Google Even Fear Intel ME, Reduce Their Attack Vector With NERF

[phoronix]

Phoronix: Google Even Fear Intel ME, Reduce Their Attack Vector With NERF

Even Google is concerned about attack vectors with UEFI and Intel's Management Engine that their NERF project seeks to alleviate some of these concerns and is used by their servers...

http://www.phoronix.com/scan.php?page=news_item&px=Google-NERF-UEFI-Linux

[FireBurn]

Surely as soon as any of this is worked around the American Government will just demand Intel and AMD change it for the next generation of processors

[starshipeleven]

What NERF is made of:
De-blobbed ME
UEFI reduced to its most basic parts
SMM disabled or vectored to Linux
Linux kernel
Userland written in Go (u-root) that is mostly kept in source form and compiled only when required https://github.com/u-root/u-root

Good stuff, this is what a Libre firmware should be made of. Minimize retarded blobs and get a fucking linux system on flash to take over any other function that isn't just dumb initialization.

[starshipeleven]

Surely as soon as any of this is worked around the American Government will just demand Intel and AMD change it for the next generation of processors

UEFI was an Intel's pet project, no US government involved.

[andrebrait]

What are they referring to here (regarding Ryzen being closed up)?

Currently the NERF effort is focused on Intel hardware while the Coreboot developers acknowledge the latest AMD chips are closed up too and "Don’t believe all you read about Ryzen."

[c117152]

Great to see Go can go this low Seriously, happy to see golang being applied to traditionally embedded C targets. Even as a go proponent, I didn't think the go compiler can produce binaries small enough to fit EEPROMs. I even dismissed a few other projects aiming to use go binaries as userland without reading through their docs... Good to know I was wrong.

[jabl]

What are they referring to here (regarding Ryzen being closed up)?

Probably something like

1) Intel introduced the ME a few years before AMD introduced their equivalent (PSP). ME has gotten a lot more press than PSP, and thus some people may have missed the PSP thing and thus believe that Intel is worse than AMD, whereas the reality is that they're both roughly equally bad.

2) In conjunction with the EPYC/ryzen launch IIRC AMD were claiming that now they're all open and so forth, they had a reddit AMA where the most popular thing people asked them was a way to remove that damn PSP, but actually in the end nothing has happened so far.

[johanb]

2) In conjunction with the EPYC/ryzen launch IIRC AMD were claiming that now they're all open and so forth, they had a reddit AMA where the most popular thing people asked them was a way to remove that damn PSP, but actually in the end nothing has happened so far.

Correction, people asked them to make the PSP code open source, not remove it. Some AMD Product Manager named James said that they have talked with Lisa Su about it (the CEO) and are considering it, but told us that it would take a long time. We have not heard anything about it since.
Considering how long it has taken for them to open source their vulkan implementation though, I wouldn't hold my breath.

https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/dekwva9/

[Staffan]

UEFI was an Intel's pet project, no US government involved.

The US government can still make demands of what it should or shouldn't contain. The US government has a long term plan to control the entire internet, the ME is of course a part of that plan.

[schmidtbag]

Currently the NERF effort is focused on Intel hardware while the Coreboot developers acknowledge the latest AMD chips are closed up too and "Don’t believe all you read about Ryzen."

Jeez, Intel sure is getting immature lately. This is basically the corporate equivalent of a child getting in trouble, whose response is "yeah well he did it too!". Yeah Intel, we get it - you're not the only one. But that doesn't detract from the fact you're still doing something that's pissing people off. If you want to get people to stop hyping Ryzen then how about set an example?