Hacker News Reader

Comment by mtgx | Hacker News Reader

So far AMD has ignored fixing this pretty much because "only privacy nerds" care about it. Well, some of those privacy and security nerds happen to work for companies like Google and even have influence over those companies' hardware purchases.

So now AMD has just lost a big chuck of potential Google business, and who knows what kind of other potential contracts, because it continues to ignore this issue instead of actually showing some leadership on it.

Maybe it's time for AMD to actually differentiate from Intel on this issue?

View on HN

Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled. Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch.

However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP).

The rules of the game are different when you're one of the Super 7 instead of just some random pleb. And increasingly those guys are no longer interested in leaving this threat vector open, which says something.

>" Intel does the same thing with the "High-Assurance Platform" for the intelligence community, which is effectively a ME killswitch."

Do you have any links or documentation you could share regarding these exceptions? Thanks.

Here you go: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

To see the Int community have a special mode to disable ME simply confirms that the ME is exploited, if any further proof was needed.

This article discusses Intel Management Engine and a company offering laptops with it disabled: https://www.theregister.co.uk/2017/10/21/purism_cleanses_lap...

>> Well, some of those privacy and security nerds happen to work for companies like Google and even have influence over those companies' hardware purchases.

>> So now AMD has just lost a big chuck of potential Google business...

> Devil's advocate: if large customers care, AMD can easily give them a "special" microcode image with it disabled...

> However, these fixes are generally not offered to the public even when they already exist (again, see: Intel HAP)...

Google could take the "don't be evil" motto one step further: they could require CPU vendor give them publicly available microcode that disables these "features." Basically, they could use their market clout to put the PC market in the right direction.

Google servers and home users have very, very different privacy and security needs. The bottom line is that the biggest threat vector on most home machines is the user. Securing a PC against threats when the user installs a browser extension for coupon printing and blasts through UAC prompts without reading them is very, very different than securing a server farm.

There's also the factor that some people, at least, would like to secure PCs from the user, particularly in the case of DRM video (which has an implementation in Intel ME). There's no real equivalent for Google servers.

Maybe it's time to bag the stupid X86 instruction set entirely and move to a 64-bit chip that has a sane instruction set and that embraces loyalty to the end user all the way down to the metal.

> "only privacy nerds"

There's nothing weird in caring about security.

Data in tech companies and banks is worth hundreds of millions. Attackers are therefore willing to pay millions for a ME 0-day.

What I find shocking is that nobody among the big names who should be conscious about security seem to give a rats ass about that. If I was say a high profile banker and someone told me that all my computers contained code that could be used to spy on me, my data, my business and my personal life, that would drive me crazy.

The high profile banker knows that computer security can be a money sinkhole. Unfortunately there's no clear and measurable relation between how much you spend on security and the benefits you get.

Reply on news.ycombinator.com