Hacker News Reader

Comment by hd4 | Hacker News Reader

Sorry to go straight off-topic but if anyone from AMD is reading, please remove PSP from future and/or give us the ability to remove it from existing machines, this is a golden opportunity (with the Intel ME having been shown to be broken recently https://news.ycombinator.com/item?id=15656931 ) you really shouldn't pass up.

View on HN

They already said they wouldn't open source it (after suggesting they might). I doubt they'll ever think about removing it.

[0]: https://news.ycombinator.com/item?id=14803373

Companies have been known to be astute and flexible when it comes to spotting opportunities especially when their competitors are making very publicized mistakes. It remains to be seen whether AMD is one of those.

Being open source doesn't really matter; it's having access to the keys. And they're never going to give those up because it would break the chain of trust for their DRM.

I don't want their DRM or their DRMed content. I'll gladly buy a computer for my own uses that don't have those "features".

They're not going to. The PSP has a hand in DRM (it runs 'trustlets' in a container), and DRM can only work through obscurity currently.

And DRM is necessary to AMD’s bottom line because...?

People won't buy AMD chips if they can't play Blu-rays or Netflix or use commercial software?

It's not a thing today, but it's not hard seeing the world go that way in the future once the legacy BIOS uses are finally aged out.

Blu-rays and Netflix work just fine on my old laptop that doesn't support secure enclaves.

The onus is on us to make sure that a future where we are locked out of the devices we own does not come to pass.

> Blu-rays and Netflix work just fine on my old laptop that doesn't support secure enclaves.

4k Bluray requires Kaby Lake or newer (I don't know whether it works on Ryzen or not) and HDMI 2.0a with HDCP 2.2.

We're not even getting anything over 720p on Linux.

1080p requires Internet Explorer, Edge, or Safari on Windows or MacOS¹.

4k in the webapp requires Edge in addition to the hardware requirements wolfgke lists.

1: https://help.netflix.com/en/node/23742

* Laughs in pirate

Hah, and people still calling me a pirate for watching 4K MKV movies... under a SandyBridge.

PSP is different than secure enclaves.

This is my biggest frustration with all of this stuff. Every hardware feature with a word like "security" in it is now tantamount to a new Intel ME or "trusted path" implementation.

My favorite is how PSP is confused with DASH, the thing that actually does remote management.

Um, PSP implements a secure enclave capability, so no that’s not correct?

Secure Enclaves on AMD and Intel typically refers to SME/SEV and SGX.

> It's not a thing today, but it's not hard seeing the world go that way in the future once the legacy BIOS uses are finally aged out.
Agreed. Just look at the root situation in android. Banking apps, netflix and even snapchat won't work on a rooted phone. It's absolutely bullshit, but it's normal now. Same can and will happen for PCs.

> or give us the ability to remove it from existing machines
DRM would still work by default.

I assume that if this was on the cards at all they would've done it earlier. Let's keep our fingers crossed though, it could make a big difference in the direction of technology (and thus the world) from here on out.

Not that I disagree, but you realize that point about ME & PSP (which are separate controllers not part of the main boot CPU) isn't particularly relevant to the linked article, which is about removing the 16 bit BIOS boot path from future firmware? By the time you're running real mode IBM PC boot code, the ME & PSP have long since come alive and sorted things out for boot configuration.

Why would they care? The folks asking for this are a tiny (tiny) minority of the market.

It's a huge potential win for cloud and government contracts. Amazon, Google, Microsoft and the US Government probably aren't too keen on having ring -3 code running in their datacenters waiting to be exploited somehow.

> Microsoft and the US Government probably aren't too keen on having ring -3 code running in their datacenters waiting to be exploited somehow.
Which is why they have a special configuration for that, sold to them by Intel.

Source?
coreboot was initially developed at LANL, a US Government laboratory. It's worth considering why that might be.

GP is referring to Intel's High Assurance Program (http://blog.ptsecurity.com/2017/08/disabling-intel-me.html) which offered the possibility to disable ME.

Search for Intel HAP (High Assurance Program). It's a magic killswitch that disables the ME, provided officially only to three-letter agencies and such, of course.
As for coreboot, keep in mind that it was originally developed long before the ME was a thing. IIRC the original motivation was that BIOS sucks. Which it does, sure, but that's orthogonal to the ME.

Google is asking for that (or at least trying to remove Intel ME from their servers in the labs) AFAIK.

Reply on news.ycombinator.com