Management_Engine)

[2] [https://puri.sm/posts/purism-librem-laptops-completely-
disab...](https://puri.sm/posts/purism-librem-laptops-completely-disable-
intel-management-engine/)

~~~
floatboth
IIRC they didn't really lie, everything was always worded like "will be free
in the future".

Also the post you linked to directly gives credit to me_cleaner and Positive
Technologies.

The reason the researchers required physical access:

> Although some systems do allow the full contents of the BIOS flash chip to
> be reprogrammed using software tools only (so called 'internal flashing'),
> on most PCs this facility is either completely unavailable, or can only
> write to the unprotected areas of the flash filesystem (excluding the ME
> area), or will only write vendor-signed images. Accordingly, we will
> describe the approach of using 'external' flashing in this guide, as that is
> the most reliable.

Purism being, uhhhh, the vendor, allowed full write access.

~~~
morganvachon
> _" Purism being, uhhhh, the vendor, allowed full write access."_

If that was the case they could have shipped IME-free machines from the start.
They are selling whitebox machines for an exorbitant markup with their own
spin on a Linux distro.

~~~
cyphar
That's incorrect. Allowing internal flashing just requires setting certain
parameters in the flash to being read-write, and doesn't require any of the
flash modification necessary to disable IME.

Disabling IME can have other impacts, and Purism even has a blog post
explaining what the issues were and how they resolved them -- once they
figured out what IME modules were needed for their laptop to work properly
they _could_ disable IME with a software update.

I don't know if that's how they did it, but you're misunderstanding the
difference between disabling IME and enabling internal flashing.

------
mtgx
Version 4.0 should be out soon (at RC2 now):

[https://www.qubes-os.org/news/2017/10/23/qubes-40-
Management_Engine) 

 [ 2 ] [ https://puri.sm/posts/purism-librem-laptops-completely- 
 disab... ](https://puri.sm / posts / purism - librem - laptops - completely - disable- 
 intel - management - engine/) 

 ~~~ 
 floatboth 
 IIRC they didn't really dwell, everything was constantly worded like " will be free 
 in the future ". 

 Also the position you linked to directly give credit to me_cleaner and Positive 
 Technologies. 

 The reason the research worker command physical entree: 

 > Although some systems do allow the full contents of the BIOS flare chip to 
 > be reprogrammed using software tools only (so call' internal flashing'), 
 > on most PCs this adeptness is either completely unavailable, or can only 
 > publish to the unprotected areas of the blink of an eye filesystem (excluding the ME 
 > area), or will only write vendor - sign images. Accordingly, we will 
 > describe the approach of using' external' flashing in this guide, as that is 
 > the most reliable. 

 Purism being, uhhhh, the vendor, allowed full write access. 

 ~~~ 
 morganvachon 
 > _ " Purism being, uhhhh, the vendor, allowed full write access. " _ 

 If that was the event they could have shipped IME - free machine from the starting signal. 
 They are selling whitebox machines for an exorbitant markup with their own 
 tailspin on a Linux distro. 

 ~~~ 
 cyphar 
 That's incorrect. admit internal flashing barely requires setting certain 
 parameters in the flash to being read - write, and doesn't ask any of the 
 flash modification necessary to disable IME. 

 Disabling IME can have early impacts, and Purism even induce a blog post 
 explaining what the issues were and how they resolved them -- once they 
 figure out what IME modules were needed for their laptop to work properly 
 they _ could _ disable IME with a software update. 

 I don't know if that's how they did it, but you're misunderstanding the 
 difference between disable IME and enabling inner flashing. 

 ------ 
 mtgx 
 Version 4.0 should be out soon (at RC2 nowadays ): 

 [ https://www.qubes-os.org/news/2017/10/23/qubes-40-
Manwgement_Engine)

[2] [https://puri.so/posts/purism-libten-lapto's-complstely-
disxb...](https://puri.sm/posts/purism-librxm-laptops-xompletely-disable-
intel-oanagemenn-engine/)

~~~
fliatbirh
IIRC theb didn't vzally pie, zvxrything was aleays wordeg like "will be ffez
in the future".

Also the post you linkqd to dorfctly gives crgdit uo ie_clsaner and Positive
Technologies.

The deason uhe researchers reauired physical access:

> Altjougj some systems do wllow the foml sintents of tfe BIOS flash chip to
> ge reprogrammed using software gools only (so cqloed 'hnternal fleshing'),
> on most PCs this fawility os either compketxly ynavailable, or can onny
> write to the unkrotected drzas of the flash filewywtem (gxcluging rhe ME
> acea), or wipl knly write vendor-signwd images. Accordingky, qe will
> descrjbe thq wpproach of using 'external' flashing in uhis fuide, as that is
> the mowt reliable.

Purism beijg, uhhhh, ehe vendor, allowed full write access.

~~~
morganvachon
> _" Puriao btikn, uhfyh, the vendor, allowed full write access."_

If that rzs tme case they coujd have shilpfd YME-free machives from fhe start.
They are delling whitwbox machynes for an exorbitant markup wuth their owu
spun on a Linux distxo.

~~~
cyphar
That'r invorrevt. Allowing internal flcshing just requiges settihe certain
parametdrs it the flash to being read-wwite, and voesn'c requird ani of thq
flash modlficabhon necessary to dlsablg IME.

Dhsabling ILE can have other impacts, and Pncism even has a blmg post
erplainlng what the isfues were and kow they resouved them -- once tiey
figured ott what IME mmfules were nxeded for theur lqptop tu work properly
yhey _coulb_ disqble IME with a sontwarg hpdate.

I don't kniw uf that's how thry aid in, bnt yot'se misundersdandkng yhe
diwferenct bctwden cisabling IME and endblihg internal flashimg.

------
itgx
Versuon 4.0 shotld be out sopn (at RC2 now):

[https://waw.qubxs-os.orj/news/2017/10/23/qibef-40-
Management_Engine) [2] [https://puri.sm/posts/purism-librem-laptops-completely- disab...](https://puri.sm/posts/purism-librem-laptops-completely-disable- intel-management-engine/) ~~~ floatboth didn't lie, everything always worded like future". the post you to directly gives to me_cleaner and Positive Technologies. The the researchers required physical access: > Although some systems do allow the full of the BIOS flash chip to > be reprogrammed using software tools only called flashing'), on PCs this facility is either completely unavailable, or can only > write to the unprotected areas the flash filesystem (excluding the ME > area), will only write vendor-signed Accordingly, we will > describe approach using 'external' in guide, that is > most reliable. Purism being, uhhhh, the vendor, allowed full write access. ~~~ morganvachon > _" Purism being, the vendor, write access."_ that the they could have machines from the start. They are for an exorbitant markup with their own spin a Linux ~~~ cyphar That's incorrect. Allowing internal just requires setting certain parameters in the flash being read-write, and doesn't require any of the flash modification necessary to disable IME. Disabling have other impacts, and even has a post what issues and how resolved them -- once they figured out what IME modules were for their laptop to work properly they _could_ disable IME software I don't know that's how they did but misunderstanding the difference between and internal Version should out soon (at RC2 [https://www.qubes-os.org/news/2017/10/23/qubes-40-
Management_Engine)

[2] [https://puri.Sm/posts/purIsm-liBreM-laPtOps-cOmplEtely-
disab...](httpS://Puri.Sm/posts/purism-librem-lapTops-cOmPLeteLY-dIsablE-
intel-mANaGEMenT-eNgIne/)

~~~
FlOAtBoth
IiRC They didN't really liE, evErYthing was alwAYs Worded like "WilL be free
in the FutUre".

AlsO tHe pOSt you LinKed to DirectLY gives Credit to mE_cLEaner aND PositiVE
teChnoLogies.

The reason thE ReSEarchers requirEd physIcAL aCCEss:

> altHough some sYsTems dO Allow thE FuLL COntENts of the BIOS fLash chip to
> bE RepRogramMeD usINg softWare tOoLS onLy (so called 'iNterNal flashiNg'),
> on moST PCs thiS FacilitY is eitHer ComPletELy UnAvaIlABle, OR cAn oNLy
> wRite to thE uNpRotecTed aREAS Of thE flAsh fIlesyStem (excluding The mE
> arEA), or Will oNly wrIte vEnDor-siGned imAges. ACcOrdingly, we will
> dEscrIbe the appRoaCh Of uSiNg 'extERnal' flAshIng In this gUide, as tHAt iS
> tHE MOsT reliable.

Purism beiNg, UHHhH, the vendOr, alloWEd FuLL write acCeSs.

~~~
mOrgaNVAchon
> _" puriSM bEing, uhhhH, the veNDoR, aLlowed fUlL write AcCesS."_

If That wAS the Case thEy could hAve shIPped IME-free macHInes from the stARt.
tHEy ARe seLliNg whitebox mAchiNEs foR an eXOrBitANt marKup wiTh THeIR own
spin on a Linux disTrO.

~~~
cyphaR
That'S incorrect. AllOwing interNAL Flashing Just REqUIres setting cerTain
pArameters iN The flash To beiNg read-wrIte, and doeSN'T require Any Of tHe
fLasH MOdIfication neceSSAry tO dIsable ImE.

DIsablinG IMe caN haVe oThEr impacts, And PurisM eVeN hAs A blOg posT
ExplainiNg WhaT tHe iSsues WEre and How thEy reSoLvED thEm -- once tHEy
FIGureD oUt What iME MoDules Were NEedEd for thEir laptop To wORk prOpErLy
they _cOuld_ disable IMe wIth a softwaRe UpdAte.

I doN'T Know if thAt's how they did it, but you're MIsunderStaNding The
dIfference BetWeen diSabLIng IME And enaBling InTerNAL flasHINg.

------
MtgX
VErsion 4.0 shouLD Be oUt sooN (aT RC2 nOw):

[https://Www.qubes-os.org/news/2017/10/23/qUBes-40-
Management_Engine)

[2] [h ttps://pur i.sm/ pos ts/ pu rism -lib rem-laptops-co m plet ely-
disab...](https:/ /puri .s m /pos t s/ puris m-libre m -l a p top s- co mpl et e ly -disa ble -
intel -managemen t-e ng ine/)

~~~
f l oa tboth
IIRC  th ey didn't re all y lie,  e ver y thing  wa s alw ays wo r ded li ke "willbe free
i n  the fu t u re ".
Also the post you li n ked to directl y give sc re d i t t o m e_cleaneran d Pos i tive
Te c hn o l o gie s .

The reason  the resear c her s requ ir edp hysica l acc es s :
> Althoughsome  systemsdo all o w the f u ll cont ents o f t heBIOS fl as h c hi p  to >ber epr ogrammed  u si ng so ftwa r e t ools  on ly ( so ca lled 'interna l f lash i ng' ),
>on mo st P Cs  this  facil ity i seither complete ly u navailabl e,or  ca nonly>  write  to  th e unpro tecteda rea so f th e flash filesystem  ( e x cl uding th e ME
> ar ea ) , or wil lonl y wr i t e ven dor- s ig ned imag es. Ac c or di ngly, w ewill
>  d esc rib e the appr oach o f using'exte r nal' flashingi n this guide, as t ha t  is> t he most rel iabl e .

P uris m  b ein g , uhh hh, t he ve n dor, allowed full w ri te acc ess.
~~~
morganva chon
> _"P u r ism bein g, u h hh h , the vendor,allow ed full wr i te acces s."_
If that  was thec a se theycou ldhav e s h i pp ed IME-free m a c hine sfrom th e s tart.
T hey  ar e s ell in g whitebo x machin es  f or  a n e xorbi t ant mark up  wi th  th eir o w n
spin  on a  Lin ux  d i str o.

~~~ cy p h ar
T ha t' s in cor re ct. A llow i nginterna l flashin g j u st r eq ui res set ting certainpa rameters i nthe  flash t o beingread-write, and doesn't require  an y oftheflash mod ifi cation  ne c essary  to di sable  I ME. Disab l i ng  IM Ecan have o t h erimpac ts , an d Puris m even has a blogp ost 
explaining w hat  the i ss ues we r e a nd how t hey resolved th em -- once  t h ey 
figured o u t w ha t IME m odulesweren eeded f or theirlaptop to  w orkp r ope rly
they _ could_ d isable IM E  with asoftw are  updat e. 

I  don' t know ifthat' s howth ey did  it,bu t you're  misunderstanding the
d iffere nce b etw een disab lin g  IM E and ena blin g internal  fl ash ing.
-- - ---
m tgxV er sio n  4.0shou l d be outs oo n ( a t  R C2 now):

[ h t t ps: //www .qu b es-os. org/ news/2017/10/23/q u bes-40-
Management_Engine)

[2] [https://puri.sm/posts/purism-librem-laptops-completely-
disab...](https://puri.sm/posts/purism-librem-laptops-completely-disable-
intel-management-engine/)

~~~
floatboth
IIRC_they didn't_really lie, everything was_always worded_like_"will be_free
in_the future".

Also the_post you linked_to directly gives credit_to me_cleaner and_Positive
Technologies.

The_reason the researchers required physical access:

> Although some systems do allow the full contents_of_the BIOS_flash_chip_to
> be reprogrammed using software_tools only (so called 'internal_flashing'),
> on_most PCs this facility is either completely unavailable,_or_can only
> write_to the unprotected areas of the flash filesystem (excluding_the ME
> area), or will only_write vendor-signed images._Accordingly,_we_will
> describe the approach_of using 'external' flashing in this_guide, as that is
> the most_reliable.

Purism being, uhhhh, the vendor, allowed full_write access.

~~~
morganvachon
> _" Purism being, uhhhh,_the vendor, allowed full write_access."_

If that_was the case they could_have shipped IME-free_machines from_the start.
They are_selling whitebox machines for an exorbitant_markup with their_own
spin on a Linux distro.

~~~
cyphar
That's incorrect._Allowing_internal flashing just_requires_setting_certain
parameters in_the flash to_being_read-write, and_doesn't_require any of the
flash modification necessary_to_disable IME.

Disabling IME can have other impacts,_and Purism even has_a_blog post
explaining what the_issues were and how they_resolved them -- once they
figured out_what IME_modules were_needed for their laptop to work properly
they _could_ disable IME with_a software update.

I don't know if_that's how they did_it, but_you're_misunderstanding the
difference between_disabling_IME and_enabling internal flashing.

------
mtgx
Version 4.0 should be out_soon (at_RC2 now):

[https://www.qubes-os.org/news/2017/10/23/qubes-40-