Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

121–130 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#121

Post by LeoPanthera »

alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

> no longer allowing you to run Linux

Is this actually true? openSUSE is supplied with a shim bootloader apparently signed with Microsoft's keys, allowing the OS to boot on any machine with Secure Boot enabled.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#122

Post by monocasa »

YXNjaGVyZWdlbgo wrote: post #118
monocasa wrote: post #115

Earlier quoted context omitted.

I'm a security researcher. PSB as described there is orthogonal to the specific policy of tying the board to a specific CPU key, as you can tell from per CPU keys not being in the hardware root of trust as described by cloudflare. In fact you can swap the CPUs across boards from different ODMs in your most recent citation, since the root is an AMD key that then verifies the off chip ODM cert in flash. I stand by my o…

If you really think PSB doesn't provide any security benefit or "improves security in a meaningful way" you should do more security research.

I was pretty sure that I made it clear that the concept under discussion was using a hardware root of trust scheme like PSB to tie a specific CPU to a particular vendor's boards.

As an aside I'm putting a lot of effort into staying civil; I'd appreciate seeing that effort be a bit more reciprocal.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#123

Post by userbinator »

judge2020 wrote: post #84
alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

> RISCV architecture (a free architecture that doesn't include that shit) Surely you can't think the architecture itself is the differentiator. x86 didn't have all of this security 20 years ago, give engineers a few years of time to throw some locks on a risc-v chip and it'll be Enterprise Ready™ in no time.

With the (already?) expiration of x86 patents, I'd love to see a "pure" x86 implementation without any of the user-hostile crap, and see how far the community can take it; but sadly, the RISC bandwagon is diverting attention away from that.

A CPU without the user-hostile features but still able to run the massive existing software base would be ideal.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#124

Post by supernovae »

smoldesu wrote: post #117
Godel_unicode wrote: post #105

Earlier quoted context omitted.

> ...the government had no problem forcing them to both add IME/PSP. This is a false narrative, these management engines were added because large (corporate) customers of the major CPU vendors asked for them. Enterprise IT shops love stuff like this, anything to help them tame the unruly beast of asset inventory and management. This is the same reason things like iLO and DRAC exist, and they have all of the same type…

Why are management engines not delegated to professional/enterprise machines only then? Seems like an awful lot of money to waste putting specialized hardware into every machine you ship if only a fraction of the users will actually ever take advantage of it.

economy of scale. Cheaper by volume and priced on utilization.

There was a time when HP sold servers that could be up to say, 8 cores but only two were on by default and you cloud license the rest. It was cheaper to shop the hardware and software gate it rather than limit it and have a process in the middle.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#126

Post by userbinator »

hoppyhoppy2 wrote: post #67
aasasd wrote: post #36

Someone still buys Lenovo?

Perhaps not in your social bubble, but Lenovo is the world's largest personal computer manufacturer by market share, with just under 25% of the world's computer sales (measured by number of units shipped)

There is much irony in still calling it a "personal" computer...

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#127

Post by alerighi »

judge2020 wrote: post #84
alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

> RISCV architecture (a free architecture that doesn't include that shit) Surely you can't think the architecture itself is the differentiator. x86 didn't have all of this security 20 years ago, give engineers a few years of time to throw some locks on a risc-v chip and it'll be Enterprise Ready™ in no time.

RISCV is an open architecture. If a manufacturer does that, simply don't buy the processor from that manufacturer and buy it from another. All your software will still be compatible since it's the same architecture.

Otherwise with x86 is more complex: you can choose between Intel and AMD (that has bought the license for the x86 instruction set - not something cheap to get), and both of them had their backdoor processor inside the computer (at least on Intel there are ways to disable it, as far as I know with AMD is more difficult if not impossible to do).

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#129

Post by robocat »

mjevans wrote: post #111
judge2020 wrote: post #101

Earlier quoted context omitted.

the prompt: https://twitter.com/FedsAgainstGunS/status/14734795248054927...

Thank you for the screencap, I wasn't about to watch a video to discover this. 1) It's WAY WAY too easy for someone to not really read this and just press Y to continue, like load setup defaults. 2) There should _not_ be a way of disabling the prompt (the popup even mentions you can do this.) 3) If ever there were a time for a simple math problem (like multiply two numbers and enter the result) to indicate a user had…

> There should _not_ be a way of disabling the prompt (the popup even mentions you can do this.)

I think you are mistaken. I am presuming that the prompt is suggesting that you can disable the PSB security feature (in which case the prompt doesn’t show, which seems very sensible).

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#130

Post by amelius »

hoppyhoppy2 wrote: post #67
aasasd wrote: post #36

Someone still buys Lenovo?

Perhaps not in your social bubble, but Lenovo is the world's largest personal computer manufacturer by market share, with just under 25% of the world's computer sales (measured by number of units shipped)

And Apple at 9%.
Post reply on HN