Both Boot Guard and PSB prevent you from modifying the system firmware (and, say, putting Coreboot on there), but because Boot Guard is implemented in the ME, and because the ME is in the chipset, not the CPU, you can take CPUs out of Intel-based systems and transfer them to somewhere else. If you do the same with a PSB-fused AMD, the firmware on the new board won't be signed with the same key and it'll refuse to boot.

None of this technology provides any real way to prevent you from booting Linux. If vendors wanted to do that, they could already just ship firmware that only supported the Windows signing key and didn't let users enroll new keys. They don't need PSP, ME, Boot Guard or PSB to do that.

And given that is firmware, it's worse than that: the manufacturer can with a firmware update remove (that you can't downgrade thanks to all this security bullshit) the possibility to disable secure boot and revoke the keys used by Linux distributions. Reason why I tend to never update the firmware of computers (as to me the firmware is just a bootloader to GRUB that then boots the operating system).

The real thing is, we don't need this kind of security. We don't need ME, PSP, PSB, TPM, and all kind of bullshit. I've never herd of an attack in real life that exploits the boot process. When 99% of computers runs Windows that is full of security vulnerabilities, and nearly half of them even a no longer supported version of Windows, the other half a non updated version because updates are a waste of time.

And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based attacks have existed for over a decade, and the Hacking Team leak included a firmware implant targeted at some ThinkPads. Do I think most users need to worry about this? No, I don't, and I don't know that there's enough people who do need to worry about this that it should be the default (I have thoughts on this, I'll write them up later this evening). But to deny that some people do need to worry about this is just inaccurate.

And Microsoft has required secure boot and TPMs on all certified client systems since Windows 8.1. Almost all shipped hardware already has all this functionality. If Microsoft had any interest in being evil here, they've had the opportunity to do so for years.

Anyway! Even if you can't replace the firmware, the secure boot database is in an unprotected variable store, so you can just replace it even if PSB is enabled. You're welcome.

This is a pure cash grab by Lenovo and AMD, not about mitigating attacks.

If this were about platform security for the benefit of the owner, it would not be permanent, nor enabled by default. All this does is create more e-waste and nuke resale value for Lenovo systems and Ryzen CPUs.

Lenovo has been increasingly slimy for years now (I guess everyone forgets that they've been caught distributing spyware in their products multiple times?) and this is just yet another stop on the road.

I hope Lenovo and AMD both get their asses sued.

If it's not permanent then it doesn't work - any plausible mechanism for allowing it to be disabled can be triggered by whoever's replacing your firmware (which makes AMD's approach somewhat bewildering here, given that you can just replace the CPU). But yes, I agree that enabling it by default is probably the wrong approach here.

This is a real argument. While it might make sense for cloud computing for the client to verify system integrity, malware that modifies firmware is not the largest blip on the radar in these times. A good protection is actually the numerous different manufacturers.

I agree, these technologies aren't primarily for security, they are to enforce how devices are used.

> If you're a journalist or an activist dealing with governments that have a track record of targeting people like you, it should probably be part of your threat model.

But considering what we know about the NSA, at least Intel's Management Engine is likely backdoored. So any anti-USA journalist/activist has probably to worry about that too. And an even bigger threat is industrial and diplomatic espionage of non-USA companies and countries using these processors.

(Also could be extrapolated to other countries' secret agencies for potential Huawei, Russian processors, if those ever get popular, like Huawei's control over EU's telecommunications.)

There are situations where that kind of security is required, of course, but they are not something that you should worry about if you use the computer to watch YouTube videos and thus I don't think that makes any sense at all to be present on a consumer PC.

Especially if you extend features like remote attestation, it is more about user control than user security.

Even with a fully encrypted disk with LUKS, someone could replace your boot manager with a tool to capture your encryption key.

For most people this will be a non issue: the cost of such an attack would highly surpass the benefits.

But I suspect some people would be valuable targets for this.

Surely you can't think the architecture itself is the differentiator. x86 didn't have all of this security 20 years ago, give engineers a few years of time to throw some locks on a risc-v chip and it'll be Enterprise Ready™ in no time.

A CPU without the user-hostile features but still able to run the massive existing software base would be ideal.

And who would make the tens of billions of investment to build a fab for that?

On the other side RISCV instruction set is far simpler, being a RISC instruction set it decides to not have advanced optimizations in the processor (even better, none at all) and leave the optimization work to the compiler, that not only simplifies the processor, but also reduces the surface of attack of the processor (Meltown, Spectre, and all these attacks are just impossible on RISCV!). Of course that has a performance penalty, but since you simplify the processor you can just put more core in the saved space right?

What I'm referring to is the expiration of patents from the P6 era, which would mean all the uop-based stuff is now free to implement.

What a lot of the RISC hype doesn't understand is the huge value in backwards compatibility --- you can have your "100% free" world but it'll forever remain niche. We need to accommodate the proprietary world if we want any chance of freedom winning; and not try to divide the world of computing.

And they will stay at that level, is the parent's point, which is 25+ years before today and thus affordable to clone and fabricate. It's not about 486 or for that matter 8086 beinh difficult...

Anyone that wants to be 100% sure of the supply chain has to move away from globalization.

I still cannot understand why the US and other countries with high tech allowed themselves to become so absolutely dependent on China.

When their own companies killed of local manufacturing and went to China out of greed and increased profits then governments should have stepped in on strategic grounds, so why didn't they?

It was obvious to me some 25 years ago and I've no monopoly on this insight so they must have been well aware that this would happen. In essence, these countries have been shooting themselves in the feet for decades.

The question is why.

Edit: I can remember the time when the US military required certain components, chips etc. to be able to be second-sourced from multiple manufacturers before they were incorporated into equipment. Does anyone else remember this?

Clearly governments, not only the US, have been aware of the problem for many decades and have chosen to do nothing about it. Moreover, what brought them to abandon this once good policy in the first instance?

Otherwise with x86 is more complex: you can choose between Intel and AMD (that has bought the license for the x86 instruction set - not something cheap to get), and both of them had their backdoor processor inside the computer (at least on Intel there are ways to disable it, as far as I know with AMD is more difficult if not impossible to do).

Only the base RISC V is guaranteed thanks extensions.

Also you are forgetting that just like Android and ARM, there are other forces at play that don't make it as easy in practice as FOSS advocates wish for.

I remembered hearing that same line when I bought a Raspberry Pi in 2012. "It's useless! You can't run x86 software on it, so what's the point?"

Flash-forwards a decade and now Graviton instances are blowing up like nothing else in the industry. RISC-V is in a very similar position to ARM 10 years ago; the groundwork has been laid, standards have been ratified and base packages/several kernels work perfectly fine on it. The only difference is that ARM is more expensive to license and is less flexible.

> Only the base RISC V is guaranteed thanks extensions.

Yeah. Is that a problem? The situation on ARM is equally bad if not worse (frequent iterations end up throwing even relatively recent CPU models under the bus), and the reason why RISC-V divided itself into extensions is so that you didn't have to start from scratch when John RISC decides to add in 3 new floating point instructions. It's a pretty damn good compromise if you ask me, and it certainly doesn't have any bearing on software availability; RISC-V programs run on RISC-V processors. ARM does not have that same liberty.

There are plenty of genuine constraints for RISC-V (the majority of them in the manufacturing/mass production side of things, now), but the majority of these software issues have been solved and taped out years ago.

The problem is dreamers thinking RISC V will be any different than other CPUs in the industry when big players come playing.

LLVM, contributions level at the scale of Linux kernel, C++20 support now lags behind everyone else.

When money comes to play, the rainbows and flowers eventually turn into wall street yuppies.

We live in a world where people talk about Thinkpads vs Macbook Pros, but for 99% of the world laptops are appliances they buy like we'd buy a toaster.

They don't care that they can't run Linux, if anything onerous code signing requirements ala mobile devices would be great for the safety of their devices with minimal effects on what they can do.

-

I'm not saying I want the market for power users to die, I'm one of them after all, but I also feel like these conversations on HN are often disconnected from the reality most people live in...

This isn't really a "they don't know better so they don't complain", this is a "even if they knew better they wouldn't complain"

The more fence sitters you convince that things are possible, pushes the fence further and further towards the other side.

There might be billions of people buying computers, but the set that has any opinion on boot code signing requirements is not large enough to cause any significant impact on the market as a whole.

There are companies that cater to these niche markets, like Pine/Framework/System76/Purism. They are tiny. Dell sells more computers in a single contract than all of these other companies have sold over their entire existence combined.

What impact might occur if a government like France were to require in the future only RISC V architectures with free boot loaders, of if the US government or a large corporation required use of measured boot to see at boot-time if the boot code or subsequent OS had been compromised?

With persistent threat actors and the falling price of processing power, I wouldn't be surprised if in the next ten years some larger organizations (or tens of thousands of small businesses) start demanding this kind if IT security from their vendors.

[0] (in French, of course) https://sill.etalab.gouv.fr/fr/software and their repo, https://github.com/disic/sill.

> The hypothetical homogeneous group 'they' you refer to doesn't exist

They do exist. Making wrong statements with conviction doesn't make it true.

You can look Chromebook sales figures, you can look at the best selling laptops at major retailers, you can look at what's driving record laptop sales, look at price points that are soaring, look at the mobile space...

-

> It's billions of people and 'they' feel many ways.

Which is why we draw conclusions based on a large sample size like I did above. You're never going to be able to consider billions of points of view, so yes, you need to try and find the common thread in their preferences and usages.

-

> By painting with a common brush, you shut down discussions of what could be and encourage fence sitters to give up.

No, by painting with a common brush, you can have actual useful discussions about the reality of things, rather than espousing your own personal whims.

-

> Let's talk about why it's possible, easy to do, and how to do it.

a) Where did my comment say it's impossible?

b) It's not easy to do or it wouldn't have existed in the first place. The whole point of my comment is saying that you need to figure out how to do it taking the current reality of things into context.

If the world thought how HN does we'd already have bills banning IME and PSB. So it doesn't. You can't pretend that people actually are a little nudge away from caring about this, or you'll quickly find that you're wrong and nothing will have actually changed.

-

> The more fence sitters you convince that things are possible, pushes the fence further and further towards the other side.

Again, what you could do if you believed that fence sitters were some large portion of laptop buyers is do what I've done, show some indications of this. Show us how niche efforts aimed at power users aren't the only rumblings about how awful locked down computing is.

What you're doing is still painting a group with a large brush, except you're not even showing us where you got the paint.

You get what I mean? So yeah, my recommendation is that we all talk like things are easy to make better, instead of saying, "too late its all over" because you'll encourage more people to try which I assume you agree is a good thing but if not, I guess to each their own.

Instead of trying to act like most people will ever care about locked bootloaders and PSB style co-processors, why don't we accept that they don't, they won't, and see what can happen from there?

An example of that is looking at it from a national security perspective. If you can paint it as a vulnerability to the tech industry you could see movement without the sisyphean task of convincing people that this stuff matters in their day-to-day lives

One would suppose instead that the logical thing to do is create financial opportunities that wouldn't otherwise exist by restricting what you can do without allowing them to insert themselves in the revenue stream.

I recall a long junked verizon phone I owned before android was a thing that could only ever be used with verizon. Despite paying for the phone in full including its GPS because Verizon had full control of the platform the only way to actually use the GPS was to pay Verizon $10 per month for navigation.

An environment where I could repurpose my existing phone instead of buying a new one when I switched carriers, where I could keep my phone number even, or one in which actually using the GPS didn't cost as much over time as the entire phone didn't exist but if you asked me at the time if I would like to live in our present universe or one which those restrictions remained the norm I should easily be able to answer.

Hacker news is about aggregating interesting things to read not a collection of grievances. For example this thread is about tech and if half of it was random grievances it would be a shitty website. Asking someone if they sympathize with your issue and asking them if you can paint it on the side of their house will get you two very different answers.

You and other tenants need to get together and either sue or more broadly look at how misdeeds by landlords are handled in your city and or state.

> You and other tenants need to get together and either sue or more broadly look at how misdeeds by landlords are handled in your city and or state.

We've had 3,200 people visit the site in the last 3 days. We're on our way.

This is why we need government intervention. If laws dictated that computing equipment etc. sold to the GP couldn't have 'locks' on them then these problems would instantly disappear.

Such laws can be easily be justified on grounds of (a) stopping monopolistic practices (anti-monopoly laws), and (b) minimizing e-waste.

This won't happen unless there's pressure on government like there has been over the right to repair from the Right to Repair movement. In fact such pressure could come from an extension of the group's current activities.

There is nothing stopping RISC-V SoC/CPU vendors from tacking it on.

With RISC-V, there is pretty much no such obligation. It's an open spec, there is no licensing fee and there isn't an obligation to add hardware susceptibilities. Chinese companies will (and are) manufacture chips like this at the lowest cost possible, likely eschewing any black-box m53s running Minix that you'd find on an American CPU. It also opens the possibility for more bespoke chip designs (as it's a modular ISA), and hopefully dividing the market between security-conscious products and consumer ones will stop all devices from being digitally wiretapped.

It's all speculation right now, but it's highly unlikely that RISC-V will be pozzed in the same way x86 or even modern ARM clusters are. There's too much competition, too much money to be made, and too few incentives. Suffice to say, you're probably going to hear the three-letter agencies complaining about "unsafe Chinese chips" soon or something equally stupid.

This is a false narrative, these management engines were added because large (corporate) customers of the major CPU vendors asked for them. Enterprise IT shops love stuff like this, anything to help them tame the unruly beast of asset inventory and management. This is the same reason things like iLO and DRAC exist, and they have all of the same types of bugs for the same core reason.

Not only does the government not want management engines, the ability to turn them off using HAP is courtesy of the US government (namely the NSA!) asking for a feature to disable it.

The main problem here is that the truth is boring, and the conspiracy theory sounds much more interesting.

https://www.csoonline.com/article/3220476/researchers-say-no...

Another reason is that ME (and PSP) are used to assert "security" of "Protected Media Path", which is part of streaming services DRM.

It's not the only way to do it, sure, but there's a reason why IBM POWER designs have approximately 2.1x amount of cores that is stated in the spec - pretty much every core has a smaller, simpler one dedicated to keeping the big one running without melting and helping transition to low-power states and back, and there are at least two more cores whose only job is handling some of the early loading of code from flash. Part of why they have those cores is that since POWER8 there was a shift towards more standalone operation without external controller chip (and POWER9 even describes such boot process in manual). For comparison, traditionally the FSP (aka BMC) on IBM POWER systems initialized all of hardware before the CPU would execute first instruction, puppeting the CPU buses through debug interface.

There was a time when HP sold servers that could be up to say, 8 cores but only two were on by default and you cloud license the rest. It was cheaper to shop the hardware and software gate it rather than limit it and have a process in the middle.

Also, customer CPUs are often (due to binning) rebranded Enterprise CPUs that were rejected (or just not purchased) for whatever reason, or vice versa. Easier to build ME on them all and configure it later.

Your ECC memory? It's something Intel just flips on or off depending on how they want to sell the chip - many Core i7s and i9s have it on-die but you can't use it. That's because it might be useful on a Xeon Platinum equivalent.

Sure you're open to buy RISC-V CPUs from China but how are you going to be certain that they have no backdoors?

From a purely technical standpoint, I agree (and wouldn't put it past Intel either). My argument is that having an open ISA makes it easier for manufacturers to compete with each other, which in turn makes it harder for interested parties to pin down every CPU manufacturer and punch holes in their individual designs.

> Sure you're open to buy RISC-V CPUs from China but how are you going to be certain that they have no backdoors?

Pragmatically, you can't. My point though was more that open ISAs give us options to buy hardware that doesn't get designed domestically, which is the main enabler for companies like AMD, Intel and Apple, and moreover, the government. If one chip is confirmed to be vulnerable in some way, you'll have legitimate competitors to choose from.

There seems to be a bit of a consistent thread running through lots of discussions that RISC-V because its 'open' magically solves all sorts of problems - it does have some advantages - but it doesn't solve these issues any more than Arm does (and Arm already has massive diversity of supply and billions of CPUs shipped without ME type issues).

Well, that clearly didn’t happen with ME. Intel’s market share gradually grew for the decade after ME was introduced.

You buy a Toyota, they screw up the floormats, causing a potentially dangerous situation, millions of cars recalled, issue fixed. Volkswagen knows about an intentional 'screwup' (the exhaust cheating), they get caught, class actions, people return cars, get monetary compensation, etc.

You buy an Intel, after Intel knows about a screwup... whoops... here's a software fix that cripples your cpus performance. Whoops, didnt fix everything, disable hyperthreading. Money back? Nope. Any other kind of compensation? Nope.

Same with software.. they put an EULA there, and they're somehow not responsible for anything anymore.

Here, you might lose a functionality that made you buy that computer in the first place, and "whoops".

And regardless, for a class action suit there'd have to be a class, and as usual the vast majority of people buying Lenovo are not aware of this, wouldn't care if they did, or actually consider it a feature; this article is about some Lenovo machines that I think are sold primarily to businesses who would probably like it if the machine couldn't have end users overwrite the OS or fiddle with the hardware.

This is EXACTLY what all the major handsets/cellphones have had in them for a very long time.

Carriers required certain side/backdoors into the devices.. which was really a tunnel for LEO/State...

RISC-V is just an ISA.

That exists for the POWER architecture, but unfortunately those cpus are way behind x86 in speed and efficency, at least so far. I expect RISCV will be the same way for quite some time. Maybe someday...

Is this actually true? openSUSE is supplied with a shim bootloader apparently signed with Microsoft's keys, allowing the OS to boot on any machine with Secure Boot enabled.

Usually it's considered game over if an attacker has physical access to your machine.