Slashdot Mirror
FSF-Endorsed Libreboot X200 Laptop Comes With Intel's AMT Removed
gnujoshua (540710) writes "The Free Software Foundation has announced its endorsement of the Libreboot X200, a refurbished Lenovo ThinkPad X200 sold by Gluglug. The laptop ships with 100% free software and firmware, including the FSF's endorsed Trisquel GNU/Linux and Libreboot. One of the biggest challenges overcome in achieving FSF's Respects Your Freedom certification was the complete removal of Intel's ME and AMT firmware. The AMT is a controversial proprietary backdoor technology that allows remote access to a machine even when it is powered off. Quoting from the press release: "The ME and its extension, AMT, are serious security issues on modern Intel hardware and one of the main obstacles preventing most Intel based systems from being liberated by users. On most systems, it is extremely difficult to remove, and nearly impossible to replace. Libreboot X200 is the first system where it has actually been removed, permanently," said Gluglug Founder and CEO, Francis Rowe."
AMT has remote power up capability but if the system is off ... it is OFF (no idle or standby).
Are privacy and security issues the leverage that finally puts Linux in people's hands in significant numbers?"
(Are there enough people who *care* about these issues?)
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I've always found AMT useful. It's turned off by default, so I'm not sure how it's a security risk. What I like about it is the following:
- Allows you to remotely manage client PCs in a work environment, up to and including re-formatting the HDD with a new OS, including being able to remotely mount a local ISO image to install the OS.
- Works even when some of the most critical system components don't work, such as CPU, RAM, etc, as it's an independent subsystem. Even if you don't want the remote management features, this is a huge deal when you have a seemingly dead system and aren't sure exactly how to fix it. AMT helps you figure out the EXACT problem FAST, and you don't even have to have the computer in your hands to do so.
- Integrates with LDAP (including Active Directory, Samba, etc)
- Provides the ability to power on and remotely wipe the laptop if it was stolen and contains sensitive data.
So what's so controversial about it?
Can we put it all back, under our control?
I want a computer that secureboot's my signed bootloader that boots my signed kernel that executes my signed init and starts a signed console with a signed login and logs me into a signed bash.
I want the promise fulfilled: that I know with cryptographic certainty that as long as my key is secure, "They" have not tampered with my persistent environment.
A far cry from what it has become: the MAFIAA knowing with cryptographic certainty that I have not tampered with my environment.
But does it run Windows?
If I have been able to see further than others, it is because I bought a pair of binoculars.
Let me know when I can buy one that isn't 5+ years old hardware.
Thanks!
Would it be easier to go with an AMD laptop? Do they have similar firmwmare concerns?
You can lead a horse to water, but you can't make it dissolve.
$550-750 for a 6 year old, low-resolution, low memory laptop?
I mean, if I absolutely HAD to have something FSF-compliant without the possible security risk of AMT...
But, honestly, that same amount of money will get you a MUCH better NEW laptop and there are ways to secure a system around AMT.
Chas - The one, the only.
THANK GOD!!!
These RYF (Respects Your Freedom) laptops are a perfect metaphor for the FSF/GNU. Old, tired, retreads that are overly expensive and innovate nothing. Back in the 80's and 90's GNU was innovating and inventing, can you name the last innovation/invention coming from GNU? Red Hat (for better or worse), OpenBSD, FreeBSD have all been putting in massive work and the FSF/GNU has been all politics, and I can't even think of any political work they've made a difference on.
I can boot, run, and be productive on FreeBSD and Fedora on my UEFI booting MacBook and W530 ThinkPad. I'm not spending $540 + shipping for old tech just because it gets an FSF endorsement. The FSF is teetering on irrelevancy.
Why not just buy a laptop with either an AMD CPU or an Intel Core that is NOT a vPro series (which is nearly 100% of all consumer retail laptops)?
Intel vPro CPUs typically only make it into corporate purchased laptops.
This is a solution looking for a problem.
You suffer from RMSDS, Richard M Stallman Derangement Syndrome. This is a mental illness typified by behaviour such as a disturbing fascintaion with RMS's personal habits, to a paranoid absurd delusion that RMS has never accomplished anything and GNU is a failure.
Whatever your accomplishments, RMS's fully eclipse yours, and he will be remembered as an important historical figure for centuries to come. His name will live on, and be celebrated. To contrast, you have no name, so you won't even be forgotten.
Someone installed libreboot and Trisquel on an ancient laptop. Stop. The. Presses.
I use Trisquel on a new ThinkPad. I disabled AMT. Can I have my own headline?
For better security I should pass on all the more reputable systems out there because they have an Intel back door... and go to a machine produced by the Communist Peoples' Liberation Army which could (and probably is) be stuffed full of counterfeit chips some of which might contain some very nasty undocumented and as-of-yet undiscovered backdoors... and THIS is endorsed by the FSF????????
Methinks the hard-left ideology of some of the people at FSF have made them blind to certain risks which come from the extreme left.
People need to pressure Intel to make these functions HARDWARE disableable (like with a processor pin going to a switch or jumper) just as pressure was put on them to get rid of the unique processor ID stuff they were pushing back in the 80x386 era; that worked. I'm not sure there is ANY amount of pressure westerners could apply that would make the Chinese PLA back down on any bad stuff THEY are building into the computers they are selling into the west.
For safety, put anything important on systems that have NO connection to the web, and only connect systems to the web that contain nothing important.
If you're going to drop the Intel ME, Intel could still put something together in the CPU microcode patches. Or, you know, just in the silicon itself.
This product is a sham. "Only free software -- until it's not".
The market for this is the enterprise. Say you have a Snowden employee. You can wrap around the PC software and monitor all traffic in and out. You can detect an unauthorized OS such as booting from memory stick. You can remotely re image a drive that has been severely compromised by malware. You can shut down a machine attacking your network from the inside such as the ransomware file encryption.
If you own a business this is an IT department God mode saving many trips out to the machines in a multi-national deployment.
If you buy one for your own personal use and don't have access to the God mode shell and your laptop is either stolen or compromised, then you are pretty much not needing or wanting this.
If you do buy one and it does log into your network and is stolen, then you can do everything such as keylog, sniff passwords, copy files, change passwords, etc.
The question is who is in charge of the God mode?
Since Intel a private corp made it, I presume they don't want the NSA into their IP either, so unless the interface is exposed, they should be relatively secure from the NSA, but never trust the NSA other others from gaining access.
For the enterprise this was designed for, this is not always an option. Intel Oregon for example has RA campus of D1B, D1C, D1D, D1X, RA1, RA2, RA3, then 5 more campuses including Cornell Oaks, Jones Farm, Aloha, etc. Add a few VPN clients and you can see the value.
If I understand it correctly, I would be able to power on, fix or reimage my home desktops/laptops while at work or away on a trip. Or fix my moms crashed computer from half way around the globe. And, since all communication is authenticated with a TLS certificate, there is little danger of other taking over my hardware.
I understand people's right to be paranoid or want 100% open systems, and hope that appropriate choices remain available. But even for most Linux kernel developers a failsafe way to repair an unbootable system from remote is a good thing.
I don't see the issue (if it's disabled by default). Just like server class IPMI, you shouldn't allow access over the internet. Of course, that doesn't stop morons from doing so. Quick google search easily gets me a list of IPMI login pages, most often with default credentials. >_
It can always be remotely re-enabled. Didn't you even read the docs?
It exists to fight terrorism and pedophillia because feminist police state is the most important value to modern (wo)man.
Why would one want to live without feminist police state. Both the feminist and the police state part are key to modern life.
Without them there would be men marrying cute young girls. Can't have that. Also the men would be in control of women and girls.
What about the firmware on the embedded controller in the laptop. It manages things like the leds and some power management. It is quite a beefy blob of code on thinkpads (at least on my X200s). IIRC it has access to main memory in order to carry out its ACPI duties.
" Intel Active Management Technology: Known Vulnerabilities and Exploits"
:)
What is needed is another OOB security-sub-system to protect the Intel Active Management Technology from getting compromised
@ArmoredDragon: "I've always found AMT useful. It's turned off by default, so I'm not sure how it's a security risk."
Either by accident or design, it allows for a backdoor into the system. I wouldn't be suprised it it didn't come with its own backdoor ref.
oh, right...a nobody company with a nobody computer...