Hacker News Reader

Comment by Iv | Hacker News Reader

The last Intel security bugs made them lose a lot of the reputation they had, at least amongst system adminstrators though.

Now is a crucial time for AMD to strike back.

View on HN

This and their Minix backdoor are the reasons why I wanted an AMD for my laptop, but I was sad I couldn't find a high-end Thinkpad with AMD processor. I hope that will change next year.

Why call it minix backdoor? It puts some blame on minix, yet minix is blameless here.

Minix is an excellent FOSS microkernel multiserver OS with a focus on reliability and fault tolerance.

The way Intel is using it just isn't nice.

I'm not blaming it on Minix, but it does make use of Minix. I'm mentioning it to identify what I'm talking about. I believe the official name is Intel Management Engine. Or maybe that's just part of it.

Intel ME is the name I usually see, and also the name that the tools to remove/disable when possible do reference.

If you're talking about the Management Engine, doesn't AMD have basically the same thing just called PSP?

Possibly. The Intel version is better publicised. I have no idea what PSP can do, but Intel's IME makes it possible to remotely completely override anything about a PC, which can be convenient for sysadmins for large organisations, but hasn't been disabled for consumer products.

I have no idea whether the same is true for PSP.

AMD supports KVM redirection, too, via a standard called DASH. You can see examples at https://community.amd.com/community/devgurus/dmtf-dash/blog. From the standard body's description: "DASH provides support for the redirection of KVM (Keyboard, Video and Mouse) and text consoles, as well as USB and media, and supports the management of software updates, BIOS (Basic Input Output System), batteries, NIC (Network Interface Card), MAC and IP addresses, as well as DNS and DHCP configuration. DASH specifications also address operating system status, opaque data management, and more." https://www.dmtf.org/standards/dash

Intel's AMT is also an implementation of DASH.

The extensive research on the ME I actually conside a pro for Intel, since I know more about what it does and how to disable it. The PSP is still more of a black box.

The remote management features in Intel ME require a vPro capable chipset.

To be useful to you, usually yes.

To be a convenient security hole, AFAIK no.

Any quotes on ME being safe on non-vPro?

It's still a security risk – code is running in the ME that can be exploited locally.

Without vPro or with remote management and the network stack turned off there's a much smaller (probably close to zero) remote attack surface. With a vPro-capable chipset that has remote management enabled, the ME has its own IP address, plenty of potentially unsafe services, an insecure-by-default provisioning mechanism and much more.

T495 Zen+ A485 Zen X395 Zen+

The 5 at the end denotes an AMD product.

I'd hold out for after CES though. That's when Zen2 is coming to laptops. With thinkpad lag I'd say August of next year.

AMD has the same "Secure Enclave".

AMD PSP; "AMD Platform Security Processor".

Not with the Directors of those system administrators though. Nobody got fired for buying Intel is a thing. I had to fight to get our recent server purchases to be AMD.

What were the arguments you were getting against buying AMD?

Reply on news.ycombinator.com