Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Purism avoids Intel’s Active Management Technology

puri.sm

Post reply on HN
Print view View original

81–90 of 121 posts

Re: How Purism avoids Intel’s Active Management Technology

#81

Post by stallmanite »

wmf wrote: post #80
stallmanite wrote: post #70

Earlier quoted context omitted.

The idea of gaining control of the management hardware like this is really exciting. Can anyone here comment on whether it could plausibly happen? I’m guessing it would require leaks from Intel because otherwise whoever develops the capability would presumably keep it close to the vest or sell it for major $ right?

The ME is running Minix/x86 and presumably a vulnerability could be used to inject new code that isn't signed by Intel. But what would you do with it? Why not just use the OS?

I can’t put it into words well but it’s like if I discovered a vestigial limb attached to my body. I’d want to try firing it up.

Re: How Purism avoids Intel’s Active Management Technology

#83

Post by shawnz »

alasdair_ wrote: post #64
selectodude wrote: post #63

Earlier quoted context omitted.

>It's up to Intel to prove that they don't exist. That seems a bit over the top to ask them to prove a negative.

Releasing the code would allow people to verify it.

Releasing the code would help to make it more auditable.

Re: How Purism avoids Intel’s Active Management Technology

#85

Post by LargoLasskhyfv »

boring_twenties wrote: post #21
fsflover wrote: post #4

Earlier quoted context omitted.

Probaly won`t happen since AMD have their own secret code which no one could neutralize yet.

Recent (1-2 years?) AMD BIOS supports disabling the Platform Security Processor (their ME equivalent). I haven't been able to figure out what exactly this means, but it does seem to be disabled after system initialization. Kind of like Intel's HAP bit, except user-settable.

I found [1] https://www.igorslab.de/en/inside-amd-bios-what-is-really-hi... to be a good explanation. Essentially it's the crank which brings up the rest of the SOC. The other functions are optional, but no booting possible without it.

Re: How Purism avoids Intel’s Active Management Technology

#86

Post by Answerawake »

swader999 wrote: post #67

Another vector for attack is shipping. Do you trust that this won't be intercepted and "customized" on its way to your address from the factory?

They offer "anti-interdiction service"

https://puri.sm/posts/anti-interdiction-services/

From the site:

-Customized tamper-evident tape on the sealed plastic bag surrounding the laptop itself

-Customized tamper-evident tape on the internal, branded box

-Glitter nail polish covering the center (or all) screws on the bottom of the laptop

-Pictures of all of the above plus pictures of the inside of the laptop before sealing the bottom case

-All pictures sent to the customer out-of-band, signed by Purism and encrypted against the customer’s GPG key

-All coordination occurring over GPG-protected email

Re: How Purism avoids Intel’s Active Management Technology

#87

Post by kmeisthax »

johnklos wrote: post #82

How I avoid Intel's Active Management Technology: I don't buy Intel. Even neutered Intel seems unnecessarily risky.

Unfortunately the same business types who demanded such a ridiculous self-own as an integrated CPU-level backdoor also pressured AMD into shipping the same thing. And we know less about the AMD PSP than we do about Intel ME.

ARM is no better, either, at least in practice. Their relatively friendly licensing terms would allow a vendor willing to make their own silicon in volume to ship a no-TrustZone, no-Secure-Boot SOC. However, nobody does this. In fact, moving to ARM has traditionally been used as an excuse to lock out third-party operating systems and unlicensed software. (Remember Windows RT tablets?)

Re: How Purism avoids Intel’s Active Management Technology

#88

Post by Eldandan »

pastrami_panda wrote: post #76
Eldandan wrote: post #60

Earlier quoted context omitted.

I've been able to make the adjustment by buying something with a slightly larger display. A 13" 16:10 display is comparable to 14" 16:9. At 1080p/1200p you lose some vertical pixels and a very tiny amount of physical vertical length, but you gain horizontal pixels and length, along with potentially more ports. This was my recent experience choosing between a new XPS 13 or a T14s amd. Side by side the screens weren't…

I can't really stay productive on anything less than 15". Right now I'm currently enjoying this years lineup of 17" laptops whose body is basically what a 15" was some years ago. I do graphics and sound production aside from programming so I'm really enjoying the extreme screen-to-body ratios. Vapor chamber cooling is also a nice addition. But the thing that really gets me is the 16:10 resolution, I could personally…

>I can't really stay productive on anything less than 15".

Agreed. Without a dock/external monitor 13" and 14" are really not the sizes one should focus on for productivity, except in short bursts. 16:10 really makes an impact on displays smaller than 17". It took serious justification for me to give up the XPS 13" 16:10 display in favor of a 16:9 14" laptop. I absolutely would not have chosen a 13" 16:9 display because of how big of a net loss it is.

Re: How Purism avoids Intel’s Active Management Technology

#89

Post by malikNF »

sscarduzio wrote: post #47
neilv wrote: post #36

Purism just needs TrackPoint and thicker keyboards, and I can upgrade my stockpile of ThinkPads. :) https://www.neilvandyke.org/coreboot/

The trackpoint is the single reason I never bought a Thinkpad.

I was the same, but once I got used to it helps keep your hands almost always on the keyboard, I really love it now. Whenever I use a different laptop these days, I instinctively search for the trackpoint.
Post reply on HN