System76 Bringing Out "Pangolin" As An AMD Renoir Linux Laptop

[Adarion]

I wonder what the exclusive selling point of this one is. Were they supposed to come with Coreboot? Something like that. Because, aside from the 64 GiB RAM, it looks like your average machine in that class. (Didn't even see IPS broadly advertised for the screen, one would hope for this or a comparable tech in this price range, though.)
So what would be special about this one?
Cause I can get a Schenker (bestware) / Tuxedo model with rather similar specs for a similar price.

[ThoreauHD]

For folks crapping on them for rebranding a custom clevo, keep in mind that Dell does the same thing, just at the component level. The one that breaks that mold is the XPS, but the rest are just rebrands.
I'm personally glad to finally see a AMD linux laptop from 2nd tier vendors, or any tier vendors. It's getting hard to justify Intel, and it will only get worse as AMD hammers at 5nm.

[mojerseyboy]

the battery on this model is only 49W which in my opinion won't last for the entire day. I hope I'm wrong.

[chithanh]

If it the same laptop as the Tuxedo mentioned a few posts ago, only one of the USB-C ports supports DP-alt mode.

That is clear to me, but it may not be clear to some random reader of the specification page. Whoever wrote this did a poor job.

While it is true that no one is disabling the ME, since it is currently impossible, System76 and Puri.sm are not only setting the HAP bit, but also removing as much of the ME as possible without damaging usability, as confirmed by both companies in the link you had posted.

It is not the inability to disable the ME that bothers me here, it is the dishonesty about it. Some OEMs like Purism even resort to intentionally confusing terms like "neutralizing". Tricking buyers into thinking that there is no more danger from ME now (which we know is untrue from mentioned BHEU2017 presentation).

Plus if you set the HAP bit, I think none of the removed components matter anyway as they only become active after the HAP bit check was passed. So that seems kind of pointless, though maybe not entirely if you don't trust the HAP bit.

[torsionbar28]

It is not the inability to disable the ME that bothers me here, it is the dishonesty about it. Some OEMs like Purism even resort to intentionally confusing terms like "neutralizing". Tricking buyers into thinking that there is no more danger from ME now (which we know is untrue from mentioned BHEU2017 presentation).

Plus if you set the HAP bit, I think none of the removed components matter anyway as they only become active after the HAP bit check was passed. So that seems kind of pointless, though maybe not entirely if you don't trust the HAP bit.

Prior to the newest 11th gen intel parts, System76 was effectively neutering the ME. Using tools like 'me_cleaner' and replacing the code using an external EEPROM flasher. While technically ME was still present, only the bare minimum parts necessary to initialize the CPU remained, with the majority of the ME code, including the network stack, eliminated. I don't think it's dishonest at all to advertise using language like "neutralize" to describe this effort. If anything, your frustration seems to be misdirected - the responsible party here is Intel, not the laptop OEM's.

[torsionbar28]

Although I wonder if there's not a way to work-around the 30 minute power off when ME is fully disabled. Two machines as hypervisors, that live-migrate the workload every 29 minutes? That would be interesting, and with cheap 25 GbE cards on the secondary market, a possibility to try out. You wouldn't even need a switch, just a crossover cable.

[chithanh]

I don't think it's dishonest at all to advertise using language like "neutralize" to describe this effort. If anything, your frustration seems to be misdirected - the responsible party here is Intel, not the laptop OEM's.

Although I wonder if there's not a way to work-around the 30 minute power off when ME is fully disabled.

"Neutralize" is clearly overstating their capabilities. While Intel is at fault for forcing the ME on their customers, the OEMs are themselves at fault for lying about disabling/"neutralizing" it and thus misleading their customers.

As you noticed in your second post, Intel ME is both a hardware and a software feature. Even if you completely wipe the firmware, that will only affect the software part. I suggest watching Coreboot developer Peter Stuge's 30C3 talk, "Hardening hardware and choosing a #goodBIOS". Around 17:18 mark he mentions that since i965 chipset, even with a completely wiped firmware, the computer will send a single IPv6 packet out of the Ethernet interface.

So me_cleaner will wipe parts of the firmware, clearly not enough because OEMs additionally need to set the HAP bit to remove more functionality (or so is thought). And we still have the hardware part of the ME.

the majority of the ME code, including the network stack, eliminated

We don't know that. We just assume what happens because ME stops talking on the network interface and drops off PCIe. But since there is no introspection, an outside observer cannot tell for sure, only Intel can. The ME might enter an undocumented free-for-all debug mode for what we know.