Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel patches new ME vulnerabilities

blog.ptsecurity.com

Post reply on HN
Print view View original

321–330 of 337 posts

Re: Intel patches new ME vulnerabilities

#321

Post by michaelmrose »

pjmlp wrote: post #315
michaelmrose wrote: post #313

Earlier quoted context omitted.

Nvidia has historically supported new drivers/Xorg for old hardware for aprox 10 years whereas amd/ati cards still available at retail have been unsupported in as little as 3 years time leaving you with open source drivers as your only other option if you want to install a new version of your distro with your older hardware. The fact that they are open source is of course a good thing whats not is that they were at o…

I know Linux since Slackware 2.0, so I am quite used to these issues regarding graphics cards, including the fun days of manually writing my own xorg.conf file. Eventually one gets fed up and wants the laptop just to work.

Tried buying ones that come with linux? Alternatively stuff known to work well with linux like thinkpads?

Re: Intel patches new ME vulnerabilities

#322

Post by watersb »

NullPrefix wrote: post #286
watersb wrote: post #245

Earlier quoted context omitted.

My Ivy Bridge laptop uses twice the power as my Apollo Lake laptop. Literally 2x.

Apollo is Atom, isn't it? So it's not apples to apples. I'm pretty sure there were sub 10W SoC for some years before Ivy bridge.

Yes, Apollo Lake is an Atom SoC. While I am doing simple web development, performance is about the same. Mostly lacking RAM versus older, Core platforms.

But all-up, Windows 10 at 6 Watts. Including the display, storage, the whole system — or so the performance counters on the battery tell me.

Re: Intel patches new ME vulnerabilities

#323

Post by CamperBob2 »

TomMarius wrote: post #320
michaelmrose wrote: post #312

Earlier quoted context omitted.

Servers are "safely" operable until they die. The failure mode is that the machine stops operating. If your system has redundancy built in it keeps working possibly at reduced capacity. If not it stops. If its essential that service not be interrupted you build in redundancy and ensure that it fails in a safe way if it does. I'm not sure where safety or insurance comes into this discussion at all. People upgrade soon…

No, we literally upgrade because it's cheaper than the billions in damages.

Just curious, are you familiar with a concept in the quality/reliability field known as the "bathtub curve?"

Re: Intel patches new ME vulnerabilities

#324

Post by TomMarius »

CamperBob2 wrote: post #323
TomMarius wrote: post #320

Earlier quoted context omitted.

No, we literally upgrade because it's cheaper than the billions in damages.

Just curious, are you familiar with a concept in the quality/reliability field known as the "bathtub curve?"

Yes. I guess that you're trying to point at us increasing the early failure rate, right? We're insured against that. We can't insure ourselves against the right part of the curve.

Re: Intel patches new ME vulnerabilities

#325

Post by namibj »

detaro wrote: post #88
namibj wrote: post #76

Earlier quoted context omitted.

No, the Xeon Phi "accelerators" are usable too, they are basically 486 cores on modern litography (to allow for higher density/clock speeds), with a vector unit attached to them. I don't know how hard it would be to boot linux on one though...

Only the first generation (X100 model numbers). If I remember right they ship with Linux already, but need a host system to run in of course.

This host system should be not much more than a PCIe root emulator though. This is the level one can get on an e.g. FPGA with custom logic, which implies that any attempts to insert hardware/firmware level attacks into the actual logic you care about is near impossible to do due to the low-level nature of the custom PCIe implementation.

Re: Intel patches new ME vulnerabilities

#326

Post by 153791098c »

confounded wrote: post #316
confounded wrote: post #314

Earlier quoted context omitted.

Thank you for this information! I’m interested in something like this (though maybe not as beefy) for self-hosting. Are there any companies that sell the gear you describe, or guides/wikis on getting set up?

Answering my own question, suppliers of boards are available on the FSF's site (these are the boards which the FSF use themselves): https://fsf.org/ryf

Yes that's a good starting point. And a great option if you have the money for it. This will also support the people that put in hard work to achieve and provide ultimate user freedom.

If you are on a tight budget however i recommend buying the motherboard on aliexpress (for about $200) and if you are not comfortable in flashing libreboot yourself you can ask a company that delivers bios chips for this motherboard to flash a custom bios and supply the libreboot rom binary to them. You can easily swap the bios chips yourself. The libreboot and coreboot websites have lists of hardware that are compatible (ram/cpu).

Also if you are interested in newer liberated hardware, look into the Talos II. They provide a proper workstation that comes with only free software. It will be more difficult to setup since it has a different cpu architecture, but it is definitely the way forward.

Re: Intel patches new ME vulnerabilities

#327

Post by close04 »

mmt wrote: post #317
close04 wrote: post #272

Earlier quoted context omitted.

Oh I'm sure some companies do it. Whatever it is you can be certain someone is doing it :). But it's nowhere near being a rule in Europe. And TBH replacing servers after 2 years because you're worried about uptime feels like a horrible overreaction and self harming at the same time. Servers that are meant to provide 99.999% uptime (so 5 nines or above, or maximum 6min downtime per year) are built to run for far longe…

> And TBH replacing servers after 2 years because you're worried about uptime feels like a horrible overreaction and self harming at the same time. I agree. Such a tactic, in the face of modern high-availability systems design (including the notion of servers being "cattle not pets"), seems actively harmful, other than, perhaps, introducing a something akin to Netflix's "chaos monkey" into the system. I could underst…

That's how I interpreted "uptime really matters". Those systems are definitely built to last.

But even going some orders of magnitude lower about, 85% of x86 servers achieve at least 99.95% availability according to statistics [1].

[1] https://www.statista.com/statistics/515441/worldwide-survey-...

Re: Intel patches new ME vulnerabilities

#328

Post by mmt »

close04 wrote: post #327
mmt wrote: post #317

Earlier quoted context omitted.

> And TBH replacing servers after 2 years because you're worried about uptime feels like a horrible overreaction and self harming at the same time. I agree. Such a tactic, in the face of modern high-availability systems design (including the notion of servers being "cattle not pets"), seems actively harmful, other than, perhaps, introducing a something akin to Netflix's "chaos monkey" into the system. I could underst…

That's how I interpreted "uptime really matters". Those systems are definitely built to last. But even going some orders of magnitude lower about, 85% of x86 servers achieve at least 99.95% availability according to statistics [1]. [1] https://www.statista.com/statistics/515441/worldwide-survey-...

I'm just wondering if "those systems" include any present-day x86 servers. If not, then it's safe to say they're a red herring, since this whole discussion is based on an article about, specifically, Intel CPUs.

Re: Intel patches new ME vulnerabilities

#329

Post by michaelmrose »

TomMarius wrote: post #320
michaelmrose wrote: post #312

Earlier quoted context omitted.

Servers are "safely" operable until they die. The failure mode is that the machine stops operating. If your system has redundancy built in it keeps working possibly at reduced capacity. If not it stops. If its essential that service not be interrupted you build in redundancy and ensure that it fails in a safe way if it does. I'm not sure where safety or insurance comes into this discussion at all. People upgrade soon…

No, we literally upgrade because it's cheaper than the billions in damages.

How would you incur billions in damages?

Your cpu is probably fit for 10-20 years of service. Every other part of your computer will fall down around it first.

Re: Intel patches new ME vulnerabilities

#330

Post by close04 »

mmt wrote: post #328
close04 wrote: post #327

Earlier quoted context omitted.

That's how I interpreted "uptime really matters". Those systems are definitely built to last. But even going some orders of magnitude lower about, 85% of x86 servers achieve at least 99.95% availability according to statistics [1]. [1] https://www.statista.com/statistics/515441/worldwide-survey-...

I'm just wondering if "those systems" include any present-day x86 servers. If not, then it's safe to say they're a red herring, since this whole discussion is based on an article about, specifically, Intel CPUs.

I now see that the content is behind a paywall but the title is still visible. It's a statistic for 2017/2018:

> Share of servers with four or more hours of unplanned downtime due to hardware flaws worldwide in 2017/2018, by hardware platform

Systems like IBM's System Z had 0 servers with more than 4 hours unplanned downtime over this period. At the other end Cisco and Fujitsu x86 servers had ~16% of servers experiencing 4 or more hours of unplanned downtime over the period.

We can infer that the vast majority of the x86 machines will be Intel considering AMD's market share in the server space.

P.S. The article is about Intel's ME flaws and patches so probably our whole discussion branched off in the wrong direction :).

Post reply on HN