System76 Will Disable Intel Management Engine On Its Linux Laptops (liliputing.com)

System76 is rolling out a firmware update for its recent laptops that will disable the Intel Management Engine altogether. The decision comes after a major security vulnerability was discovered that would allow an attacker with local access to execute arbitrary code. Liliputing reports: What's noteworthy in the System76 announcement is that the PC maker isn't just planning to disable Intel ME in computers that ship from now on. The company will send out an update that disables it on existing computers with 6th, 7th, or 8th-gen Intel Core processors. System76 also notes that Intel ME "provides no functionality for System76 laptop customers and is safe to disable." Right now the firmware update will only be available for computers running Ubuntu 16.04 or later or a related operating system with the System76 driver. But the company says it's working on developing a command line tool that should work on laptops running other GNU/Linux-based operating systems. System76 says it will also release an update for its desktop computers... but on those machines the update will patch the security vulnerability rather than disabling Intel ME altogether.

Comments

If it works

[Anonymous Coward]

I'm glad that they are doing this, BUT, from what I know about the IME, it is extremely complicated and disabling it is not simple or straight forward -- otherwise someone would have done it a long time ago.

Re:If it works

[Narcocide]

I want to belieeeeeve!!! Save us system76 you're our only hope!!

Re:If it works

[cfalcon]

There was new-ish news about this from the summer. A few privacy-minded places are starting to shut the ME down in various ways, some by spoofing the flag the government uses to disable it on its own systems, others in other ways.

Re:If it works

[Z80a]

The problem was understanding what IME does as it is a encrypted black box piece of hunk.
But things are made quite a lot easier with the literal NSA bit that disables everything but the bare essentials to operate the machine.

Re:If it works

[Hal_Porter]

It gets worse. Some of them are probably still using Thinkpads, even though they're made by Lenovo. Now you'll say "No worries, if they re-image them they can avoid any spyware Lenovo put in there at the behest of the Chinese government".

Uh yeah, that won't help. Lenovo uses the WIndows Platform Binary feature to reinstall it. Basically you put an executable file into one of the ACPI tables. Windows copies it to disk and then runs it. With Administrator access. Probably more than Administrator access actually - I bet a native executable has more privilege than one running with Administrator rights on the Win32 subsystem does.

https://www.theregister.co.uk/...

To pull this off, the LSE exploits Microsoft's Windows Platform Binary Table (WPBT) feature. This allows PC manufacturers and corporate IT to inject drivers, programs and other files into the Windows operating system from the motherboard firmware.

The WPBT is stored in the firmware, and tells Windows where in memory it can find an executable called a platform binary to run. Said executable will take care of the job of installing files before the operating system starts.

"During operating system initialization, Windows will read the WPBT to obtain the physical memory location of the platform binary," Microsoft's documentation states.

"The binary is required to be a native, user-mode application that is executed by the Windows Session Manager during operating system initialization. Windows will write the flat image to disk, and the Session Manager will launch the process."

Crucially, the WPBT documentation stresses:

The primary purpose of WPBT is to allow critical software to persist even when the operating system has changed or been reinstalled in a "clean" configuration ... Because this feature provides the ability to persistently execute system software in the context of Windows, it becomes critical that WPBT-based solutions are as secure as possible and do not expose Windows users to exploitable conditions.

Oh dear. Secure as possible? Not in this case: security researcher Roel Schouwenberg found and reported a buffer-overflow vulnerability in the LSE that can be exploited to gain administrator-level privileges.

I.e. even if you reinstall them from a known clean image, they can still regrow the amputated LSE. And even if the LSE is not spyware, it contains exploitable vulnerabilities that a third party could use to install whatever they wanted. Lenovo didn't do this in Thinkpads, but they could.

At the moment the US is in the midst of media created paranoia about Russian hackers. Honestly if I were in charge of cybersecurity I'd be a lot more worried that the Chinese spy services would use something like LSE, with or without the cooperation of Lenovo, to spy on sensitive stuff.

And of course it's not just Lenovo laptops. There's Huawei phones and routers. Or indeed US brands which make routers in China could have either hacked firmware loaded onto them or the Chinese spy agencies could find an stockpile vulnerabilities in the manufacturer's firmware.

And then you have companies like XiaoMi with their young pioneer uniformed bunny signifying their devotion to the regime as a Taiwanese friend of mine pointed out

https://hungermarketingchina.w...

If you buy US stuff, you expect the US companies to cooperate with the NSA. If you buy Chinese stuff you expect Chinese companies to cooperate with its Chinese equivalents. XiaoMi's Young Pioneer bunny is none to subtle sign by the company that they're pro regime and it's not unreasonable to assume if the government asked them to help it out with national security they'd say yes.

Of course I can see

Re:If it works

[Gr8Apes]

All I can say is I forgot about the LSE/WPBT paths. It was mentioned long ago, and was another reason I tacked onto my list of why to never install Windows on a system, but the reasoning behind the "it's effectively a virus" listing was forgotten. Thanks for the reminder on why windows should never be installed on anything.

Re:If it works

[Hal_Porter]

You could probably infect a Linux or Android installation from the firmware if you wanted to. All you need to be able to do is to write one executable file into the filesystem and get the OS to run it each boot.

The basic problem is that you trust the people who write the firmware. And if the people who write the firmware can always be forced to install spyware if the government of the jurisdiction their company operates in tells them forcefully.

In the US a US company can be sent a National Security Letter. In Russia or China it's probably more like the company had to suck up to the gangsters who run the place to even exist. And if those gangsters tell you to do something for 'national security' you know that not doing it means you end up like Mikhail Khodorkovsky. I.e. you lose a lot of money and end up in a hellish prison.

And even though conventional wisdom says malware only targets WIndows because that's where the volume is, that doesn't apply in this case. If you work for a company where the boss got an NSL or worries about being Khodorovsky'd you're going to find some code to read and write Linux/Android filesystems and hack into the firmware once he explains the consequences for not doing it.

Now IMO I'm less concerned about the US spying on me than Russia or China. So personally I'm OK with US kit. Same with UK or Taiwanese kit, because the US and UK are close collaborators and Taiwan is very much aligned with the US and against China. I'm not OK with Chinese or Russian kit. However the US kit *made* by a Chinese company is increasingly dangerous.

I.e. the issue is not OS. The issue is that the allegiance of your hardware vendor matters, because they can always inject malware into your OS. And there's a plausible motive why they'd do it, regardless of how hard you make it for them by picking a non mainstream OS.

Funny thing is as much as distrust Apple in other areas, they're actually very resistant to this sort of thing. They control both the OS and the firmware very closely. It's Windows, Linux, *BSD and which are vulnerable because the OS vendor and the hardware vendor don't share code. So a secure OS can be rooted by a malicious hardware vendor.

And I suppose the Android OEMs like Samsung, LG, HTC, Asus are too. They ship hardware and software together and control both. So if you trust them, you don't need to worry about a third party hardware vendor subverting their system.

Re:If it works

[Gr8Apes]

And even though conventional wisdom says malware only targets WIndows because that's where the volume is, that doesn't apply in this case.

The problem with windows is that it makes this type of attack trivial once the basics are worked out. I'm pretty sure last I checked that Linux is a much more heterogenous system even within the kernel itself, and that no bets can be made with any one piece of information about the installed OS to own it whereas with Windows - hey, write a small DLL here, inject into System32.DLL there and insert into the registry file under the run once key - takeover complete, and you have 80-90% of the desktops in the world at your bidding. It really is almost that simple. Now you have enough computing power to go after the real targets. It's absolutely scary how simple it is to own a windows system.

Re: If it works

[joemck]

Huh... If it's through the ACPI table, can't we bypass it similar to how the Daz Loader piracy tool works: run a "loader" binary before passing control to the usual Windows bootloader. The loader modifies the tables in memory to add or remove entries as needed, and the OS is none the wiser.

Re:I will only buy non-Intel chips now

[Narcocide]

At this point all AMD has to do is willingly release the information to provably disable their own management engine equivalent and they can sweep the market.

Re: I will only buy non-Intel chips now

[lucasnate1]

Too late, amd has psp.

Re:Yawn

[Anonymous Coward]

Typical slashdot user who is never satisfied by any progress toward something nice...

Re:Easy way to cripple Intel AMT/ME

[Narcocide]

Second time I've seen this post, and I want to believe it's accurate and complete. Can any 3rd party verify this information in any way with a citation?

Sounds like the right way to go

[Snotnose]

I have yet to hear of a single useful thing IME gets me, and lots of bad things it gets me. Current laptop runs an AMD chip, when it dies/becomes obsolete in 5 years or so I'll use it to determine which CPU my new system will have.

/ Yeah, I said 5 years. This thing is 3-4 years old
// hard drive is less than half full, even though I have a NAS I'm not good at updating
/// I remember the 3 year updates, with a graphics card every 18 months. Times have changed

Re:Yawn

[Narcocide]

Oh, admit it, you're thinking of drilling some holes in a few motherboards as a test, too.

Re:Good! Common-Sense tells you that, &?

[Narcocide]

Yea, the monitoring time is the real question I have here. Weeks... eh, slight confidence boost. Months... better. YEARS (multiple) and maybe we have reasonable confidence there isn't some timeout that waits before trying other outbound ports.

Re:Yawn

[BronsCon]

I can't speak for the AC, but I'd be down to experiment with a pile of motherboards and a power drill if someone else is buying.

Re:Good! Common-Sense tells you that, &?

[AHuxley]

Re monitoring
Are clandestine services staging servers pushing very direct requests over 16992-16995 to an ip that get detected time to time?
Huge malware scans up and down ip ranges in a random attempt to find the hardware that responds as cover? Ty.

Having worked at Intel...

[GerryGilmore]

...IME was originally designed for servers only. Any OldFarts(TM) out there - remember crash carts? Yeah, the ability to remotely power-cycle servers was a really big deal when you're running hundreds/thousands of servers and VMs were just a pie in the sky. Also, basic front-end network management 101 handled security. There are still good reasons to allow IME in server deployments, but I see no good reason for including this in laptops. I suspect that this was brought into the Core line due to those people building servers needing remote management using i7, etc. chips, but that's just a guess.

Re:Having worked at Intel...

[viperidaenz]

Isn't IME on desktops and laptops for when they're used in corporate environments? Remote provisioning, updates, etc.

It lets, for example, computers be removed from the network until OS patches have been applied.

Re:Having worked at Intel...

[Anonymous Coward]

Yes, it's ridiculously useful OOB management, like having a KVM built right in. While I think there should be a simple and transparent way to completely and verifiably disable it, having used it for many years, I can't agree with the many reactionary Slashdot commenters that it serves no purpose other than a convenient NSA back door. If it were to go away tomorrow, a lot of businesses would be severely impacted.

Re:Having worked at Intel...

[thegarbz]

but I see no good reason for including this in laptops.

Is that because you think the only equipment which needs managing is servers? Hell as someone who has a mother with a computer I'm personally hoping they'll introduce a HCF instruction that can be triggered remotely.

Ok facetiousness aside, IME is a "feature" based product which is why they charge extra for chips that have more IME functionality. Management of remote machines is customer driven. It's the same justification for things like bitlocker to be included in Microsoft's OS. These companies look to see what customers are paying others for and then seek to get in on the action.

Re:Having worked at Intel...

[tlhIngan]

I suspect that this was brought into the Core line due to those people building servers needing remote management using i7, etc. chips, but that's just a guess.

No, it was brought into the main chips because servers have stuff like IPMI and ILO for remote management, but employee PCs do not. And the same reason servers can be remotely managed can be applied to employee PCs and laptops. The only difference is servers are usually concentrated in a few areas, so it's much easier for 10,000 servers to be locally managed than 10,000 PCs, making the case for remote management of PCs even more critical.

You can do bare metal bringups - perhaps the employee got to their desk and their PC is dead - it won't load the OS and there's lots of error messages. IT's effectively ILO or IPMI for consumer grade machines.

Of course, you can't "disable" IME - you can neuter it. The firmware that controls power and boot and startup and all that must still run in order for the main CPU to be brought up, so you need IME to do that part. Neutering basically disables all the remore management while leaving the power management code still active.

Re:Having worked at Intel...

[Billly Gates]

Unfortunately, the homebuilt Asus sabertooth system I assembled uses Intel ME due to Raid I need for running Hyper-V and VMWare Workstation Vms.

I use Intel RST for storage which uses the IME for my fakeRaid. I am hooked on it so to speak. Also Wake on LAN and certain UEFI functions that need to work when you disable BIOS emulation( CSM ) for fast booting need that horrible Intel ME/Minix to run properly.

So even on PC's some of it's functionality is used. AMD has zonetrust. My hunch is maybe something in the EFI firmware spec requires a ring -2 (under -1 VM and 0 for ring 0 kernel in linux speak) it to run. I do know my board I can set my UEFI without a CPU!

This is a mess. For customers such as hospitals or banks having this is unacceptable and should be banned by insurance companies. Maybe an open source equivalent or a ISO or IEEE standard for UEFI should take the role of IntelME and AMD zonetrust and the ARM equivalents where the user can set this shit up and then install an operating system on top? Or maybe an OEM can have one pre-setup like a template where business customers and geeks can with a spec change if we desire to do so?

IntelME came up as an wake up on lan on steroids but grown into a a monster like SystemD at the hardware level which is a no no.

most servers boards have ipmi with own nic

[Joe_Dragon]

most servers boards have ipmi with own nic most boards have a setting for combined or own. If intel wants to kill ipmi and go to IME they will need have so it can be put on it's own nic.

Re:most servers boards have ipmi with own nic

[MikeBabcock]

They'll just embed the NIC controller in the CPU alongside the memory controller and the VGA garbage.

Re:LOL! Not really (downmod me? I repost)... apk

[OrangeTide]

Your downmodded posts aren't hidden. They are correctly categorized as garbage. Some people will browse and see the 0 and -1 garbage, usually other mods or brave people with too much free time.

Reasons that APK deserves frequent downmoding:
  1. lacks an account and always posts as AC
  2. makes duplicate posts
  3. admits to trying to avoid moderation
  4. frequently posts off topic advertisements for his [free] products and services.
  5. talks like a git. really his English phrasing is bizarre.

Re:I will only buy non-Intel chips now

[Anonymous Coward]

Yeah like how when Windows 10 introduced telemetry it became the Year of the Linux Desktop...that's right isn't it?

It should be opt-in, not opt-out

[Picodon]

...I can't agree with the many reactionary Slashdot commenters...

...there should be a simple and transparent way to completely and verifiably disable it, ...

I think it’s a bit more than that. The feature may be useful, but the outrage is legitimate. Consumers, most of whom arguably have no need for such feature, fortuitously found out about its existence and that it is enabled in their computers. They had not been told about it, so they had no way to even try to use it. Other people (government, corporate, hackers) knew about it, so the malicious among those were in the position of abusing it (by exploiting its features and its security flaws). No wonder consumers are in arms over this. They are not over-reacting.

So, no, a way to disable it is not enough. This kind of feature requires full disclosure (before you buy), documentation (so that you can actually use the feature if you want) and, at least on systems sold to consumers who are unlikely to use it, it should be entirely disabled by default. Institutional customers who buy computers in quantity can (and indeed do) request the configuration that they want (including, for example, activation of Intel’s anti-theft protection).

Re:It should be opt-in, not opt-out

[AmiMoJo]

You can't even disable it. There is a disable flag you can set, but the ME is still used to bring the CPU up from cold and then you have to trust that the flag does what it claims to do. You can try to sabotage the ME by deleting all the firmware modules except the early boot stuff, but then you are still vulnerable to any flaws in that boot code.

This is a general problem with CPUs. Most modern ones run microcode which is updated by the BIOS and comes as a binary blob. They all have hidden code, hidden features for testing and debugging, hidden op-codes.

A truly free CPU would be great, but matching modern performance levels could be difficult and fabrication on any kind of modern process is extremely expensive. To that end it might be interesting to try to reverse engineer the microcode on something like Ryzen, but even that would probably take years and get hammered by DMCA notices (so better do it outside the US).

Re:It should be opt-in, not opt-out

[Megol]

You can't even disable it. There is a disable flag you can set, but the ME is still used to bring the CPU up from cold and then you have to trust that the flag does what it claims to do. You can try to sabotage the ME by deleting all the firmware modules except the early boot stuff, but then you are still vulnerable to any flaws in that boot code.

Just as one is vulnerable to flaws in the transistor layout.

This is a general problem with CPUs. Most modern ones run microcode which is updated by the BIOS and comes as a binary blob. They all have hidden code, hidden features for testing and debugging, hidden op-codes.

X86 have to use microcode but most other do not.
Microcode in itself isn't a problem. The reason is simple: if you don't trust the designer/manufacturer of your processor then not having microcode doesn't make any difference. If you do then signed microcode updates isn't a problem.

Open source microcode updates would only lead to problems as they are part of the microprocessor design, the code is targeting a design that can vary even within a family (when hardware is patched to fix a problem microcode touching that hardware have to be updated). This means the microcode is similar to reverse engineering a processor - actually it is part of the processor hardware.

This is assuming that the signed, encrypted microcode update path is secure of course.

A truly free CPU would be great, but matching modern performance levels could be difficult and fabrication on any kind of modern process is extremely expensive. To that end it might be interesting to try to reverse engineer the microcode on something like Ryzen, but even that would probably take years and get hammered by DMCA notices (so better do it outside the US).

RISC V?

Ryzen most likely have a encrypted (external) microcode format so first you have to break the encryption. Given that you have essentially no knowledge of the internal implementation (though older designs and plain logical reasoning will help see likely patterns) and that the encryption is probably AES 256+ class it will be hard to the level of practically impossible to do. And even so actually getting the CPU to accept a "free" update means going through a cryptographic signature check.

Not even having access to the advanced technology required to physically reverse engineer hardware is likely to help much assuming the crypto engine is competently designed for security. Using statistical techniques + a lot of processors can help but a huge cost.

Re:It should be opt-in, not opt-out

[AmiMoJo]

Microcode in itself isn't a problem. The reason is simple: if you don't trust the designer/manufacturer of your processor then not having microcode doesn't make any difference. If you do then signed microcode updates isn't a problem.

It is a problem, because unfixed microcode can change the behaviour of the CPU. Even if you do trust it, you can't be sure that it can't be backdoored by someone else. Signed updates help but are not bulletproof.

RISC V?

Maybe one day. For now the price/performance isn't there.

Not really your laptop

[Anonymous Coward]

if you can't control what's in it.

Re:LOL! Glad you sockpuppet self-upmodded yourself

[thegarbz]

The GP was unkind to you. I don't think you deserve to be censored. You provide a very good service. Personally I enjoy a good APK post with a side of LSD. The resulting colours in the sentence structure are amazing.

Re:/.ers clearly disagree OrangeTide FAKE name

[rot16]

I didn't know people like this existed. Until today. I feel like being extremely privileged.

Re:Easy way to cripple Intel AMT/ME

[Z00L00K]

It's APK, and I don't trust APK at all due to the spamming.

Minix more popular on laptops than Linux

[Keruo]

Isn't it mind-boggling that Minix is actually more used on laptops currently than Linux?

(The management engine runs custom version of Minix)

Re:Minix more popular on laptops than Linux

[Megol]

Please write Minix 3 as it isn't the same as previous versions, designed for different goals and with different design features.
Have seen many supposedly technical people being confused already, thinking that the ME runs what Linus Torvalds once used before making Linux.

Re:Minix more popular on laptops than Linux

[Hallux-F-Sinister]

Isn't it mind-boggling that Minix is actually more used on laptops currently than Linux? (The management engine runs custom version of Minix)

That might be true if no one used laptops anymore with older generations of Intel chips, before they put Minix code into them, or laptops that use AMD microprocessors, or that use some other microprocessor that doesn't run Minix; I think there are a few.

So really there are no reliable numbers of how many systems run Minix, and therefore no reliable numbers on the percentage of Minix installs versus anything else; at best you could know how many Intel MADE, if they published those figures, and you could take wild guesses about how many of those are still in use today, limited only by an upper bound in the form of the maximum number of processors running Minix, inasmuch as the number currently running it on account of being included in the ME stack of certain Intel chips, cannot exceed the number of Intel chips of the kind they put it in, released. That is, there may be OTHER systems running Minix in the total number that have nothing to do with the Intel ME, BUT, of the copies of Minix running because it was included with Intel chips, the maximum number is limited to the number of those chips manufactured, and in turn further limited by the number actually installed in a computer, and of THOSE, further limited to the number still in use, (and not retired/recycled,) etc.

Personally, if your computer was sold to you without disclosing this, and so your computer is doing things you'd like it not to, or has a vulnerability you'd like closed but can't get closed, it sounds as if Intel might be in violation of various laws preventing unauthorized use of other people's computers. (If I can go to jail for writing a virus, worm, trojan, etc., that makes your computer do something you wish it wouldn't, they should be eligible for jail time for this, since it's basically the same thing. Unbeknownst to users, Intel was cramming all kinds of things into processor chips that shouldn't be there, and running code we'd like them not to be.)

At the very least, a class-action lawsuit on behalf of owners or users of all computers this touches should probably be filed, and at least put a massive crimp in Intel's bottom line. Plus, I would like my Intel-processor-using computers scrubbed of this, or better still, the CPUs replaced at Intel's expense, and I think they should also have to pony up for the inconvenience.

But will any of this happen? Maybe... one day. But the way things go now, it'll take decades, and most of us will have died or forgotten about this by the time we get letters in the mail about how we have to accept our "share" of the proposed settlement, which will turn out to be a gift certificate for $5 off a new computer from any of this list of manufacturers, with Intel processors, (which we can't trust anymore anyway,) inside.

Anyone still stupid enough to think 'security through obscurity' is a good idea?

Speaking only for myself, I'd like to see System76 either switch to a different processor free of this, or make their own, because yeah, how DO we trust that it's been deactivated, and won't either spontaneously reactivate itself, or be able to BE reactivated during an attempt to exploit? (How awesome will it be if 10 years from now, System76 has claimed the crown of world's largest PC maker, makes their own custom chips, (preferably open source,) and this event was what started it all and put them on the path to greatness?)

Re:Minix more popular on laptops than Linux

[zwarte piet]

Tanenbaum's revenge on Linus, Muhahaha!

Trust my technique being upmodded then... apk

[Anonymous Coward]

See subject & https://it.slashdot.org/comments.pl?sid=11050927&cid=55109115/ & spam? See https://slashdot.org/comments.pl?sid=11424811&cid=55655675/ , https://slashdot.org/comments.pl?sid=11424811&cid=55655691/ & https://slashdot.org/comments.pl?sid=11424811&cid=55655719/ where our /. peers shut you down speaking FOR me against your bs outnumbering you by MANY orders of magnitude as they both LIKE & USE my work - not yours - you're not capable of being useful, troll.

* Period!

APK

P.S.=> Too bad you never come up with something that works like I do Z00L00K - you're not capable of THAT either but I am - you WISH you were me, lol... apk

Re:LOL! Not really (downmod me? I repost)... apk

[Anonymous Coward]

lacks an account and always posts as AC

So fucking what? This site allows anonymous posting. That is not a reason to downmod anything. Anonymous comments already start at 0. Just because you think everything online has to be tied to an account doesn't make it so.

Re:Yawn

[Megol]

Technically what you found was a mirror.

Good job

[Anonymous Coward]

System76 seems to be one of very, very few American manufacturers that can be trusted. But one issue still remains - have they received any NSA court orders, compelling them to subvert the systems they sell?

EZ way to cripple Intel AMT/ME

[Anonymous Coward]

Stop it's ability to send info. outward via router port filtering ports 16992-16995 + 623-625 Intel AMT/ME uses in a modem/router external to OS/PC.

Intel ME/AMT operates from your motherboard but has NO CONTROL OF YOUR MODEM/ROUTER!

(This stops it cold talking in/out permanently OR being able to remotely 'patch' it to use other ports by Intel OR malicious actors/malware makers etc.!)

Additionally, once you disable the AMT engine's software interface (ez via software articles note)? A malware to 'repatch' this = impossible (bios updaters require it in usermode ware, e.g. ASUS).

(I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system (no home LAN but TCP/IP connected online in BOTH my modem or router port filters or software firewalls))

HOWEVER - Be CERTAIN your modem/router's internal ware is "solid" too (turn off things like UPnP etc. & CHECK router/modem HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately)) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/

* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones don't)!

APK

P.S.=> Good luck - it's the BEST EASIEST & CHEAPEST DEFENSE using what you already have (hopefully, again as not ALL modems have port filtering but most do & certainly GOOD ONES DO) vs. this threat by stopping it being able to communicate in/out period, from OUTSIDE of the INTEL chipset external to it via a router/firewall hardware... apk

Re:I will only buy non-Intel chips now

[yuvcifjt]

Err no it's not.

I was quite surprised (and saddened) to discover that Win10 has been the most popular Windows OS in Western nations for several months now, including America and Europe,overtaking Win7 around the beginning of 2017.

And sadly, Win10 is now only 2% behind Win7 as being the most popular Windows OS in the World.

If people are sheep-enough to let Google use them with Android / Chrome, then it makes sense why Microsoft following their spying strategy will also succeed.

People simply don't know / don't care about their privacy.

Re:Easy way to cripple Intel AMT/ME

[yuvcifjt]

Hate to defend an illegible spammer like APK, but he appears to be right in blocking certain ports used by Intel AMT.

Hey, system76!

[nightfire-unique]

Design a model of your laptop with the original IBM 7-row keyboard and trackpoint, and you've got a customer for life here!

Re:Hey, system76!

[Ayano]

They get their laptops from the generic laptop manufacturer that supplies both Clevo and Sarger.

The only real add they have is a small crack driver support team and a little customization before shipping it to you.

That said, it's guaranteed to work with the hardware, and I've had several s76 laptops both personally and purchased on my behalf at the workplace. Not really sure how I feel about them, but I do like their mobile workstations (a 'special' kind of laptop).

Re:LOL! Not really (downmod me? I repost)... apk

[OrangeTide]

So fucking what? This site allows anonymous posting. That is not a reason to downmod anything. Anonymous comments already start at 0. Just because you think everything online has to be tied to an account doesn't make it so.

Sure, it's fine to post as AC. It's an integral part of this site. But mods are going to down mod ACs if they post horseshit. And in APK's case, he's not really anonymous. He's signed everything and chooses not to post under an account in an attempt to manipulate the comment system. He's done this for years with limited success.

PS - I've not spent a single mod point on this thread (obviously I cannot). This account is old enough that if I had multiple accounts I would more likely have the mod points on this account than some newer account, so it cannot be a sockpupper mod either.

PPS - I do use APK's host file on all my systems at home. His persistence and technical abilities work well for maintain host files. But he's less effective at communicating with other human beings on this forum. Either by his own choice or by his own limitations.

Re: /.ers clearly disagree OrangeTide FAKE name

[OrangeTide]

It's OK. I knew he'd bring out personal attacks when I responded to him with my account. Usually people reply AC to him and he ignores them after a while. He'll be fuming for a day or two before he finds something new to do. I've dealt with him before, and I've dealt with others on /. that were worse with boundaries than APK, to the point of filing police reports. At least APK usually only tries to discredit or embarrass me.

A trainwreak - for /.ers viewing pleasure

[OrangeTide]

Guess what else I found? You EVEN complimented me on hosts being effective for you in your post history stopping ads in videostreams (I could've told you that - I never see YouTube ads, or rarely until I block the server serving them up, easy to find) - but NOW you give ME SHIT?

You don't seem to understand that one thing has nothing to do with the other. I can appreciate your persistence and technical abilities, while finding your posts inscrutable and bizarre.

You seem upset, but I gave you a very fair enumeration of why people tend to down mod your posts. I'm not orchestrating some down mod conspiracy against you, but I did draw a reasonably accurate picture of how mods independently come to the same conclusion.

If you want to take my old resume and do something with it. I'll let you know that it is copyrighted material, and authorization to reproduce that material is not automatic and must be obtained. I've granted others to reproduce it, but I have not granted you those same rights. (obviously)

Inadequate fix

[Anonymous Coward]

Intel CPUs still run a blob at initialization called the FSP. This is sometimes entangled with the ME, but is separate and is not getting disabled. The blob is usually writable for updates and must run before any user-supplied code, so it's an ideal spot to put persistent malware to evade verified boot anti-persistence schemes. The AMD equivalent is called the PSP.

Re:I will only buy non-Intel chips now

[Rick Schumann]

Hate to tell you but so far as I know AMD has it's own version of the Management Engine baked right into their silicon as well.

How will this affect HDCP?

[Rick Schumann]

Having worked at Intel for a while testing graphics drivers, I know that the Management Engine is also leveraged to perform HDCP (High Definition Content Protection) as well as remote-management functions; any idea how disabling it at the firmware level will affect that? If HDCP is disabled as well then some AV content might not be playable on Intel platforms.

Re:How will this affect HDCP?

[Hallux-F-Sinister]

Having worked at Intel for a while testing graphics drivers, I know that the Management Engine is also leveraged to perform HDCP (High Definition Content Protection) as well as remote-management functions; any idea how disabling it at the firmware level will affect that? If HDCP is disabled as well then some AV content might not be playable on Intel platforms.

System76 laptops run GNU/Linux, I think... or at least of the ones that do, that's kind of the selling point. SO... does HDCP work under/with GNU/Linux? I thought HDMI worked but HDCP didn't. Am I wrong? Is there a way to play encrypted Blu-ray movies, for example, on a computer running GNU/Linux, and at full/max resolution? (It's not a sarcastic or rhetorical question... I didn't know they had any that would. I'm not saying they don't, only that I didn't know anyone had managed to do that.)

Re:You start it. I finish it + call u what u are

[OrangeTide]

OrangeTide you called me names 1st offtopic:

You've called me names and bullied me for YEARS. Also read carefully, I did not call you a git.

5. talks like a git. really his English phrasing is bizarre.

No Intel AMT/ME on my ARM, so it's not really a problem that I've looked into. Given my networking background and multi-system household I probably would have attacked the problem using routing tables rather than hosts file, certainly disadvantages to routing tables but easily centralized and it's what I am familiar with.

Good on you for finding a solution that anyone can make use of and for sharing it. But that doesn't justify your abusive behaviour for the last several years.

I even show him complimenting my hosts technique & also where he TRIED 'weaselling out' of RTF issues I nailed him on.

Please paste the link where you nailed me on "RTF issues". We haven't seen any proof.

Doesn't add up considering YOU GOT DROPPED (or left) IN THAT SAME TIMEFRAME TOO LIAR / [slashdot.org] & "laid off" https://slashdot.org/comments.... [slashdot.org] YOU GOT DROPPED/FIRED https://slashdot.org/comments.... [slashdot.org] - IN THAT TIMEFRAME TOO - YOU are busted lying!

You screwed up the with your assumptions. The post from 2016 refers to being laid off in 2001. Which I was out of work for about a year and doing random consultant gigs to pay the bills.

YOU GOT DROPPED/FIRED https://slashdot.org/comments.... [slashdot.org] - IN THAT TIMEFRAME TOO - YOU are busted lying!

My post in 2015 is about my quitting Amazon in 2009.

7 yrs. on SAME job eh? [...] Doesn't add up per https://slashdot.org/comments....

I've been at NVIDIA for 7 years. Started in 2010.

AFTER this from your post history (of bullshit) https://slashdot.org/comments.... [slashdot.org] & 15 yrs. on that job too?

Yes, I've been working in IT since 1996 and as an embedded SW engineer since 1999. That's over 15 years. I have worked a few places as full time, and a lot of places as contractor. The paperwork in California to work as a contractor for more than 2 years is complicated so I usually move on but sometimes I convert to full time. You could describe that as being a "jobhopper", although it has more to do with the legal requirements in my state than any lack of commitment on my part.

So no lies there. I've certainly made mistakes in my life and online. I'm certain I have embarrassing posts on slashdot, I vaguely recall writing several. But you've failed to turn up anything damning.

I think your lack of reading comprehension, inability to contextualize and wild assumptions have a lot to do with your emotional and mental state. Do you have difficulty empathizing with other people? Is it hard to read the motives of other people? Are you suspicious that people are plotting against you?

Well it's not true. I'm not plotting against you. I'm not your enemy. And I tried very hard to have a two way discourse in spite of threats, walls of texts, off topic rants and repetitive statements.

This has not been a two-way discussions, it's been you shouting at me the entire time. Thank you for your participation, in the future learn to let others people participate in the discussion as well.

Tuxedo did it months ago...

[Herve5]

When we migrated from macs to linux laptops one year ago, I first considered buying System76 machines. I quickly understood they'd never offer the non-US keyboard in use here (I went up to asking them if a separate procurement would be feasible... no)
Then I discovered, much closer to my home, the German guys from Tuxedo. Smaller company, not the same surface on internet. But brilliant products. And localized keyboards.
Well, when the Intel-mgt-bug was discussed (first on LWN, months and months ago) I contacted Tuxedo asking if they'd upgrade things. Basically, the thing was already disabled on the recent machines I just bought.
As some other said, Syst76 are VERY late at the party...

Re:LOL! Not really (downmod me? I repost)... apk

[KingBenny]

well, actually , its a rating, not moderation ... nothing gets censored but people are free to filter as they please, thats about it, i think this is still one of the best if not THE best forum/site on the whole wide wwwebs

Re:Purism

[Sri Ramkrishna]

This is not a fair statement to make. It is akin to the same mentality from people who say "why do I need IT? I can just go to a store and buy a laptop and self support.". What goes into the clevo shell is still done by System76, making sure they work with Linux, have a customer support framework around it, and so forth. Plus there are contributing upstream with fixes to GNOME, fixes to Ubuntu, and is part of the eco-system. You might also consider that Purism doesn't make their own laptops either.