to note in all these discussions of "why can't europe innovate": europeans in europe can and do innovate, but the processes to commercialize that innovation have been set up in the US, and have no market incentive to relocate or diversify. They can always take advantage of innovation wherever it lies. To make the market care about something it is otherwise indifferent to, you have to pay it. Whereas capital markets ordinarily don't care if a company serving europeans is domiciled in the US, if you pay them a couple billion suddenly they will. It may be expensive, but it's the only solution to the problem at hand.
5mo ago

graceful6800 5mo ago

I see you are making a critique of society, and yet you participate in that society! Isn't that strange? I am very smart. /s

abdelhousni 5mo ago

"Europe's frameworks certify the clouds. They don't assess the silicon." At least they show good intentions

tsoukase 5mo ago

Europe has a very long way to real digital sovereignty. It's not only the 3-4 cloud companies that have to be replaced. It's the whole stack, from CDNs down to the two US based mobile OSs, that will haunt European citizens for a long time as no replacement seems to come soon.