Google Even Fear Intel ME, Reduce Their Attack Vector With NERF

[juno]

Good job AMD for wasting this opportunity!

It's actually getting hard to believe they were being that dumb (and not forced) to implement the same bullshit Intel has. I don't know which is worse...

[omer666]

Jeez, Intel sure is getting immature lately. This is basically the corporate equivalent of a child getting in trouble, whose response is "yeah well he did it too!". Yeah Intel, we get it - you're not the only one. But that doesn't detract from the fact you're still doing something that's pissing people off. If you want to get people to stop hyping Ryzen then how about set an example?

The fact they use childish arguments come from the fact that they don't actually need any argument to justify the situation, because they are the leaders. It is the same with nVidia and close-sourced drivers.
What we need is a good kick in the ass from any other competitor - be it AMD or the ARM architecture - in order to make them correct their copy.
Ten years ago, AMD was growing strong, so Intel found it necessary to make processors with a lower TDP. That's not for the sake of saving the planet, it's just for marketing. They will become "better" companies only if it gives them money.

[jabl]

What NERF is made of:
De-blobbed ME
UEFI reduced to its most basic parts
SMM disabled or vectored to Linux
Linux kernel
Userland written in Go (u-root) that is mostly kept in source form and compiled only when required https://github.com/u-root/u-root

Good stuff, this is what a Libre firmware should be made of. Minimize retarded blobs and get a fucking linux system on flash to take over any other function that isn't just dumb initialization.

Yes!

(Or lets say, something like coreboot would be even better, but this is pragmatic compromise that's at least better than nothing)

Hopefully at some point it'll be possible to flash the ROM chip from Linux; few people are dedicated enough to desolder the chip from the MB, use a SPI programmer to flash it, then solder it back.

[Adarion]

I do love the Linux kernel and the idea of kicking out any proprietary firmware, be it something in conjunction with intel ME or AMD PSP or whatnot.
But KISS, people, KISS, please. Not sure how many cards need SMM and the likes, but really, I'd love the FW to be what it was meant to be: and tiny little thing that just does a POST (incl. little text screen and messages) with the computer and boots from some attached media following the user's specification.
Nothing more.

Let everything else be done by the running OS then.

Because even a Linux kernel inside there... it would need upgrading after time. Complexity brings new attack vectors / surface. Vulnerabilities. Bugs. And? How often do you see firmware updates? Mainboards? Hardly. Cellphones? Haha, you wish. IoT devices? lolwut!
I don't want the next thing on firmware level. (Even though a Linux kernel is still by far better there than certain other things.)

[Adarion]

Awww, Michael! Please, kill that moderation thing once and for all!

[microcode]

I do love the Linux kernel and the idea of kicking out any proprietary firmware, be it something in conjunction with intel ME or AMD PSP or whatnot.
But KISS, people, KISS, please. Not sure how many cards need SMM and the likes, but really, I'd love the FW to be what it was meant to be: and tiny little thing that just does a POST (incl. little text screen and messages) with the computer and boots from some attached media following the user's specification.
Nothing more.

Let everything else be done by the running OS then.

Because even a Linux kernel inside there... it would need upgrading after time. Complexity brings new attack vectors / surface. Vulnerabilities. Bugs. And? How often do you see firmware updates? Mainboards? Hardly. Cellphones? Haha, you wish. IoT devices? lolwut!
I don't want the next thing on firmware level. (Even though a Linux kernel is still by far better there than certain other things.)

I largely agree, but given the particulars, it may be less error prone despite being based on a large codebase. The portion of the kernel which would actually be involved for a given board is considerably less than the kernel overall. As for updates, sure, but people update their firmware anyway, and it's usually full of security vulnerabilities which are exploitable during POST/configuration.

With the new extended LTS kernels, you could reasonably expect to have no applicable CVEs on your firmware for more than a year in a row, and not just because nobody is looking.

[jabl]

I do love the Linux kernel and the idea of kicking out any proprietary firmware, be it something in conjunction with intel ME or AMD PSP or whatnot.
But KISS, people, KISS, please. Not sure how many cards need SMM and the likes, but really, I'd love the FW to be what it was meant to be: and tiny little thing that just does a POST (incl. little text screen and messages) with the computer and boots from some attached media following the user's specification.
Nothing more.

Let everything else be done by the running OS then.

Because even a Linux kernel inside there... it would need upgrading after time. Complexity brings new attack vectors / surface. Vulnerabilities. Bugs. And? How often do you see firmware updates? Mainboards? Hardly. Cellphones? Haha, you wish. IoT devices? lolwut!
I don't want the next thing on firmware level. (Even though a Linux kernel is still by far better there than certain other things.)

This is for servers, where you often need stuff like booting from the network, software RAID, support for multiple filesystems etc. Hence it makes sense to have a minimal Linux kernel burned into flash to give support for all that so that one can then boot the real (distro) kernel from wherever. The entire point here is to replace the proprietary UEFI crapfest with something sane as early as possible. Exactly so that the vendor firmware doesn't need a complete TCP/IP stack and whatnot.

For embedded you might indeed be better off booting directly to the final kernel.

[starshipeleven]

The US government can still make demands of what it should or shouldn't contain. The US government has a long term plan to control the entire internet, the ME is of course a part of that plan.

Yeah right. The only thing we know for sure they asked for is a kill switch for that bullcrap.

That said, this project isn't about ME, but about UEFI.

[starshipeleven]

Jeez, Intel sure is getting immature lately.

Ron Minnich (the guy that wrote this statement) is not speaking for Intel and seems to be a Google employee, and on Coreboot mailing list you see even worse shit sometimes (not from him).

[waxhead]

I do love the Linux kernel and the idea of kicking out any proprietary firmware, be it something in conjunction with intel ME or AMD PSP or whatnot.
But KISS, people, KISS, please. Not sure how many cards need SMM and the likes, but really, I'd love the FW to be what it was meant to be: and tiny little thing that just does a POST (incl. little text screen and messages) with the computer and boots from some attached media following the user's specification.
Nothing more.

Let everything else be done by the running OS then.

Because even a Linux kernel inside there... it would need upgrading after time. Complexity brings new attack vectors / surface. Vulnerabilities. Bugs. And? How often do you see firmware updates? Mainboards? Hardly. Cellphones? Haha, you wish. IoT devices? lolwut!
I don't want the next thing on firmware level. (Even though a Linux kernel is still by far better there than certain other things.)

I could not agree more. Only the absolute minimal code should be required to fire up a bootloader. That's it! BIOS may not be perfect , but it works and gets out of the way. Horrific new inventions like UEFI is a overcomplicated mess and ME / PSP and other "benefits" are utterly useless and pointless.