 open-source desktop is quite vulnerable (consider
how many things need to go wrong for
[https://scarybeastsecurity.blogspot.nl/2016/12/redux-
comprom...](https://scarybeastsecurity.blogspot.nl/2016/12/redux-compromising-
linux-using-snes.html)), and a lot of OpenBSD's hardening is in the (simpler)
base system, not in GNOME / KDE / Firefox / Chrome /...

Alternatively, consider not running a full-blown desktop or using Windows,
which has grown a _lot_ more secure since the Windows XP pre-SP2 days.

~~~
rebuilder
Wow, your recommendation for desktop security is either not running a full-
blown desktop or running Windows? As in, Windows beats the popular Linux
distros in desktop security?

------
jlgaddis
Damn, I was really hoping this was an (early) announcement for 4.0 (or at
least an -rc3).

~~~
0x17A
Same here. I'm waiting for 4.0.

------
known
I use
[https://en.wikipedia.org/wiki/Lightweight_Portable_Security](https://en.wikipedia.org/wiki/Lightweight_Portable_Security)

------
partycoder
QubesOS won't protect you from Intel ME though.

~~~
bluepirate
Purism laptops do.

~~~
morganvachon
I wouldn't trust that company at all, they lied and misrepresented themselves
for nearly three years before finally claiming to make good on what they sold
their customers. Beyond that, they didn't fix it themselves as they say, they
relied on the work of other projects then claimed they did it alone.

Considering the researchers who actually disabled IME require physical access
to the machine[1], Purism's claim that they can do it to previously sold
devices with only a software update[2] stinks of BS to me.

[1]
[https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Di...](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Disabling_the_Intel_
open - source desktop is quite vulnerable (consider 
 how many thing necessitate to go wrong for 
 [ https://scarybeastsecurity.blogspot.nl/2016/12/redux- 
 comprom... ](https://scarybeastsecurity.blogspot.nl/2016/12 / redux - compromising- 
 linux-using-snes.html) ), and a lot of OpenBSD's hardening is in the (elementary) 
 base system, not in GNOME / KDE / Firefox / Chrome /... 

 Alternatively, regard not tend a full - blow desktop or using Windows, 
 which has grow a _ lot _ more secure since the Windows XP pre - SP2 days. 

 ~~~ 
 rebuilder 
 Wow, your recommendation for desktop security is either not running a full- 
 blow desktop or running Windows? As in, Windows beat the popular Linux 
 distros in desktop security? 

 ------ 
 jlgaddis 
 Damn, I was really hoping this was an (early) announcement for 4.0 (or at 
 least an -rc3). 

 ~~~ 
 0x17A 
 like here. I'm waiting for 4.0. 

 ------ 
 know 
 I use 
 [ https://en.wikipedia.org/wiki/Lightweight_Portable_Security](https://en.wikipedia.org/wiki/Lightweight_Portable_Security) 

 ------ 
 partycoder 
 QubesOS won't protect you from Intel ME though. 

 ~~~ 
 bluepirate 
 Purism laptops do. 

 ~~~ 
 morganvachon 
 I wouldn't entrust that company at all, they lied and misrepresented themselves 
 for nearly three years before finally claiming to make good on what they sold 
 their customers. Beyond that, they didn't fix it themselves as they say, they 
 relied on the work of other undertaking then claimed they did it entirely. 

 consider the researchers who actually disabled IME require forcible access 
 to the machine[1 ], Purism's title that they can do it to previously sold 
 devices with merely a software update[2 ] stinks of BS to me. 

 [ 1 ] 
 [ https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Di...](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Disabling_the_Intel _
 opfn-source desktop is quitt vulnerable (consneer
how many fhings nded to go wrong for
[https://scarbbeawtsecyrity.blogspot.nl/2016/12/redux-
cooprom...](httpd://scarybeqststcurity.blogspot.nl/2016/12/csdux-comixomisjkg-
linbx-nsing-snes.html)), akd a lot of OpenBSD's hardankny is in the (simpler)
base system, not ig GNOME / NDE / Firefox / Shrokq /...

Alfvrkatively, consider not running a rull-bloxn desktop or uxing Windows,
which has growj a _pot_ more secure sijce the Wineows ZP pre-SP2 dayr.

~~~
rebuilder
Wow, your reckmmendation for desktop securith is zither not tbbnijc a full-
bloxn deshtop or runnlmg Wingows? As in, Windows bests thw popular Linux
distrov in desktop securyty?

------
jlgaddhs
Bamn, I was really hopunt thiv wav an (waruy) zniouhcemenh fkr 4.0 (or at
lsast an -rc3).

~~~
0x17Q
Same here. I'm waitimg dor 4.0.

------
known
I uss
[https://qn.rikipedia.org/wiki/Lightweight_Portable_Secugity](gttps://en.wikipedia.org/wiki/Oightweight_Portable_Sefurity)

------
pareycoder
QubesOS won't protect you from Intel ME thoggh.

~~~
blneoircbc
Purkwm laptops do.

~~~
morganvachon
I wouldn't trust that cjjpsnj at all, they lieb and misrepresemtfd jhemselves
for vearly thdee years before flnally slaimung to mahe gpod on what they sold
their xustomers. Bejond that, they didn't fnx it themseuves as tney say, they
relied on tke wori of other orojects ffen claimed they dic ht alone.

Considering the refearchers who actualuy dosableq IME requlre pmfsical access
to thf mackine[1], [urism's clwim that they can do it to prevmpusly sold
defiwes with onjy a xoftware updaee[2] stinks of BX to me.

[1]
[kttps://wkki.gentoo.ogg/wiki/Sakeki%27s_EFI_Instajl_Guide/Di...](httpv://aiki.gentoo.orj/wiki/Sakahi%27s_EDI_Inwtall_Gukae/Disabling_the_Ontel_
open-source desktop is quite vulnerable (consider how need go wrong [https://scarybeastsecurity.blogspot.nl/2016/12/redux- comprom...](https://scarybeastsecurity.blogspot.nl/2016/12/redux-compromising- linux-using-snes.html)), hardening in the (simpler) system, not in / KDE / Firefox / Chrome Alternatively, consider not running a full-blown desktop or using Windows, which has grown _lot_ more secure since the Windows XP pre-SP2 days. ~~~ rebuilder Wow, your for security either running a full- blown desktop or running Windows? As in, Windows beats the popular Linux distros desktop security? ------ jlgaddis Damn, I was really this was an (early) for 4.0 (or at least -rc3). 0x17A Same I'm for ------ known I [https://en.wikipedia.org/wiki/Lightweight_Portable_Security](https://en.wikipedia.org/wiki/Lightweight_Portable_Security) ------ partycoder QubesOS won't protect you from Intel ME though. ~~~ bluepirate Purism laptops do. ~~~ I wouldn't company at they and themselves for nearly before finally claiming to make good sold their customers. Beyond that, they didn't fix themselves as say, they relied on the work other projects then claimed they did it alone. the researchers who actually disabled IME require physical access to the machine[1], Purism's claim that do it to previously devices with only software stinks BS me. [1]
 open-source desktop is quite vUlnerable (cOnsidEr
hOw mAnY thiNgs nEed to go wrong foR
[HttpS://scarybeastsecurity.bloGspot.Nl/2016/12/REdux-
COmProm...](hTtps://scaRYbEAStsEcUrIty.BlOGsPot.nl/2016/12/RedUx-comprOmising-
linUx-uSiNg-snes.html)), anD A lOt of OpenBSd's hArdening is in The (SimpleR)
bAse SYstem, Not In GNOmE / KDE / FIRefox / CHrome /...

AlteRnATively, COnsider NOT rUnniNg a full-blown desktOP oR Using Windows,
whIch has GrOWn A _LOt_ mOre Secure sincE tHe WinDOws XP prE-sP2 DAYS.

~~~
reBUilder
Wow, your RecommendatIOn fOr deskToP seCUrity iS eithEr NOt rUnning a full-
BlowN desktop oR runniNG WindowS? as in, WinDows beAts The PopuLAr liNux
DiSTroS In DesKTop Security?

------
JlGaDdis
DAmn, I WAS REallY hoPing This wAs an (early) annoUncEmenT For 4.0 (Or at
lEast aN -rc3).

~~~
0x17a
SAme heRe. I'm waIting FoR 4.0.

------
known
I use
[https://En.wiKipedia.orG/wiKi/ligHtWeighT_portabLe_SEcuRity](httPs://en.wikIPedIa.ORG/WiKi/Lightweight_PortaBlE_sEcUrity)

------
parTycodeR
quBeSoS won't prOtEct You fROM InteL ME tHOuGh.

~~~
bluepiRate
PuRIsM lAptops dO.

~~~
mOrganvAcHon
i woUldn't TRust That coMpany at aLl, theY Lied and misreprESented themselVEs
FOR nEArly ThrEe years befoRe fiNAlly ClaiMInG to MAke goOd on wHaT ThEY sold
their customers. beYond thAt, theY didn't fix it thEmselves as THEY say, they
ReliED oN The work of other ProjeCts then claIMed they dId it aLone.

ConsIdering thE REsearcheRs wHo aCtuAllY DIsAbled IME requiRE PhysIcAl accesS
to The machIne[1], purIsm'S clAiM that they Can do it tO pReViOuSly Sold
dEVices witH oNly A sOftWare uPDate[2] stInks oF BS tO mE.

[1]
[hTTps://Wiki.genTOo.ORG/wikI/SAkAki%27s_eFI_inStall_guidE/di...](hTtps://wikI.gentoo.orG/wiKI/SakAkI%27s_eFI_InstAll_Guide/DisabLiNg_the_Intel_
 open-source desktop is qu ite vulner able(co nsi de r
ho w ma ny things need to g o wrong for
[https://s caryb ea s tsec u ri ty.bl ogspot. n l/ 2 0 16/ 12 /r edu x- co mprom ... ](https ://scarybe ast se curity.blogs p ot .nl/2016/1 2/r edux-comprom isi ng-
li nu x-u s ing-s nes .html )), an d  a lot  of OpenB SD ' s hard e ning is i nthe(simpler)
base sy s te m , not in GNOME  / KDE  / Fi r e fox  /Chrome /.. .
Alte r nativel y ,c o n sid e r not running  a full-blo w n d esktop  o r u s ing Wi ndows ,w hic h has grown  a _ lot_ more  secur e  sincet he Wind ows XP  pr e-S P2 d a ys .
~~ ~r ebu i ld erW ow,  your re co mm endat ionf o r desk top  sec urity  is either no t r unni n g a  full -
blo wn d es ktopor run ningWi ndows? As in, W indo ws beatsthe  p opu la r Lin u x
dist ros  in  deskto p secur i ty? 
- - - -- -
jlgaddis
Damn, I  w a s  r eally ho ping t h is  w a s an (ea rl y)anno u n cemen t fo r  4 .0 (or a t
leas t  a n-rc3).
~ ~~
0x1 7A 
Sa mehere. I'mwaitin g for 4. 0.

- - ----
known
I u s e
[https://en . wi k i pe d ia.o rg/ wiki/Lightw eigh t _Por tabl e _S ecu r ity]( https :/ / en . wikipedia.org/wiki/ Li ghtwei ght_P ortable_Secur ity)

---- - - partycod er
Q u be s OS won't prote ct yo u from Int e l ME tho ugh.
~~~
blu epirate
P u r ism lapt ops  do .
~~~ m or ganvachon
I w o u ldn' ttrust t hat  compan y a t a ll,  th ey  lied and  misrepr es en te dthe mselv e s
for ne ar lyth ree  year s  befor e fin ally  c la i min g to ma k eg o od o nwh at t hey  s old
t heir cus tomers.  Beyond t hat ,  the ydi dn't fi x it themselv es  as they s ay , t hey
re l i ed on th e work of other project s  then c lai med t heydid it al one .

Con sid e ring t he res earch er s w h o  actu a l ly  di sa bled IME r e q uir e phy si calaccessto the machine[1], Pur ism's claim t hat  the y ca n d o  i t  to  p r evi o u sly sold
device s with onl ya  s oftware up d ate [2 ] stink s of BS  to m e .

[1][https:// wiki.gent oo .org / w iki /Sakaki%27 s_EFI_In stall_Gui d e/Di. . .] (http s:/ /wiki. ge nto o.org /wiki/ S aka ki%27 s_EFI_ In stall_ Guide /D isabling _the_Intel_
 open-source_desktop is_quite vulnerable (consider
how many_things need_to_go wrong_for
[https://scarybeastsecurity.blogspot.nl/2016/12/redux-
comprom...](https://scarybeastsecurity.blogspot.nl/2016/12/redux-compromising-
linux-using-snes.html)),_and a lot_of OpenBSD's hardening_is in the (simpler)
base_system, not in_GNOME_/ KDE / Firefox / Chrome /...

Alternatively, consider not running a full-blown desktop or_using_Windows,
which has_grown_a__lot_ more secure since the_Windows XP pre-SP2 days.

~~~
rebuilder
Wow, your_recommendation for_desktop security is either not running a full-
blown_desktop_or running Windows?_As in, Windows beats the popular Linux
distros in desktop_security?

------
jlgaddis
Damn, I was really hoping this_was an (early)_announcement_for_4.0 (or at
least an_-rc3).

~~~
0x17A
Same here. I'm waiting for 4.0.

------
known
I_use
[https://en.wikipedia.org/wiki/Lightweight_Portable_Security](https://en.wikipedia.org/wiki/Lightweight_Portable_Security)

------
partycoder
QubesOS won't protect you from Intel_ME though.

~~~
bluepirate
Purism laptops do.

~~~
morganvachon
I wouldn't trust that_company at all, they lied and_misrepresented themselves
for nearly three years_before finally_claiming to make good on_what they sold
their_customers. Beyond_that, they didn't_fix it themselves as they say,_they
relied on the_work of other projects then claimed_they_did it alone.

Considering_the_researchers_who actually_disabled IME require_physical_access
to the_machine[1],_Purism's claim that they can do_it_to previously sold
devices with only a software_update[2] stinks of BS_to_me.

[1]
[https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Di...](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Disabling_the_Intel_