Comment by confounded | Hacker News Reader

Comment by confounded | Hacker News Reader

Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it.

Purism[0] sell nice MBP-style, Debian-based laptops with modern Intel processors with the NSA's 'High Assurance Platform' bit set, and as much of the ME code removed as possible. It still runs briefly at boot, but this is the most-disabled you can currently get on any i3/i5/i7 processor[1].

[0]: https://puri.sm/

[1]: https://puri.sm/posts/deep-dive-into-intel-me-disablement/

System76 are planning to do something similar[2].

[2]: http://blog.system76.com/post/168050597573/system76-me-firmw...

The last Intel processors where the ME could be removed entirely without bricking, were the non-AMT Core Duos (2008ish), which were used on the Thinkpad T400 (good for your biceps) and the X200/X200T (thick, but compact, even by today's standards).

Various companies (most prominently the Ministry of Freedom in the UK) sell these models with the ME completely removed, and a completely Free Software boot process via LibreBoot (a subset of coreboot). You can find a full list of suppliers on the FSF's 'Respects Your Freedom' hardware page[3]. Most of them will also remove the ME from a compatible laptop you send them, as a service.

[3]: https://www.fsf.org/resources/hw/endorsement/respects-your-f...

These machines are also 'naturally' resistant to both Spectre and Meltdown, and obviously have no ME to exploit. None of the Intel horror-shows of the last few years seem to have touched them.

I previously thought that running an old-machine for largely hypothetical freedoms was bizarre. After these CVEs, I'm beginning to re-examine how bizarre it really is. And I do miss those old ThinkPad keyboards :)

Purism published some reverse engineering information and received a "polite request" to remove the post. Hmm...

https://web.archive.org/web/20180407232908/https://puri.sm/p...

At that point you should just buy AMD, if only to not support a company like Intel with such a bad security track record.

AMD has an ME equivalent, which is approximately as prevalent. It’s still a DRM/DMCA-protected remote access CPU on your CPU. What could go wrong?

Buying Librebooted machines isn’t directly supporting Intel.

Sure it's not good that we still have a coprocessor running a proprietary blob, but it's not known to have the ability to use your network card.

But not on AMD machines from 2012 and before. You can buy a high-end motherboard (KGPE-D16) that can run libreboot and 2 16core Opteron 62xx cpu's with 192GB ram. You don't have to go the old and relatively slow thinkpad route to achieve freedom.

Thank you for this information!

I’m interested in something like this (though maybe not as beefy) for self-hosting.

Are there any companies that sell the gear you describe, or guides/wikis on getting set up?

Answering my own question, suppliers of boards are available on the FSF's site (these are the boards which the FSF use themselves):

https://fsf.org/ryf

Yes that's a good starting point. And a great option if you have the money for it. This will also support the people that put in hard work to achieve and provide ultimate user freedom.

If you are on a tight budget however i recommend buying the motherboard on aliexpress (for about $200) and if you are not comfortable in flashing libreboot yourself you can ask a company that delivers bios chips for this motherboard to flash a custom bios and supply the libreboot rom binary to them. You can easily swap the bios chips yourself. The libreboot and coreboot websites have lists of hardware that are compatible (ram/cpu).

Also if you are interested in newer liberated hardware, look into the Talos II. They provide a proper workstation that comes with only free software. It will be more difficult to setup since it has a different cpu architecture, but it is definitely the way forward.

This is a great reference - but I confess to being mightily disappointed at the state of the industry with regards to this issue.

Sadly, it seems like its going to need a major incident before people start to pay attention. I can't believe I'm actually rooting for the black-hats to do something so terrible, it wakes us all up.

Never heard of these. Thanks for the pointer.

System76 is probably the most well-known Linux laptop distributor in the US, their offerings are pretty popular. I know a few people with one of their laptops and all of them are pretty satisfied.

Purism is a bit more "extreme", trying to create an all-libre laptop that avoids proprietary software and hardware. Once their equipment is a bit more stable it's something I'm going to look into more, for now they're still in development though.

This comment should be on top.

Reply on news.ycombinator.com