Hacker News Reader

So, to be honest, I don't know all that much about the ARM world, and I hadn't heard of TrustZone. I looked it up, and it seems that the OEM has a great deal of discretion in setting it up, to the extent that there's a reference implementation on GitHub [0]. And if I buy a bag of loose SOCs, which I can apparently do now, I'm the OEM.

[0] https://github.com/ARM-software/arm-trusted-firmware

View on HN

Right, kinda like what happens when you buy a Xeon or an Opteron. You can enable AMD SKINIT / Intel TXT & UEFI Secure Boot if you like. Intel didn't force this upon the consumers, the OEMs requested the processor features.

But one cannot disable Intel ME. So

> Intel didn't force this upon the consumers

is wrong. I know that vendors producing servers want that Intel ME (because otherwise remote servicing servers would be much harder), but they surely did not require from Intel that Intel ME cannot be disabled.

But IME is distinct from "Intel TXT & UEFI Secure Boot" ("this"'s referent).

> Intel didn't force [Intel TXT & UEFI Secure Boot] upon the consumers

is true. Both of those things can be disabled on most hardware. In fact, I disabled them on the laptop the I just bought, because I wanted to install OSes that aren't SecureBoot signed.

Reply on news.ycombinator.com