Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256236 > unrolled thread

good freedom-respecting computer for running Debian

Back to article view | Back to linux.debian.user

Contents

  good freedom-respecting computer for running Debian Lionel Élie Mamane <lionel@mamane.lu> - 2023-03-21 00:20 +0100
    Re: good freedom-respecting computer for running Debian Charles Curley <charlescurley@charlescurley.com> - 2023-03-21 00:30 +0100
      Re: good freedom-respecting computer for running Debian Lionel Élie Mamane <lionel@mamane.lu> - 2023-03-21 01:40 +0100
        Memory use (was: good freedom-respecting computer for running Debian) Stefan Monnier <monnier@iro.umontreal.ca> - 2023-03-21 03:10 +0100
          Re: Memory use (was: good freedom-respecting computer for running  Debian) Jeremy Ardley <jeremy@ardley.org> - 2023-03-21 03:30 +0100
          Re: Memory use (was: good freedom-respecting computer for running  Debian) Jeremy Ardley <jeremy@ardley.org> - 2023-03-21 03:30 +0100
    Re: good freedom-respecting computer for running Debian Stefan Monnier <monnier@iro.umontreal.ca> - 2023-03-21 02:40 +0100
      Re: good freedom-respecting computer for running Debian Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2023-03-21 03:00 +0100
        Re: good freedom-respecting computer for running Debian Ramces Tampo-og Red <lists-16494@citadel.tokyo> - 2023-03-21 07:20 +0100
      Re: good freedom-respecting computer for running Debian Lionel Élie Mamane <lionel@mamane.lu> - 2023-03-21 09:10 +0100
        Re: good freedom-respecting computer for running Debian Stefan Monnier <monnier@iro.umontreal.ca> - 2023-03-21 14:40 +0100
    Re: good freedom-respecting computer for running Debian Teemu Likonen <tlikonen@iki.fi> - 2023-03-21 10:20 +0100
      Re: good freedom-respecting computer for running Debian "der.hans" <deb-user@LuftHans.com> - 2023-03-22 21:10 +0100
    Re: good freedom-respecting computer for running Debian Nate Bargmann <n0nb@n0nb.us> - 2023-03-22 11:20 +0100
      Re: good freedom-respecting computer for running Debian Lionel Élie Mamane <lionel@mamane.lu> - 2023-03-22 20:10 +0100
        Re: good freedom-respecting computer for running Debian Teemu Likonen <tlikonen@iki.fi> - 2023-03-22 20:40 +0100
        Re: good freedom-respecting computer for running Debian Nate Bargmann <n0nb@n0nb.us> - 2023-03-23 00:10 +0100
          Re: good freedom-respecting computer for running Debian Stefan Monnier <monnier@iro.umontreal.ca> - 2023-03-23 05:10 +0100
            Re: good freedom-respecting computer for running Debian David <curmudgeon@telaman.net.au> - 2023-03-23 05:40 +0100
          Re: good freedom-respecting computer for running Debian Lionel Élie Mamane <lionel@mamane.lu> - 2023-03-23 11:40 +0100

#256236 — good freedom-respecting computer for running Debian

Is there any good low-hassle freedom-respecting reasonable price
reasonable performance computer platform for running Debian these
days? My main computers (desktop and laptop) are due for a planned
refresh (like, for once, not refreshing in urgency because they
broke). The more free-as-in-freedom, the better, but also it has to
_work_ and not get in the way "too much". I don't particularly enjoy
hardware tinkering, I want to concentrate on software, thank you very
much. Let's say the least non-free firmware possible; I suppose at
this point I can't hope for free hardware.


I've got a sour taste with the offering of amd64-based systems; the
Intel-based ones have the Management Engine deeply embedded (efforts
of the likes of puri.sm and system76 to battle that notwithstanding),
I hear the AMD ones have something similar now. From what I can
gather, there are only out-of-production mainboards, (ASUS KCMA-D8 and
ASUS KGPE-D16), and the CPUs themselves are and... it they are also
out of production.  Even though it is all available "refurbished"
and/or second-hand, this feels like a dead end.

For laptops... refurbished Lenovo machines.

I kinda "know" AMD (ex-ATI) graphic cards are supposed to work better
than NVidia ones with free drivers, but each time I emergency-replaced
my amd64 motherboard, the shop was all "nope, I can get you NVidia in
a few days, but no stock of ATI/AMD at suppliers"... so I've been each
time running the oldest NVidia card I could find, and the nouveau
driver feature matrix
https://nouveau.freedesktop.org/FeatureMatrix.html is depressing... I
don't really care about most features, but let's say I want
accelerated video, dual head (RandR) to run my two nice monitors at
1440x2560 resolution. Which requires two HDMI (1.3), DisplayPort or
USB-C outputs. Don't care much about 3D really.

I'm willing to pay some price premium for a free platform, but not an
order of magnitude more. I'd like ECC memory... at least on my
desktop? I'd like it to "feel" like an upgrade also in performance to
what I'm running now, hopefully that will be really easy given the age
of my machines, namely a desktop with an Intel Xeon E3-1271 v3
(released in 2014) and a ThinkPad X200s with an Intel Core 2 Duo L9400
(released in 2008). I also kinda hope for something rather quiet, too,
I've been developing increasing tinnitus and I already wear
noise-cancelling headphones when next to my desktop :-|

It seems the only serious contenders, available new, with a future,
would be Power and ARM?

In the Power realm, I'm aware only of the Raptor series, starting with
the "Blackbird" which even seems to be available from a European
seller now, namely vikings.net? On the other hand, I read that Firefox
WebRTC is broken on Power
https://www.talospace.com/2023/02/firefox-110-on-power.html
the Debian package fails to build... for two months now (since
109.0-1). I mean, I don't mind using firefox-esr (that's what I use
anyway), but that could be a hint that my desktop experience will be
miserable?

Also, I also "see" rumours online that Raptor is not doing going up to
Power10, so it that a dead end in practical terms over the next years?

On the ARM side, ... I don't know anything for desktops. Is something
around?  The Power/Talos afficionados say modern/recent ARM systems
also has freedom problems, but I haven't seen them articulate
what. What about that?

As far as laptops are concerned... Anyone has good recommendations?
The Pinebook Pro order page says "don't order if you are seeking a
substitute for your X86 laptop" (???) and I've recently stumbled upon
the MNT Reform. Thare are the Apple machines, but it looks like
getting GNU/Linux to run on them is a lot of reverse engineering with
no good documentation/support from the manufacturer (I mean, kuddos to
the ones doing it, but if I could avoid supporting that kind of
non-cooperation with my money...), that basic-to-moderate hardware
features are still not ready upstream (much less in Debian
soon-to-be-stable testing out of the box...), and replacing a
Microsoft tax with an Apple tax... not sure that's an improvement?

Thanks in advance for your advice,

-- 
Lionel

[toc] | [next] | [standalone]

#256237

On Tue, 21 Mar 2023 00:02:10 +0100
Lionel Élie Mamane <lionel@mamane.lu> wrote:

> I also kinda hope for something rather quiet, too,
> I've been developing increasing tinnitus and I already wear
> noise-cancelling headphones when next to my desktop :-|

Take a look at https://silentpc.com.

> 
> It seems the only serious contenders, available new, with a future,
> would be Power and ARM?

Any thoughts on RISC-V?



-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#256241

On Mon, Mar 20, 2023 at 05:23:09PM -0600, Charles Curley wrote:

>> It seems the only serious contenders, available new, with a future,
>> would be Power and ARM?

> Any thoughts on RISC-V?

Not a released Debian architecture/port, which spells trouble for
"just using it". Is it on good path to becoming one? It got
LibreOffice support in upstream in ... 2022, so quite recently.

https://wiki.debian.org/RISC-V#ASIC_implementations.2C_i.e._.22real.22_CPU_chips
lists only "small" SoC systems , not something that looks like I would
like to compile something the size of LibreOffice on. In that list the
highest memory supported seems to be 8GB... Nowadays software seems to
be _very_ memory hungry, my desktop isn't running anything particular
(just X11, XFCE, terminals, mutt, emacs, firefox, instant messenging
stuff, nextcloud desktop) and... "free -m" says 10437 used (I
understand that's _without_ buffers and cache), Firefox clearly takes
at least 2GB if not 3B (main process 1GB RES in top and then many
"Isolate Web Content" processes taking 100MB to 340MB, they add up!),
Telegram has RES of 600MB plus 465MB swapped (!!!), etc.

That 8GB memory board has only one HDMI output, not two.


Am I missing any hardware that would be interesting?

[toc] | [prev] | [next] | [standalone]

#256244 — Memory use (was: good freedom-respecting computer for running Debian)

> https://wiki.debian.org/RISC-V#ASIC_implementations.2C_i.e._.22real.22_CPU_chips
> lists only "small" SoC systems , not something that looks like I would
> like to compile something the size of LibreOffice on. In that list the
> highest memory supported seems to be 8GB... Nowadays software seems to
> be _very_ memory hungry, my desktop isn't running anything particular
> (just X11, XFCE, terminals, mutt, emacs, firefox, instant messenging
> stuff, nextcloud desktop) and... "free -m" says 10437 used (I
> understand that's _without_ buffers and cache), Firefox clearly takes
> at least 2GB if not 3B (main process 1GB RES in top and then many
> "Isolate Web Content" processes taking 100MB to 340MB, they add up!),
> Telegram has RES of 600MB plus 465MB swapped (!!!), etc.

Reminds me: back around the beginning of the 2010s I realized that the
3GB limit on my Thinkpad T60 would be a problem in the long run but most
replacements were either wider (hence not fitting in my backpack) or
shorter (hence losing screen real-estate), so I bought a second hand T61
with the same size and aspect ratio, but with a chipset which could go
up to 8GB.

Nowadays my main laptop is that T61 (with 8GB) and
my office desktop is a Librem mini (with 24GB of RAM).
While Linux manages to make use of all 24GB of that desktop (including
pushing a few hundred MBs to the small swap partition I have
configured), I noticed that my T61 is able to perform the exact same
tasks without swapping either.

Better yet: my T61's right hinge broke recently (for the third time:
there seems to be a weakness there), so for a few weeks I temporarily
used my T60 while waiting for new hinges to arrive.  Much to my
surprise, I didn't suffer from its limited RAM.  Stats show that the
swap is used significantly more, but it never got anywhere
near thrashing: the CPU was always kept busy with useful work.
[ All those machines use SSDs, of course.  ]

So, maybe there's a "good" reason why Apple still configures their
cheapest laptop with only 8GB of RAM: for "normal" work it's still
perfectly sufficient, despite all the best efforts of web site designers
out there.
[ But I would recommend against buying a desktop/laptop with 8GB now
  unless you can easily expand it later.  ]


        Stefan


PS: To give some context, my main tools are a mix of
XFCE/Emacs/Firefox/xterm/Git/LaTeX/GCC/OCaml/LibreOffice/Coq.
And I use the `i386` rather than `amd64` version of Debian on those
machines (tho with an `amd64` kernel).

[toc] | [prev] | [next] | [standalone]

#256245 — Re: Memory use (was: good freedom-respecting computer for running Debian)

On 21/3/23 10:20, Jeremy Ardley wrote:
> On a tangent, I've just set up a Debian 11 Linode LEMP server with 1GB 
> RAM and 10GB Disk.
>
> It's not in the least troubled by the limited memory. Also there is no 
> swap in the default image - which seem sensible as it's on a SSD and 
> you don't want to be exercising a SSD with lots of swaps
>
> df
> Filesystem     1K-blocks    Used Available Use% Mounted on
> udev              482172       0    482172   0% /dev
> tmpfs             100004     452     99552   1% /run
> /dev/sda        25207476 2287196  21619456  10% /
> tmpfs             500016       0    500016   0% /dev/shm
> tmpfs               5120       0      5120   0% /run/lock
> tmpfs             100000       0    100000   0% /run/user/0
>
Oops. 25G HDD. But in other installs I usually use 8-10GB

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256246 — Re: Memory use (was: good freedom-respecting computer for running Debian)

On 21/3/23 10:02, Stefan Monnier wrote:
>
> So, maybe there's a "good" reason why Apple still configures their
> cheapest laptop with only 8GB of RAM: for "normal" work it's still
> perfectly sufficient, despite all the best efforts of web site designers
> out there.
> [ But I would recommend against buying a desktop/laptop with 8GB now
>    unless you can easily expand it later.  ]
>
>
>          Stefan
>
On a tangent, I've just set up a Debian 11 Linode LEMP server with 1GB 
RAM and 10GB Disk.

It's not in the least troubled by the limited memory. Also there is no 
swap in the default image - which seem sensible as it's on a SSD and you 
don't want to be exercising a SSD with lots of swaps

df
Filesystem     1K-blocks    Used Available Use% Mounted on
udev              482172       0    482172   0% /dev
tmpfs             100004     452     99552   1% /run
/dev/sda        25207476 2287196  21619456  10% /
tmpfs             500016       0    500016   0% /dev/shm
tmpfs               5120       0      5120   0% /run/lock
tmpfs             100000       0    100000   0% /run/user/0

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256242

> Is there any good low-hassle freedom-respecting reasonable price
> reasonable performance computer platform for running Debian these

Define your notion of "reasonable" for price and for performance.


        Stefan "who finds a Core2 Duo to offer reasonable performance"

[toc] | [prev] | [next] | [standalone]

#256243

[Multipart message — attachments visible in raw view] — view raw

On Mon, Mar 20, 2023 at 9:34 PM Stefan Monnier <monnier@iro.umontreal.ca>
wrote:

> > Is there any good low-hassle freedom-respecting reasonable price
> > reasonable performance computer platform for running Debian these
>
> Define your notion of "reasonable" for price and for performance.
>
>
>         Stefan "who finds a Core2 Duo to offer reasonable performance"
>

I'll rock a Core2 Duo: 64 bit 2.6 GHz dual core CPU, 4 GB DDR2 800 MHz RAM,
Intel integrated graphics. The Core2 Duo is the first processor I
considered to be good enough to run until death! The Core2 Duo certainly
does not have anything on my 8 × AMD Ryzen 7 4700U with Radeon Graphics and
16GB RAM.


-- 
⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀

[toc] | [prev] | [next] | [standalone]

#256247

On 2023-03-21 09:55, Timothy M Butterworth wrote:
> On Mon, Mar 20, 2023 at 9:34 PM Stefan Monnier 
> <monnier@iro.umontreal.ca>
> wrote:
> 
>> > Is there any good low-hassle freedom-respecting reasonable price
>> > reasonable performance computer platform for running Debian these
>> 
>> Define your notion of "reasonable" for price and for performance.
>> 
>> 
>>         Stefan "who finds a Core2 Duo to offer reasonable performance"
>> 
> 
> I'll rock a Core2 Duo: 64 bit 2.6 GHz dual core CPU, 4 GB DDR2 800 MHz 
> RAM,
> Intel integrated graphics. The Core2 Duo is the first processor I
> considered to be good enough to run until death! The Core2 Duo 
> certainly
> does not have anything on my 8 × AMD Ryzen 7 4700U with Radeon Graphics 
> and
> 16GB RAM.

Agree. I'm still running an old X200 with 8GB of RAM (SSD of course) 
that I
built a junk of X200 parts that someone sold to me way back. I think 
they're
still relatively fast and they can still do a lot of what normal people 
would
do with their computer these days.

ramces

[toc] | [prev] | [next] | [standalone]

#256249

On Mon, Mar 20, 2023 at 09:33:26PM -0400, Stefan Monnier wrote:
>> Is there any good low-hassle freedom-respecting reasonable price
>> reasonable performance computer platform for running Debian these

> Define your notion of "reasonable" for price and for performance.

Performance-wise, for the laptop, I'd like aptitude not to compute
(search for a dependencies solution) for much more than a few seconds
each time I press the "+" key to upgrade a package, while having
stable, stable-security, testing and sid in my sources.list

My Core2 Duo clearly is far slower than that.


For the desktop, I want to compile LibreOffice, with maximum
debugging. Realistically, this is a big job, so won't take mere
minutes, but let's say be within the same order of magnitude than a
new amd64 machine?


Price-wise... I'm willing to invest, but not to come close to five
digits in EUR/USD/GBP.

-- 
Lionel

[toc] | [prev] | [next] | [standalone]

#256252

>>> Is there any good low-hassle freedom-respecting reasonable price
>>> reasonable performance computer platform for running Debian these
>> Define your notion of "reasonable" for price and for performance.
> Performance-wise, for the laptop, I'd like aptitude not to compute
> (search for a dependencies solution) for much more than a few seconds
> each time I press the "+" key to upgrade a package, while having
> stable, stable-security, testing and sid in my sources.list
> My Core2 Duo clearly is far slower than that.

Interesting.  I don't use aptitude interactively and don't have `sid` in
my sources, but  haven't noticed any significant difference in batch
use between my core2 duo and a more recent quad core i7.  AFAIK the
constraint solving involved in this is not parallelized so it's
constrained by single thread performance (and potentially RAM
thrashing), which hasn't changed drastically since the core2 duo days,
sadly, in my experience :-(

> For the desktop, I want to compile LibreOffice, with maximum
> debugging. Realistically, this is a big job, so won't take mere
> minutes, but let's say be within the same order of magnitude than a
> new amd64 machine?

Ah, right, for that kind of job you want many cores, so a core2 duo will
definitely let you down :-)


        Stefan

[toc] | [prev] | [next] | [standalone]

#256250

[Multipart message — attachments visible in raw view] — view raw

* 2023-03-21 00:02:10+0100, Lionel Élie Mamane wrote:

> Is there any good low-hassle freedom-respecting reasonable price
> reasonable performance computer platform for running Debian these
> days?

Maybe from Tuxedo: https://www.tuxedocomputers.com/en/why-TUXEDO.tuxedo

(I don't own Tuxedo computer myself so I can't tell much.)

-- 
/// Teemu Likonen - .-.. https://www.iki.fi/tlikonen/
// OpenPGP: 6965F03973F0D4CA22B9410F0F2CAE0E07608462

[toc] | [prev] | [next] | [standalone]

#256275

[Multipart message — attachments visible in raw view] — view raw

Am 21. Mar, 2023 schwätzte Teemu Likonen so:

moin moin,

> * 2023-03-21 00:02:10+0100, Lionel Élie Mamane wrote:
>
>> Is there any good low-hassle freedom-respecting reasonable price
>> reasonable performance computer platform for running Debian these
>> days?
>
> Maybe from Tuxedo: https://www.tuxedocomputers.com/en/why-TUXEDO.tuxedo
>
> (I don't own Tuxedo computer myself so I can't tell much.)

I have a Tuxedo laptop with AMD since a year. I've been quite happy with
it, but 90% of my use is screen down and connecting over SSH.

I didn't have time to try debian on it before setting it up for work.
Ubuntu LTS went on fine and has worked smoothly for me.

I did not go minimalistic, AMD Ryzen 7 4700U with Radeon Graphics with
32GB of RAM and 1 TB NVMe drive.

ciao,

der.hans
-- 
#  https://www.SpiralArray.com   https://www.PhxLinux.org
#  "If I want my children to work hard, I better be the hardest working
#  person they've ever met. If I want the children to be nice, I better
#  be the kindest human being they've ever met." -- Rafe Esquith

[toc] | [prev] | [next] | [standalone]

#256263

[Multipart message — attachments visible in raw view] — view raw

Why have you ruled out a system with an integrated Intel GPU?  I've been
quite satisfied with the integrated Intel GPUs for quite some time.
They work well with the compositors in Xfce and GNOME.  They don't seem
to have any issues with XScreensaver's 3D modules.  This is the extent of
my 3D experience as I am not a gamer.

My main desktop is a Lenovo M73 i5 based tower and I've had it over
seven years bought as an off-lease model.  The GPU has two ports and
supports dual monitors without issue.  When I read all the torment
people put themselves through with Nvidia, I just shake my head.  As far
as I'm concerned Nvidia is banned from my network.

Yes, I do have non-free firmware packages installed.  I can't say that
they're strictly necessary.

- Nate

-- 
"The optimist proclaims that we live in the best of all
possible worlds.  The pessimist fears this is true."
Web: https://www.n0nb.us
Projects: https://github.com/N0NB
GPG fingerprint: 82D6 4F6B 0E67 CD41 F689 BBA6 FB2C 5130 D55A 8819

[toc] | [prev] | [next] | [standalone]

#256272

On Wed, Mar 22, 2023 at 05:11:17AM -0500, Nate Bargmann wrote:
> Why have you ruled out a system with an integrated Intel GPU?

Well, I was trying to see if one could get reasonable hardware that
doesn't have untrustable stuff like Intel ME and AMD PSP, and in
integrated Intel GPU requires an Intel CPU and thus having an Intel
ME...

[toc] | [prev] | [next] | [standalone]

#256273

[Multipart message — attachments visible in raw view] — view raw

* 2023-03-22 20:05:21+0100, Lionel Élie Mamane wrote:

> Well, I was trying to see if one could get reasonable hardware that
> doesn't have untrustable stuff like Intel ME and AMD PSP, and in
> integrated Intel GPU requires an Intel CPU and thus having an Intel
> ME...

"Reasonable" is vague but here are more options: Nitro PC or Nitro Pad
(used Lenovo):

    https://shop.nitrokey.com/shop/product/nitropc-132
    https://shop.nitrokey.com/shop/product/nitropad-t430-119
    https://shop.nitrokey.com/shop/product/nitropad-x230-67

"Disabled Intel Management Engine"

-- 
/// Teemu Likonen - .-.. https://www.iki.fi/tlikonen/
// OpenPGP: 6965F03973F0D4CA22B9410F0F2CAE0E07608462

[toc] | [prev] | [next] | [standalone]

#256281

[Multipart message — attachments visible in raw view] — view raw

* On 2023 22 Mar 14:06 -0500, Lionel Élie Mamane wrote:
> On Wed, Mar 22, 2023 at 05:11:17AM -0500, Nate Bargmann wrote:
> > Why have you ruled out a system with an integrated Intel GPU?
> 
> Well, I was trying to see if one could get reasonable hardware that
> doesn't have untrustable stuff like Intel ME and AMD PSP, and in
> integrated Intel GPU requires an Intel CPU and thus having an Intel
> ME...

I understand.  I know there was a lot of speculation about it a couple
years back or so but has it been conclusively determined that it acts in
any nefarious manner?  After all, complexity is going to exist at some
layer and managing a modern computer is a complex task.  Do I wish the
hardware were more free?  Yes.  Still, the manufacturers don't seem to
find value in that.

- Nate

-- 
"The optimist proclaims that we live in the best of all
possible worlds.  The pessimist fears this is true."
Web: https://www.n0nb.us
Projects: https://github.com/N0NB
GPG fingerprint: 82D6 4F6B 0E67 CD41 F689 BBA6 FB2C 5130 D55A 8819

[toc] | [prev] | [next] | [standalone]

#256286

> I understand.  I know there was a lot of speculation about it a couple
> years back or so but has it been conclusively determined that it acts in
> any nefarious manner?

AFAIK the information necessary to be able to assess whether it may act
in a nefarious manner (or not) is missing.

As poor peons, we're constantly being told that it's no big deal to have
all our lives' details shared by hundreds of companies because...
we're good people so we shouldn't have anything to hide, right?

By the same reasoning, when a company hides information from us, I can
only assume it's because ... they do have something to hide :-(


        Stefan

[toc] | [prev] | [next] | [standalone]

#256287

On Wed, 2023-03-22 at 23:59 -0400, Stefan Monnier wrote:
> > I understand.  I know there was a lot of speculation about it a
> > couple
> > years back or so but has it been conclusively determined that it
> > acts in
> > any nefarious manner?
> 
> AFAIK the information necessary to be able to assess whether it may
> act
> in a nefarious manner (or not) is missing.
> 
> As poor peons, we're constantly being told that it's no big deal to
> have
> all our lives' details shared by hundreds of companies because...
> we're good people so we shouldn't have anything to hide, right?
> 
> By the same reasoning, when a company hides information from us, I
> can
> only assume it's because ... they do have something to hide :-(

Or a government.

Cheers!

[toc] | [prev] | [next] | [standalone]

#256292

On Wed, Mar 22, 2023 at 06:05:48PM -0500, Nate Bargmann wrote:
> * On 2023 22 Mar 14:06 -0500, Lionel Élie Mamane wrote:

>> Well, I was trying to see if one could get reasonable hardware that
>> doesn't have untrustable stuff like Intel ME and AMD PSP, (...)

> I understand.  I know there was a lot of speculation about it a
> couple years back or so but has it been conclusively determined that
> it acts in any nefarious manner?

While the question of:

 * Whether it acts nefariously on purpose by decision of Intel
   (whether that is credible to me depends on what one means by
    "nefariously"; the Sony rootkit was "nefarious" in my opinion)

 * Whether your particular piece of hardware that you got was
   "intercepted" and changed to spy on you (like was routinely done
   e.g. on Cisco and telco hardware leaving the USA...)

 * Whether it still contains security bugs allowing an undetectable
   firmware rootkit to be installed without Intel's collaboration, and
   without access to Intel's signing keys

is at this point speculative, the fact that it allowed, for a long
time, installation of undetectable firmware rootkit is not.
https://www.blackhat.com/docs/eu-17/materials/eu-17-Goryachy-How-To-Hack-A-Turned-Off-Computer-Or-Running-Unsigned-Code-In-Intel-Management-Engine.pdf

I'd prefer a platform where the firmware is auditable (notwithstanding
the better wish for free software that I can modify), thank you very
much. This is becoming steadily more important; Russia and China don't
(our should not...) trust technology coming from the USA (for good
reasons), maybe from "the Western World" in general. In turn, China,
with its ever deeper "integration" between state intelligence and
technology companies... would/should "we the Western World" trust it?

If USA & Germany could, for decades, subvert the security of Crypto
AG, do we really want to "trust" that Intel, AMD, ... Oppo/OnePlus,
Huawei, Xiamo and ... Lenovo ... and ... IBM ... are not subverted?

If ASML collaborates with the USA to "block" Chinese capacity in chip
production, can we trust that NXP does not collaborate with USA
intelligence, in a world where we have known for decades that they
perform worldwide mass surveillance, injection of backdoors in
cryptography standards, etc?


Look at the situation and recent events around UEFI secure
boot... Microsoft is the sole gatekeeper to who/what can boot on an
amd64 PC out of the box (they are the _only_ ones whose bootloader
signing keys are in the firmware "out of the box"). It starts
innocuous enough, they setup a service where they (I assume for a
fee...) audit your bootloader and sign it. The whole GNU/Linux / free
OS ecosystem has done efforts to make their work in doing that, and
managing revocation / blocklisting of known vulnerable bootloader
versions, easier. They, by fiat, suddenly they decide that ... no, on
a certified machine, any non-Microsoft bootloader signed by Microsoft
_is_ _not_ allowed out of the box.
https://mjg59.dreamwidth.org/60248.html


So, no, having Intel, AMD, etc being the stewards... may have worked
OK for some time, but I don't want to lock us collectively into that,
if we can avoid it.

Lionel

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web