Earlier quoted context omitted.
Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.
> because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime. This is rather an argument against DMCA or an argument why researchers working in this area should consider leaving the USA.
Disabling Intel ME 11 via undocumented mode
201–210 of 228 posts
Re: Disabling Intel ME 11 via undocumented mode
#202Earlier quoted context omitted.
Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.
This isn't necessarily true: https://www.ftc.gov/news-events/blogs/techftc/2016/10/dmca-s... Of the four criteria in the exemption, I wouldn't put it past the government trying to make the case that exposing a NSA spy program somehow falls afoul of good faith investigation - but the general view that "any DRM research is a crime" is no longer accurate.
Re: Disabling Intel ME 11 via undocumented mode
#203Earlier quoted context omitted.
You can't think of any reason? Have you or do you work for a large company [1], especially hardware companies? I've sat through I don't know how many "planning" meetings, which were little better than design by committee, and whose outcome was not in the best interest of the customer despite the best intentions of everyone there. 1. Or the government or one of it's contractors. I've even sat through meetings 12 engin…
Explain to me why I can't disable it for my home PC.
And even if there is, the "non-evil" reason for keeping this as is might be that "enterprise customer doesn't want something that is easily disabled, and we can't justify cost of a separate design / fab run for a small minority of customers", vs. "Haha, now we have a backdoor into EVERYTHING!"
(Hell, even the proposals about disable via hardware switch, or having the ME on a separate component probably boil down to money. To an outsider, hardware companies are funny beasts in that they really start caring about things like counting pennies and minimizing BOM cost as much as possible. I've been in worried meetings where we were literally counting and debating pennies, and wondering how I got there, but it makes sense at a company level since those pennies add up when you are building thousands or millions of something! This may have boiled down to "motherboard manufacturer doesn't want to have to put another mechanical part on the board, and they are looking to buy a shitload of our parts, let's keep them happy")
Please note: I'm not saying, or even advocating, that this is a good thing, or results in ideal outcomes when I say "benign". I'm just using it in the sense that this likely wasn't a malicious decision, but probably one motivated by money at some point, by people who didn't necessarily see the harm in it.
Re: Disabling Intel ME 11 via undocumented mode
#204Earlier quoted context omitted.
I’m not sure where you got the idea that such things only exist on x86 and shame Intel and AMD for a feature that’s useful for many scenarios. Have you considered the fact that such features exist because there are actually many customers that want it? I was literally using the counterpart of ME on Power today. These tools are essential to many enterprise workloads, especially when you are in Boston and your data cen…
Then let owners control whether it's enabled or not (by a hardware switch if necessary). As it currently stands, I can't imagine a benign reason that would drive intel and AMD to lock users out of their machines.
Re: Disabling Intel ME 11 via undocumented mode
#205Earlier quoted context omitted.
>even before US embargo'd Intel from china You can see how well this embargo works in every electronics mall
>> even before US embargo'd Intel from china > You can see how well this embargo works in every electronics mall IIRC, the embargo was only against very specific processors used in a specific supercomputer design.
Re: Disabling Intel ME 11 via undocumented mode
#206Earlier quoted context omitted.
Register windows and delay slots. These turned out to be not such a great idea.
[I'm not a microarchitecture expert] I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195 , http://blog.erratasec.com/2015/03/x86-is-high-level-language... ). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpreti…
Also, it's not really an x86 thing (for instance most Atoms don't have these extra registers), it's an in-order vs out-of-order thing. Most Power cores do have the larger bank and renaming.
Re: Disabling Intel ME 11 via undocumented mode
#207Earlier quoted context omitted.
Wouldn't it just take a motherboard maker or two to find an alternative to the PCH, like Nvidia nforce or a VIA chipset. adopt something like openbmc and sell it as an open feature? No intel PCH, no Intel ME. Seems like the Linux kernel is eager to support it: https://lwn.net/Articles/683320/ What happened to 3rd parties making chipsets? Another case of Intel abusing it's monopoly?
Short answer: yes https://arstechnica.com/gadgets/2009/02/intel-sues-nvidia-ov... https://www.extremetech.com/extreme/57766-update-intel-sues-...
Seems like they mention chipsets, but didn't go far enough given what happened to Nvidia chipsets vis-a-vis GPUs. They could do a little bit better as a regulator.
http://www.mercurynews.com/2010/02/13/nvidia-gains-ally-agai...
Re: Disabling Intel ME 11 via undocumented mode
#208Earlier quoted context omitted.
Intel ME is not an effective DRM scheme. You need to be exceptionally careful when you mention DRM, because if it becomes commonly believed that Intel ME could be used to implement DRM all of a sudden the DMCA comes into play. Research into Intel ME vulnerabilities becomes a federal crime.
It's only a federal crime in the US ... aren't these guys in the UK?
(Though it is somewhat more limited than the DMCA.)
Re: Disabling Intel ME 11 via undocumented mode
#209This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) we…
If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled…
You can build such features without baking the keys into the hardware. You can have an open security module where changing the key simply makes everything that has been previously secured by it unreadable. That way a user can load his custom keys and firmware if he wants to. You can cascade that dependency down the secure boot chain by mixing some secret from the module into the HDD decryption for example.
Only vendor lock-in (e.g. windows RT) and DRM require hardcoded keys.
Re: Disabling Intel ME 11 via undocumented mode
#210Earlier quoted context omitted.
Register windows and delay slots. These turned out to be not such a great idea.
[I'm not a microarchitecture expert] I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195 , http://blog.erratasec.com/2015/03/x86-is-high-level-language... ). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpreti…
Of course, IBM knew about this way back.
https://en.wikipedia.org/wiki/Tomasulo%27s_algorithm
Those who do not study history are doomed to repeat it.