Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Purism Librem Laptops Completely Disable Intel’s Management Engine

puri.sm

Post reply on HN
Print view View original

161–169 of 169 posts

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#161

Post by nickpsecurity »

n1000 wrote: post #68
sspiff wrote: post #41

You can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap door setting - once disabled, there is no way to turn it back on. From what I've heard, this disabling is done through the Intel HAM (high assurance mode), but I have no idea what the differences between the Dell and Purism approaches are.

Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.

Probably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements:

https://gdmissionsystems.com/cyber/products/trusted-computin...

http://www.integrityglobalsecurity.com/pages/solutions.html

https://www.ghs.com/products/safety_critical/integrity-do-17...

Warning: These companies' marketing folks like to go overboard. Sharing for the technical data and Dell references but not endorsing every claim you see. ;)

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#162

Post by fox8091 »

klibertp wrote: post #66
fdej wrote: post #22

Earlier quoted context omitted.

My HP laptop has a single column with delete/home/pgup/pgdn/end, like this: https://h30434.www3.hp.com/t5/image/serverpage/image-id/3646... This works very nicely for me.

Ok, now I know what I'd need to do to finally switch to hjkl (for arrows) when using Vim, I'd just need to buy a keyboard like yours ;) Joking aside, a keyboard is a very personal thing and picking the right one depends on many factors, from the shape and size of your hands and fingers to your chair and desk setup, to your OS and programs you use. For most people, it probably doesn't matter that much, but for people…

Something that helped me was remapping the caps lock key to ctrl.

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#163

Post by klibertp »

fox8091 wrote: post #162
klibertp wrote: post #66

Earlier quoted context omitted.

Ok, now I know what I'd need to do to finally switch to hjkl (for arrows) when using Vim, I'd just need to buy a keyboard like yours ;) Joking aside, a keyboard is a very personal thing and picking the right one depends on many factors, from the shape and size of your hands and fingers to your chair and desk setup, to your OS and programs you use. For most people, it probably doesn't matter that much, but for people…

Something that helped me was remapping the caps lock key to ctrl.

Already done, of course. It was easy, as I had it remapped to Esc before anyway :) But using CapsLock as Ctrl makes it harder to press Ctrl-a and Ctrl-x, which are kind of essential.

Anyway, CapsLock is got to be the least useful key on a keyboard. It occupies a place on the home row, suggesting it should be as often used as Enter is... while it's decidedly not. I have no idea why it persists, it was useful on a typewriter, where you needed to apply significant force to press a key and doing so to two keys at once (Shift+letter) could have been hard, but today?

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#164

Post by tinus_hn »

jchw wrote: post #94
mrec wrote: post #86

Earlier quoted context omitted.

> I remember 640x480 being the highest resolution my first personal computer could display Eeee, you were lucky. My first personal computer maxed out at 320x256, or 160x256 if you wanted more than 4 colours.

Hey, I did say I was relatively young :) I wouldn't have minded starting on Commodore 64 or Apple ][ or anything, but I missed by a decade or two. Oh well.

You can still do that, these machines are emulated pretty much perfectly.

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#165

Post by kbart »

mi100hael wrote: post #143
kbart wrote: post #32

Earlier quoted context omitted.

(Embedded) System engineer, so lot's of hex typing and editing. It's a pain without full numpad.

Why not just use the row of numbers along the top? It's way faster anyway once you learn them.

When using non-English keyboard layout, top row numbers are often converted to the locale characters, so you have to switch back and forth between languages to use them.

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#166

Post by nilved »

askvictor wrote: post #149
nilved wrote: post #105

Earlier quoted context omitted.

In practice, this never happens. The value is certainly less than the data you're selling about your users to Google.

What data are you giving to Google (or another CDN) by loading jQuery or a font from them? What does the ToS say? Genuine question. Edit: here's the ToS: https://developers.google.com/speed/libraries/terms If you believe Google, they're not collecting anything.

Don't be naive.

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#167

Post by tekjenitalor »

If in doubt act correctly and in due accordance with all applicable law and regulation: all will then be fine.

If you can't follow our rules then you deserve to be persecuted, surveilled and imprisoned at our whim but always know that you are being watched and your past will be used against you.

Luddite time?

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#168

Post by sspiff »

n1000 wrote: post #68
sspiff wrote: post #41

You can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap door setting - once disabled, there is no way to turn it back on. From what I've heard, this disabling is done through the Intel HAM (high assurance mode), but I have no idea what the differences between the Dell and Purism approaches are.

Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.

Sorry for the late response!

I've just checked and I could not find it for most models. I could find it for the OptiPlex 7450 All-in-One, but not for the Precision line.

At [1], you can find a screenshot of the setting that reflects this option. A colleague of mine ordered such a system and it came with a leaflet explaining that this meant that Intel ME was turned off and could no longer be turned on for this machine (trap door mechanism). It also explained that SKUs with Intel ME enabled could enter this state through the UEFI menu. He opened his system up and inspected the system board, and it was also labeled with a seal stating that Intel ME had been disabled on this system and could not be turned on. I'm trying to get hold of the leaflet so I can give you the exact wording Dell used for this.

The fact that this state can be entered through a UEFI program makes me believe that other systems running Dell's newest UEFI platform will have the same capability, but I have not been able to confirm this.

My screenshot is from the Belgian Dell enterprise portal. The wording translates to "System management: vPro Management Engine (ME) not executable, customer order".

[1] https://i.imgur.com/lpidbH3.png

Re: Purism Librem Laptops Completely Disable Intel’s Management Engine

#169

Post by sspiff »

nickpsecurity wrote: post #161
n1000 wrote: post #68

Earlier quoted context omitted.

Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.

Probably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements: https://gdmissionsystems.com/cyber/products/trusted-computin... http://www.integrityglobalsecurity.com/pages/solutions.html https://www.ghs.com/products/safety_critical/integrity-do-17... Warning: These companies' marketing folks like to go…

It was indeed an Optiplex system. You can find reference to it in this KB article[1] about replacement system boards.

[1] http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/...

Post reply on HN