Hacker News Reader

Comment by 0xbear | Hacker News Reader

Intel CPUs had the various "management" features for over a decade. Does anyone actually use them though?

So did AMD CPUs:

"For years AMD’s processors for business PCs supported additional security technologies (collectively known as AMD Secure Processor and Platform Security Processor before that) enabled by the ARM TrustZone platform with the ARM Cortex-A5 core. AMD’s previous-gen PRO-series APUs included Secure Boot, Content Protection, per-Application security, fTPM 2.0, and support for Microsoft Device Guard, Windows Hello, fingerprint security, data protection and so on."

I honestly don't know who uses them. I've not seen it in finance or health. Government?

TrustZone is not a "management" feature in the sense that Intel AMT is; it is a security feature that can prevent/obscure certain hardware access (basically Ring 0 for peripherals), but does not allow for out-of-band machine access like AMT (although in-band machine access, with the firmware circumventing the user OS is a possibility).

Trustzone is ARM's hardware access control. But I suspect AMD's PSP which incorporates an on-die ARM core rather than just implement the Trustzone ip, is doing a lot more. Reportedly it can manage DMA actions itself independently of the amd64 core.

Seems like a catch-22 of adoption. Not worth the effort to develop on unless it is ubiquitous enough? I'm sure there will be growing (security) pains as well. Also not sure exactly how AMD allows development for the PSP (specific vendor keys?).

I've seen IME (or its more featured server companion iLO) in both servers and workstations for out-of-band remote management.

It's really nice from a corporate admin view - you can always make sure machines have latest updates installed, reinstall them when users mess stuff up... and you don't depend on the machine being powered on or a working OS!

of course, anyone who has to manage more than a dozen boxen for employees of his $CORP.

enterprise computer management is a sanctioned backdoor just as employers are allowed to read your corporate email.

Exactly. Those boxes were bought and paid for by the corporation. They are the company's property, and they have the right to access them whenever they want.

It's a shame that those backdoors then find their way into consumer products, but it's silly to assume that a corporation doesn't have the right to access their own equipment.

No they don't.

Except legally they do and morally it's debatable.

I have no expectation of privacy on a work machine as the company has to protect its IT systems and assets.

However I do have in my case since it's a Linux desktop with encrypted disks to which I have the password alone in a company full of Windows machines with an outsourced IT department who couldn't support Linux if I asked.

They wouldn't be selling them unless somebody was buying them.

They wouldn't be selling them if the customers had a choice.

But the customers don't.

You have a choice. You need to specifically buy a Q-series chipset to get working AMT.

I presume that's a sign some enterprises are buying it or Intel wouldn't bother with Q-series.

Another story is that the difference between Q and non-Q may be nothing more than firmware and some ROM bits ;)

But ME is everywhere.

ME is not a "management feature", it's a general purpose auxiliary CPU used to implement management features and also "consumer features" like DRM.

Whether you like it or not, ME is not relevant to the fact that yes, the AMT was developed because some customers actually use it.

That very well may be, but you are the only one talking about AMT, and I still can't get a CPU without an undocumented privileged CPU thrown in. If I had a choice, I would not get ME

The whole thread started with somebody asking whether Intel management features are of any use:

https://news.ycombinator.com/item?id=14668965

To which you responded that Intel wouldn't be selling them if customers had a choice to which I responded that they absolutely would.

What is fun is the confusion between DASH and PSP.

Only as a backdoor.

Let's be fair. It's not used only as a backdoor. There are a few enterprise use-cases for it, too.

So, I would say it's mostly used as a backdoor.

But does anyone actually use them for that? In the server space people do not and instead use management cards from the server manufacturer, but I have never worked with desktop IT in an enterprise setting. My guess is that enterprise workstations is the intended audience for the IME.

Reply on news.ycombinator.com