Purism Now Shipping Their Laptops With Intel ME Disabled

[phoronix]

Phoronix: Purism Now Shipping Their Laptops With Intel ME Disabled

Purism has announced today all laptops to be shipping from their company will now have the Intel Management Engine (ME) disabled...

http://www.phoronix.com/scan.php?page=news_item&px=Librem-Laptops-ME-Disabled

[starshipeleven]

Good, this is what they should be doing.

Thanks to the security researchers for finding the setting, and thanks to the US government for requiring a ME killswitch in the first place.

[microcode]

Man, if they could make them with dual(one removable) batteries, I would seriously consider it.

[Cape]

Damn these guys from purizm DELIVER!

[davidbepo]

Good, this is what they should be doing.

Thanks to the security researchers for finding the setting, and thanks to the US government for requiring a ME killswitch in the first place.

probably if the us government didnt try to spy everything that moves ME wouldnt exist or would have less "features"

[starshipeleven]

probably if the us government didnt try to spy everything that moves ME wouldnt exist or would have less "features"

ME was clearly designed to allow device manufacturers to keep control over what their device does even when sold to people, so they could appease the retards in the media industry and show their system is "secured" and none can steal their precious content.
And while Intel were at it, they added some nifty out-of-band management features too because the thing is basically a IPMI lite already, so why not making a killer feature for enterprise users too? (that requires tons of cash to be used, as it's subscription-based and comes from Intel, you can't just crack it)

[audir8]

If 3rd party chipsets were still around a la Nvidia/VIA/SiS/ALi, etc.. platform management and security would be a hugely different field methinks. Facebook has something in their open compute platform, but I don't know how it makes it to desktop/laptops without some serious work from motherboard makers.

[numacross]

And while Intel were at it, they added some nifty out-of-band management features too because the thing is basically a IPMI lite already, so why not making a killer feature for enterprise users too? (that requires tons of cash to be used, as it's subscription-based and comes from Intel, you can't just crack it)

If you are talking about AMT then it doesn't require any cash to use if you are willing to provision the systems by hand in a BIOS-like pre-boot environment. The tools to manage it are free as well (http://www.meshcommander.com/open-manageability works with every AMT feature including the VNC). There's also PowerShell module from Intel and Python stuff from the community. It's all based on WBEM so works pretty much with anything supporting that.

And by "you can't just crack it" do you mean that you just have to provide an empty password to the AMT HTTP interface which by the way is always open regardless of the OS or even the computer being on? (CVE-2017-5689)

[starshipeleven]

If you are talking about AMT then it doesn't require any cash to use if you are willing to provision the systems by hand in a BIOS-like pre-boot environment. The tools to manage it are free as well (http://www.meshcommander.com/open-manageability works with every AMT feature including the VNC). There's also PowerShell module from Intel and Python stuff from the community. It's all based on WBEM so works pretty much with anything supporting that.

Yeah sure, many mid-sized to large companies are totally going to use an open project that does not provide any techsupport.

And by "you can't just crack it" do you mean

No, I was talking of the commercial software used to connect to AMT, it's very exoteric stuff, it's not common bread-and-butter software like VMWare (full vSphere stuff, not just Workstation) or Adobe suite that can be downloaded for free if you go to Piratebay and friends.

[starshipeleven]

If 3rd party chipsets were still around a la Nvidia/VIA/SiS/ALi, etc.. platform management and security would be a hugely different field methinks. Facebook has something in their open compute platform, but I don't know how it makes it to desktop/laptops without some serious work from motherboard makers.

Facebook has an open firmware for the most common type of IPMI systems employed. (IPMI is basically a crappy ARM SoC with a GPU shared with the host, an ethernet port, and some connections to redirect its input to the host)

But you need a board that has IPMI, and then to make a "custom ROM" for it.