[naikrovek]

I love how people forget what this is for. that's "love" in sarcasm quotes, if it isn't clear.

this is for me when I want to enable virtualization on a user's laptop remotely, without sending a human to their desk or to their house to enter the bios password and to enable virtualization or do whatever else I need done in there.

this is how I ship a laptop from the manufacturer directly to an end user, at their home, and they unbox it, turn it on, log in, and the computer becomes a corporate-managed device. I don't have to fly someone out so they can set up the computer, or ship the computer to the office for configuration before it gets shipped again to the end user.

this is not a nefarious thing, nor is it a target for hackers, because there are far easier ways to trick someone into doing something which lets the hacker onto their system.

[LukeShu]

Neat, I'm glad you have the option of purchasing hardware with this feature. But please let me buy hardware without it.

[naikrovek]

well if you aren't in an enterprise it is unused and inactive

if you don't want to spend $0.10 on the feature in the chip, spend 100 billion times more than that to start a CPU fabrication company and license x86_64 so you can make your own CPU.

we can't have everything a la carte. it doesn't make sense.

[LukeShu]

Framing it as a $0.10 cost issue is disingenuous. It's not that I want to save $0.10, it's that I want hardware that specifically does not have that functionality. And I'm willing to spend more to get it; though not $10billion more.

And it's not that they'd have to re-tool their fabs to make it either; they're already set up to make non-ME systems for certain government buyers. Please let civilians buy those systems.

[speed_spread]

> nor is it a target for hackers

I think hackers will decide on this, not you. And at least acknowledge that IME/PSP seriously expands the attack surface of the hardware at a very low level, enabling new classes of exploits against which the OS has no defense.

[mihaaly]

So this is made for noble purposes so it must be no risk?

So is the internet. And a few other things. I do not feel your arguments particularly strong.

E.g. wouldn't this purpose a target for specially prepared external managmenet dongles (similar like those hinted in the article but of course made professionally and with the noblest of noble system admin motives) that could be plugged in where and when corporate management is necessary to set up, then remove, send to the next computer if necessary? And not built into EVERY computer, from granny to the schoolboy so YOU could do something? This concept soulds like the key under the doormat kind of security. And you rely corporate systems on this.

[imwillofficial]

“ nor is it a target for hackers, ” Most ignorant statement of the year.

[naikrovek]

yep all the hacks which have broken it sure have me proven wrong. gosh.

the thing isn't even capable of the devastating things you all fear. it's a minimal CPU (a slow 486 on Intel chips) with a miniscule web server which is off unless configured to be on and it can't read your disk or read RAM. all it can do is talk to hardware. it's how you configure the bios without rebooting at the console.

[matheusmoreira]

https://www.csoonline.com/article/3662772/cybercriminals-loo...

https://www.wired.com/story/intel-management-engine-vulnerab...

https://www.tomshardware.com/news/intel-me-security-vulnerab...

You were saying...?

[naikrovek]

yeah I was saying that these are not always enabled on consumer devices and are protected by firewalls in most consumer and corporate situations by default.

you are smart enough to have firewalls in place, right? or are you so knowledgeable about security that you turn those off?

I see you linking to attempts and maybe some real vulns but even if they were exploited in the wild without local USB access, which I don't see in those links, firewalls would have prevented them.

physical access appears to be a requirement for those now-patched vulnerabilities, so while I was mistaken about a bit of this, my overall point stands. wow I guess you sure proved your side!

if you don't like this kind of thing in your CPUs, please feel free to start a CPU company and make your own stuff.

[imwillofficial]

Bingo. One of the core competencies of a SysAdmin is thinking critically about security vs convenience.

[naikrovek]

oh we were playing bingo? no one told me

[imwillofficial]

Be better at your job, and more knowledgeable in your opinions.

You literally got destroyed and that’s your comeback?

[matheusmoreira]

Good for you I guess but I sure as hell don't want no "corporate management" malware anywhere near my stuff let alone inside the chips where they can't be disabled. Please keep this crap fully isolated in your "corporate devices" so that we don't have to deal with it.

[nequo]

Why is there no easy way to disable it if I don’t need someone to tweak my non-corporate-managed laptop remotely?

[npteljes]

It's true that we haven't got a remote exploit yet, or at least, it's not publicly known. And I agree that it can be useful, convenient even, for everyone involved. It does however give up a good amount of control, the end user's control over their own machine.

>this is not a nefarious thing

Hell is paved with good intentions. The intent is irrelevant. Every substance that we banned so far in agriculture were developed, and used with the intent of improving the crops. Yet, they turned out to be a net negative. We don't know the end game of the ME/PSP yet, but I'm not keen to participate, I'd gladly buy a CPU without it, and let other people find out.