Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-13 Thread Denis 'GNUtoo' Carikli
Hi, On Thu, 7 Dec 2017 22:29:44 +0100 (CET) eche...@free.fr wrote: > [...] to this new initiative of Dell or System76?.. For Intel devices with chipsets more recent than the GM45, so far I know only the following manufacturers that "disables" the Management Engine: - Puri.sm which enables the HAP

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-13 Thread Denis 'GNUtoo' Carikli
On Thu, 07 Dec 2017 16:22:48 -0600 Timothy Pearson wrote: > While dell has not gone into detail on this offering, from what has > been described it is highly likely that they were setting the HAP bit. I would guess that too, especially since Dell was already part of the High Assurance Program (HA

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-09 Thread Zoran Stojsavljevic
> Due to its complexity and closed source approach, many different UEFI implementations have > suffered many different vulnerabilities. Many (all?) include a full network stack. I have closed UEFI shell UEFI. As you all, probably, if you use UEFI as BSP. You could NOT enter UEFI shell, since every

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-08 Thread awokd
On Fri, December 8, 2017 4:44 am, Zoran Stojsavljevic wrote: > Let me try again to state what I stated before, with some new insides, > because Tim brought the new equation: HAP into > this discussion. In addition to all the issues with ME listed so far, systems from Dell etc. ship with UEFI BIOS.

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-07 Thread Zoran Stojsavljevic
Let me try again to state what I stated before, with some new insides, because Tim brought the new equation: HAP into this discussion. HAP - High Assurance Platform is long known (I know it from 2014), and its purpose, introduced by INTEL ME team was to disable ME as an application in INTEL embedd

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-07 Thread taii...@gmx.com
Companies such as dell and purism that purport to offer a "safe" "disabled" ME/PSP are being dishonest - there is no way to disable something so integral by design to the boot process of modern x86-64 platforms. If for once there is an organization that cares about security they can buy a pre

Re: [coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-07 Thread Timothy Pearson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 While dell has not gone into detail on this offering, from what has been described it is highly likely that they were setting the HAP bit. Unfortunately Dell has been billing this as a "inactive" ME when the truth is something else: apparently the ME i

[coreboot] Hardware vendors offering systems with Intel ME disabled

2017-12-07 Thread echelon
Hello, First I apologize in advance for introducing some "off topic" noise in the coreboot mailing list, but I would like to point to you a story which was posted on slashdot 4 days ago : https://hardware.slashdot.org/story/17/12/03/2113220/dell-begins-offering-laptops-with-intels-management-eng