Hacker News Reader

Comment by userbinator | Hacker News Reader

If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too?

It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough.

The underlying reason why ME became popular is the same reason why proprietary walled gardens became popular: because they are heavily promoted as a security/safety feature, and "who doesn't want to be safe and secure?"

Remember that, shortly before the turn of the century, Intel was convinced by the masses to remove a feature that would seem almost innocuous today, a serial number, but only because they marketed it as for DRM/identification instead of a security feature:

https://www.wired.com/1999/01/intel-on-privacy-whoops/

View on HN

> The underlying reason why ME became popular ...

... is also because it provides management features that are wanted by enterprise customers. If you're running hundreds of servers in a data center, the more management you can do remotely, without visiting the machine room and preferably automated as much as possible, the better.

This is quite irrelevant and even undesirable for an individual's personal computer.

While enterprise customers might want remote control they also would like to be able to disable it.

I read statements like this often on HN, but not once during my years of work as a sysadmin in enterprise IT in different countries did I meet anyone who used ME/AMT for employee laptops. Also not at conferences.

Admins use the ILOM/IPMI for servers, so you don't really need it for server CPUs. For laptops all management happens at the operating system level, not below it.

Admins used the "Intel System Defense Utility"[1] back in the vPro/AMT days. It allowed for "nice" BMC-like features for normal desktops and laptops. I know about it from "The Website is Down"[2], but I find it hard to believe that nobody used it.

[1]: https://downloadcenter.intel.com/download/15362/index.htm?ii... [2]: https://www.youtube.com/watch?v=v0mwT3DkG4w

I hadn't seen that episode of TWiD. So hilarious, with a mix of sad how true it is.

Are there any enterprise-useful features provided by ME that couldn't be provided external to the CPU?

Since the boot process already involves some amount of hand holding from outside the CPU, any of those features could have been provided by a designed-for-enterprise motherboard with ME-like features in the BIOS/UEFI or even some sort of peripheral in the PCH (or wherever).

"... because they marketed it as for DRM/identification"

Scott McNealy, Sun Microsystems (1999): "You have zero privacy anyway. Get over it."

https://www.wired.com/1999/01/sun-on-privacy-get-over-it/

> Millions of American consumers tell us that privacy is a grave concern to them when they are thinking about shopping online

Wow! And look where we are now. Quite the irony how things played out.

First, because of undisclosed design and patents it is difficult for competition to compete in the x86 market.

Second, competition is exactly what we need to get rid of hardware backdoors and unwanted features. If I had the coice to buy a PC without closed firmware and hardware, I would do so. The more open, the better. We direly need competition there.

The pinebook (aarch64 machine) has an opensparc1000 in exactly the same capacity as the intel ME. The firmware blob is out and people have poked at it, but the functionality has yet to be reproduced in open software.

https://code.facebook.com/posts/1601610310055392/introducing...

It could be an open solution too. I have only cursory followed OCP and other hardware advances, but this being used with Raptor's power servers. Opensparc before Oracle, and recently the RISC V community might have built something similar too.

> because they are heavily promoted as a security/safety feature,

You can build such features without baking the keys into the hardware. You can have an open security module where changing the key simply makes everything that has been previously secured by it unreadable. That way a user can load his custom keys and firmware if he wants to. You can cascade that dependency down the secure boot chain by mixing some secret from the module into the HDD decryption for example.

Only vendor lock-in (e.g. windows RT) and DRM require hardcoded keys.

Reply on news.ycombinator.com