I do not like the post. It seems scant on details and rife with conclusions. The Google presentation linked to has a bit more detail on the underlying technologies. A modern processor is a complex beast, and a security argument can always be made to reduce complexity. Citation needed for espionage and privacy evasion use cases...
Can someone ELI5 why Intel needs an OS in the processor?
Also remember while a case can be made (although in my opinion a very weak one) for why you need a separate computer running beside your main processor, the main issue people have is that you:
- Can not see what that operating system is doing
- Can not read the source code for that operating system
- Can not stop or manage that operating system
- Can not upload/change/edit anything to do with that operating system
Can someone ELI5 why Intel needs an OS in the processor?
If you're a sysadmin for a machine that you don't have physical access to, and the main OS is hosed, how do you fix it?
It's a very useful feature for large enterprises, and pretty much only for them. The interesting question is why doesn't Intel charge "enterprise pricing" for the feature, just like they do for stuff like ECC?
Can someone ELI5 why Intel needs an OS in the processor?
If you're a sysadmin for a machine that you don't have physical access to, and the main OS is hosed, how do you fix it? It's a very useful feature for large enterprises, and pretty much only for them. The interesting question is why doesn't Intel charge "enterprise pricing" for the feature, just like they do for stuff like ECC?
It's probably cheaper to just ship it everywhere and enable it on enterprises
Can someone ELI5 why Intel needs an OS in the processor?
If you're a sysadmin for a machine that you don't have physical access to, and the main OS is hosed, how do you fix it? It's a very useful feature for large enterprises, and pretty much only for them. The interesting question is why doesn't Intel charge "enterprise pricing" for the feature, just like they do for stuff like ECC?
It's also the method by which a sysadmin will get to hear of drive failures in hardware RAID arrays, ECC memory errors, and other things relevant to the general upkeep of a server, regardless of the OS running and whether it is hosed or not.
Can someone ELI5 why Intel needs an OS in the processor?
Also remember while a case can be made (although in my opinion a very weak one) for why you need a separate computer running beside your main processor, the main issue people have is that you: - Can not see what that operating system is doing - Can not read the source code for that operating system - Can not stop or manage that operating system - Can not upload/change/edit anything to do with that operating system
I think it should be considered that none of these things are inherent to an OS running in a side CPU to the main CPU.
Rather, these are symptoms of specific implementations.
>> Note to AMD: Now might be a good time to remove similar functionality from your CPU lines to try to win market share from Intel. Better to do so now before Intel removes the “Management Engine.” Strike while the iron’s hot and all that. I am absolutely certain this comes with backing maybe even pressure from government surveillance bodies. You don't have it - you don't get a contract. AMD does already follow suit…
Then they should release the same CPU without the ME. Like they do for overclocking purposes. Leave it to the consumers to choose.
I do not like the post. It seems scant on details and rife with conclusions. The Google presentation linked to has a bit more detail on the underlying technologies. A modern processor is a complex beast, and a security argument can always be made to reduce complexity. Citation needed for espionage and privacy evasion use cases...
Surely, this is more an opinion piece than a didactic article. Here you have a more detailed write-up on the issue, including a known vulnerability and how others could be lingering: https://www.eff.org/deeplinks/2017/05/intels-management-engi...
Thanks. The citation describes the existence of vulnerabilities and laments the lack of transparency. While the latter is indeed lamentable, and is known to be a contributing factor in increasing risk, vulnerabilities do exist in any system, including transparent ones (e.g., OpenSSL). Still am not seeing any evidence of malice by this vendor, as "providing a full set of entrenched vulnerabilities, user espionage tools and privacy-evading mechanisms" would perhaps imply. Vendors have a hard time with security. Chip vendors are no different, only the stakes are higher.
Is anyone actually using Intel Management Engine? I understand why Intel would have it as a feature, but the majority of all users, including large companies and other organisation with 1000+ desktops, don't need it or use other solutions.
Besides not being able to turn it of, it actually seems like a nice enough offer, I just never heard of anyone using it.