/hrt/ - Hardware Removal-of-botnet Thread

I have created cancer edition
Last thread (1/4)

This general is dedicated to the creation of a list of hardware that is relatively botnet-free.
The Intel ME and other components are a serious threat to user privacy.

>"But what's the Intel ME, user?"
I'm glad you asked! The Intel ME, or Management Engine, is a secondary co-processor in every single Intel chip in the last decade.
It runs a MINIX-based operating system and has full networking capabilities, drivers, and a goddamn web server in it.
networkworld.com/article/3236064/servers/minix-the-most-popular-os-in-the-world-thanks-to-intel.html
This page offers additional information, and explains that it can read your files and applications, act as a keylogger, capture the screen, inject rootkits, etc.
libreboot.org/faq.html#intelme
Very nasty stuff, and no, the HAP bit thing isn't a full fix
firmwaresecurity.com/2017/12/06/bheu-slides-on-intel-me-vuln-uploaded/

>"HAHA INTEL BTFO! SCREW YOU GOYS I GOT RYZEN!!"
AMD has its own botnet, called the PSP, or Platform Securiy Processor.
Here's what it is:
libreboot.org/faq.html#amd-platform-security-processor-psp
Here's Libreboot asking for it to be opened up in Ryzen:
libreboot.org/amd-libre.html
Here's Plebbit asking for it:
reddit.com/r/linux/comments/5xvn4i/update_corebootlibreboot_on_amd_has_ceo_level/
Here's Edward motherfucking Snowden asking for it:
mobile.twitter.com/Snowden/status/837367956229206016
And here's AMD telling everyone to go fuck themselves:
yro.slashdot.org/story/17/07/19/1459244/amd-has-no-plans-to-release-psp-code

>"b-but how can I avoid this? Im scared, user!"
That's the point of this thread. To highlight options that are out there that are relatively free of botnets.
This will include the typical Librebooted memepads and whatnot, but a big part of this is also exploring alternative architectures.

Other urls found in this thread:

libreboot.org/docs/hardware/#desktops-amd-intel-x86
libreboot.org/docs/hardware/#serversworkstations-amd-x86
libreboot.org/docs/hardware/#laptops-intel-x86
puri.sm/learn/freedom-roadmap/
crowdsupply.com/eoma68/micro-desktop
imx6rex.com/open-rex/
coreboot.org/Chromebooks
docs.google.com/presentation/d/1eGPMu03vCxIO0a3oNX8Hmij_Qwwz6R6ViFC_1HlHOYQ/edit#slide=id.p
cavium.com/Table.html
en.wikipedia.org/wiki/Free_and_open-source_graphics_device_driver#ARM
lwn.net/Articles/738225/
github.com/altreact/archbk/issues/3
raptorcs.com/TALOSII/
nxp.com/products/microcontrollers-and-processors/power-architecture-processors
powerpc-notebook.org/faq/
embeddedplanet.com/product/single-board-computers/
code.coreboot.org/p/openfirmware/source/tree/HEAD/
lemote.com/html/product/
embeddedplanet.com/single-board-computers/processor/cavium-oceteon-ii/
crowdsupply.com/gnubee/personal-cloud-1
crowdsupply.com/gnubee/personal-cloud-2
code.coreboot.org/p/openboot/source/tree/1/
en.wikipedia.org/wiki/SPARC#Implementations
sifive.com/products/freedom/
lowrisc.org/
librecmc.org/
gogs.librecmc.org/libreCMC/libreCMC/wiki/Supported Hardware
github.com/corna/me_cleaner/wiki/External-flashing
github.com/yuq/mesa-lima
kobol.io/helios4/
en.wikipedia.org/wiki/Freebox
cnx-software.com/2017/09/20/firefly-introduces-rk3399-coreboard-with-up-to-4gb-ram-128gb-emmc-flash/
forum.linksprite.com/index.php?/topic/4645-danger-backdoor-found-in-allwinner-linux-kernel-all-allwinner-h3a83th8-devices-with-sunxi-34-kernel-are-vulnerable-to-privilege-escalation/
xda-developers.com/qualcomm-snapdragon-845-secure-processing-unit/
twitter.com/NSFWRedditGif

(2/4)
For inclusion into this list, if the processor is made by Intel Corporation or Advanced Micro Devices, the device must be 100% free as in Libreboot.
Otherwise, a less-extreme stance is taken, and something like Coreboot or U-boot will suffice.

Findings so far
x86 (Supported Distros: Basically all):
For desktops, there's lots of C2Ds and atoms listed, but also some very nice opterons and apparently an iMac
libreboot.org/docs/hardware/#desktops-amd-intel-x86
libreboot.org/docs/hardware/#serversworkstations-amd-x86
For Laptops, you have the CD and C2D memepads
libreboot.org/docs/hardware/#laptops-intel-x86
Purism doesn't do libreboot, but their roadmap includes this as a future goal.
puri.sm/learn/freedom-roadmap/
The last AMD chip that came without the PSP is Piledriver.
VIA also makes x86 processors. Proprietary BIOS, but maybe Coreboot potential?

ARM (Supported Distros: Most)
Obviously there's a shit ton of SBCs
One of these is EOMA68, which features 3D-printable housings, and potential RYF cert.
crowdsupply.com/eoma68/micro-desktop
iMX6 Rex is an education-based SBC that combines elements of a Pi and an Arduino. It uses U-Boot.
imx6rex.com/open-rex/
For a laptop option with an open firmware, try ARM Chromebooks.
I'm dead serious. Open it up, remove the write protection, reflash coreboot with different payload (Not seaBIOS or Depthcharge), install loonix of choice.
coreboot.org/Chromebooks
docs.google.com/presentation/d/1eGPMu03vCxIO0a3oNX8Hmij_Qwwz6R6ViFC_1HlHOYQ/edit#slide=id.p
Cavium makes some god-tier processors. Be on the lookout for that.
cavium.com/Table.html

(3/4)
In general, your biggest concern with ARM is the GPU drivers.
Mali is fucked. PowerVR too. Vivante GC and Qualcomm Ardreno are fine. Broadcom VideoCore is partial.
en.wikipedia.org/wiki/Free_and_open-source_graphics_device_driver#ARM
MALI MIGHT BE GETTING OPENED UP PRAISE LINUX TORVALDS TECH TIPS
lwn.net/Articles/738225/
Some anons have reported that lighter environments like XFCE are usable on stuff like Mali without the driver, but it's not ideal.
One user said he couldn't remove the ChromeOS on his libreboot C201. This github issue talks about a solution.
github.com/altreact/archbk/issues/3

OpenPOWER (Supported Distros: Fedora, Debian, CentOS/RHEL, OpenSUSE, Ubuntu, BSDs):
Raptor Engineering sells POWER9 workstations, that may soon be getting RYF certification.
They're expensive as fuck, but probably the most powerful non-botnet computers that exist. Comparable to Xeons/Epyc.
raptorcs.com/TALOSII/

PowerPC (Supported Distros: Gentoo, Free/Open/NetBSD)
The company that still makes this is NXP
nxp.com/products/microcontrollers-and-processors/power-architecture-processors
Here is a project for a Libre PowerPC laptop using NXP, shooting for RYF certification.
powerpc-notebook.org/faq/
EmbeddedPlanet has several PowerPC SBCs, most using NXP.
embeddedplanet.com/product/single-board-computers/
If you have old PowerPC Apple products, they use OpenFirmware, which is here
code.coreboot.org/p/openfirmware/source/tree/HEAD/
Recommended models if you want to buy one: late PowerBook G4, PowerMac G5

(4/4)
MIPS (Supported Distros: Debian, Gentoo, NetBSD):
The /csg/ of desktops. Lemote is a chink company that sells libre MIPS boards, using PMON firmware.
lemote.com/html/product/
A German user on this board says he is going to work with Lemote to resell their stuff.
EmbeddedPlanet also has MIPS boards with processors from Cavium with U-boot firmware.
embeddedplanet.com/single-board-computers/processor/cavium-oceteon-ii/
GnuBee has two low power NAS devices. They're cheap, they use MIPS, and they're going for RYF!
crowdsupply.com/gnubee/personal-cloud-1
crowdsupply.com/gnubee/personal-cloud-2

SPARC (Supported Distros: *BSD, Gentoo, Illumos):
Legit server stuff here. Open ISA and Open Boot firmware.
code.coreboot.org/p/openboot/source/tree/1/
Below link is a big list of options, from ancient 80s shit, to modern servers released this year with 5.0GHz and 32 cores
And of course, everything in between
en.wikipedia.org/wiki/SPARC#Implementations

RISC-V (Supported Distros: FreeBSD):
Only SBCs here. SiFive has some.
sifive.com/products/freedom/
There's also LowRISC
lowrisc.org/

For Routers, check out LibreCMC and its supported list.
librecmc.org/
gogs.librecmc.org/libreCMC/libreCMC/wiki/Supported Hardware

Is there a list to check in which cpu this ME shit is?

I have a i5 3450

You have it.
The last Intel CPU you can get with Libreboot is Core2Duo

fuck me then, btw I can't connect to the last link in the intel section, my pi-hole must block this.

Do I have to live with the botnet, or is there a simple way to remove that shit?

try me_cleaner
github.com/corna/me_cleaner/wiki/External-flashing

The Purism link? Yeah you should unblock that.

Removal? not really. There have been some recent """""removals""""" involving a HAP bit thing that supposedly disables it on skylake, and Intel apparently done something, but from a lot of conversation I've seen both in these threads and in other threads, these fixes are likely placebo. They're half-fixes at best.

I own a computer with a PPC processor. Feels good to have no backdoors installed.

PowerMac?

Please tell me X220 Libreboot is gonna happen.

Some user in an older thread says they're still working on it. I personally don't think it'll happen by their initial deadline, as they planned to have it figured out by the end of this month.

I need an SBC with gigabit ethernet and h265 video. If possible usb 3.0 or 2Gb ethernet.

Either ARM or whatever but I want it for a botnet free low power consumption server that'll be running 24/7.

I hope they will, it would be awesome. I don't even know what alternatives are for thinkpads right now.

AMD is allowing it to be disabled with the latest agesa.

They didn't open-source anything. We don't know if it does anything.

>Presses button
>"Whew! I'm so glad I'm free from the botnet!
>Button did nothing
>CIAniggers laugh

isnt it possible to use the nsa flag thing to disable the management engine?

No.

As mentioned above, it's a half-fix at best.

Anyone have any more suggestions for devices to add?

>the AGESA+PSP+UEFI source will never be open

I really hope RISC-V takes off and gets supported by major manufacturers and software developers. It would be interesting to see how a highly optimized RISC chip that has implemented all the lessons learned over the last couple of decades would square off against x86 for general computing. It seems that RISC stopped making sense when we could just shirk the lithography and bump up the clocks. Now that we have hit a wall for both of those it seems like it would make sense to pursue a RISC approach.

It's still got a long way to go, but that LowRISC thing looks promising. From what I can tell, the clockspeeds will be comparable to a Raspberry Pi, so I'm thinking it will at first be competing in the SBC market. Eventually I hope higher-performance stuff gets made with it.

Yep.
as mentioned in the first post, Libreboot, Plebbit, and Edward motherfucking Snowden asked for this to be opened up, but AMD still said no in the end. Hopefully they'll have a change of heart, but if we're going by the fucko conspiracy theory angle, they would never do that because of pressure from the three-letter organizations.

but those damn opcodes
it hurts

Mind explaining?

>It was said that everybody within ARM is in favor of solving the problem by open-sourcing ARM's driver — except for one recalcitrant high-level manager.
REEEEEEEEEEEEEEEEEEEEEEEEEE

Rapid question: are C2Q affected by Intel ME?

Shame they don't tell us who this guy is.
Any way we could find out?

risc-v opcodes are seven bits, but if any of the first 2 bits are set, the opcode is compressed.
so effectively you get 33(may be 32) + 3(compressed) opcodes, this wouldn't bug me as much if one of the main design docs didn't complain about MIPS lack of opcode space(though that happened for a bunch of other reasons)

Last time I checked Libreboot's notabug, I saw something about them talking about providing libreboot support/instructions for C2Q stuff (On T500/W500 specifically)

Probably not, hopefully he's close to retiring or switching companies

yes every cpu after core2duo has one

The yuq mali driver continues to see progress with the mali-450 gpus now supported, no idea if it will ever get to the point of usability to be included with mainline mesa like vivante and adreno drivers

github.com/yuq/mesa-lima

There's currently no driver for the modern opencl and vulkan supporting mali midgard or bifrost architectures.

Close to be beaten the fuck up in some dark alley.

This
Who is he?

48core Cavium desktops WHEN?

That would be fucking incredible. I'm still waiting for another email from PogoLinux guy on the status of their firmware for their ARM rackmounts. They use dual-caviums for total of 96 cores

bump

>hormone replacement thread

mips is celeron performance
arm is shit
sparc only has 1 (one) floating point unit
powerpc is old and dying
openpower is expensive as fuck

well you sure showed THEM

>AMD gives options to disable psp

why are you still using intel, jamal?

when did that become a thing?

Loonix, even in its heaviest DEs, is lighter than Windows
One of those MIPS devices is meant for use as a NAS
Give one good reason why ARM is shit. Remember that there are chromebooks with 2.0GHz processors, and potentially 48-core server chips of that architecture.
Interesting on SPARC. Do you have evidence of this drastically affecting real-world usage, or is this just theoretical?
I answered someone in the last thread, but how is powerpc old if there's a company still making it? Remember that old powerbooks/powermacs are not the only computers of that architecture.
Openpower is indeed very expensive, but so are Xeon/Epyc server systems, which is what POWER9 is in direct competition with.

I don't even know why I bother responding to bait.

See:

>I don't even know why I bother responding to bait.
education purpose, user

That makes sense.
Here's a trap

got any devices that might be worth adding to the list?

>OP is living in a fantasy world.
It's over sunshine. BotNet is here to stay. The lion will not lay down with the lamb.

>lions and lambs and shit
wat?

>Here's a trap
pic related :^)
>got any devices that might be worth adding to the list?
Maybe libre NAS solutions? I'm thinking about it for a time. And for now I think that best option is go for librebooted Intel D945GCLF + LSI RAID 8704EM2. Though I need dig into configuring this.

So for unbotnetted-NAS there are those:
kobol.io/helios4/
crowdsupply.com/gnubee/personal-cloud-1

And as bonus, some french ADSL router that runs on MISP, that I found by accident: en.wikipedia.org/wiki/Freebox

I already have the GnuBee, but I've never seen the Helios4 before. Seems to use U-Boot, suprisingly decent performance (higher than the average soc), and open hardware.
I'm gonna add it. Thanks!

The only thing that concerns me about it, is this case from PMMA which can easily store static charge.

The only thing you need secure comms for is comms, so performance isn't particularly important. Use a fast gaymertoi for kiddyshit and if it gets pwned there won't be anything on it that matters.

You need a benign metadata profile anyway to avoid interesting slaughterbot swarms.

A separate, preferably tiny, machine for financial transactions etc would be fine. Anyone ITT probably has a pile of PCs and one more won't matter.

A "secure computing stick" would avoid all the external garbage and allow peripheral choice.

Does ARM not realize that the longer they avoid opening their drivers, the more market share they will ultimately lose? The market is crying out for a alternative to x86. ARM is throwing away the opportunity to be that alternative.

Didn't they make you learn the Bible in school? Disgraceful.

I hope you are not him:
There's no place for nihilism among godly man.

I am not he.

do you even english?
It's "I am not him."

bump

Firefly perhaps.

cnx-software.com/2017/09/20/firefly-introduces-rk3399-coreboard-with-up-to-4gb-ram-128gb-emmc-flash/

Finally, thanks.

What are you doing to become a worthy target?

existing

underrated

Existing isn't illegal, so clearly you're up to something

Indeed

...

...

I imagine it takes more than a different BIOS to stop agencies. Liberoot just helps lessen one point of attack but plenty still remain, especially attacks based off internet activities rather than just hardware.

oh most certainly
but this thread is about the hardware.
hence the name.

Also, not saying that you're making this argument, but I hate dismissive, defeatist attitudes when it comes to this.
I've seen it a lot with the Librem Phone. People saying shit along the lines of "lel it's a scam, guys! baseband exists!"
Like yeah, no shit. There's no getting around that though, and the phone is 10 times better than your average shit when it comes to security/privacy.
It's the whole "This thing right here is not absolutely 100% perfect, so let's disregard it entirely, and give in to the botnet!"
You might as well say "Encryption algorithms can technically be broken. Let's stop using encryption"

again, not saying that to you. just ranting.

this thread got really philosophical and shit all of a sudden

wew

what platform can I use to privately mine monero and zcoin?

Not him. I know what you mean, but I like it. These days I feel like the though police has visited Sup Forums and we no longer discuss important things by some obvious troll spouting fallacies and advocating nihilism.

I know jack shit about mining, but I hear it's GPU dependent, and not so much CPU dependent.
So anything you can get a sweet GPU on I guess.

I'm not quite sure if I understand your english, but I think I agree. There do appear to be a lot of shills/nihilists/jews/trolls on Sup Forums lately.

bump

Meanwhile at Intel...

kek

all core2duos?

bump

>I know jack shit about mining, but I hear it's GPU dependent, and not so much CPU dependent.
All you neee to know is GPUs are much better for parallelization than CPUs because they have thousands of cores and mining algorithms are parallelizable.

Yeah pretty much. I think they might be supporting Core2Quad on the T500/W500 too.

As for anything newer, they had a thing a while ago where you could pre-order an x220 (Which is Sandybridge), and they'd ship it by the end of this december once they figured out how to libreboot it. Doesn't look like that's gonna happen in time, but they did have the page up, and one user claims they're still working on it.

Also, if you go AMD, the newest you can get is a bit later, with the D16 server/workstation board with 2 Opterons

What about olimex's arm laptop? It's weak but not botnet

is it possible to get 4 or 8gb ram instead of 2?

That's just an uninterruptable power supply, user

AllWinner had a kernel backdoor, but I assume they removed it by now.

forum.linksprite.com/index.php?/topic/4645-danger-backdoor-found-in-allwinner-linux-kernel-all-allwinner-h3a83th8-devices-with-sunxi-34-kernel-are-vulnerable-to-privilege-escalation/

Yeah they have to have removed that by now. Otherwise EOMA68 is gonna have some explaining to do (they use an allwinner)

I used to have Olimex in there, but I don't think we ever confirmed its boot firmware. I believe I added it because some user in one of the earliest threads wouldn't shut up about it, but if it uses U-Boot or whatever, I re-add it.

The next generation of the DragonBoard is coming out, the 820c

>The following high level features are functional:
>* Support for all ARM CPU cores (2x Gold + 2x Silver)
>* A5xx GPU support using Mesa/freedreno (mesa 17.1 at least is required, 17.2 is recommended)
>* HDMI display (4K)
>* USB3.0, on board UFS storage
>* on board 1Gb Ethernet (PCIe) and WLAN/ath10k (PCIe) , both using upstream drivers
>* Low speed I/O on the 96boards expansion header
>* H/w video codecs, including 4K codecs (support for Gstreamer and ffmpeg frameworks)

Probably the closest thing to open source you are going to get. The Adreno GPU is much better than the standard ARM GPU and it's more open.

Thanks for keeping this thread going, user. So is RISC-V the most open source option out of all of these? What's the most powerful?

...

>snapdragon 845 is already released
Why can't they make an updated model?

>Core2Duo

The Intel Xeon E5450 (socket 771; modifiable to socket 775) can fit in the librebooted GA-G41M-ES2L. The thing is, will it work with the Xeon?

xda-developers.com/qualcomm-snapdragon-845-secure-processing-unit/

The latest high end qualcomm SoC doesn't seem to be a botnet

>The SPU’s completely isolated from the system, according to Qualcomm. It’s not a “system master,” meaning it can’t access information from other systems or take control of new processes, but it’s able to access information from other systems independently.

Cant be sure if its not open source.

OP here
>RISC-V the most open source option out of all of these?
Most certainly, and because of that, I think it has a bright future. It just needs more time to develop and grow. as mentioned previously, the LowRISC I think has similar clockspeed to an RPi, so it will at first be competing in that market. I hope some people end up making something more high-end with it though. That would be amazing.

As for what's most powerful, that would probably be the TALOS II. Technically modern SPARC hardware would probably be up there, with 5.0 GHz clockspeeds and 32 cores, but those are server systems that would be purchased as part of a business transaction. Not exactly something you could just buy like the TALOS afaik.

Is the boot firmware open (U-boot or similar)?

I've heard a lot of anons bring that up. I don't know anything about that sort of mod. Maybe someone with a bit more knowledge could bring this up with the Libreboot folks? I've mentioned a couple times that they're gonna be supporting a Core2Quad mod for certain Libreboot Thinkpads.

Also, you're welcome. I don't know how I came up with the idea to start this project, but I'm glad I did.

I tried to buy an orange pi from aliexpress to help with mali driver development. I don't have a credit card so I couldn't pay. I don't want to spend 40€ on amazon some shitty 15€ SBC that is probably going to collect dust because I don't have a lot of time to spend on developing the driver anyway.

It's all good. The official one is getting opened up as soon as the management faggot changes his mind/retires/gets fired/dies/etc.

bamp