Comment by oneplane | Hacker News Reader

Comment by oneplane | Hacker News Reader

Parent Full thread

> Buy a laptop whose hardware is actually open.

Nice idea in theory, not really applicable in the real world. Not on the technical side because it doesn't exist (you have no access go the Intel Boot ROM on the CPU, and not to modern AGESA to start with something fundamental, but also no access to AMD or NV GPU specs, they are about as closed as they can get). On the market and people side, there just isn't enough of a market for it. The closest you might get is Framework where you get modules (but no open firmwares and things like information for all registers on all chips).

Most people don't buy a 'collection of components' to then 'install firmware, a bootloader, an operating system and applications'. That market doesn't exist.

Instead, they have some sort of preconceived notion about an appliance they want, and they really aren't interested in the technical details. It just needs to work, preferable as soon as you take it out of the box without having to do special things to it.

People might be persuaded to care about ecological impact, or long-term cost, or maybe even ROI when buying a more expensive device vs. a cheaper device (if applicable). But technical details will never win, it never has. Not with laptops, not with phones, not with video cassettes.

That's light-years ahead of "the vendor has remote access to my device all the time while I might or might not access it even having it in my hands, depending on how the vendor feels about it". Apple is in a league of its own with respect to selling you hardware and fundamentally retaining ownership of that hardware.

Is it? CompuTrace and Intel AT would like to have a word with you. As do Dell, Samsung, Sony and Lenovo. Sure, their entry level consumer goods tend to have that mostly implemented in software, but even base tier business products have this. As does every Windows 10 version from Pro and up.

Your broadening of the scope really doesn't help.

We could make it more interesting. Put an AMD EPYC CPU you own into a Dell server, then take it out and put it in a different server. CPU no longer works, because it's now cryptographically tied to Dell. AMD won't help you, and neither will Dell. And it's not just AMD and Dell that implement this. Are they at fault? Not really, you should have RTFM. But there is nobody that can 'fix' this for you.

Maybe that's not interesting to you, so we could move on to LTE infrastructure, or car radios or HAM radios. Or maybe that's no fun and you'd rather talk about the CI interface on your TV. Or maybe you don't have that and then we can find something else if need be.

Or, we could scope it back to what it is about: Activation Lock that the owner of the device can enable and disable with their credentials, and it should not be something that someone else can bypass, otherwise the feature is worthless.

Computrace is just another rootkit that you might or might not want to install on your hardware. Intel AT has been discontinued since 2015, good riddance. Only a handful of laptop vendors ever had the chutzpah to have the rootkit preinstalled on sale, and only Apple currently has the preinstalled rootkit in firmware.

>Are they at fault?

Yes, they are at fault of being customer-hostile.

>should not be something that someone else can bypass

That would make sense if the credential was on a piece of paper sold with the laptop, rather than in the vendor's database somewhere.

Still any laptop is fundamentally open to an evil maid attack, so anything past encrypting your hard drive is mostly crap.

That's a pretty bleak and somewhat unrealistic outlook. And just because they are 'another rootkit' or 'discontinued' (which I already mentioned) doesn't mean they aren't existing examples.

As for your statement about being customer-hostile: I disagree. I do not want an Activation Lock that someone else can bypass. Call that what you want, but to me that's a feature, not a bug.

The fact that there was a mistake made doesn't mean the whole system is therefore bad. And it also doesn't mean that suddenly it's open to an evil maid attack either (where the heck did that come from?). It's almost like you are completely unfamiliar with root of trust, public-key cryptography and secure enclaves. While nothing is perfect, having a hardware root-of-trust (like Intel ACM kickstarts everything else, Apple's SEP, AMD's AGESA, or ARMs TrustZone) means you can actually prevent evil maid attacks. So far, out of the ~100 different SEP implementations Apple had, only 2 had enough flaws to be bypassed, and those are decades old by now. That's a pretty good trackrecord.

Your statement about no other vendors having pre-installed 'rootkits' (they are not rootkits, they are not hidden from any kernel), is wrong again. The products and vendors I described two comments ago have this. You can buy this right now. And with your mentality, you'd call Windows Autopilot a rootkit as well. All of this together leads me to believe you're just angry at something and not really living in the same world as the rest of us.

Reply on news.ycombinator.com