Slashdot Mirror
FSF-Endorsed Libreboot X200 Laptop Comes With Intel's AMT Removed
gnujoshua (540710) writes "The Free Software Foundation has announced its endorsement of the Libreboot X200, a refurbished Lenovo ThinkPad X200 sold by Gluglug. The laptop ships with 100% free software and firmware, including the FSF's endorsed Trisquel GNU/Linux and Libreboot. One of the biggest challenges overcome in achieving FSF's Respects Your Freedom certification was the complete removal of Intel's ME and AMT firmware. The AMT is a controversial proprietary backdoor technology that allows remote access to a machine even when it is powered off. Quoting from the press release: "The ME and its extension, AMT, are serious security issues on modern Intel hardware and one of the main obstacles preventing most Intel based systems from being liberated by users. On most systems, it is extremely difficult to remove, and nearly impossible to replace. Libreboot X200 is the first system where it has actually been removed, permanently," said Gluglug Founder and CEO, Francis Rowe."
AMT has remote power up capability but if the system is off ... it is OFF (no idle or standby).
Are privacy and security issues the leverage that finally puts Linux in people's hands in significant numbers?"
(Are there enough people who *care* about these issues?)
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I've always found AMT useful. It's turned off by default, so I'm not sure how it's a security risk. What I like about it is the following:
- Allows you to remotely manage client PCs in a work environment, up to and including re-formatting the HDD with a new OS, including being able to remotely mount a local ISO image to install the OS.
- Works even when some of the most critical system components don't work, such as CPU, RAM, etc, as it's an independent subsystem. Even if you don't want the remote management features, this is a huge deal when you have a seemingly dead system and aren't sure exactly how to fix it. AMT helps you figure out the EXACT problem FAST, and you don't even have to have the computer in your hands to do so.
- Integrates with LDAP (including Active Directory, Samba, etc)
- Provides the ability to power on and remotely wipe the laptop if it was stolen and contains sensitive data.
So what's so controversial about it?
Can we put it all back, under our control?
I want a computer that secureboot's my signed bootloader that boots my signed kernel that executes my signed init and starts a signed console with a signed login and logs me into a signed bash.
I want the promise fulfilled: that I know with cryptographic certainty that as long as my key is secure, "They" have not tampered with my persistent environment.
A far cry from what it has become: the MAFIAA knowing with cryptographic certainty that I have not tampered with my environment.
But does it run Windows?
If I have been able to see further than others, it is because I bought a pair of binoculars.
Would it be easier to go with an AMD laptop? Do they have similar firmwmare concerns?
You can lead a horse to water, but you can't make it dissolve.
Such requirements are only self-imposed requirements. Even defense contractors like Boeing use stock computers from large OEMs like Dell.
I can't think of a single instance when something being FSF-compliant matters at all, except maybe if you want to work for Richard Stallman. If Wikipedia is to be believed then there are exactly twelve people in the world affected.
Do not look into laser with remaining eye.
Newer Intel things are much harder to free (for example, removing AMT from later Intel boards makes it reset every 30 minutes like clockwork.) At least people are trying to do something though. Instead of bashing on these efforts, why not focus on getting Intel and AMD to free those proprietary bits of software? Then it would not be necessary to waste months of effort on older hardware only to have someone bash on them that it's not good enough.
I agree, for me it stands for RMS Decidedly Successful. He's on the level of Alan Turing. Turing was driven to kill himself by people against who he was back then. Same thing for some people now with RMS. His philosophy of freedom as in libre will be common sense in 100 years, and people like you will be looked back on in shame.
Why not go w/ the Librem, discussed here a few days ago?
I fully endorse this! I visited a Linux conference in my city several months back, and all the booths had something interesting or the other. Only exception was the FSF - except for slogans like iBad and posters & stickers, they really had nothing worth showing. And how can they be, when they've completely discounted the importance of good products, and made liberated products the only criteria by which to endorse? Other companies make products around Linux or the BSDs, while all these guys do is take a fully functional Linux, cripple it some b'cos the software that makes it better ain't liberated, and then they expect people to pay equal or inflated prices for those.
What are all the GNU programs I have on my computer? Most of them - GTK+ ones - now conquer my whole screen and are usually difficult to resize, except under GNOME. Functionality - less than other standard BSD or Linux programs. If GNU wants to be relevant, there is one way they could do it - have their cadres focus on writing great software, as opposed to being the Software industry's equivalent of the OCCUPY crowd.
Get the FSF/RMS to do some ass-smooching, and then you too will get your /. headline
I've wondered that as well. Why do these laptops need to be based on an x86? Use something like RMS' previous fav - a Loongson CPU, or an Allwinner - the same thing being used for some Android tablets. That way, one can get a fully documented thing. Of course, it would be illegal to sell that in the US due to laws violating IP, but since when has that stopped RMS, or the FSF, which is his sock puppet?
I can't think of a single instance when something being FSF-compliant matters at all
Except for ones own piece of mind, of course. Which I guess doesn't matter.
It is pitch black. You are likely to be eaten by a grue.
If you're going to drop the Intel ME, Intel could still put something together in the CPU microcode patches. Or, you know, just in the silicon itself.
This product is a sham. "Only free software -- until it's not".
Interesting, the first time they did that, it would trigger a wave of replacement world wide, so you get the situation where they wont because they dont want to burn that card.
It long past the point where the world needs a reliable supply of non-US based technology components, i now consider almost everything originating from the US as being irrevocably compromised. And china is not much better.
We have sold our souls to the devil for the nice tunes he plays, and now we have to pay.
Funny how when its RMS, it's "religion" and "god worship" but when it's Einstein or Newton it's just appreciating the immense contributions made by a gifted intelligent individual. I hear the same thing with anti-Obama nutbags, calling anyone who has admiration for him a stupid "worshiper" who "drank the Koolaid". Ah, the convenience of self-justifying logic. How nice that must be for you.
Re: "It long past the point where the world needs a reliable supply of non-US based technology components, i now consider almost everything originating from the US as being irrevocably compromised" :)
Yes this is the first small positive steps that keep the networked computing side. The user gets new firmware, hardware and an OS thats more understood. The hardware also has some of the more remote friendly aspects looked at.
The next step for nations is a box with a chip and motherboard that is fully understood as designed. Beyond that is paper, a typewriter, one time pads and number stations.
Projects like this will help a lot of people and nations
Domestic spying is now "Benign Information Gathering"
Re: "But, honestly, that same amount of money will get you a MUCH better NEW laptop and there are ways to secure a system around AMT."
The issues with the newer systems is the remote low level access thats part of the "NEW laptop" or computer system.
If a person is seen and tracked outside away from their networked computer that would give time to access that networked computer.
Some of the needed tools are are built into the hardware as sold and powered waiting for the remote commands.
After a system is altered all the owner would see in their own logs is the soft sleep or shutdown and their own use.
Projects like this remove some of that built in, waiting, easy remote access as sold. A remote system that could have granted easy network access might now need physical access or other network access that might be more a bit more difficult to hide.
Domestic spying is now "Benign Information Gathering"
lol, I had you pegged. Anyone who likes someone you don't like is a "religious zealot". Face it, you just resent RMS, and Obama, who are in your face about being good people and doing good things, and you can't do anything about it. You're the very picture of abject impotence..
This is where the whole notion of risk management comes into play.
Now, if you're a world famous nuclear scientist working on spurting-edge fusion power experiments, a stupid-rich CEO of an unpopular company or a politician with even more dirty laundry than your AVERAGE political hack, you're probably a FAR bigger target than "Joe Familyguy".
I'm not saying "don't secure your shit.
But at some point, the risk/return equation simply becomes unacceptable for most people.
Technically, if you disassembled your machine, broke it down to component parts, sealed each part inside an air/water-tight safe (a different safe for every part), and buried each part in a location only known to you in a concrete and rebar cage. Your shit would be REALLY fucking secure.
But actually using the system (let alone accessing the data) becomes an unacceptable hassle.
So, at some point, there's ALWAYS tradeoffs between security and usability. ALWAYS. Anyone telling you different is selling you a line of high-grade BULLSHIT.
Chas - The one, the only.
THANK GOD!!!
Icaza is an interesting person. I loathed him during the Novell days. He was doing evil in my view. Now, at Xamarin, I think he is doing immense good. But, he is only doing that good because he was stopped from doing any more evil. Sometimes brilliant people need to be contained and redirected. Icaza is a prime example.
And govt agencies and hackers would also be able to do this and we don't want that. As far as fixing your mom's computer, a simple video chat using some mobile phone can be used to fix the computer, without the invasive spyware.
" Intel Active Management Technology: Known Vulnerabilities and Exploits"
:)
What is needed is another OOB security-sub-system to protect the Intel Active Management Technology from getting compromised
@ArmoredDragon: "I've always found AMT useful. It's turned off by default, so I'm not sure how it's a security risk."
Either by accident or design, it allows for a backdoor into the system. I wouldn't be suprised it it didn't come with its own backdoor ref.
Different guy here: I would love to get one of those but they are significantly more expensive (granted the hardware does look very nice, it's probably worth it). I'm tempted to pick up a Libreboot X200 sometime soon, with 8GB RAM and an SSD it should be more than adequate for running a lightweight desktop and doing all the stuff I typically do. The keyboard looks very nice.
Your comment shows the basic confusion people like you suffer from, and RMS has a one-liner that encapsulates it perfectly: "The freedom to remove another person's freedom is not a freedom at all, it's tyranny." If your software project's "success" means the loss of freedom for a lot of people, then your project should fail. It's basic ethics and morals. Comcast would post amazing returns to its investors if everyone was forced to use them for broadband... why shouldn't we let them have a monopoly?
We probably are close in ideology. But consider this, if RMS was any less of a clever zealot, would the Novell project have failed like it should have? Would Microsoft be playing nice now? Would Linux exist as it does? Would people even have a free c compiler? Do you really want to roll those dice? With the Snowden revelations, and ever new threats to our freedom emerging every day as tech changes, don't we need some unwielding force for libre, so that the middle we end up in is somewhat tolerable, like it is now? I personally use all sorts of proprietary code, and I write proprietary code, but I am glad RMS is doing exactly what he is doing, so that overall I live in a (somewhat) free world of technology. Ugh, imagine if GNU/Linux didn't exist, and all we had were IIS servers! As for Microsoft, remember that the .NET project was originally just another one of their "Embrace/Extend/Extinguishi" shticks. Now it can actually so some good because it will simply never be dominant.
Have you ever actually tried to fix an unbootable computer over "simple video chat" with a non-technical person? Hehe.
I would install a pre-shared key and not give it "govt agencies and hackers". If they have a secret backdoor into TLS or intel hardware, I am screwed anyway.
Say you wanted to spend $750 on a newer laptop, then needed to spend 10 hours researching it and working out how to disable all remote management things and remove proprietary blobs from the firmware. Oh, and add in a modern WIFI chip too. That would be implying that you value your time at ~$35/hour.
If you value your time more highly than that ... well, it may become worthwhile to look at a solution like this.
Will a modern (last couple of years) laptop really let you get your work done more rapidly?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
I don't know about defence contractors, but I'll be in the offices of an oil major tomorrow lunch time because they wipe the hard drives of all their OEM laptops and re-image them with a heavily customised version of XP, Vista or Win7 with all sorts of weird different networky things. Pain in the arse, but that costs them money - I go into their office for a videoconference meeting (because their laptop won't work on anyone else's network), and they pay a day's day-rate.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"