zlacker

>>ploggi+(OP)
QubesOS won't protect you from Intel ME though.

>>partyc+h9
Purism laptops do.

>>bluepi+9c
I wouldn't trust that company at all, they lied and misrepresented themselves for nearly three years before finally claiming to make good on what they sold their customers. Beyond that, they didn't fix it themselves as they say, they relied on the work of other projects then claimed they did it alone.

Considering the researchers who actually disabled IME require physical access to the machine[1], Purism's claim that they can do it to previously sold devices with only a software update[2] stinks of BS to me.

[1] https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Di...

[2] https://puri.sm/posts/purism-librem-laptops-completely-disab...

>>morgan+0k
IIRC they didn't really lie, everything was always worded like "will be free in the future".

Also the post you linked to directly gives credit to me_cleaner and Positive Technologies.

The reason the researchers required physical access:

> Although some systems do allow the full contents of the BIOS flash chip to be reprogrammed using software tools only (so called 'internal flashing'), on most PCs this facility is either completely unavailable, or can only write to the unprotected areas of the flash filesystem (excluding the ME area), or will only write vendor-signed images. Accordingly, we will describe the approach of using 'external' flashing in this guide, as that is the most reliable.

Purism being, uhhhh, the vendor, allowed full write access.

>>floatb+Dk
> "Purism being, uhhhh, the vendor, allowed full write access."

If that was the case they could have shipped IME-free machines from the start. They are selling whitebox machines for an exorbitant markup with their own spin on a Linux distro.