I wonder if Right to Repair legislation would help us with this.
Why is the latest Intel hardware unsupported in libreboot? (2017)
61–70 of 132 posts
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#62I'll preface this question with the disclaimer that I'm a true believer in the mission of Coreboot/Libreboot. Playing devil's advocate, if Intel were to release the signing key for the ME, or Intel Boot Guard, wouldn't this increase the likelihood of a malicious vendor preinstalling a rootkit in hardware that uses Intel CPUs? To answer in advance regarding the likelihood of this happening. There's already been enough…
Any big corporation with security competence is going to seriously care about the security of their corporate and production fleet; the stakes for securing systems only ever increases over time, and threats are only getting more sophisticated. So you don’t necessarily need to believe in the altruism of a corporation to see why their interest in secure computing at lower levels of the stack may actually line up with u…
Is Google at risk because of this? I have consolidated all my private stuff to only Google instead of spreading it all over FB, MS, Apple, and other vendors.
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#63AMD's in a similar boat, if you scroll a bit further down too :(
Yea, that was disappointing indeed. After reading the first several paragraphs, I was hoping that the answer would be get an AMD processor instead of Intel , but nope. I hope that in the future some manufacturer(s) start making fully open source verifiably secure RISC-V (or ARM) processors, and that we have a migration over to that.
Feel free to call it a conspiracy theory, but I firmly believe the IME/PSP is an operation by one of those three letters.
Intel Management Engine is abbreviated as IME, and AMD Platform Security Processor is abbreviated as PSP. Those are each same abbreviation as Input Method Editor, a mandatory keyboard input layer for East Asian languages, and PlayStation Portable, Sony’s game console which cryptographic security is famously hacked, by the way.
That can’t be coincidence. Those are names intentionally chosen to make technical information hard to search for.
So a “clean” CPU can only be built outside of sphere of influence of whichever agency managing IME/PSP, and of course has to be free from its Red counterparts as well. I don’t think that will happen naturally.
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#64By now, it's probably reasonable to assume that NSA, GCHQ, the FSB, the Third Department, and Mossad can all use that backdoor.
Really? I am curious to know what observations or evidence you base your arguments/predictions on? Do you believe they have an (even better than 'post-Snowden leaks') search-engine like PRISM, but for private networks all around the world?
Could a user tell it's happening? What signals would indicate this? Is it increased CPU usage disguised as a system process?
And are you talking about mainstream proprietary OS'es like MacOS and Windows? I already know a little about Intel ME and proprietary silicon, but I don't know where to find a proper analysis, or a blog or book that deep dives into the ramificitions of the existense of these backdoors.
It seems to also not be in the mainstream consciousness just how serious it could be?
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#65This is really sad. I am sure hundreds of hours were spent on this project with now essentially does nothing.
Does this mean all free software advocates are stuck on archaic pre 2010 hardware?
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#66Reading this always makes me sad. It's like computing got utterly corrupted post-2008 and there's yet to be a fix. The tragedy of all this is that a 2008 laptop should be more than enough for today's needs if web development wasn't greedy and was resource aware.
There are modern alternative systems with an open firmware stack, for example the Talos II running Power9. Granted, it is not available as a cheap, slick and slim power efficient laptop, but it is real, only twice as expensive and very capable. https://en.m.wikipedia.org/wiki/POWER9 See performance benchmarks incomparison with AMD/Intel at: https://www.phoronix.com/scan.php?page=article&item=power9-t... https://www.p…
There's also the Blackbird which is even more affordable - https://raptorcs.com/content/BK1B01/intro.html. It's still sadly more than I could justify spending - for my non-portable needs I use a ~5 year old Intel NUC which was cheap as chips and still going strong. But if that ever changes a Talos POWER-based system is at top of my list.
The Talos guys pop up in the comments on HN now and then and they're very pleasant.
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#67Earlier quoted context omitted.
No SSL => MITMer can definitely read your traffic trivially. Broken SSL => MITMer can possibly negotiate insecure and read your traffic anyway. MITMer can also possibly cause a denial-of-service, or get arbitrary code execution on that one chip that controls your entire CPU . If I had to choose, I would take the first option. (This precludes options like removing the IME entirely, or updating it to a version with non…
I'm coming from a place of good faith here so bear with me. My understanding is that any vulnerability here would also exist in accessing any HTTPS website. I'm assuming you wouldn't choose to browse the web without SSL/TLS, so I'm assuming the difference here is that it's the CPU management chip instead of your browser? I suppose that if you broke SSL/TLS you could commandeer arbitrary AWS/GCP/Azure instances. For t…
Nitpick: Remote code execution is breaking a TLS implementation (eg. openssl), not breaking TLS itself.
> so I'm assuming the difference here is that it's the CPU management chip instead of your browser?
Yes.
If a vulnerability is found in a SSL/TLS implementation, it can be fixed with a software update.
I don't know how Intel ME works, but I'm guessing updating it is harder to update than a browser.
> For that matter, do you trust SSL/TLS significantly less than SSH?
I'm not the GP, but I'm guessing they do. TLS solves a more complex problem than SSH, as SSH assumes the user validates a server's public key manually (even though they usually don't, but TOFU [1] makes it somewhat harder to exploit), whereas a TLS server's key can change at any time.
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#68Earlier quoted context omitted.
> It's like computing got utterly corrupted post-2008 and there's yet to be a fix. The ironic thing is that OP's posted article were news from 2009. Now, a decade later, we almost expect another total Intel CPU failure every year due to all the problems the architecture had while still promising sandboxed security. But, as with all self-claimed "secure systems". If there's no audit, it cannot be seen as unsecure. Sec…
I think the market for enthusiast machines shrinking might just help make the case for lower but still meaningful volume of RISC-V machines. That said, I do think it’s unclear how there would ever be a pathway for them to go from hobbyist machines to competing with AMD and Intel.
RISC-V has found a niche in anything embedded that needs some decent performance, especially in storage and networking. With a little imagination you can see some products there merge with other functionalities and take over larger markets, e.g. a NAS product line incorporating smart home and smart speaker functionality, evolving into 'home box' systems.
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#69By now, it's probably reasonable to assume that NSA, GCHQ, the FSB, the Third Department, and Mossad can all use that backdoor.
Really? I am curious to know what observations or evidence you base your arguments/predictions on? Do you believe they have an (even better than 'post-Snowden leaks') search-engine like PRISM, but for private networks all around the world? Could a user tell it's happening? What signals would indicate this? Is it increased CPU usage disguised as a system process? And are you talking about mainstream proprietary OS'es…
The mere fact that you would expect a system process or anything else visible to the operating system, indicates that you haven't read much about Intel ME :/
Re: Why is the latest Intel hardware unsupported in libreboot? (2017)
#70Earlier quoted context omitted.
Any big corporation with security competence is going to seriously care about the security of their corporate and production fleet; the stakes for securing systems only ever increases over time, and threats are only getting more sophisticated. So you don’t necessarily need to believe in the altruism of a corporation to see why their interest in secure computing at lower levels of the stack may actually line up with u…
Is Google at risk because of this? I have consolidated all my private stuff to only Google instead of spreading it all over FB, MS, Apple, and other vendors.
At risk because of Intel ME/integrity based attacks? I simply don’t know. I assume the risk is managed some way or another, probably a lot with network security. I personally was more bothered by CPU vulnerabilities, and there’s also the looming threat of DRAM vulnerabilities, but for now it seems like almost anything can be effectively mitigated at some cost.