Comment by jchw | Hacker News Reader

Comment by jchw | Hacker News Reader

Parent Full thread

It's a balancing act. I don't believe I need absolute 100% control of all things going on in my computer; if I did, I wouldn't be able to utilize it anyways. It's pretty telling that Intel ME has been largely invisible to even savvy users until recently.

Having competition is probably part of what's needed to ensure that there's some control. The problem is that none of the competition is currently approaching it from a user freedom standpoint. After all, most companies making processors are publicly traded and even if they weren't, need to sell a huge volume of them to break even and have decent per-unit costs. So trying to target what is unfortunately a very tiny niche of users isn't going to go well.

And for the truly paranoid, it's impossible to prove that the processor wasn't tampered with, that there isn't a ring below yours. You can really only ever get to the point of being able to reasonably doubt the existence of it, which won't satisfy everyone.

I think Intel is digging its own grave by taking the worst stances on issues of user freedom. Eventually, if Intel ME's power over the machine continues to increase, something bad is going to happen as a result of it, and it's going to erode the already fragile trust people have in them. The ME exploit was part 1 of that.

But what about companies like AMD, or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom? There's no imaginable consequence for that. And there's no real benefit of reversing course, either. I can't see a future where open computing will be anything more than an extreme niche with sub-par options.

One of the better scenarios I can think of is that computing as we know it today becomes a niche itself and a lot of the users do value privacy and security. This seems plausible the better that Chromebooks and phones and tablets get; the average user won't need a computer tower or a laptop with 16 GB of RAM. But I imagine it won't be good news for the prices we currently enjoy :)

or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom?

I think ARM SoCs are even worse. Try finding a full (or just partial) datasheet/technical documentation for anything like the ones used in recent smartphones and tablets, for example. They are going to want a NDA. The only ones publicly available were leaked. They also differ significantly between each other and often even within the same model line, so it's nothing like a PC where a lot of things still remain relatively standard.

ARM also has TrustZone, their DRM technology of which there is almost no public documentation.

TrustZone is not DRM nor a management engine like Intel's ME. It is just a reference design in order to implement some sort of sandbox and security zone in the SoC.

ARM doesn't mandate how TrustZone is used, it just provides the technology. If SoC designers use it to force DRM into their products, it's not really ARM's fault.

Also, just to make it clear, it is not ARM's fault if ARM based SoCs lack proper documentation.

It's at least partially ARM's fault, as ARM doesn't publish documentation for their cores. SoC vendors are just as bad, if not worse, but ARM doesn't get off scott-free.

Eh? Here's the TRM for the Cortex-A57, to pick the first arm core I thought of: https://developer.arm.com/docs/ddi0488/c/preface The architecture manuals are also downloadable.

And Mali?

Actually, the Arm server space is solving this problem through standardization. These are the SBSA and SBBR specs. All systems from different vendors will look the same way to the OS and boot thr same way as x86 servers. You will be able to run the same binary OS distribution on any system. Gone are the days of a BSP for every SoC. And these server specs will drive how non-server systems will look, since there will be an inherent cost to do something different (both in hw, sw and firmware).

public implementation link https://github.com/ARM-software/arm-trusted-firmware. its software running in privileged cpu mode.

> I think ARM SoCs are even worse. Try finding a full (or just partial) datasheet/technical documentation for anything like the ones used in recent smartphones and tablets, for example. They are going to want a NDA.

If you're thinking of someone like MediaTek, Allwinner or the like: they aren't really in the merchant chip business. They pretty much design a chip for a single large project and supply it with support chips, (usually crummy) drivers, and even a linux or android port as a "complete unit". Often there isn't really a data sheet as such; they send some engineers along to help with integration.

This, by the way, was the original meaning of "SoC" when people were starting to think of common hardware/software codesign in the 1990s: a purpose-built chip for a specific design built out of a combination of standard IP and custom circuitry, but conventionally fabbed instead of being FPGA. Think of it as integration of some of the board design onto a single die. The IP market people thought at the time would eventually develop didn't really, though.

Intel and AMD are still in the good‡ old days of data sheets, second sourcing (pretty much dead but it's still in those companies' DNA) etc.

‡ and they were good times IMHO.

"I don't believe I need absolute 100% control of all things going on in my computer"

Neither do I and probably also operating systems developers, but having control doesn't imply having constantly to fiddle with all internal hardware bits of a machine with no remaining time to do actual things (if you meant this I'm totally with you on this one). To me having control means preventing others to do things behind our backs, sort of a switch we use only once to turn off that crap, and keep under watch just to prevent others to use it. Public information about ME and similar subsystems should help us to do that.

> I don't believe I need absolute 100% control of all things going on in my computer; if I did, I wouldn't be able to utilize it anyways.

It's possible to have 100% control of your computer without being able to being able to utilize it. At a higher level, take Linux as an example: I can certainly utilize it, but I still have 100% control over it. The difference here is that I have the option to change things as I see fit, even if I don't know how it works or even that it exists. Most of the time I leave it alone, but there are times where doing things like swapping out the window manager or driver can be helpful.

Lot of good insights in this comment.

Reply on news.ycombinator.com