Hacker News Reader

Comment by Taek | Hacker News Reader

It's all kind of moot anyway if you are running hardware with blobs (Intel ME, for example). Getting truly to 100% is pretty far away, as frustrating as that is.

View on HN

The ME/AMT is the nastiest of them all. And those are not the only ones. FSP, the CPU microcode.

You can get rid of AMT if you're on older hardware, or your willing to buy a laptop from (US) http://www.libiquity.com/, (UK) https://minifree.org/ or (EU) https://tehnoetic.com/;

The future is bleak though, there's not much hope in sight freeing anything from Nehalem onwards. I have a Thinkpad X201, and flashing coreboot with blobs is the best I could for the moment.

I do remember though that I had Gentoo 100% from sources a few years back. But updates were too much of a pain in the ass, and after tweaking the compiler flags, I always ended up breaking my system. So I'd take reproducible builds over that.

With major effort, ME has been disabled on Lenovo X230 (Ivy Bridge).

Where do you get your information from? AFAIK, it's only has been stripped down to a bare minimum, putting it in some sort of recovery mode - but it can't be erased from the BIOS chip yet.

https://www.coreboot.org/pipermail/coreboot/2016-September/0...

I was thinking of this project - https://github.com/corna/me_cleaner This is the one that strips most of the ME (which seems to be Java applets, if I remember correctly Igor Skochinsky's presentation), but there's still the core "OS" in PCH, which loads and executes the applets - we don't know what nefarious things that part of ME might be up to - and it has DMA, and access to the network controller - that's how they remotely wipe HDD's, even without an OS being installed, even without the computer being turned on - that shit is straight out of Orwell's 1984. Telescreen, that's what it is.

Thanks for the info.

Is there security benefit in running on a desktop with non-Intel (e.g. Broadcom) add-on NICs and nothing connected to the integrated Intel NIC?

Yes. It seems this only works with Intel cards(wifi or ethernet); I don't know the reasons why, though - it might be some firmware support. Also, I find it odd that it can work with the wireless chip - shouldn't the laptop be associated with the AP? If somebody knows, I'd be happy to learn about it.

Source: https://software.intel.com/en-us/blogs/2013/08/07/intel-vpro...

Reply on news.ycombinator.com