Comment by walterbell | Hacker News Reader

Comment by walterbell | Hacker News Reader

> We are slowly being boiled to the point of no return. We need some kind of consortium for users to represent our interests otherwise in 10 or 20 years we will have very limited choice when it comes to computer technology.

For servers purchased in bulk by hyperscalers, OpenCompute has done a great job of coordinating owner requirements for hardware and firmware delivered by ODMs and silicon vendors in the server supply chain. Founded by Facebook, OCP built on the pioneering ethos of whitebox servers at early Google Search.

To create a similar organization for clients, one would need to pool enough buying power to influence the supply chain for "PC" (x86/Arm) client devices. OCP bypassed Tier 1 OEMs and worked directly with Taiwan ODMs. This worked because hyperscalers could implement custom firmware and do their own support. The closest existing client vendor might be Framework, which has not yet managed open-source firmware. Plus Clevo (coreboot) OEMs. DMTF [2] might have some interest.

A possible baby step towards open clients would be an OCP reference design for a "privileged access workstation" to access security-sensitive administrator web consoles for hyperscaler clouds. Include both a discrete TPM and an open silicon root of trust (OCP MS Caliptra or Google OpenTitan are both open firmware). AMD OpenSIL has promised OSS client firmware by 2026 and AMD mini-PC boards are everywhere. The building blocks are present for a high-integrity reference client with open firmware, under control of the client-owning cloud customer.

With suitable licensing, anyone from Tier1 PC OEMs or small vendors could create custom derivatives of the OCP reference client IF they retain mandatory core properties like open firmware and open silicon RoT. We could intentionally reboot the accidentally-open IBM PC ecosystem, at least for the small niche of secure cloud administration. If the OCP reference client is successful, it could motivate a new client-focused org for open client hardware.

[1] https://www.opencompute.org

[2] https://www.dmtf.org

Although on the subject of hyperscaler hardware and restricted closed ecosystems, AMD EPYC processors have that nice feature which allows OEMs to permanently vendor-lock the processor to their hardware on first boot, so you can't take a chip from a Dell server and stick it in a non-Dell server for example. If you're buying a random surplus EPYC processor you might not even be able to know which vendor it's bound to until you try it.

At some point, EU "circular economy" rules will need to look at secure mechanisms for transfer of decommissioned hardware ownership for sale on secondary markets. This also applies to hyperscaler server recycling, and even old Apple hardware that could be made to work with alternate operating systems.

If AMD EPYC CPU policy is enforced by PSP firmware, then it can be negotiated by customers in a large enough, non-OEM, buying pool.

The immediate solution is to not remove the CPU from the motherboard. Sell them as a unit.

I agree and I know you're being helpful, but as soon as that's normalized they're going to start locking the ram.

That doesn’t work well if the motherboard has a proprietary form factor/power requirements/riser cards/etc.

Plus, shipping a motherboard is much more difficult and expensive than a CPU.

Yeah, if a server/workstation has a proprietary motherboard you should just keep the whole thing together and sell it as a unit.

Sure, but what if the motherboard (or some other proprietary and expensive component) has a major failure? Then you're stuck with a locked CPU.

Generally, the used market values standard form factor stuff more, so you'll frequently see people running a supermicro/etc server with a low end CPU wanting to upgrade to a better CPU from the same gen. So, pulling CPUs to sell to the enthusiasts in the used market from proprietary servers (HP, Dell, etc) when they go EOL has been pretty standard practice for at least a decade. There then ends up being a big pile of undesirable proprietary motherboards/chassis, and low-end CPUs for them. Both eventually get e-wasted, sometimes with the motherboards/chassis getting parted out.

The reasoning for this is pretty simple. Shipping an entire server is expensive - at least $100 CAD, sometimes more. Shipping a motherboard is cheap (sub-$30), and a CPU basically free (~$10). A proprietary server cannot be upgraded down the line (whereas a standard SSI-EEB chassis can have its motherboard swapped for a newer one), which decreases its value further. If someone has a standard chassis, they can buy any standard motherboard; to sell your proprietary one, you have to find someone with a proprietary chassis and a dead/missing motherboard, a very small market (supply vastly outpacing demand). For someone to want to buy your proprietary whole server, they'll have to be willing to accept that the chassis is junk whenever they want to upgrade past its generation of hardware, which is a relatively small market. Resale value in a few will also be terrible, because no one wants old hardware they can't upgrade. The market has a pretty hard cap on value for old hardware. All of this put together means that proprietary whole servers are worth (maximum_price_for_used_server * proprietary_undesirability_multiplier) - (shipping_cost), while a standard motherboard is worth (maximum_price_for_used_server) - (shipping_cost) and an unlocked CPU is worth (maximum_price_for_used_cpu) - (shipping_cost). It can sometimes be the case that selling an unlocked CPU from a proprietary server nets more money to the seller than selling the entire server, depending on era/brand/specific CPU.

It's not just EPYC, Lenovo makes heavy use of PSB (Platform Secure Boot) locking for their desktop/workstation machines too (TR or Ryzen Pro). The PSB feature is enabled by default so when installing a new CPU the user is prompted to lock it at every boot until the feature is disabled in BIOS.

The locking is handled on-chip, it's permanent, and it leaves the CPU working only on the OEMs motherboard/BIOS. This poisons the used parts market. But worse, these systems are always just one BIOS update away from not booting the fused CPUs anymore (e.g. signing the firmware update with new keys).

AMD included this in their CPUs because large OEMs like Lenovo and Dell asked for it. There's no extra security being offered by this feature, despite the OEMs throwing the word around every time to cover up it's only securing profit.

OP here, is OpenCompute mostly for server grade hardware? I feel like the enthusisant marketing is being left behind by all these solutions that the average computer user doesn't need.

Yes, it's for servers.

Reply on news.ycombinator.com