Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

91–100 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#91

Post by kube-system »

jacquesm wrote: post #82
kube-system wrote: post #81

Earlier quoted context omitted.

I disagree. Market targeting, segmentation, and consumer preferences are real things which can be and are routinely measured.

That's agreement, not disagreement.

I am saying that the market for people who care about these types of things is objectively niche. Large manufacturers build what they build because they fund the research to know what to build. And they are successful at selling them because they were correct.

There might be billions of people buying computers, but the set that has any opinion on boot code signing requirements is not large enough to cause any significant impact on the market as a whole.

There are companies that cater to these niche markets, like Pine/Framework/System76/Purism. They are tiny. Dell sells more computers in a single contract than all of these other companies have sold over their entire existence combined.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#92

Post by [deleted] »

mjevans wrote: post #33

How is it not illegal to do this without at least first ASKING the user for confirmation? I'd be annoyed but find it 'merely anti-consumer' rather than 'intentional destruction of property' if the BIOS refused to finish POST without the user confirming that yes, they want to sacrifice this CPU and make it (p)owned by $CORP.

[deleted]

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#94

Post by BoorishBears »

fartcannon wrote: post #77
BoorishBears wrote: post #69

Earlier quoted context omitted.

Trusted computing environments only hurt 1% of the users anyways. We live in a world where people talk about Thinkpads vs Macbook Pros, but for 99% of the world laptops are appliances they buy like we'd buy a toaster. They don't care that they can't run Linux, if anything onerous code signing requirements ala mobile devices would be great for the safety of their devices with minimal effects on what they can do. - I'm…

The hypothetical homogeneous group 'they' you refer to doesn't exist. It's billions of people and 'they' feel many ways. By painting with a common brush, you shut down discussions of what could be and encourage fence sitters to give up. Let's talk about why it's possible, easy to do, and how to do it. The more fence sitters you convince that things are possible, pushes the fence further and further towards the other…

This is very feel good but falls short of making an actual point.

> The hypothetical homogeneous group 'they' you refer to doesn't exist

They do exist. Making wrong statements with conviction doesn't make it true.

You can look Chromebook sales figures, you can look at the best selling laptops at major retailers, you can look at what's driving record laptop sales, look at price points that are soaring, look at the mobile space...

-

> It's billions of people and 'they' feel many ways.

Which is why we draw conclusions based on a large sample size like I did above. You're never going to be able to consider billions of points of view, so yes, you need to try and find the common thread in their preferences and usages.

-

> By painting with a common brush, you shut down discussions of what could be and encourage fence sitters to give up.

No, by painting with a common brush, you can have actual useful discussions about the reality of things, rather than espousing your own personal whims.

-

> Let's talk about why it's possible, easy to do, and how to do it.

a) Where did my comment say it's impossible?

b) It's not easy to do or it wouldn't have existed in the first place. The whole point of my comment is saying that you need to figure out how to do it taking the current reality of things into context.

If the world thought how HN does we'd already have bills banning IME and PSB. So it doesn't. You can't pretend that people actually are a little nudge away from caring about this, or you'll quickly find that you're wrong and nothing will have actually changed.

-

> The more fence sitters you convince that things are possible, pushes the fence further and further towards the other side.

Again, what you could do if you believed that fence sitters were some large portion of laptop buyers is do what I've done, show some indications of this. Show us how niche efforts aimed at power users aren't the only rumblings about how awful locked down computing is.

What you're doing is still painting a group with a large brush, except you're not even showing us where you got the paint.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#95

Post by mjrpes »

vetinari wrote: post #47
iratewizard wrote: post #35

Earlier quoted context omitted.

My first thought was, is it really a big deal to do that to your laptop's cpu? Then I saw that they're doing this to desktops. My next thought was, people buy pre-built desktops still? Still really concerning to see Lenovo make boneheaded moves like this when they've had one of the better track records for manufacturers.

> My next thought was, people buy pre-built desktops still? If you are enthusiast and need a one or two desktops, then probably not. If you need to procure several hundred of them every few months, then probably yes. What this definitely will do is to affect the market price of these desktops once the lease (or depreciation time) runs out and owner will try to unload them on second hand market.

How does this affect the 2nd hand market? Will the buyer not be able to use the desktop?

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#96

Post by monocasa »

newsclues wrote: post #59
monocasa wrote: post #55

Earlier quoted context omitted.

CPUs being backdoored is orthogonal to this.

The security processor is a black box. If the nsa wants a back door, could this functionality not be the justification for the security weakness created by installing the security processor? It’s what I’d do..,

The security processor is there and starting the boot process whether or not it's checking a per CPU key on die.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#97

Post by contravariant »

vel0city wrote: post #23
AnotherGoodName wrote: post #3

Could it be AMDs doing behind the scenes? I don't see the motivation for Lenovo here but I do see AMD asking vendors to do this to prevent OEM CPUs completing with retail CPUs.

The motivation from Lenovo's customer perspective is theoretically the customer knows this was the processor intended for the machine by Lenovo and nobody swapped it out in between the Lenovo factory and the customer's hands. Of course, no system is perfect so it's not a full guarantee and also there's the impact to the secondary market. But if you're an enterprise leasing these machines you don't care about the seco…

I suppose that's helpful if you trust Lenovo.

I've permanently lost trust in them after they decided to include malicious root certificates in their systems.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#98

Post by vetinari »

mjrpes wrote: post #95
vetinari wrote: post #47

Earlier quoted context omitted.

> My next thought was, people buy pre-built desktops still? If you are enthusiast and need a one or two desktops, then probably not. If you need to procure several hundred of them every few months, then probably yes. What this definitely will do is to affect the market price of these desktops once the lease (or depreciation time) runs out and owner will try to unload them on second hand market.

How does this affect the 2nd hand market? Will the buyer not be able to use the desktop?

Cannot be bought as s source of spare parts, that you might use in different computers. At least not CPUs.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#99

Post by monocasa »

YXNjaGVyZWdlbgo wrote: post #80
captainmuon wrote: post #76

Earlier quoted context omitted.

That link doesn't explain how it improves security, as all mainboards of the vendor have the same key. All it does is prevent somebody from sneakily replacing the mainboard with a different brand! It would make more sense if the board was bound to the specific CPU (assuming the CPU is the root of trust). But then you could just encase it in some kind of thermal epoxy... It's obvious that this is supposed to limit the…

If you read the two pages and you concluded that both AMD with their statement on Page 1 nor servethehome on Page 1 and Page 2 provided any information about how PSB works I can't help you.

Or that commenter read and understood the description of how it works, and failed to see how it increases security in a meaningful way. I also struggle to think of a threat model that this protects against.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#100

Post by wmf »

akelly wrote: post #90
NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

Good analysis. My question is wouldn't it be both more secure and more user friendly to burn the BIOS signing public keys into the motherboard chipset instead of the CPU?

This is basically what Google Titan does. Most vendors don't want to add an additional root of trust chip (and I'm not sure there are any good ones available to buy).
Post reply on HN