MINIX: Intel's hidden in-chip operating system • Hacker News Board

Re: MINIX: Intel's hidden in-chip operating system

#91

Post by Aloha » Tue, Nov 07, 2017, 4:20 PM UTC

colejohnson66 wrote: post #50

JepZ wrote: post #23

While I am unsure if switchting to Linux for ME is a good solution, open sourcing whatever runs ME is a very important step towards user/customer security. And that is not because we all want to know intels secrets about 'how to make the fastest CPU' but because ME can change the product on a fundamental level while we use the product. The reason I doubt that Linux is a good solution is that linux wasn't built to run…

Well, someone managed to get Linux running on a Motorola 68k of all things: https://www.bigmessowires.com/2014/11/17/68-katy-68000-linux...

Linux has actually run on a Motorola 68k for quite some time (late 90's I think?)- what makes this special is its a 68008, which is a 68000, with an 8 bit data bus.

Re: MINIX: Intel's hidden in-chip operating system

#92

Post by wolfgke » Tue, Nov 07, 2017, 4:33 PM UTC

tomxor wrote: post #64

tsujamin wrote: post #19

" What Minnich would like to see happen is for Intel to dump its MINIX code and use an open-source Linux-based firmware. This would be much more secure. The current software is only secured by "security by obscurity". Changing to Linux would also enable servers to boot much faster. According to Minnich, booting an Open Compute Project (OCP) Server takes eight minutes thanks to MINIX's primitive drivers. With Linux it…

Yes, it's complete FUD. It's also moot, because it really doesn't matter much whats in ME, ME just needs to not exist. The primary reason for choosing MINIX is memory footprint and reliability, additionally GNU is never popular for proprietary blobs like this... it would actually harm users with ME's current strategy if you think about it, GNU forces them to publish their likely buggy striped down version of linux, y…

> additionally GNU is never popular for proprietary blobs like this... it would actually harm users with ME's current strategy if you think about it, GNU forces them to publish their likely buggy striped down version of linux

I don't know whether Intel ME contains the usual userland tools that are typical for UNIX-like operating systems. But it is well-known that a lot of MINIX 3's userland was taken/ported from NetBSD, as the MINIX 3 developers openly admit: http://wiki.minix3.org/doku.php?id=developersguide:portingne...

Re: MINIX: Intel's hidden in-chip operating system

#93

Post by dis-sys » Tue, Nov 07, 2017, 4:33 PM UTC

It is another proof that Andrew Tanenbaum should be awarded the Turning Award - all those privacy & security issues aside (as he is not involved in the deployment, he was not even told for the deployment), his Minix positively influenced an entire generation of software engineers and now it is proven to be practical in such a world scale deployment.

Re: MINIX: Intel's hidden in-chip operating system

#94

Post by jabl » Tue, Nov 07, 2017, 4:36 PM UTC

JepZ wrote: post #23

While I am unsure if switchting to Linux for ME is a good solution, open sourcing whatever runs ME is a very important step towards user/customer security. And that is not because we all want to know intels secrets about 'how to make the fastest CPU' but because ME can change the product on a fundamental level while we use the product. The reason I doubt that Linux is a good solution is that linux wasn't built to run…

> While I am unsure if switchting to Linux for ME is a good solution

FWIW, this is NOT at all the goal of the NERF project that this zdnet article talks about. So what the idea is roughly:

- Remove or disable the ME as much as possible (impossible to do 100% since e.g. the ME is responsible for booting up the main CPU, but it appears you can remove a large part of it)

- Replace the upper levels of the UEFI firmware stack and the bootloader with Linux + a minimal userspace written in Go (u-root).

See https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit... for more details.

Re: MINIX: Intel's hidden in-chip operating system

#95

Post by cperciva » Tue, Nov 07, 2017, 5:02 PM UTC

cure wrote: post #81

tsujamin wrote: post #19

" What Minnich would like to see happen is for Intel to dump its MINIX code and use an open-source Linux-based firmware. This would be much more secure. The current software is only secured by "security by obscurity". Changing to Linux would also enable servers to boot much faster. According to Minnich, booting an Open Compute Project (OCP) Server takes eight minutes thanks to MINIX's primitive drivers. With Linux it…

This article is not FUD and crap. The source of the numbers quoted is here: https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit... I know Ron Minnich. He is one of the founders of the coreboot project. He's been at this (replacing proprietary firmware with a free software alternative) for a very long time and he knows what he is talking about.

But... replacing Minix with Linux wouldn't be replacing proprietary code with a free alternative. It would be replacing free software with a less free alternative.

Re: MINIX: Intel's hidden in-chip operating system

#96

Post by monocasa » Tue, Nov 07, 2017, 5:08 PM UTC

userbinator wrote: post #45

turblety wrote: post #40

While the backdoor and surveillance arguments are good, and the chips are very likely backdoored (if not deliberately then by undetected bugs) there are other issues with this closed source firmware. Let's say another bug [1] is found that lets anyone remotely control your computer, but Intel becomes bankrupt, or just doesn't see it as a big enough threat to roll out a firmware update. You then essentially have a com…

The fact that it's closed source is not actually the biggest problem --- it's the fact that the hardware completely refuses to run firmware that's not signed by Intel, and Intel is not giving you the keys or any other way out. Intel could open-source the firmware, but without any way to use it on the hardware, it'd be useless for anything but finding exploits --- arguably an even worse position. See also https://en.w…

Hence why GPLv3 and it's anti-Tivoization clause is so important.

Re: MINIX: Intel's hidden in-chip operating system

#97

Post by msla » Tue, Nov 07, 2017, 5:14 PM UTC

turblety wrote: post #40

While the backdoor and surveillance arguments are good, and the chips are very likely backdoored (if not deliberately then by undetected bugs) there are other issues with this closed source firmware. Let's say another bug [1] is found that lets anyone remotely control your computer, but Intel becomes bankrupt, or just doesn't see it as a big enough threat to roll out a firmware update. You then essentially have a com…

Moreover, Intel could selectively release patches for only the newer chips, providing an incentive to upgrade.

Intel deliberately creating such holes and then only fixing them on more expensive models would be possible as well, but the PR from that one might be distasteful enough to hurt Intel.

Re: MINIX: Intel's hidden in-chip operating system

#98

Post by Crespyl » Tue, Nov 07, 2017, 5:15 PM UTC

jlebrech wrote: post #78

akoncius wrote: post #60

Earlier quoted context omitted.

for example where?

AMD?

AMD processors now include PSP/TrustZone.

Re: MINIX: Intel's hidden in-chip operating system

#99

Post by cjsuk » Tue, Nov 07, 2017, 5:34 PM UTC

sfifs wrote: post #87

cjsuk wrote: post #13

Earlier quoted context omitted.

SPARC was the solution. It's open and royalty free and was sold by multiple vendors. Add to that Open Firmware and you're done. It's also not the hacked up turd that x86-64 is or the fragmented mess that ARM is. Problem is it's dead. Going out on a limb here, but we can solve this with another layer of abstraction in the long term. We need to develop a fully portable open source virtual machine model (think p-code ma…

wasn't Java supposed to be precisely that?

Yes I suppose it was.

Re: MINIX: Intel's hidden in-chip operating system

#100

Post by fencepost » Tue, Nov 07, 2017, 6:04 PM UTC

turblety wrote: post #40

While the backdoor and surveillance arguments are good, and the chips are very likely backdoored (if not deliberately then by undetected bugs) there are other issues with this closed source firmware. Let's say another bug [1] is found that lets anyone remotely control your computer, but Intel becomes bankrupt, or just doesn't see it as a big enough threat to roll out a firmware update. You then essentially have a com…

> When the next massive security bug is found (which is inevitable with all code, open source or closed) you are left essentially with 10k unusable laptops.

While this is less useful for devices going outside the network (e.g. the laptops you mention), I suspect that the big enterprise response is going to have to be smarter networks. I can easily picture high end fully managed switches becoming more like firewalls, possibly even to the stage of deep packet inspection for recognized patterns.

Not having worked with this, does the ME get its own IP or piggyback looking for particular patterns in packets? And how feasible is it to detect by testing for missing packets (or spurious ones if they're received and passed through?)