Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google

What Hacker News said

Strong rec SEJeff · 2017-11 · on ““We have obtained fully functional JTAG for Intel CSME via USB DCI””

Absolutely fantastic video from a google engineer (and the original author of LinuxBios / Coreboot) on how they replaced the UEFI firmware with Linux to get Dell servers to boot in 20 seconds: [this video]

Strong rec anonym29 · 2023-04 · on “GNU+Linux laptops with Libreboot preinstalled, based on coreboot”

Intel CSME (formerly ME) and AMT ST (formerly PSP) have many properties that are / would be desireable for someone who is/was building a backdoor (DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc). Keep in mind that even if there has not been a backdoor deliberately added, there absolutely have been serious exploits in ME and PSP, and even for those who are not worried about the government, these security coprocessors still pose grave risk to data privacy and security, potentially handing "ring -3" access to non-government hackers. While I personally share your belief that these are probable backdoors, it is important to remind

Recommends mmcclellan · 2017-11 · on “An Open Letter to Intel”

I first heard the Minix thing in this talk: [this video] which I found, I think via a HN thread. Anyway, most of the articles rehash this talk and IMO its a solid 30 minute investment.

Recommends jjevanoorschot · 2017-11 · on ““We have obtained fully functional JTAG for Intel CSME via USB DCI””

A recent talk [0] by Ronald Minnich from Google gives a nice overview of their efforts to replace parts of Intel ME and UEFI with Linux, mostly for security reasons. [0] [this video]

Recommends watersb · 2018-07 · on “Intel patches new ME vulnerabilities”

There seems to be confusion about vPro, AMT, BIOS, UEFI, Trusted Boot, and so on. This talk helped me: "Replace Your Exploit-Ridden Firmware with Linux" [this video]

Recommends ignoramous · 2023-03 · on “Ask HN: Where can I find a primer on how computers boot?”

The gist is (which doesn't hold universally true), when the CPU is powered up, it initializes its internal RAM, loads in a pre-boot ROM, executes it. pre-boot ROM's job is to initialize whatever it has to, to bring in the initial bootloader which initializes RAM, finds a suitable bootloader program and loads it in. This program, also called second-stage bootloader , is an Operating System in its own right. It can understand filesystems, explore attached hardware, speak multiple network protocols, initialize devices as needed. The second-stage bootloader (there may also be a third-stage ) usually then boots into a Kernel. The Linux Kernel invokes the init process and things proceed into the u

Cites wolfgke · 2017-11 · on “Forget iPhone X–Apple's Best Product Is Its Privacy Stance”

> Is this related to Purism announcing that they had successfully disabled the Intel Management Engine on their laptops? Or is that unrelated? It is completely unrelated. Intel ME is about a remote servicing interface that exists on all current Intel processors. While it has some usages for managing computers in a corporate setting or managing servers (keyword to look for: Intel Active Management Technology (Intel AMT), which needs Intel vPro), it exists on nearly all current Intel processors (except, I think, Intel, Quark; but this processor is built for completely different purposes). Thus there are rumors that it is a backdoor for, say, 3-letter agencies. I don't want to spread any rumors

Cites jstewartmobile · 2017-12 · on “Harvey – An effort to provide a modern, distributed, 64-bit operating system”

Why so many haters? Just the fact that they've got Ron Minnich[0-1] on the team--one of the guys fighting the good fight against all of the voodoo BS in your Intel/AMD firmware--makes it worth a look IMHO. [0] [this video] [1] [LINK]