Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is the latest Intel hardware unsupported in libreboot? (2017)

libreboot.org

Post reply on HN
Print view View original

51–60 of 132 posts

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#51

Post by jchw »

ajxs wrote: post #34

I'll preface this question with the disclaimer that I'm a true believer in the mission of Coreboot/Libreboot. Playing devil's advocate, if Intel were to release the signing key for the ME, or Intel Boot Guard, wouldn't this increase the likelihood of a malicious vendor preinstalling a rootkit in hardware that uses Intel CPUs? To answer in advance regarding the likelihood of this happening. There's already been enough…

Any big corporation with security competence is going to seriously care about the security of their corporate and production fleet; the stakes for securing systems only ever increases over time, and threats are only getting more sophisticated. So you don’t necessarily need to believe in the altruism of a corporation to see why their interest in secure computing at lower levels of the stack may actually line up with user’s interests more or less.

But honestly, the best argument here is don’t trust anyone; In theory anyone can inspect the source code and binaries for Corebooted devices. It’s not perfect and there’s obviously cases where you can never be 100% sure there’s no tricks, but IMO it’s still a lot better than the alternative of having roughly the same drawbacks but no visibility.

I’m not sure where this fits in in the grand scheme of things though, because in all honesty trust in computing seems like it’s an unending rabbit hole ripe for abuse. Intel ME may even have been born with genuinely good intentions, but I do think it’s secretive, blackbox nature is the absolute worst part of it all.

(Obligatory disclaimer, I work for Google, all of these opinions are just my personal opinions.)

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#52

Post by callekabo »

Scrolling up they recommend avoiding Purism hardware because

> In particular, the Intel Management Engine is a severe threat to privacy and security, not to mention freedom, since it is a remote backdoor that provides Intel remote access to a computer where it is present.

However, the Intel ME has been disabled in Purism hardware since 2017.

https://puri.sm/posts/purism-librem-laptops-completely-disab...

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#53

Post by Neil44 »

tinus_hn wrote: post #7

Realistically if some party made use of these backdoors regularly someone would probably have noticed the traffic already.

I was thinking that, but if I was being smart about it I’d loop the traffic back through localhost and out of an innocent ssl connection.

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#54

Post by bubblethink »

ajxs wrote: post #34

I'll preface this question with the disclaimer that I'm a true believer in the mission of Coreboot/Libreboot. Playing devil's advocate, if Intel were to release the signing key for the ME, or Intel Boot Guard, wouldn't this increase the likelihood of a malicious vendor preinstalling a rootkit in hardware that uses Intel CPUs? To answer in advance regarding the likelihood of this happening. There's already been enough…

>wouldn't this increase the likelihood of a malicious vendor preinstalling a rootkit ?

Vendors already fuse their keys using bootguard. So if they want to install rootkits, they can do that now. Lenovo already did that with superfish. Bootguard doesn't make any assurances about the quality of the bios. It just says to the consumer that this machine's bios came from the vendor. Sort of like the https padlock.

I think what you mean to ask is how we could ensure the integrity of the boot flow up to the OS without bootguard. It can be done higher up in the stack. Chromebooks do it pretty well. There are other projects like heads that do it as well. Your chain of trust needs to extend into the OS for it to be meaningful.

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#55

Post by davidovitch »

pmlnr wrote: post #29

Reading this always makes me sad. It's like computing got utterly corrupted post-2008 and there's yet to be a fix. The tragedy of all this is that a 2008 laptop should be more than enough for today's needs if web development wasn't greedy and was resource aware.

There are modern alternative systems with an open firmware stack, for example the Talos II running Power9. Granted, it is not available as a cheap, slick and slim power efficient laptop, but it is real, only twice as expensive and very capable. https://en.m.wikipedia.org/wiki/POWER9

See performance benchmarks incomparison with AMD/Intel at: https://www.phoronix.com/scan.php?page=article&item=power9-t... https://www.phoronix.com/scan.php?page=article&item=power9-t...

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#56

Post by Iolaum »

ajxs wrote: post #34

I'll preface this question with the disclaimer that I'm a true believer in the mission of Coreboot/Libreboot. Playing devil's advocate, if Intel were to release the signing key for the ME, or Intel Boot Guard, wouldn't this increase the likelihood of a malicious vendor preinstalling a rootkit in hardware that uses Intel CPUs? To answer in advance regarding the likelihood of this happening. There's already been enough…

The ask is not to allow users to install firmware with the vendor's key but with their own key.

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#58

Post by Deukhoofd »

callekabo wrote: post #52

Scrolling up they recommend avoiding Purism hardware because > In particular, the Intel Management Engine is a severe threat to privacy and security, not to mention freedom, since it is a remote backdoor that provides Intel remote access to a computer where it is present. However, the Intel ME has been disabled in Purism hardware since 2017. https://puri.sm/posts/purism-librem-laptops-completely-disab...

Pretty sure that write up was done around 2009

Re: Why is the latest Intel hardware unsupported in libreboot? (2017)

#59

Post by ekianjo »

callekabo wrote: post #52

Scrolling up they recommend avoiding Purism hardware because > In particular, the Intel Management Engine is a severe threat to privacy and security, not to mention freedom, since it is a remote backdoor that provides Intel remote access to a computer where it is present. However, the Intel ME has been disabled in Purism hardware since 2017. https://puri.sm/posts/purism-librem-laptops-completely-disab...

See this https://blogs.fsfe.org/tobias_platen/2015/09/22/why-i-wont-b...
Post reply on HN