Hacker News Reader

Comment by mike_hearn | Hacker News Reader

It'd make no difference, as the keys in question are replaceable via microcode updates and the microcode version is included in the remote attestations.

SGX doesn't really give Intel "control" in the sense of taking away existing freedoms. It's a new feature. You can always elect not to use it, or not to use software that uses it.

View on HN

You can always elect not to use it, or not to use software that uses it.

That's always the excuse given for every new invasive user-hostile feature. The problem is when the majority of new applications and websites require it. You can always elect not to use a computer either, but I think such a position would be untenable even for a "extreme Stallmanist".

It gives Intel control over developers. In general, a computer will execute what you ask it to. SGX will not let you run production enclaves without Intel's permission. This is like Verified Boot, except there's no credible security benefit to be gained from it.

It is a bit of a bait-and-switch since no other CPU feature works this way and Intel never mentioned this "feature" in all their years of disclosures about SGX.

Isn't that how most extensions work? And microcode has been around for at least a decade now.

I know of no other CPU feature that requires authorization from Intel.

TXT requires an ACM, which is essentially a small signed BIOS subset. At least ACMs are freely downloadable from Intel, and they don't look into what you'd like to run under TXT.

https://software.intel.com/en-us/articles/intel-trusted-exec...

Reply on news.ycombinator.com