To Taiidan and all others complaining about Purism lies and consumer being

I keep reading stuff about purism lying about deactivating/disabling ME
being impossible, lying about the future of Intel removing ME, etc. I think
THIS is misleading.

First, its me_cleaner job to do the cleaning.
The ME hack itself won't remove ME, but can remove modules by stripping
them. There is a big semantic difference between the words removing,
disabling and deactivating, I agree. Me_cleaner won't remove ME, that is
true. But all this ranting is not factual.

See here:


"For pre-Skylake firmware (ME version < 11) this tool removes almost
everything, leaving only the two fundamental modules needed for the correct
boot, ROMP and BUP. The code size is reduced from 1.5 MB (non-AMT firmware)
or 5 MB (AMT firmware) to ~90 kB of compressed code.

Starting from Skylake (ME version >= 11) the ME subsystem and the firmware
structure have changed, requiring substantial changes in me_cleaner. The
fundamental modules required for the correct boot are now four (rbe,
kernel, syslib and bup) and the minimum code size is ~300 kB of compressed
code (from the 2 MB of the non-AMT firmware and the 7 MB of the AMT one)."

To have Intel without ME ( but also without vt-d2, meaning no IOMMU) one
will need to choose old hardware, like the x200, which will not have more
then 8gb ram and won't support hardware isolation, so no real advantage of
using Qubes.

x230 and x220 and others will boot with deactivated ME, booting with ROMP
and BUP present, true, but without kernel and no other modules.

The rest of what you say, I agree. But oversimplifying things doesn't
fulfill the goal of making people aware of what is needed now and in the
future. Maybe Intel will change their way of fusing keys into the CPU when
they realise a lot of money is going out of their pocket to privacy
defending manufacturers. Maybe not. Time only will let us know. Their
objective is good. They might now success against Goliath, but really
trying their best for actual possibilities. ( IOMMU, minimal ME footprint,
disabling ME the same way it is done for three letters agencies laptops).

Until brand new laptops can fulfill IOMMU needs for certain threat models,
there is few alternatives now.

Used laptops:
Having IOMMU without ME/PSP (Qubes): Lenovo g505s.
Removed ME, without IOMMU: x200.
Disabled ME with IOMMU (Qubes): x230/x220.

New laptops:
Deactivated ME, with IOMMU (Qubes): Purism Librems.

With IOMMU (Qubes), no ME/PSP: kgpe-d16, kcma-d8
With IOMMU (no Qubes): Talos II.

Let's start a real debate aimed at improving stuff and building proper
Pressure against manufacturers will build with market laws, and energy
should be put where things can evolve in the meantime.

For my part, I wouldn't recommend using a x200 other then for amnesic
G505s are not powerful and tough enough to run Qubes as a daily driver.

ME is a really nasty piece of shit to deal with, agreed. But things needs
to move forward. Hiding in a cave waiting for things to magically happen is
not enough.


Le mer. 11 avr. 2018 16:57, <> a écrit :

> On 04/11/2018 03:14 AM, Drew White wrote:
> > On Wednesday, 11 April 2018 16:55:48 UTC+10,  wrote:
> >> What you ask for is impossible, it simply isn't made - no one has a
> >> laptop with 64GB RAM and 12 threads let alone one that is old enough to
> >> not have UEFI.
> > I know that they exist, and I would have one if I had enough money. But
> they do exist. As for UEFI (Microsofts shit invention) if I can disable it
> or else just replace it with an actual REAL BIOS, then I will.
> You can't do that unless the computer supports coreboot and the new
> stuff doesn't.
> >> The best you will get is a W520 or W530 where you can install coreboot
> >> (open hw init + nerfed ME) and have 32GB RAM.
> > Can the CPU be upgraded in those though?
> Yeah its socketed.
> I suggest buying a W520 and installing the best ivybridge CPU you can,
> then you get the better non-chiclet keyboard and it is also better
> supported in coreboot the port for the W530 was never upstreamed.
> >> Purism is not libre - their "open source firmware" has hardware
> >> initiation done entirely via binary blobs and their ME is certainly not
> >> disabled as the kernel still runs along with any hypothetical backdoor.
> >> Their marketing is incredibly dishonest and I simply don't understand
> >> why they get so much air time.
> > lol, then the only way I can get around it is to disable it myself by
> editing the CPU firmware? Or is there something else that controls that?
> (I'll have to look into it.)
> Disabling ME/PSP is impossible, it simply can't be done without
> intervention from intel/amd.
> The puridiots claim they will eventually be able to convince intel to do
> it because some sales guy at a convention said so (they will say
> whatever to get you to buy stuff) - however google tried a few years
> back and even them as a billion dollar company wasn't able to convince
> intel to do it.
> ME cleaner nerfs it even with the hap bit it isn't disabled because the
> kernel still runs it simply shuts off after the kernel runs but that is
> more than enough time to set up any potential backdoor and perform a
> variety of dirty tricks.
> NSA/MSS/FSB says: "oh no they removed the networking module what will we
> do now D: D: D:"
> > If their information is wrong, then I'll report them for false
> advertising. Thanks for letting me know.
> I don't know who you could report them to but thanks anyway I would like
> that very much their marketing is very sleazy and dishonest.
> Like I said I simply don't understand why I am the only critical voice,
> the tech media frequently publishes glorified press releases for them
> with absolutely no criticism or real facts about how their computers are
> not and can't ever have free firmware or free hardware...
> (Gotta love their insulting of their honest competitors and donating to
> their own crowdfunding campaign)
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to
> To post to this group, send email to
> To view this discussion on the web visit
> .
> For more options, visit

You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
To post to this group, send email to
To view this discussion on the web visit
For more options, visit

Reply via email to