Live data from Hacker News

MINIX: ​Intel's hidden in-chip operating system

zdnet.com

31–40 of 113 posts

Re: MINIX: ​Intel's hidden in-chip operating system

#31
post #26
post #13

Earlier quoted context omitted.

SPARC was the solution. It's open and royalty free and was sold by multiple vendors. Add to that Open Firmware and you're done. It's also not the hacked up turd that x86-64 is or the fragmented mess that ARM is. Problem is it's dead. Going out on a limb here, but we can solve this with another layer of abstraction in the long term. We need to develop a fully portable open source virtual machine model (think p-code ma…

> Problem is it's dead. and if it's so good, why is sparc dead?

Big endian, not enough suppliers, Oracle, too expensive, not enough market share and much more

Re: MINIX: ​Intel's hidden in-chip operating system

#32
post #23

While I am unsure if switchting to Linux for ME is a good solution, open sourcing whatever runs ME is a very important step towards user/customer security. And that is not because we all want to know intels secrets about 'how to make the fastest CPU' but because ME can change the product on a fundamental level while we use the product. The reason I doubt that Linux is a good solution is that linux wasn't built to run…

[deleted]

Re: MINIX: ​Intel's hidden in-chip operating system

#33
It would be interesting to know the HFT attitude on this. How many nanoseconds can you shave off of your trades with ME removed?

It seems like throws a spanner in the face of the unikernel / kernel bypass approach of getting closer to the metal, when your CPU can be directly running a web server(!) without your control.

Re: MINIX: ​Intel's hidden in-chip operating system

#34
post #11

So if switching to AMD is NOT the solution, what is? ARM? For your portable needs there is: https://puri.sm/posts/purism-librem-laptops-completely-disab...

AMD PSP is efficiently ARM tech called TrustZone so I would expect most of SOC to have own backdoors as well. So far only option is POWER-based systems and they're costly.

Pre-PSP AMD CPUs are an option.

Re: MINIX: ​Intel's hidden in-chip operating system

#35

Earlier quoted context omitted.

Yeah but at least you have a chance to find the backdoors.

It is possible find backdoors in closed source software. Check the Cisco story.

Yeah but at least you have a better chance to find the backdoors. ;-)

Re: MINIX: ​Intel's hidden in-chip operating system

#36

It would be interesting to know the HFT attitude on this. How many nanoseconds can you shave off of your trades with ME removed? It seems like throws a spanner in the face of the unikernel / kernel bypass approach of getting closer to the metal, when your CPU can be directly running a web server(!) without your control.

None. ME isn't running on the CPU.

It's possible that ME initiates memory access that clogs the bus, though.

Re: MINIX: ​Intel's hidden in-chip operating system

#37

So if switching to AMD is NOT the solution, what is? ARM? For your portable needs there is: https://puri.sm/posts/purism-librem-laptops-completely-disab...

It's good to note that you still have mysterious chunks of blobs with newer laptops (including the purism one), also thanks to Intel - that's Intel FSP, that does the initialization for the processor and the memory.

Second, all system since about....2007 (?) have a Intel ME ROM burned inside the chipset, so there's no telling what is still running there, and what exactly is capable of.

Re: MINIX: ​Intel's hidden in-chip operating system

#38

So if switching to AMD is NOT the solution, what is? ARM? For your portable needs there is: https://puri.sm/posts/purism-librem-laptops-completely-disab...

ARM is an option as long as you have control over the TrustZone code, and some manufacturers give that to you. You'd probably have to rule out the large SoC vendors, though.

Re: MINIX: ​Intel's hidden in-chip operating system

#39
post #29
post #17

Earlier quoted context omitted.

For desktop your options are: — FX 8350 (Piledriver) from AMD with no PSP: very cheap, no flashing necessary, but not the best performance. Single core performance much worse than even Pentium G4620[1]. — Some Intel processors and a Raspberry Pi: much better performance but you have to ME_Clean the firmware, hence the Pi. — POWER9 processor for amazing performance and completely open & free firmware all around: the C…

> Personally I recommend IvyBridge-EP or Haswell Xeon E5 Err, the ME has been present on every Intel system since 2006 or so. The only thing that changed with Skylake is that the ME runs on an x86 core, on previous processors the ME ran on some RISC microcontroller.

Not just any RISC, but ARC, a descendant of the SNES's Super-FX chip

Re: MINIX: ​Intel's hidden in-chip operating system

#40
While the backdoor and surveillance arguments are good, and the chips are very likely backdoored (if not deliberately then by undetected bugs) there are other issues with this closed source firmware.

Let's say another bug [1] is found that lets anyone remotely control your computer, but Intel becomes bankrupt, or just doesn't see it as a big enough threat to roll out a firmware update. You then essentially have a computer that you can't use, due to the fact it's not secure and anything done on it could be compromised.

Maybe not a massive deal for the average home user who would just buy another laptop. But let's say a large company buys 10k laptops all with an Intel chip inside it. Then Intel goes bankrupt, becomes incompetent (i.e. can not resolve bugs), refuses to upgrade firmware, or something else. When the next massive security bug is found (which is inevitable with all code, open source or closed) you are left essentially with 10k unusable laptops.

If the code was open sourced, the large company could pay someone else to fix the problem, or what's more likely is someone in the open source community would fix it for us.

The fact you have another processor running beside your main one, that has full access to everything you do without your permission, knowledge or ability to stop it should worry everyone. Even if there are no backdoors or bugs in the code right now, it's a very dangerous precedent to set that we buy hardware we can not control. Maybe one day Intel decides to put an expiry date in their chips, or some DRM to prevent you watching certain content without a license. These restrictions can't be good for society in the long term, can they?

But the biggest problem should be for large companies and corporations. They are putting the faith of their own business into Intel, which like all businesses could one day fail, big time.

1. https://www.intel.co.uk/content/www/uk/en/architecture-and-t...

Post reply on HN