I have asked this many times, but no response, are any of the devices with tenth gen processors or newer have any network stack still active underneath the bios?
Basically, are all backdoors offline on it?
Also, one other thing, can those devices be used with no proprietary blobs for graphics or sound, etc… if they don’t have nvidia? With ath9k wifi too I might add
I wanted to confirm if you know the answer to this.
Although, your devices are mega expensive and I am out of money for that at the moment anyhow.
The newly Qubes certified NitroPC pro - the big desktop with either i5 12600K or i9 12900K.
The sales page says, ’ Deactivatable Intel Management Engine’, it doesn’t say, ‘Deactivated’. Will there be a version where you have deactivated it yourselves?
Because that’s quite tricky and I’d hesitate to mess with that but if there was an, ‘already deactivated’ option . . . that would be good.
I can’t comment on the newer 10thGen/NV models, but assume it is similar and they also feature the Nitrokey’s coreboot-heads firmware. I did, however, look up the bios for the new Nitro PC Pro with the dasharo firmware. This gives you options to deactivate ME without flashing. Dasharo has documentation, that explain bios options and wikipedia explains the differences of the options.
I would think they would be auto deactivated just from that alone…
It seems since then I learned, if you don’t activate it, it stays off. OEMs have way more control over this than regular users. Thus, if the OEM you buy it from doesn’t enable it, its possible to keep it disabled for good. I think me cleaner can make sure it stays dead at that point.
By this I mean, not intel, but the vendor who sells the computer using that processor. Which means, nitrokey can in fact do this!
Depends on your idea of blob, if you mean hardware that requires blobs on the software end that is mystery like, then no.
Btw, coreboot makes X230 thinkpad like devices have way better security than some newer devices without coreboot.
If intel me’s network stack is disabled, then its not blobbed in a problematic way. I don’t expect unrealistic fsf level freedom where everything can be used without blobs… that is absurd and impossible. Also, their criteria is so rigid that only sandy bridge and other old hardware is usable. I do however want all problematic backdoors off or non-functional on a network level.
We would have to ask nitrokey how much of this is true already. I am pretty sure this is possible though.
Btw, coreboot makes X230 thinkpad like devices have way better security than some newer devices without coreboot.
That’s broadly overgeneralising. You are dismissing the huge attack surface coming from unpatched CPU microcode against which Coreboot doesn’t really help.
Again: if your device is powered off the Intel ME is fully functional if some modules of it were not actually removed (which is rarely the case anyway - the best you can get is usually HAP Bit disabled).
Sure, microcode updates are needed for most usecases, however, that applies for all x64 CPUs, “ancient” or not. Of course it makes a difference, whether Intel still supports updates, but your plain statement also creates FUD. For example, one can argue that older CPU generations are always better researched for vulnerabilites than the latest and greatest.
Note the dmesg excerpt I pasted above from the x230 is after loading the latest microcode Intel provides. And it’s no secret what bugs have been found for the CPU, for example:
# dmesg |grep microcode
[ 0.096141] SRBDS: Vulnerable: No microcode
Now, SRBDS relates to the RDRAND cpu feature. I regard this fully mitigated by the Linux kernel, so it is a non-issue for the machine in my case.
Hence, as of today, the rest of said CPU bugs is covered by a combination of microcode updates and the Linux kernel being in control with its own issue mitigation. So, no, I won’t sell you the x230 - get your own if you want a proper trackpoint
I agree there, as for trackpoint, I wish newer devices would have this as an option on their keyboards. Its so much more easy to deal with for me than the touchpad.
