Disabling Intel ME on Boot Guard Computers | Hacker News Reader

Disabling Intel ME on Boot Guard Computers

gnustomp.com

52 pointsgnustomp9 comments

From the recent articles, it looks like disabling Intel ME is now the "new jailbreaking" --- something which the corporations are very much against, but which can have benefits for users. Boot Guard is just another in a long line of many features advertised for security but really for maintaining control over users.

It's sad that this battle is now taking place on the once-open PC; but given that Intel has been shown to change direction from intense negative backlash[1], maybe if everyone opposes, they will stop locking down the platform further. The problem is that there is now an IMHO extremely authoritarian "security industry" heavily advocating for these user-offensive features. (And opposing them causes you to be called a terrorist, pirate, or worse.)

[1] http://archive.wired.com/politics/law/news/1999/01/17513

I've never been persecuted in the manner you describe. No one has called ever called me a terrorist or a pirate or worse. These anti-competitive strategies like bootlocking, and the sandboxed OS have been marketed, quite successfully, as protecting the privacy of their users. Most people go along with this crap out of fear, I wager.

Uh, I don't think 'corporations are very much against' neutering the IME. I don't even think that Intel has said anything publicly about it.

Are you fearmongering completely without any substance to back up your claims?

>ME "disabling" by HAP is not a cure

https://mobile.twitter.com/rootkovska/status/938458875522666...

That bug described requires modifying the ME firmware image, which Boot Guard prevents...

Boot Guard is implemented by the ME, in part of the code that still runs in HAP mode. But, crucially, the buffer overflow described there occurs before Boot Guard runs.

Huh. I assumed Boot Guard was a thing that happened in the IntelME bootrom.

I guess I'm too used to similar things in game consoles.

Doesn't ME also control processor speed? What happens to your battery life under Linux once ME is turned off?

It's a black box, but I don't think anyone has reported what you describe? Purism has been shipping laptops for a few weeks with the IME disabled, and their touted battery life seems reasonable.

Reply on news.ycombinator.com