It's also a convenient place to put in all the things they don't want to hard wire. Which gets more every day.

Need to maintain crypto keys for SGX enclave memory? Do it in the ME. Need to do some extra stuff on suspend/resume? Do it in the ME. Not sure if any other special handling might require updates at a later date? Do it in the ME. ...

There's no need for nefarious purposes to explain why the ME isn't optional anymore - it's just more convenient.

Need to add/remove/read system's crypto keys, Do it in ME.

Need to monitor/hack the computer when the users think it is "power off", Do it in ME.

Need to add other "features" to the system in the future, Do it in ME.

Those are the concerns around the ME. But those motivations aren't necessary to explain the presence of the ME. Occam's razor and all that.

> I've yet to encounter anyone who actually wants it

Ignoring the security concerns, the remote access, imaging, etc, are actually pretty nice. Better done than most 3rd party IPMI implementations.

If it were open and documented , and able to be turned off, it has value.

It's in part used for DRM. You've probably used it if you've watched BluRays or Netflix over 720p.

I am genuinely asking, how intel ME is related to watching movies in Netflix? Would you mind to elaborate a little bit?

AFAIU, it's used in the HDCP encryption negotiation.

Yup. There's also rumours it holds the secure enclave equivalent, so getting root into this means you're double fucked:

https://twitter.com/mjg59/status/932730696614813696

Given Intel's announcement: https://security-center.intel.com/advisory.aspx?intelid=INTE...

>Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE).

It seems like there's a reasonable chance of that being the case.

Link to Intel's announcement isn't working. Might be a server-side issue ¯\_(ツ)_/¯

Apparently it needs to have appended &languageid=en-fr to work [1]

[1] https://security-center.intel.com/advisory.aspx?intelid=INTE...

Several corporations use it for Lights-Out management or on laptops to ensure data security compliance.

The things for which you actually want a backdoor in your server to control it from. Maybe even in the face of an attacker who has gained full control of both software and hardware.

I would love a potential employer/recruiter to woo me with, "Your choice of non-backdoor-ed laptop that respects your privacy." I would at least give them a phone call for that line.

What is private about a company laptop? Your own laptop shouldn’t be backdoored, but I think it’s irrational to expect the a laptop owned by the company won’t be managed by that company.

I don't expect it. That's why if a company offered it to me I would be impressed. It would speak volumes that they:

A) Trust their employees

B) Respect my privacy

C) Aren't paternalistic

I say it also has to do with them just not caring about what their users want. You’re still gonna buy an x86 processor and AMD has their own ME-like tool too. What are you gonna do, run your desktop on ARM or RISC-V?

Would be good to have a low performance riscv motherboard with something like a PCI bus. Then, run an x86 daughter card. Early arm systems (acorn RISC pc) could house a 486 daughter card like this, and you could run Windows on it in a box. Have one at home.

And even with ARM (I'm not familiar with RISC-V), you're likely going to have binary blobs for critical drivers.

Worse, in Qualcomm chips you have essentially the same OS as in AMD "Secure" Processor. Trustonic TEE OS. Handling ARM "Trust"Zone.

>I say it also has to do with them just not caring about what their users want.

Why are people buying their products?

Because the only alternative is AMD, who, until Ryzen, was lacking in performance quite a bit.

In that case, it actually goes against your "they don't care about their users" narrative. Or maybe they partially care about their users.

Anyway, I see some value in the features that ME provides, and so I'm not as anti-ME as a lot of the commenters on here. But obviously, I want the security bugs to be fixed too.

What I was trying to say is that Intel doesn’t really have a financial incentive to have non-ME SKUs because, besides the majority of users not caring, those who do care don’t really have any other options.

Sadly, the main reason IMO this isn't possible is not just that desktop software is designed for the x86 instruction set, but that it's designed for lots of RAM and CPU usage, when it could be slimmer.

I want it. Wearing multiple hats at a small company, I have to occasionally reimage machines and this would make it very useful for me.

You've already got it! If you are reimaging physical machines, most server class machines have IPMI features that allow reimaging.