Hacker News Reader

Comment by breatheoften | Hacker News Reader

This is the kind of thing that will cause Apple to switch to internally designed arm chips for their Mac line with great alacrity.

One could argue that it’s surprising they haven’t already.

View on HN

Performance still matters. They're getting closer, but they aren't there.

> "baseline score of 4400 (which is the score of an Intel Core i7-6600U"

https://twitter.com/codinghorror/status/907711853530300416

It rips my current computer apart, which is perfectly decent:

https://browser.geekbench.com/v4/cpu/compare/4107961?baselin...

Am I the only one sceptical about if these scores actually translate to true computing power?

If these things can outperform on passive cooling why are we not seeing people building farms out of them with active cooling.

You're right but it's not a drop-in replacement: obviously being passively cooled into such a small device does not make it useful for constantly sustained performance. I'm confident aptly designed hardware surrounding those chips could have the characteristics we're looking for, but there are multiple barriers to break, such as a software <-> hardware synergy that is lacking for laptops, desktops and servers on the ARM side of things, as well as the current platform being largely good enough, so there's really no incentive (yet). IOW it's too esoteric right now to be of value, although some have tried, such as Scaleway, but that's not A11, and we all know where non-Apple ARM performance stands currently.

I am also skeptical. I would love to be proven wrong and see ARM as a successful competitor to Intel's monopoly first and the x86 monoculture second. (I'm also excited by AMD's recent successes in the CPU sphere. The Threadripper 1950X is a phenomenal CPU — 16 real cores at 3.4GHz is nuts and like nothing Intel sells.)

I think they can very likely match the TDP-down (7.5W,800MHz) performance of a Intel CPU from 2015 in a passively cooled iPhone. Now can they match the TDP-up (25W,2.8GHz,actively cooled) performance of this chip? Probably not.

That's the thing with Intel CPUs. There are a huge number of ways to configure them. Even knowing the part number is not really enough to judge what the overall system performance will be.

https://en.wikichip.org/wiki/intel/core_i7/i7-6600u

Give me a break. The same three letter agency that convinced Intel to do this will convince Apple to do the same. I'm guessing you're basing your faith in Apple based on their refusal to cooperate in the San Bernadino case[1] and the so-called "cop button" in iOS 11[2]. (And some generic "we value privacy" rhetoric that I won't bother linking.)

That stuff is great but doesn't mean much. Just because they're blocking border agents from trivially imaging phones at the border doesn't mean that they won't cooperate at a higher level with some undocumented baseband features.

Just as Defense in Depth is a concept in security, we've already seen a corollary "Offense in Depth" from the intelligence community. Is the best attack in the random number generator[3] or undocumented silicon[4] or intercepting your boxes on the way to your data center[5] or tapping your fiber[6] or stealing your certs[7] or paying your employees to go rogue[8]? Why choose when you can just do them all.

Apple hardware is vertically integrated and utterly undocumented. The AMT chip has been present on motherboards since 2006[9]. The Snowden Introspection Engine found that the Wifi Chipset remains powered up even when Wifi is turned off.[10] I find it hard to believe that the same government who went to all these lengths to compromise our infrastructure would really let Apple get away with refusing. How did that turn out for Joseph Nacchio?[11]

[1] https://www.washingtonpost.com/world/national-security/us-wa...

[2] https://www.cultofmac.com/498052/ios-11-lets-quickly-disable...

[3] https://en.wikipedia.org/wiki/Random_number_generator_attack...

[4] https://en.wikipedia.org/wiki/Hardware_backdoor#Examples

[5] https://www.extremetech.com/computing/173721-the-nsa-regular...

[6] https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...

[7] https://nakedsecurity.sophos.com/2013/12/09/serious-security...

[8] http://www.ocweekly.com/news/fbi-used-best-buys-geek-squad-t...

[9] https://libreboot.org/faq.html#intel

[10] https://www.documentcloud.org/documents/2996800-AgainstTheLa...

[11] https://en.wikipedia.org/wiki/Joseph_Nacchio

You're asserting that a 'three letter agency' convinced Intel to do this, and asserting it as factual. I'm not convinced that it is, and think market focus is more probable than nefarious agencies. Though, to be sure, those types of agencies would probably be willing to take advantage of this.

No, it seems more probable that they did this because their largest customers want centralized management at a low level. They want to be able to track and control assets, and to prevent asset loss. They, being the largest customers, control the features that Intel offers. It then makes no sense, financially, to make two versions of the CPU.

Unfortunately, the market for people who care is vanishingly small. Most people don't much care about privacy or security, other than to pay it lip service - if even that much. Prevalent is the idea that they've nothing to hide and, thus, nothing to fear.

So, without evidence that this was inspired by a three letter agency, I'm going to assume it is a financial decision. That seems much more reasonable and probable.

Do you have any evidence to prove three letter agency coercion? I'd expect it to be quite the news event, if you did.

If what you say is true, why has vPro not seen wider adoption?

It has been around long enough.

Anybody work for an MSP or enterprise that actually uses this in the field?

I can't say, really. My contention was largely around the idea that it was asserted as fact that it was at the behest of a three letter agency and the remainder of the comment presented based on that. It has not been established that it was at the behest of a three letter agency and presenting arguments based on that is like building a house on the sand.

It hasn't anything to do with quality specifics, nor of alternatives. Without factual evidence to support the three letter agency theory, the rest of the argument is invalid.

Don't get me wrong, I think it's a horrible idea. I've just seen no reasons to assert that it was done because of a three letter agency being the directors. As near as I can tell, and I've followed this fairly closely, no such evidence exists. At best, it's speculation. At worst, it's conspiracy theory. Either way, presenting it as fact and then basing an argument on that is illogical.

We can do better than that. There are lots of valid complaints that don't need speculation, disinformation, or hyperbole. IME is a horrible idea, at least it is so long as you can't disable it as the end user. This very thread is a fine example of one of the reasons that it is horrible. It's a security nightmare and should be user controlled.

No three letter agency needed to point this out. Wild, unsubstantiated, accusations may make people take the complaints less seriously. That seems less than helpful.

Do you then have substantive evidence that market forces/centralized management caused this?

No, but I do not present it as fact nor as being the only possible solution. I think it more likely, as I said. In fact, I was clear about saying it was only my opinion that it was more likely.

That's pretty different than asserting it was done at the behest of a three letter agency and then basing a whole argument on that. Extraordinary claims require extaordinary evidence.

Occam’s razor. I’m a very conspiratorial person and I’ve seen nothing to suggest any nefarious activity or collusion so I’m not getting carried away on this.

https://securingtomorrow.mcafee.com/executive-perspectives/a...

This is a statement by the Intel CTO from 2016 on the ME discussions, and briefly reassured us that Intel is conscious of the security of the ME, and that they have teams dedicated to it and can push firmware updates out to cover vulnerabilities.

https://www.intel.com/content/www/us/en/architecture-and-tec...

Intel made an official announcement in May that they have discovered an escalation of privilege vulnerability and are addressing it accordingly as you would expect. It also notes that consumer hardware and firmware is not affected by the vulnerability, demonstrating that Intel actually does release two different chips, and prioritizes privacy and security more over features on the consumer models.

https://newsroom.intel.com/news/important-security-informati...

Intel releases a software tool for checking if your system is one of the vulnerable units or not, they have a fix already for the firmware and confirm it is not due to physical design flaws, and are working with manufacturers to push the updates ASAP.

Overall, I don’t feel like Intel is at all intentionally sabatoging it’s customers, and genuinely considers the ME a valued feature by consumers, even though it bothers me that one is included on every product, they do differ and consumer models have fewer privileges than business models, which seems to be more of a firmware design than a hardware design, so I tend to believe that they simply don’t design extra chips without the ME and instead lock it down more on a software level. Vulnerabilities also appear to be firmware based, and the extremely vague announcement by black hat doesn’t suggest otherwise either. Intel very obviously takes the security of their devices very seriously and makes themselves available to users who need help identifying whether or not they’re vulnerable and what to do about it.

In post-Snowden era, I'm not sure that Occam's razor applies that way anymore.

If the FBI couldn't compel Apple to make a slightly modified version of iOS, the NSA certainly couldn't compel Intel to design and implement the ME.

Nor could they likely pay them enough to make it worth the trouble if there wasn't a market for the ME - Intel is $170 billion company, with a $12 billion R&D budget last year alone [0].

[0]https://www.electronicsweekly.com/blogs/mannerisms/markets/i...

THANK YOU. Intel is not Facebook or Google or Microsoft. They do not run software botnets, search engines, or social networks. They do not have political directives or dreams of changing the world. People with those objectives infiltrate other industries where they can actually influence something.

I'm not sure why people immediately jump to conclusions that things like this are the result of actions by three letter agencies. I just don't understand why people do that?

On another site, having a similar conversation about this very topic, multiple people jumped in to assert that this was done at the behest of the NSA and that the legal mechanism for doing so was a National Security Letter. No amount of linking was able to convince them that that's not even what an NSL does. Nor would they believe that an NSL contains no such mechanism to force a company to do such.

Worse, it was multiple people who believed this. It wasn't just one isolated individual. Even showing them what an NSL really is made no difference to them. I pointed out what it did have the power to do, and they countered by saying that's what they claimed but that it could secretly do more. I asked for a citation and was told it wasn't out there because it was top secret. They linked to some of the most outlandish stuff, as if Cold War spies were actually proof that the NSL could compel Intel to include the ME and to include exploits in the code just for NSA use.

It went on like that, for a good day and a half of back and forth. I finally gave up trying to help them be sane.

I don't get it. I truly don't understand. These are otherwise bright people, or so they seem. I'm well and truly flabbergasted by this behavior.

Autism is a hell of a drug

This comment violates the guidelines: https://news.ycombinator.com/newsguidelines.html. Please don't post like this here.

Recent intel Cpus are designed in a country with a rich history of using and spreading exploits. I think it's a coincidence.

> It then makes no sense, financially, to make two versions of the CPU.

You are wrong. They offer countless different versions of CPU's, famously denying "enterprise" features like ECC to private customers. One can only wonder why they are so generous and give everybody "enterprise" manageability for free.

Your arguments make sense that the attack capacity continues to advance on many fronts (of course, the easy exploits like social engineering still remain the most common exploits by far — in raw numbers and probably in terms of impact as well). I would argue though that the existence of advanced attack capability doesn’t mean that the securable surface area of computing functionality can’t also grow over time.

I can probably agree that none of apple’s actions have significantly affected the percentage of computing functionality used in society that is comprisable at low cost — however I do think that Apple can choose to act to (1) increase the average cost to compromise (2) expand the (incredibly small) set of functionality which is not trivial to compromse.

I don’t think that any truly expert 3-letter agencies can reasonably oppose those goals in a way that completely prevents them from advancing. I think it would be self-defeating for the NSA to implement something like a “security blocking sophon”[1] that permanently cripples the capacity of technology to become more trustworthy given how dependent are the societies in which these entities operate on trustworthiness being possible in some contexts ...

[1] (sophons are a concept from this novel — which I won’t spoil, great series!) https://en.m.wikipedia.org/wiki/The_Three-Body_Problem

Thank you for providing sources with your statements.

I agree with your premise but still want to recognize you backing it up with data.

Apple is a large enough buyer that they could probably get Intel to supply CPUs with the feature disabled. They likely don't have to go as far as changing the CPU architecture entirely.

Google has already asked and Intel said no. You would need to get a coalition of many different OEMs in order to force Intel's hand.

EDIT: Actually, I might be mis-remembering. After a short while of searching I couldn't find any references to what I just said (though searching for "Google" appears to make the results less relevant than normal).

Do you have a reference for this?

I just searched for a while and couldn't find it, so I must be mis-remembering. Edited.

You must be. We have always been at war with Eurasia.

Its possible that this isn't so because the performance would be relatively crap.

I wouldn’t be so quick to dismiss the idea on performance. The new A11 seems to be doing pretty well: https://www.extremetech.com/mobile/256090-apples-new-a11-bio...

Now imagine that with a laptop’s power budget. Put a Transmetta like x86 decoder in front for legacy apps, combine with Apple’a full stack control, custom blocks on the chips, llvm bitcode and a few more years of development and you end up with a laptop that covers 80% of Apple’s market.

They can still use Intel for higher end machines, but the bulk of laptops will be all Apple. Along with unbeatable battery life.

Translating from x86 on the fly to run most existing desktop apps combined with switching to an under performing platform would be a one two punch that would make apple unpalatable compared to the competition. Further it would disable the idea of installing windows in a partition for gaming or other purposes. It would further require supporting software on both x86 and arm unless apple is willing to wholly surrender the high end.

Apple laptops already have a good battery life. I don't think people would be willing to give up performance relative to competitors products to have better battery life.

Basically in sum you are expecting apple to support 2 different hardware arch on the desktop/laptop, have inferior performance compared to windows, give up bootcamp etc in order for people to have 14 hours of battery instead of 9 when they will just do what they currently do and plug their devices in when they go to bed.

Its certainly an interesting idea but I think the downsides outweigh the positives.

I think different people have different use cases. Not everyone is tied to legacy apps. I’m sure a lot of MacBook Airs are just used for web and email. Look at the Macbook, it’s trade-offs are for people that want long battery life and probably do a lot of typing. Think journalists on the road, on long flights. I’m sure that market would jump at longer battery life for majority of apps.

As for not being able to install Windows, I’m sure you could if the x86 front end was in silicon (again, think Transmetta), but it is probably not for that target market anyway.

As for Apple supporting two systems, I don’t see the problem. They did it for the 68k to PPC and PPC to x86 transition, and when you own the entire stack, including system language and build chain, it probably isn’t as big a deal as cross platform with different APIs and paradigms.

Why Apple wants to do that?

I mean, if use a tapped Intel chip can keep FBI and NSA away from their door step, they probably more than happy do to that.

Because at the end of the day, most people will only blame Intel, not them.

In the short term maybe, but in the long term apples capacity to generate profit will eventually depend on their ability to implement systems that operate in society with incredibly high levels of trustable operation (autonomous cars, robots... — who knows what the future tech will bring — many of those possibilities will require at least same as level of computing security as is possible now. If it becomes widely possible to remotely compromise anything with an Intel chip — then the intel parts will simply not be viable parts in future products)

Reply on news.ycombinator.com