81–90 of 145 posts
Earlier quoted context omitted.
Did they release specs so that customer could build their own ME to manage the CPU? That would be interesting.
Why would they do that?
Good thing Apple is moving to M1; no more of that Intel crap. and stick with AMD for Linux.
Earlier quoted context omitted.
Plot twist: there’s been a few ME vulnerabilities. And who knows what other purposeful ME backdoors there may or may not be.
Sure, which is why this is useful to researchers. But the access someone needs to your system in order to exploit the ME vulnerabilities is sufficiently extreme that if someone achieves it you probably have other things to worry about.
Earlier quoted context omitted.
Why would they do that?
I can't imagine why someone would hide details of the product they are selling. That is dishonest and should be illegal. Imagine if someone was selling food and would omit some ingredients from the list or you buy a house with a basement and you don't get a key nor info what's inside.
But for whatever reason they have been very tight-lipped.
Earlier quoted context omitted.
Hold up there you don't know if someone's been tampering with the trees, you'll have to grow your own forest first
The “trusting trust” flaw still applies, better sequence your own species of tree.
Nothing against the original post (which just says what they found), but this seems to be really overblown. Yes, of course Intel has instructions to update the micro code, since that's a thing that they do. Neither is it particularly surprising that they didn't bother to document operations that only they would ever have reason to use (in their eyes). If, as sibling comment notes, you have to be in a specific unlocke…
Should products be fully documented so that consumers can make an informed decision?
In this specific case, users do not have the ability to use this instruction, so there is no reason to document it.
So, which CPUs are actually open-hardware and available to consumers with mainboards that support them? Is RISC-V going to be this?
And of course nothing about RISC-V implies that production implementations will be open source at all.
Earlier quoted context omitted.
The previous publicly known mechanism required signed updates. This mechanism allows anyone to twiddle the bits.
> This mechanism allows anyone to twiddle the bits. This remained unclear to me. Other comments say the CPU needs to be in red unlocked state, whatever that is. The screenshot shows UEFI. So one could guess the CPU is in such state before the operating system gets loaded. But the operating system typically loads a microcode update, after that the CPU should no longer be in unlocked state. So for "everyone can fiddle…
Earlier quoted context omitted.
Should products be fully documented so that consumers can make an informed decision?
In most cases there is a public API which is documented and a private API which is not. In this specific case, users do not have the ability to use this instruction, so there is no reason to document it.