Re:Disabling the Intel Management Engine
by platinumrad on Tuesday October 10, 2017 @06:47PM
(#15445945)
Intel doesn't have to ship IME-less chips. All it has to do is provide a way for users[1] to disable features that compromise their security but Intel doesn't, for whatever reason.
[1] I'm aware that a "High Assurance Program" bit exists that disables most functions of the IME but you can't expect the average consumer (or even the majority of technically-inclined consumers) to own an SPI flash programmer and to be willing and able to use one on their motherboard. Furthermore, researchers believe that setting this bit would cause any computer with the Verified Boot fuses set (i.e. pretty much any recent laptop) to fail to boot[2].
[2] https://github.com/corna/me_cleaner/issues/53#issuecomment-3...
Intel's advantage is built and defended on economies of scale. Making a hundred million of one thing [1] is more profitable than making 50 million of two things. Particularly if enterprises' demand for IME is stronger than consumers' demand for non-IME chips (assuming no strong externalities, e.g. NSA corruption).
I think the Intel Management Engine is crap. But there's a comprehensible reason it's there.
[1] https://www.ft.com/content/beff6e56-53ed-11e4-80db-00144feab...