Purism Librem Laptops Completely Disable Intel’s Management Engine | Hacker News Reader

Purism Librem Laptops Completely Disable Intel’s Management Engine

puri.sm

322 pointsmike-cardwell164 comments

There's a blog post on their site that goes into detail on how this is done: https://puri.sm/posts/deep-dive-into-intel-me-disablement/

That's a fun article. Thanks. The best part was the wifi breaking randomly. This is why I could never be a hardware guy:

> Therefore, I started progressively whitelisting more modules so me_cleaner wouldn’t remove them, and testing if it affected the wifi module. This was annoying to test because I’d have to change me_cleaner, neutralize the ME firmware, then copy the image from my main PC to the Librem then flash the new image, poweroff, then restart the machine, and if the Wifi wasn’t working, which was 99% of the time, I had to copy the files through a USB drive.

Sounds painful. We've all had debugging experiences like that once in our lives.

I appreciate their effort and public documentation!

That article's crap. You want http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

Call me cynic, but it wouldn't surprise me if the NSA intercepted those in their hardware interception program[1] and install spyware on them whenever they are delivered to an address outside the US.

[1] https://www.extremetech.com/computing/173721-the-nsa-regular...

That's why the OS should check to make sure the ME is still disabled and not boot otherwise, or signature check it somehow, create a hardware indicator, etc. But then there's still the harddrive firmware and who knows what else.

Still, this is upping the bar quite a bit if you're security conscious. In security all you can do is make the attackers lives harder, you can't fool proof it.

Plus they mentioned two different open source tools to disable it yourself (via software, not hardware as they do here). So you can buy a laptop with cash off craigslist and do it yourself if you're super paranoid.

"But then there's still the harddrive firmware and who knows what else."

Graphics card blobs, wifi cards blobs, etc. Just about every vital subsystem on a modern PC/phone/tablet etc. has been compromised by design through closed device drivers so that someone with enough skills and access to those information (such as some 3 letter agencies) can create a sort of covert channel where data can be computed, read or stored and transmitted without any means of intercepting that by any applications, because every part it's going to pass through contains some closed code that can be instructed to encrypt and tunnel the data from one place to another.

This came to mind years ago when I was struggling with a network card requiring a firmware blob that refused to load. I started wondering why were they making things so complicated for users and admins by keeping drivers closed; that blob could have contained just about every possible malware in existence and I would never have noticed it. Then I had a flash: disk drives also contain closed firmware, and video cards too. I recall having thought "heh, if they had a blob into the CPU as well they could close the circle and build a system where they can move information inside the machine or receive/transmit them from/to the external world completely unbeknown to the user. Then years later I read about Intel ME and got a thousand flashes because I almost saw that coming.

To me there is no such thing as a trustworthy system anywhere in the world, at least not until every single line of its software, firmware and hardware has been opened for public scrutiny. There is too much at stake, and surveillance is a damn rich business both for companies and people in power.

I think you may be interested in a development of a stateless laptop [1] by Joanna Rutkowska. They are trying to prevent any data storage outside of the user knowledge and control.

[1] https://blog.invisiblethings.org/papers/2015/state_harmful.p...

It’s not likely that the NSA would do that to every laptop a vendor ships outside the US, because it would increase the risk of their tools being compromised for no benefit. Hardware intercept would only be used if someone they were already interested in happened to order a laptop from the United States, and the risk/reward ratio supported bugging the laptop.

The NSA has already had a whole cache of tools get out in the open, and they wouldn’t want that to happen again. The thing about so-called cyber weapons is that they get weaker every time you use them...

Not much left to the imagination after Snowden.

My exact worry. All of this sounds pretty good but for a person like myself, living in Eastern Europe, ordering such a laptop means the physical shipment can go through 20+ places where an agent could intercept it, get to a back room, modify the hardware and/or the software for no longer than 1-2 hours, put it back in the box and you'll be none the wiser.

I am just not sure how can I trust anybody at this point. I am even wondering if the Librem products aren't a honeypot for the privacy-conscious individuals.

A good strategist understands the needs of their opponents and can imitate an organization that serves them. How much do we know about Librem really?

That line of thinking doesn't go anywhere though. And ever since the ancient ages, we haven't invented tamper-proof packaging and shipping.

Still, we have one thing going for us. The agencies are usually slow to adapt. So it's probably a safe bet that the first several thousand of those laptops will be secure for real.

(EDIT: With 16GB of RAM being the maximum, none of the three laptops are good enough fit for me yet.)

Note that they do let you swing by the factory in South San Francisco and to pick up your machine, if you like.

They also offer some kind of tamper resistant packaging, but at this point we’re entering a hall of mirrors of paranoia. If you have some clever system to resist interdiction, if it’s cheap and effective, I’m sure they’d consider it.

What prevents someone from getting a job there and tampering with them while in the factory when no one is looking?

I really want one of these, but the ergonomics look awful.

Is there a technical reason they only come with low resolution (1080p) screens? (“Linux” is not a valid reason...)

Also, as much as I would like a 15” screen, the off center keyboard is a deal-breaker. It’s just asking for RSI.

Does anyone own one? How is the trackpad / keyboard / battery life / fan noise? Maybe I can deal with 1080p in exchange for a reasonable OS and security.

Yeah I would have bought one when I was shopping but numpads on a laptop are a terrible idea. I ended up going for a Dell Precision 15 instead.

Seconded. I discovered this the hard way when I bought a 15" Lenovo.

> numpads on a laptop are a terrible idea.

I disagree completely. Having a numpad on a laptop is the only way of getting cursors and function keys (from Home to Insert to Delete) in a sane place. On my current laptop, were it not for a numpad, I'd have to press a Fn key every time I wanted to use Home/End. I'd also need to hunt for Delete somewhere above the Backspace, and PageUp/PageDown being on both sides of Up arrow (and close to it!) is simply infuriating. And it's a Dell Latitude[1], much better in this regard than tons of normal laptops.

I'm not against remapping some keys, but you need the physical keys to be there in the first place to remap to them! Without the numpad, disabling the irritatingly placed PageDown/PageUp keys would leave me without the keys completely.

There are downsides - mainly the fact that it's harder to work with a laptop actually on my lap, ie. it's harder to balance the device when most of the applied weight is on the left side, but I can deal with this with a $20 laptop tray. For additional $10 I can even get a tray with a place for an external mouse, although as I use trackballs exclusively I have little need for it.

[1] https://www.computershopper.com/var/ezwebin_site/storage/ima...

My HP laptop has a single column with delete/home/pgup/pgdn/end, like this: https://h30434.www3.hp.com/t5/image/serverpage/image-id/3646...

This works very nicely for me.

I could not deal with those arrow keys, though.

That arrow key design is terrible though.

Ok, now I know what I'd need to do to finally switch to hjkl (for arrows) when using Vim, I'd just need to buy a keyboard like yours ;)

Joking aside, a keyboard is a very personal thing and picking the right one depends on many factors, from the shape and size of your hands and fingers to your chair and desk setup, to your OS and programs you use. For most people, it probably doesn't matter that much, but for people who use keyboards for work, it's IMHO worth it to take your time and choose a keyboard that is precisely right.

As an example, I was perfectly happy with a standard desktop keyboard when I used Vim, even though Esc is rather far from home row (but it's easy to find by touch). Once I switched to Emacs, with its famous dependence on pressing and holding (as opposed to just hitting Esc in Vim) Ctrl and Alt, I almost immediately started getting RSI in my left hand. I quickly noticed that it happens only on the full-sized keyboard, not on (most) laptop keyboard. I considered switching away from Emacs, but, as with many cults, you can only leave in a body bag, so I had to find another way of dealing with it.

After a lot of research, I found that Logitech K340[1] is the keyboard for me. As you can see, the Ctrl key is where it should be (in the bottom left corner - sometimes there's a Fn key there), is bigger than usual and much closer to the home row than in full-sized keyboards. This eliminated pain in my hand almost entirely. Full-size Enter key and Backspace (their shrunk versions are evil), quite workable placement of function keys above the numpad, the Fn key placed where it doesn't bother me, and arrow keys which are easily found by touch are all essential features, which match my workflow very well. The only key which is not as accessible as I'd like is Insert (the top one), but I don't use it very often.

I'm sure there are tons of people who would find that keyboard unworkable for their workflows, though. I guess what I want to say is that if something works for you, then you should just use that. Still, you should make sure it actually works, because a wrist pain a year down the road is not a pleasant thing.

[1] https://purplezest.files.wordpress.com/2010/03/121.jpg

Something that helped me was remapping the caps lock key to ctrl.

Already done, of course. It was easy, as I had it remapped to Esc before anyway :) But using CapsLock as Ctrl makes it harder to press Ctrl-a and Ctrl-x, which are kind of essential.

Anyway, CapsLock is got to be the least useful key on a keyboard. It occupies a place on the home row, suggesting it should be as often used as Enter is... while it's decidedly not. I have no idea why it persists, it was useful on a typewriter, where you needed to apply significant force to press a key and doing so to two keys at once (Shift+letter) could have been hard, but today?

The arrow key cluster, it burns us!

> I disagree completely. Having a numpad on a laptop is the only way of getting cursors and function keys (from Home to Insert to Delete) in a sane place. On my current laptop, were it not for a numpad, I'd have to press a Fn key every time I wanted to use Home/End. I'd also need to hunt for Delete somewhere above the Backspace, and PageUp/PageDown being on both sides of Up arrow (and close to it!) is simply infuriating. And it's a Dell Latitude[1], much better in this regard than tons of normal laptops.

I've found the layout used on the VAIO Z to be very practical, with Home/End as FN + Left/Right, and PageUp/PageDown as FN + Up/Down:

https://www.replacementlaptopkeys.com/product_images/images/...

It appears to be close to the Dell Latitude, but removing the dedicated PageUp/PageDown keys, and instead having larger arrow keys likely works better.

> There are downsides - mainly the fact that it's harder to work with a laptop actually on my lap, ie. it's harder to balance the device when most of the applied weight is on the left side, but I can deal with this with a $20 laptop tray.

If you're already always using the laptop on a desk or table with a stand because it's too awkward to use, you know, on your lap... then just get a real keyboard to go with it.

I use an external keyboard on my desks at work and at home, but at least I can put my laptop on my lap and still use it on-the-go, too (which I do on a daily basis).

"numpads on a laptop are a terrible idea."

Terrible idea for you, great idea for me. As I've mentioned in my other comment, numpad is a must for me, even on laptop, so you shouldn't generalize like that.

Actually for me a numpad is a requirement. Some of my tools specifically rely on numpad key mappings.

How is 1080p low resolution???

Compare that to the gdp pocket 7'' with 1920×1200.

It's more about DPI than the number of pixels ("resolution"). In more exact terms, the angular diameter of single pixel, or the ratio between DPI and viewing distance.

The resolution is good enough when you cannot anymore see any pixelization effect from typical viewing distances. 1920x1080 on 15" screen is not quite enough, 2560x1440 or 2880x1800 are better options.

I'm not sure what's the status of high-DPI support in FOSS graphics stacks today. The 1920x1080 may be practical choice, because it makes UI elements to look "normal size" on 15" screen without additional scaling. Without high-dpi mode, e.g. websites look way too tiny past 1080P (1 virtual pixel == 1 real pixel).

1080p is considered low res! Crazy the times we live in. There are still laptop manufacturers making 1366x768 displays, the worst resolution ever invented.

I understand pixel density is nice, but for the vast majority of workflows you do not need anything better than 1080p on a 15" display.

No you don’t need better than 1080p but most developers need crisp text and I would like to go further and 4k 15inch displays would be perfect for me as it would allow me to have smaller text without a loss of quality.

No you just want fancy things. Whatever, that's fine.

But it's not a requirement for 'most developers' - in fact the ones I know with high resolution laptops don't want them, they're just annoyed by lingering issues with UI scaling and tiny text. I can't think of a sane reason for having font sizes so small that you need 4k to display text properly. Text is plenty crisp at 1080.

Also this is a laptop. More pixels means shorter battery life.

Maybe what you really need is a desktop.

I find it's only crisp enough when I use bitmap fonts, I prefer how vector fonts look on 4K but I'll still buy 1080p for the battery life.

> Text is plenty crisp at 1080.

It looks so much better at 2000. Of course you can get by with 1080 - hell, there've been times when I got by with 600 - but when you can see more code and read it more easily, it's easier to get on with development.

I can't say my development really suffers between my hi-res 27" 4k/1440p monitors at home and my 24" 1200p screens at work.

It's a bit absurd to argue that you need a high pixel density to code. It's no longer an insane luxury, but even being a relatively younger programmer I remember 640x480 being the highest resolution my first personal computer could display. What fundamentally changed about programming that now we can't even do it without 200 PPI displays?

Obviously, nothing. High resolution for most people is still just a 'nice to have.' But even 1080p@15" will produce relatively crisp text. I'd argue East Asian languages are the only ones to significantly improve in legibility, as sub-pixel rendering pretty much does what it needs to do for English nowadays.

That being said, I absolutely will always go for high DPI and everything, I just don't think it's sane to argue it's an absolute must for what amounts to typing and reading text.

> I remember 640x480 being the highest resolution my first personal computer could display

<FourYorkshiremen> Eeee, you were lucky. My first personal computer maxed out at 320x256, or 160x256 if you wanted more than 4 colours. </FourYorkshiremen>

> 320x256

LUXURY. We had 32x24 b&w characters and we were glad of them.

(ZX81, nominally 256x192 pixels but only accessible as 8x8 character cells.)

I seem to recall that there were characters made up of all the options of quarter squares, so you could have a pixellated display of 64x48 at least

edit: seems like HN doesn't support these characters but see https://en.wikipedia.org/wiki/Block_Elements

I made a 'zooming through a tunnel' program in assembler once, using them

You are, indeed, correct - https://en.wikipedia.org/wiki/ZX81_character_set

Although in the context of developing on small screens, they're not very helpful.

(And if you redefined the character set on the fly, you could make things like Forty-Niner. https://www.youtube.com/watch?v=OTTWMIQVznM )

LUXURY. My first experience with programming was some programmable TI (I think?) calculator that had 8-digits LCD screen and a memory of 39 "slots".

In the manual, there were some programs you could type in, including "Mars Lander". The calculator shows a landing speed (e.g. "8.2") and then you need to type the thrust adjustment (e.g. -1.0 or +3.0) and then the new landing speed is shown. If you do it right, you land safely and it shows "00000" or something. But nah, that did not happen, you just crash ("11111")

Following that, when I got ZX-81 with 32X24 screen, and like, 1Kb of memory, I was in heaven :)

Hey, I did say I was relatively young :) I wouldn't have minded starting on Commodore 64 or Apple ][ or anything, but I missed by a decade or two. Oh well.

You can still do that, these machines are emulated pretty much perfectly.

Low res on a CRT looks much, much better than low res on an LCD panel though

True, but not even the superior antialiasing properties of CRT can make 640x480 look better than a 1080p LCD panel.

It’s a bit absurd that you don’t need a roof over your head that isn’t made out of mud... Do you see the idea that people make normal and impossible to live without without it being really “needed” - having a structured that doesn’t put mud into your foor is important not because it’s really necessary but because our standards have improved.

This is not true at all for 'most developers'. I have a 32" 4k display and I still use DPI scaling. I've also done development on as low as 480p without much of a hindrance. Sure big resolutions are nice, but not at all a must.

If you mean software developers and not UX designers, that's silly. You get crisp text on 640x480 if you use bitmap fonts.

It's low considering that price tag. The reason we didn't get this as normal 10 years ago was because of collusion so it's right to expect in 2018(probably when the next batch ships) to have some good screens.

I read a lot of documents online, and many of those in PDF (often scanned), ePub, or other formatted presentations.

Reading those on a large (9") tablet is doable, in 1-up portrait mode. Reading on a large retina desktop display works -- 2-up mode with excellent resolution.

Reading them on a laptop suck balls. At a 9:16 aspect ratio with 1080 px height, both font and resolution are too low to read clearly. And unless you've got a hybrid laptop (I've been looking at options online, but they strike me as overly fussy and asking for trouble), no-go.

At a higher dot-pitch, this might work, but it's pretty iffy.

Surprisingly, other than the OS and applications, a tablet makes a suprisingly good mobile device. Samsung's announcement that they'll be supporting Linux installs is promising. The other side of this that needs addressing badly is standardising keyboard and case form-factors.

A tablet (display + brains), self-supporting folio case, and bluetooth keyboard isn't quite perfect, but it's quite good. In reality, keys are falling off and/or getting disabled on the keyboard, the tablet itself cannot run a real OS, I'm fighting Android, and virtually the entire App ecosystem is worse than useless.

My MSI from four years ago had a UHD screen:

http://penguindreams.org/blog/msi-ws60-running-linux/

My current Dell XPS15 does as well; both ran/run Linux. I do a lot of photo editing (Lightroom in VM, although I'd started to use Darktable) and I probably wouldn't buy a primary laptop without a UHD display today.

It's just too narrow. 1200 lines is the bare minimum for my comfort.

I'm not paying premium for a device with a worse resolution than my phone's

I bought a laptop with a 1920x1200 display in 2007. It was a 17" Dell, but still, it took nearly ten years before higher resolutions became common.

> Also, as much as I would like a 15” screen, the off center keyboard is a deal-breaker. It’s just asking for RSI.

Agree. Is entering numbers with a numpad so common use case that it justifies the inclusion of mini-numpad at the cost of off-centering the main keyboard?

"Is entering numbers with a numpad so common use case that it justifies the inclusion of mini-numpad at the cost of off-centering the main keyboard?"

At least for me - definitely yes. I won't even look at the laptop that doesn't have dedicated numpad. I guess it's a matter of taste and use case.

Just out of curiosity, what kind of work do you do?

(Embedded) System engineer, so lot's of hex typing and editing. It's a pain without full numpad.

How about a USB numberpad with all 16 hex characters?

http://www.ipv6buddy.com/

I am in no way affiliated, I just searched "USB hex numberpad"

I've tried regular USB numpad, but it's just not the same as having everything in a single keyboard. You need table or stable base for that and typing is slower when you have to reach for it, especially if it's not fixed and moves constantly. Still better than nothing though.

That website cannot be real. The sarcasm is so thick you need a machete to cut through it.

From http://www.ipv6buddy.com/faq/ :

> Is this a joke?

> No, this is in fact a real IPv6 keypad that will actually be delivered to your door if you buy one!

>How about a USB numberpad with all 16 hex characters?

Thanks for posting that, I had no idea that such a USB numpad existed, though I have no "real" use for it, it seems to me like a really nice idea.

How do you go about entering a-f in hex? Genuine question, I find I quite annoying when I need to do it, even with a number pad

I guess practice is what matters most, it happens naturally now -- right hand enters digits, while left inserts a-f, x when needed.

Here you go: https://elitekeyboards.com/products.php?sub=topre_keyboards,...

Yes, it's expensive but it'll be the nicest numpad you've ever used. Topre switches are the best.

Are they any quieter than Cherry brown? I bought a Das keyboard and it is driving me nuts. I appreciate the tactile feel, but noise not so much.

Why not just use the row of numbers along the top? It's way faster anyway once you learn them.

When using non-English keyboard layout, top row numbers are often converted to the locale characters, so you have to switch back and forth between languages to use them.

Not exactly numbers, but unicode characters - yes. It's easier to memorize some codes if you have a numpad. Also it helps to have dedicated keys for basic arithmetic operations.

I never want to do without my numpad.

I'm using a 2017 MacBook Pro in work right now and I ended up investing in a separate keyboard and mouse, partly due to lacking the numpad but also because the keyboard on this thing just feels horrible to use.

It's useful in 3D programs like Blender for navigating around the 3D space.

Absolutely. As a multimedia producer, I can not use a keyboard without numpad, not only with blender, but with many other open source or proprietary software.

Especially Adobe products are terrible with keyboard shortcuts, where in some cases you can not edit (AE) or can not map properly in non US layouts.

I basically have the same technology in my 4 year old Zenbook (1080p screen, no USB-C ports, etc.). The CPU was upgraded, but is still outdated. But that I could maybe compromise on if the build quality was good.

What are absolute dealbreakers are the missing keyboard options for my country.

> Is there a technical reason they only come with low resolution (1080p) screens? (“Linux” is not a valid reason...)

Apart from the fact that a lot of systems still have mediocre high-dpi support at best, there's also battery life, cost and the fact that 1080p on a 15" is more than adequate for most people.

>a lot of systems still have mediocre high-dpi support

As far as I can tell, the only desktop OS with good high-DPI support is macOS.

Gnome has had good high DPI support for a while now...

Any DE that does not support fraction scaling does not qualify as "good HDPI support". KDE is doing it the right way.

I'm running Gnome on my retina displayed laptop and I can confirm that this is not true.

The high DPI suppport on gnome equates to 'SCALE ALL THE THINGS 2x DERPA DERPA DERP'

And the scaling is integer-based. So, I can choose 1x, 2x, or any other whole number. Useless as hell for me, who wishes it was probably 1.25x.

It sucks bad enough that I actually WISH I was on a 1080p screen, because with the 2x scaling i effectively have a 1324x768 pos screen.

They introduced experimental support for fractional scaling in 3.26: http://www.omgubuntu.co.uk/2017/09/enable-fractional-scaling...

This is good to know. I may have to try this out and see how it works. The other option is to just install KDE since they seem to have implemented HDPI support _correctly_.

Yes, KDE on 4k looks good since 17.01. But non Qt/KDE GIMP, InkScape, Audacity, are still a pain to use on Linux with HiDPI.

$1600 for "adequate"? That's some expensive paranoia. For a computer that approaches $2k after taxes, I would want something better than adequate. Especially since at that price point, it'd be my daily driver computer.

Why would Linux even been a reason for low resolution? Plenty of software supports hi-dpi.

Xfce unfortunately not. I have 4k laptop set at 1280p because it is impossible to set everything so that it doesn't look ridiculously small. Still, I prefer low res to KDE/Unity/Gnome.

I just wish they made this in a desktop, or in a standalone board I could build a machine around.

Who cares about the ergonomics? It's a _laptop_ -- those always have terrible ergonomics, which is why you should carry a (small) keyboard and (small travel) mouse. Put the laptop on a table and the keyboard on your lap -- that way you won't hurt your neck as much as if you put the laptop on your lap, nor your arms/hands as much as if you put the laptop on a table but don't use an external keyboard.

> the off center keyboard is a deal-breaker. It’s just asking for RSI.

No. Laptop are a disaster for RSI and posture in general. The off center keyboard has a tiny effect. Use external keyboards and monitors!

For website of a purist software freedom company I was surprised to see Privacy Badger show up with a red 5:

ajax.googleapis.com fonts.googleapis.com secure.gravatar.com fonts.gstatic.com code.jquery.com

Can someone explain why you would want to link to fonts/js libraries rather than have a copy on the server and server that yourself?

One reason would be that the browser will cache them if they are used in multiple sites, so loading will be much faster on subsequent sites using the same resources. Another might be that such resources load faster off a CDN than your own server.

In practice, this never happens. The value is certainly less than the data you're selling about your users to Google.

Value to whom? The site loads faster (so people like it slightly better), it's easier to maintain (less files to serve and keep track of), all for the cost of something the site owners didn't pay for in the first place.

This is often repeated but without any data to back it up its a bit of a myth.

My tests show local resources consistently loading faster than making a link to Google. These are supposed to be cached but thing like fonts are always loaded again. Anyone can repeat this for themselves.

> Anyone can repeat this for themselves.

I tried, they came from the disk cache.

What data are you giving to Google (or another CDN) by loading jQuery or a font from them? What does the ToS say? Genuine question.

Edit: here's the ToS: https://developers.google.com/speed/libraries/terms If you believe Google, they're not collecting anything.

Don't be naive.

What's wrong with any of those things?

Libraries are probably fine, but pulling them from Google means that Google can track you

Probably but those domains are meant to be cookie less for speed

They still know which IP address is loading it. And I do often see cookies on CDNs in uBlock Matrix.

Don't know how I never put this together. Good (cynical) explanation for Google fonts.

Don’t mistake their generosity for generosity.

This is not cynical, it's realistic. After all, tracking users is closely tied to their main source of income. It is not a coincidence that most pages use Google Analytics.

Use decentraleyes!

https://decentraleyes.org/

> Protects you against tracking through "free", centralized, content delivery. It prevents a lot of requests from reaching networks like Google Hosted Libraries, and serves local files to keep sites from breaking. Complements regular content blockers.

What do the security experts think about Librem products? Does it live up to what's promised? Any gotchas users need to be aware of? I have not come across their comments on this topic, so links to the same would be appreciated if I missed them.

They have a track record of lying about their product, though disabling IME is a big step towards living up to their marketing.

Examples?

Is there any other new hardware other than Purism and Chromebooks that uses Coreboot/Libreboot?

EDIT: A list from coreboot site [1] does not look comprehensive as it is not mentioning Chromebooks or Purism.

[1] https://www.coreboot.org/Products

PC Engines uses coreboot for their APU boards (usually used as routers or firewalls).

The price/performance & energy efficiency isn't too compelling in my opinion, but if you like the idea of running your router, firewall or other network appliance on x86 with an open source BIOS and OS, its worth looking into.

Ministry of Freedom claims some of its laptops don't have ME, such as the Libreboot T400

> The Management Engine (ME), part of Intel AMT

Not hugely consequential, but Intel's product line is confusing enough without any help. AMT for years has been an application that runs on ME (unless something has changed). From the authoritative book, Platform Embedded Security Technology Revealed: Safeguarding the Future of Computing with Intel Embedded Security and Management Engine by Xiaoyu Ruan, a security researcher with the Platform Engineering Group at Intel (2014)

The list of old inventions finding new applications in new domains goes on. The new applications benefit a much wider population and improve more people’s quality of life.

When Intel’s Active Management Technology (AMT) first appeared in 2005, it was marketed as an advanced system management feature for Intel 82573E series gigabit Ethernet controllers. In 2007, a new embedded coprocessor, namely the management engine, was introduced. Originally, the management engine was designed primarily for implementing the AMT rather than running security applications. At that time, the main problem that was supposed to be resolved by the embedded engine and AMT was the high expense and difficulty of system management by network administrators. The management engine was a component of Intel chipsets with vPro technology. The Intel AMT implementation was moved from gigabit Ethernet controllers to the management engine and became a feature of vPro.

Intel AMT is not the only application on the management engine. The first security application on the engine was the integrated TPM ...

You can also order Dell machines with ME disabled. Additionally, most current Dell systems can disable Intel ME in the BIOS settings as well. This is a trap door setting - once disabled, there is no way to turn it back on.

From what I've heard, this disabling is done through the Intel HAM (high assurance mode), but I have no idea what the differences between the Dell and Purism approaches are.

Could you provide sources for this? I have never heard of such a Dell machine... My understanding was that there are currently no real options to run an Intel CPU laptop without ME.

Probably Optiplex given its use in high-security defense sector which, combined with Separation Kernel Protection Profile, would have all kinds of security/hardening requirements:

https://gdmissionsystems.com/cyber/products/trusted-computin...

http://www.integrityglobalsecurity.com/pages/solutions.html

https://www.ghs.com/products/safety_critical/integrity-do-17...

Warning: These companies' marketing folks like to go overboard. Sharing for the technical data and Dell references but not endorsing every claim you see. ;)

It was indeed an Optiplex system. You can find reference to it in this KB article[1] about replacement system boards.

[1] http://www.dell.com/support/article/be/nl/bebsdt1/sln145409/...

Sorry for the late response!

I've just checked and I could not find it for most models. I could find it for the OptiPlex 7450 All-in-One, but not for the Precision line.

At [1], you can find a screenshot of the setting that reflects this option. A colleague of mine ordered such a system and it came with a leaflet explaining that this meant that Intel ME was turned off and could no longer be turned on for this machine (trap door mechanism). It also explained that SKUs with Intel ME enabled could enter this state through the UEFI menu. He opened his system up and inspected the system board, and it was also labeled with a seal stating that Intel ME had been disabled on this system and could not be turned on. I'm trying to get hold of the leaflet so I can give you the exact wording Dell used for this.

The fact that this state can be entered through a UEFI program makes me believe that other systems running Dell's newest UEFI platform will have the same capability, but I have not been able to confirm this.

My screenshot is from the Belgian Dell enterprise portal. The wording translates to "System management: vPro Management Engine (ME) not executable, customer order".

[1] https://i.imgur.com/lpidbH3.png

I've read that "disabling" ME in the BIOS is a complete misnomer, at least on Lenovo.

I would guess you are referring to a motherboard BIOS setting that at least claims to "turn off" Intel ME. But for all we know, it is still possible or easy for someone to remotely access the ME and use it.

Purism is doing some much more in-depth stuff including both hardware and software/firmware changes. I don't know the details myself but it's a whole different level of approach.

On a side note I liked reading about a phone campaign by the same group. This post introduced me to it.

Librem 5 – A Security and Privacy Focused Phone https://puri.sm/shop/librem-5/

Great news!

Does anyone know of any efforts to remove the ME equivalent from AMD's processors?

I've been looking at librem laptops, as I'd kinda like a dedicated linux laptop. But as with many of these kinds of projects, i18n concerns are secondary, and in this case, there is no scandinavian/nordic keyboard options :/ (And I do appreciate that it might not be quite simple to have all kinds of keyboard configurations available)

It's surprisingly easy to switch to the English layout. As a programmer, it was refreshing to leave behind the convoluted key combinations while coding. (I'm looking at you, `tilde`, on a Hungarian keyboard)

On Linux, writing accents using a compose key isn't much slower than typing the letters directly either.

Scandinavian languages do not really have accented letters, though. What we have in Swedish, Danish and Norwegian are three more letters than the English alphabet, with distinct sound and meaning, that happen to look a bit like accented A's and O's. These letters are very common in our languages and a without them would be nigh unusable; like a keyboard without V, P or B (these letters have similar frequency in Swedish)

I'm Norwegian, and what I've found is that I prefer a US keyboard layout for coding, and only switch to a Norwegian layout when writing Norwegian.

Especially given that æøå are generally using the triangle right of p and l, and so messing with my brackets and braces.

I remember those well enough that I have no reason to have them on the keyboard, which doesn't make it particularly inconvenient not to have them on the keys, and I can always switch to US layout with a quick keyboard combo if I need a character I don't remember the position of on Norwegian layout.

Of course, it helps that I live in the UK where the layout differences between US/UK keyboards are minor, so I'm not particularly inconvenienced when I have to use someone else's keyboard - if I lived in Norway I'd probably have stuck to a Norwegian layout.

As a German living in Sweden, I've switched to EURkey[1]. That way I don't have to give up the Swedish å or the German ü and ß. And I have a US base layout, which makes coding easier.

[1] https://eurkey.steffen.bruentjen.eu/layout.html

For programming, yes, it might even be beneficial to use the US layout, and I've even used FI keyboard with US layout for longer stretches of time. But for communicating with own language, not quite as useful. I guess I could just not do that ;)

I use the "mac" variant option for the US QWERTY layout (`setxkbmap us -variant mac`). This functions as a regular US QWERTY layout, but I've access to various "special" characters and latin extended characters (e.g. æåøœ¡), as well as ^'"`~ as dead keys (to create îûéèñũäüö or whatever) via a modifier key (I use alt, but you can set it to whatever).

This allows me to use a single functional keyboard layout to write English, Norwegian _and_ code in.

I made https://github.com/mpartel/ee-altgr-keymap which is essentially the US layout plus AltGr+A -> ä AltGr+O -> ö

You could easily add å if you want.

I've considered a few times switching to a qwerty (from french azerty), but there are two things that made me pull back:

1. french people I know who use qwerty tend to not write any accentuated characters anymore. I'm ready to accept compose keys are usable, but it clearly seems to encourage incorrect spelling when you use a language with a lot of accentuated characters in a sentence

2. vim. I really don't see myself fighting to remap my habits and workflows, given what I perceive as very few benefits switching layout would provide

> I'm ready to accept compose keys are usable, but it clearly seems to encourage incorrect spelling when you use a language with a lot of accentuated characters in a sentence

I don't think it's at all clear, because most people don't have a compose key - only linux does that.

> vim. I really don't see myself fighting to remap my habits and workflows, given what I perceive as very few benefits switching layout would provide

Being able to use a default vim is very useful, and the default vim is qwerty-oriented. (It took me a long time to learn to use hjkl on Dvorak).

1. If you care about your spelling, you just need to find the right layout (which would be "English (international AltGr dead keys)" on Debian), then it's almost as easy as the azerty keyboard: é : altgr + e ` : altgr + ` (then the letter) ¨ : shift + altgr + ' (then the letter) ^ : altgr + 6 (then the letter)

If I remember correctly it's slightly easier to type é and è on an azerty keyboard, but not that much.

2. vim is qwerty centric, the best example for me was using CTRL-[ instead of ESC which actually makes sense on a qwerty but not on an azerty. It doesn't take that much time to learn new habits.

Overall, I would advise against changing your layout unless there's another good reason. I decided to switch because I was using many computers with a qwerty layout, and only my personal computer was still with an azerty layout. It sounded more productive to just have one layout instead of having to think about it.

Well, I guess it's a matter of preference, then, because I definitely feel like having to press 3 keys instead of one is indeed a problem when you have to do it four or five times per sentence :)

A side note, btw, regarding CTRL-[ : it seems not to be well known, and it doesn't work on things that use "alt" to access file menu (like gvim), but using alt + <normal mode key> in insert mode instantly drops to normal mode and execute that key. For example, I usually leave insert mode by doing A-j or A-h, I never hit the ESC key.

My favorite trick is `A-e a` when inside parenthesis to jump just after it and still be in insert mode, like when writing parameters to a function and jumping out of parameters list to add the `{` character.

Hello, I'm living in France and I made the switch to qwerty and it was one of my best work-hacks in my live (after learning touch typing). It took around 3 weeks to get used. The advantage is soo huge! Just to take your fears - I'm a heavy VI user and I have to say after switching to qwerty you will get to love VI even more. Not even talking about programming.

Regarding your concern with accents: Under Linux I am using English (International with AltGr dead keys) which allows me to compose accents by pressing AltGr then the key(s) that represent the accent and then the base character. So for à I press AltGr+Backtick and then 'a'. The advantage is that it gives me all of the accents that I need in Europe - there is no problem in writing German äÄöÖüÜß, and even for French you can easily have a œ in cœur - I would not even know how to get this one on an azerty keyboard.

For Windows there is as well a possibility to install this layout.

The other advantage is, that if you work a lot with different countries - I am remotely often on customer's computers via different remote sessions - then no matter what country, you always have qwerty - on Windows it's normally just one Alt+Shift away.

Definitely good investment and I will not go back (by the way I had to learn 3 layouts in my life - German, then French and now I am so happy with qwerty.

Has nobody made a kind of autocorrect that just adds accents and such? Of course you’d sometimes have to fix them yourself, but my experience so far learning French on an iPad (coming from English and not wanting to learn a new keyboard too) has been that this ought to be a reasonable approach.

I like the idea, actually. But I can guarantee that given how teachers/parents/old people always complain that young french people can't write french properly, they would brutally yell at this idea :)

no french azerty ones either :(

You can remap the keyboard at will in either console or Xorg via software utilities.

Consolekeys (I think that's still it) for console, xmodmap for Xorg.

Generally, Xorg will prompt you for the desired layout anyhow.

Mind, the labeling on the physical keyboard itself may not match. I generally don't even look at the keyboard when typing, so that's not an issue.

I use US/intl (also the new Dutch) layout for Nordic languages, Dutch and German. You get all the characters for Scandinavian languages easily with the EURkey layout (AltGr + aow for äöå). I did bind en-dash and em-dash to AltGr + - and AltGr + _ respectively because I use those a lot.

I have also tied CapsLock to the Nordic layout (Swedish/Finnish), so when CapsLock is on, you can blindly type and get those öäå characters on a regular qwerty layout. I never seem to use that, but at least I'm rid of CapsLock. ;)

I write both code and text in different languages, and in international environments just getting used to a standard qwerty layout has turned out to be the most efficient option.

It's a laptop. To not hurt yourself it's best to use it with an external keyboard and mouse anyways, so there's your I18N :)

What about the https://en.wikipedia.org/wiki/Baseband_processor#Security_co... in Purism 5 phone?

The baseband processor isn't started as first boot, and as I understand it can be selectively enabled/disabled while main cpu is on.

The Purism 5 is going to be using a baseband processor that's similar to ones used in car infotainment systems. It won't share RAM with the CPU and will be isolated from the rest of the phone. It'll even have a hardware kill switch, where you can physically sever the circuit, if you're that paranoid!

The CEO of purism did an interview where he went to a moderate degree of depth on the technical side, you can watch it here if you're curious. He mentions all of the above features in it, and more!

https://www.youtube.com/watch?v=4SwE9W8JasA

Just noticed I said Purism 5. It's called the Librem 5--and of course I see this after it's too late to edit! :'(

I'm still waiting for them to ship a Librem 15 I ordered exactly 2 weeks ago. The product page still says "Available to ship from inventory (1-2 weeks ETA), while quantities last" so I don't know why that hasn't shipped or why they haven't responded to my email about an update of status.

Intel is going to screw them over soon with a hardware revision.

Question: how would one ensure that such systems aren't interdicted, presuming that concern falls within your threat model?

http://www.spiegel.de/international/world/the-nsa-uses-power...

How do you verify it's disabled? It's like saying "it's open source, it has no backdoors!"

I love the concept but not the prices. In comparing their 13" to the Macbook Pro 13" I found the prices are about the same. The Macbook has a much better screen, a better touchpad, and the resale value will be much higher so its lifetime cost will be lower.

Unfortunately, doing custom manufacturing for a limited market (i.e., people who will pay for privacy) means they're probably never going to be able get price parity with mass-market brands.

I don't worry so much about resale because I plan on using my computers as long as possible.

The touchpad works fine for me, and I don't notice the difference in screens (except aspect ratio). Battery life and weight are comparable.

So to me, the privacy factor and supporting Purism is well worth the price. Also the Librem probably runs native Linux better, which is a huge difference-maker for me.

Except for the long run you're pretty much guaranteed a brick when apple drops hardware support if you plan on running MacOS..

Not sure if these have replaceable battery which is another gotcha, so it might be a moot point in the 'disposable hardware' era..

That said, lack of replaceable battery on macs will change the resale value picture.. don't think that's really hit things yet..

Does disabling the IME have implications for performance or energy consumption?

Probably no implications on performance or energy consumption. Disabling it will prevent many remote management capabilities which are desirable in corporate environments.

Some details: https://www.kernel.org/doc/Documentation/misc-devices/mei/me...

How much do they cost and where can I buy them?

https://puri.sm/ is their website and should have more there.

The products page of the linked article: https://puri.sm/products/ . That Librem 11 looks tempting...

Librem 11 looks tempting, but important to note that "To be announced (prototyping and supplier negotiations phase)" which probably means several more months...

and now they have a phone to build.

In Germany: https://www.floss-shop.de/de/hardware/

I want to see the layout in that chip, i want to see the dissasembly that ran on it. Playing dead with a clock signal still going into it- thats not enough.

If in doubt act correctly and in due accordance with all applicable law and regulation: all will then be fine.

If you can't follow our rules then you deserve to be persecuted, surveilled and imprisoned at our whim but always know that you are being watched and your past will be used against you.

Luddite time?

Reply on news.ycombinator.com