Of course, there is no specificity to the EU here -- this applies to Russia, China and other countries too.

Edit: maybe Intel is already eligible to a € multiple Billions fine from the EU based on this? (Disclaimer: I have no clue about how such fine works).

This does come at a cost of performance, energy efficiency, high price, etc, but DoD / homeland security offices (or their equivalents) are ready to tolerate it.

Same applies to OSes, but mature open-source OSes are several.

You are also talking about defense politics, i.e. the military sector. That and the secret service sector is not covered at all by EU legislation and EU executive.

Also, I don't see why after looking at interests banning Intel from doing so would be advisable. Most relevant EU countries have close cooperation with the US in the military and secret service sectors.

That said, defence ministers usually don't outlaw things. It would be the parliaments. And EU law might actually hinder them from doing so, given that it first and foremost focuses on enforcing open competition and free flow of goods.

The important EU states certainly have the same back door access or a 'trusted' means of disabling it.

Freedom is for the powerful and important, not the pish posh tax slaves these Grace's fatten themselves upon.

Can't find source for this, but a few months ago I read that US (NSA, CIA) and EU (BND) agencies get the same Intel CPU WITHOUT IME, even more NSA made it a requirement for Intel that IME must be completely removed.

http://www.zdnet.com/article/researchers-say-intels-manageme...

I've not tested it, but it looks like you flip a bit and it all goes away. Well, slightly more complicated but that's the gist of it.

With this out of the way, here's the TL;DR: like most corporations executives, the fundamental goal of most officials in place isn't to conduct their mission/mandate but to further their own power; two motivations which ideally go together but in actual fact seldom do. Only the illusion of the former is actually necessary to achieve the latter.

I won't elaborate much because this view amounts to a borderline revolutionary thesis of sorts (calling for a new kind of regime, in place of the disingenuously called "representative democracy"). It's interesting but it's a book, not a comment.

Just recall history and ask questions about:

- The subtle and yet vast spectrum of 'corruption': where does it begins, how far it goes, even after every involved party has died?

- The illusion of safety or 'acceptable' conduct that officials (or execs) can convince themselves of, regarding their organization and themselves: how cognitively biased can human beings be, paradoxically increasingly so as the stakes go higher?

- When we could predict with reasonable confidence that things could go very wrong very fast, did we always manage to prevent just that from happening? Did we even try to the best of our then-capabilities? (Don't even go Godwin on that, not even wars, think market crash or viruses).

- How often in history do we need, as whole societies, the lessons of examples and dire consequences before we put our act together? What is the limbic value of 'could' versus 'hasn't yet'?

Once you realize, as I did some time ago, that we are much less rational beings than anything else, every mind-blowing decision you've witnessed in your own life by people who should have known better becomes not just possible but likely and even understandable, if not outright predictable.

My personal contention is that we'll basically need to go through a 'black swan' of sorts to really deeply learn about electronic safety; much like knowing about germs and viruses did not automatically provoked decent health procedures even by health professionals, let alone the public. But now we do wash hands and sanitize rooms. Just consider how hard a lesson it's been to learn for humanity.

We are in the infancy of the electronic age; I'm afraid it will get worse before it gets better. I just hope it will take the form of a temporally 'short' catastrophy rather than a whole new medieval age of sorts, "dark ages" as seen from a hypothetical future; but the more I observe human beings today, the less confident I feel about us taking the high road directly. Especially when lives are threatened not clinically but rather socially and psychologically. Our survival instincts tend to be numbed when life/reproduction isn't directly threatened.

At this point you may go Orwellian because it's almost less frightening than what's potentially facing some of us on this planet, and our societies appear to be both very resilient yet very susceptible to flaws (probably goes hand in hand). And when there's a flaw... be it legal, psychological, or otherwise... you know someone someday will exploit it. Circumstancial aspects like this ME merely serve as paths to what will eventually become history, but alas it's almost impossible to predict which particular aspect will be the trigger, as impossible as it is to shield ourselves from all angles. But whatever, it too, shall pass.

This isn't to say we can't mitigate because we absolutely can and should (I do try personally), but we can't really alter the shape of things to come because it would amount to changing human nature before the fact. Never happened in history. I don't think evolution works like that, period. Sorry for taking the discussion into a rather philosophical light, but that is my best answer to the 'whys' you asked and seem concerned about —concerns that I share but fail to astonish me nowadays.

Oh, we are incredibly diverse and adaptable. It matters very little that almost all of us are wrong, until it becomes "absolutely all".

I just hope that black swan happens before we start directly plugging our brains into the network. If it does, I am confident we will be fine after a few decades.

I know purism is just neutralizing IME, so it's the same as this, but they're the best solution right now, and I hope that by supporting them, I participate in a clear message to the industry that I don't want their undocumented blackbox on my hardware. Who knows ? Maybe one of the major players will take the hint and try to remove them, or document them. Or maybe a new player will displace them.

[0]: https://puri.sm/posts/reverse-engineering-the-intel-manageme...

[1]: https://puri.sm/posts/neutralizing-intel-management-engine-o...

Also, Purism is taking steps to get coreboot to run on their laptops[1][2], so the graph on this website isn't even right anymore.

And I just found out that, interestingly, the T400 and X200 both come with IME. The only difference is that the AMT can be fully disabled on older intel chipsets[0].

[0]: https://libreboot.org/docs/hardware/gm45_remove_me.html

[1]: https://puri.sm/posts/coreboot-on-the-librem-13-v2-part-1/

[2]: https://puri.sm/posts/coreboot-on-the-skylake-librems-part-2...

Purism has mentioned they may take interest in porting the rest of the way to libreboot someday.

The real issue too is that a lot of naysayers dislike Purism because they provide modern competition to people selling Librebooted laptops.

If I read it right they do the same as described in the gentoo wiki page (get rid of every module except the bring up).

we take the extra precaution of neutralizing the ME itself (removing everything but the “hardware initialization” module)

Am I missing something?

It seems like their current devices are sold with me_cleaner being ran, along with removing several "fuses". Which is pretty good.

I'm still unsure if buying these laptops actually sends a signal that this isn't OK. Intel gets their money in the end.

And even then, your RAM has proprietary code running on it (I'm not aware of any DDR4 that doesn't have embedded SoCs for initialization, none of that is done in CPU firmware anymore), your hard drives can have up to entire embedded SoCs with proprietary code running on them, and there isn't an unencumbered 802.11AN wireless chip in existence. The only bright side to that is none of that hardware has system-wide access the way these backdoor coprocessors do.

Most people don't know that IME exists, they won't know either. You won't see an uproar from the consumers, because there are few that care (us). You are better off informing the general public in my opinion.

EDIT: I'd actually put money into RISC-V products instead.

We sell an x86 server where the management engine is unreachable; there is no path from the external network to the ME. I can tell you point blank that most enterprise customers are unaware of even hypothetical issues there or for that matter with IPMI implementations. We stopped using this as an early feature in our customer conversations because they just couldn't care less about it until they hand you off to their deeper technical team (if they even have one, which is not as often as you'd think if you have not realized that security in enterprise datacenters is almost always an afterthought). Otherwise it just doesn't come up very often.

Until high-volume customers take a concern, no amount of outrage or paranoia is going to make any difference. You might as well be outraged that, for example, implementations of some BIOSes are so poor that the measured boot (hashes to TPM) don't cover all of the configuration items or vendors fail to correctly lock down their firmware flash or update path. This is pretty common and you don't hear about it because most people can't make measured boot work and generally don't even try.

Security, in general, appears to be mostly viewed as optional. Obviously I think getting this right is important, in our case for other reasons, but in and of itself people generally view security as an expensive vitamin.

And yes, security will be seen as optional. Because security is not the product, and thus not the revenue source, of most of these companies.

I'm not pushing our solution, just sharing what I have observed. Management engine in practice will _always_ be unpatched. It is _inherently_ unsafe. Anyone who thinks they will keep their patches up to date, unless they work at Amazon or some other entity where they can institutionalize it, is crazy. I had a CIO directly tell me their mean-time-to-patch CVEs in their exposed servers was two years. The statistics on Linux bug lifetimes show that 5Y is not uncommon.

Security is our underpinning but not how we sell (for the reasons I am explaining); there is a very good reason for that which is that people don't actually buy real security, they buy tools to pass audits. You can see shadows of this in the way that companies continue to deploy vulnerable agents even when they are revealed to degrade host security, or in the resistance to internal secure communications (and the reaction in general to TLS1.3).

Security practices inside large enterprises are bizarre and the result of perverse incentives. Let me give an example. The internal use of Websense proxies, for example, will tend to block encrypted content within TLS connections using entropy detection; a malicious actor will simply use an entropy reduction strategy (bananaphone or whatever trivial solution); a legitimate user who is sending an encrypted document will have that document blocked. People justify these tools as meeting the need to allow inspection of traffic; however your Websense administrator is not actually qualified to see all of the traffic that flows over the proxy (for example, does being able to read the CEO's mail make the admin an insider?) and protocols that carry content that is both safe-to-inspect and unsafe-to-inspect (the CFO's password, for example) do not differentiate the two making inspection inherently dangerous. A decade and a half ago, I knew someone who peeked at the loading dock, invoicing and shipping so that they could predict how the quarter was going to time stock sales.

That's a comical example but it's one we have directly encountered in the secure exchange of cryptographic material; but similar issues crop up all over, from the use of transparent proxies and corporate CAs (to "allow inspection") to all manner of craziness.

The facts lead you to a world view that is even more cynical than the idea of security as theater: instead, security as _ritual_. "I need this server to be secure, I'll install some agent"; "We need this server to be inspectable; I'll disable all forward-secrecy protocols and decrypt and inspect the content." And so on.

So .. I don't think it's high volume or anything else like that which is an outcome of process rather than a choice. It's that many companies long ago adopted a world view where any kind of real security is as far from consideration as possible.

(not speaking for skyport, speaking for me)

I honestly believe that a lot of people would be capable of taking responsibility for all of this themselves. I think they just don't want to. They have neither the time nor the energy to put constant pressure on all of these organizations. They have so much other stuff to worry about in their lives.

e.g. if I read a story on HN about some police brutality, posted by some familar, karma-rich HN user, I'd quite possibly give it more credence than a report from said police department denying it. Just because I'm in the HN tribe.

This effect is why posting deliberately inflammatory fake news on platforms like Facebook is so damn effective. The typical pattern is (a) establishing the author's tribe (e.g. gun-toting 50-something male living in a southern state) and then (b) launching the attack.

I really like to think that, as a rational person, my bullshit detectors would fire... but its an interesting thought experiment as to what I'd give credence to just because it was uttered by a respected HN poster.

Cheap RockChip-based Chromebooks. Not even CPU microcode needed. No binary blobs anywhere, as long as you disable 3D acceleration:

https://libreboot.org/docs/hardware/c201.html

Apple's SoC's, including the CPU, are designed by Apple, not ARM (the company). They run the ARM instruction set but the CPU core is not ARM's design. The last Apple chip to have ARM-designed CPUs was the Apple A5(X) with the ARM Cortex-A9 from 2011, every Apple chip after that has had a CPU designed by Apple. Additionally, the SoC most likely contains "hidden" core(s) not unlike Intel ME (like most SoC's do) that boot up the system and perform power management and other peripheral duties.

ARM is not the answer because they don't do their own chips. They license the technology and their clients are free to add whatever management engine hardware to their SoC.

An ARM-based SoC could be built without hidden hardware or firmware blobs but I am not aware of a SoC that could run on completely free and open software.

The approach of Intel and AMD is completely hostile to anybody who cares about such things.

Even Tesco was selling them a few weeks ago!

Update: I know other vendors (AMD) do that too, but it still looks monopolistic. First of all, Intel has a huge CPU market share. Also, probably the vendors together constitute a monopoly.

It also shows that the market of people willing to put money where their mouth is on this are fairly few and far between. The Raptor workstation crowdfunding campaign promised to get rid of all the proprietary firmware in the system and failed by a large margin.

I would gladly buy one

EDIT: Hah, jknz beat me to it.

It's almost 20 years ago since the public convinced Intel to remove a feature from their processors which would seem almost harmless today: https://news.ycombinator.com/item?id=10106870

However, the serial number was not heavily marketed as a security feature, unlike ME and all the other new and oppressive functionality today. The security argument is impressively powerful --- and more scarily, it seems the companies and government have almost perfected how to harness it.

I do not believe the argument that these changes are undertaken out of concern to protect users, whether it is made with respect to "features" of Intel chips (including Intel SGX), corporate-controlled OS, advertising-supported browsers, etc.

It is difficult to prove such organizations are deliberately trying to make things more difficult for users to control, unless of course employees inside these organizations speak out. The organizations can always provide alternate reasons for doing what they are doing.

However I recall reading of a comment made by Gates in the 1990's, at a time when he wanted Windows installed on every PC sold, that he did not like the idea of users potentially changing BIOS settings. I can only guess as to why, but it is curious to me that we are left with certain strange historical artifacts such as Windows always needing to be installed in the first partition. Other OS do not have this requirement.

While that sort of deliberate subterfuge may be difficult to prove, I think it would be easier to argue these organizations believe (or pretend to believe) that users are "incapable" in ways that have no basis in fact.

You, dear user, are incapable of controlling your computer. We, benevolent organization, can help. Just sit back and we will take care of everything.