57
Europe built sovereign clouds to escape US control. Then forgot about the processors (www.theregister.com)
submitted 5 months ago by to c/technology@beehaw.org
13 comments fedilink hide all child comments
 

Intel ME and AMD PSP: The silicon layer nobody certifies

About cloud sovereignty and the often-ignored and unknown on-CPU management engine running below the OS and BIOS.

The article is quite long; it explains how CPUs run firmware that can include remote management over the network, and can be running even when the OS is not. They can be vulnerable to supply chain attacks and firmware replacements. Because it's on hardware, the firmware with open security vulnerabilities is often not updated.

Regarding cloud, the French SecNumCloud is a framework for cloud infrastructure security requirements. It doesn't cover these hardware attack vectors specifically but may mitigate risks through surrounding practices and isolation.

In conclusion, even a cloud provider that meets SecNumCloud must be asked whether and how they manage CPU management engine attack vectors.

all 13 comments

sorted by: hot top controversial new old
[–] 10 points 5 months ago

https://www.cs.umass.edu/~emery/classes/cmpsci691st/readings/Sec/Reflections-on-Trusting-Trust.pdf

The lower you go the harder it is to be able to identify security risks

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 5 months ago (3 children)

    Why the heck do we have such a technology in CPUs?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 13 points 5 months ago* (1 child)

    One usual use case is for IPMI-style server management, being able to remotely monitor and interact with the machine before even the BIOS is ready, so particularly more relevant to server deployments. For example, adjusting BIOS settings over a dedicated management LAN for several thousand rack servers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 5 months ago

    So, Ignoring security for a moment, it makes remote resolution of severe machine issues much easier. It is great for IT, it even allows remote OS reinstall.

    Now, considering security issues and the lack of parity between AIs ability to attack and defend (better at breaking than fixing) it is sure to become a huge vulnerability, IMO.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 7 points 5 months ago (4 children)

    Good luck in trying to make a non-AMD or non-Intel x86 CPU. Maybe the chinese will find success in 10 years.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 14 points 5 months ago (3 children)

    I dunno man, ARM and RISC-V are pretty dope.

    It'd be nice if, say, ST would shit out a EU market RISC-V linux SoC akin to the CV1800B or SG2002 or BL808. But like, europe fabs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • [–] 5 points 5 months ago (2 children)

    Are there even any European companies that explore the usage of risc-v?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • 39 comments in c/technology@lemmy.world view that post
    [–] 76 points 5 months ago (15 children)

    To make an apple pie from scratch, you must first invent the universe.

    Actually a good step in the right direction, but it's not the end.

  • permalink
  • fedilink
  • source
  • hideshow 15 child comments
    •
  • [–] 34 points 5 months ago (14 children)

    RISC-V already exists so why not build on that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 26 points 5 months ago* (13 children)

    It said RISC-V is decades away

    "There is no immediate solution. RISC-V, the open source processor architecture European sovereignty advocates point to as a long-term alternative, remains years from competitive performance in datacenter workloads. "It will take decades,""

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] 18 points 5 months ago (1 child)

    RISC-V isn't in the same scenario. There's one company behind ARM with a few external companies with architecture licenses (who doesn't share their contributions), and ARM competes mostly just on the same commercial terms so for a long time it wasn't worth investing in single core performance because they could instead fill the efficiency niche.

    Also there's more knowledge on how to build high performance cores. Doesn't mean it's trivial, but it means the lead isn't several decades. With enough investment you can make it happen faster. And there's a national security motivation for investing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 5 months ago (8 children)

    RISC-V is decades away

    Eh... what? I have a RISC-V SBC and it just works, running Debian on it in minutes of setup and it cost me peanuts.

    Sure it's not a state of the art CPU ... and if I wanted to run anything demanding on it, I'd have to be patient. Heck it's not even made in the EU but in China... but it works, today, it just depends on what your workload is. So yes it's not the fastest or has the best efficiency but still, it exists already.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 4 points 5 months ago (7 children)

    What does that tell you about its performance under datacenter workloads?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 5 months ago* (6 children)

    Nothing because it depends on the workload? I mean if you run a static Website to few people it's more than enough. If you're trying to predict weather or render high definition 3D graphics in real-time it's not... but also nothing is so...

    Was it a rhetorical question and if so what were you implying?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 5 months ago (5 children)

    It was a rhetorical question. I wish all good for that architechture, but it doesn’t seem very competitive as for now.

    https://ben3d.ca/blog/risc-v-in-2024-is-slow

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 5 months ago* (4 children)

    Depends entirely on the metrics you use for comparison. In terms of performances yes of course it's slower than others, nobody is contesting that. In terms of openness it fairs better than most. My point was solely that it's usable for some use cases and thus that it's not a theoretical architecture in 2026. It works. Yes it's slow but for use use cases it doesn't matter.

    If you don't care for openness then it's not competitive. Being competitive depends entirely on your constraints.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago (3 children)

    The case was described in:

    "There is no immediate solution. RISC-V, the open source processor architecture European sovereignty advocates point to as a long-term alternative, remains years from competitive performance in datacenter workloads. "It will take decades,""

    To which you replied with ”Eh.. What?” and went on to tell an anecdote about how it works well on a personal computer running linux. It doesn’t really relate to the problem in hand here although is neat.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 5 months ago* (last edited 5 months ago) (2 children)

    Because those components are (theoretically) sold as equivalent. If you sell me cycles in a data center, one for 10e/h and another for 100e/h (because it's 10x slower and thus must have ~10x more instances) and you don't give me any details on why, I'll take the 10e and of course it won't be competitive. FWIW I do buy compute time in data centers and I'm also aware (but not involved with) https://www.top500.org/ and how none of them are RISC-V based, it's not my point. My point is that the metrics to compare will never make it competitive if we exclude its raison d'etre. RISC-V was never proposed to be the most efficient and powerful architecture (even though of course it'd be nice if it'd be).

    It's like apple versus orange then complaining that the apple doesn't taste orange-like enough. Sure, that's correct, but also pointless.

    Edit : it's not an "anecdote" it's a proof of existence, again RISC-V works today. It's not set of blueprints. It does compute, easy as that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago (1 child)

    So even you know it’s not being used to any scale in data centers. In theory they could run on Raspberry PIs but that’s not useful to the problem in hand. Where did you get 10x slower by the way?

    An anecdote does not imply that something is not real.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    Starting to worry we're talking past each other.

    Yes, RISC-V isn't used at scale in data centers. Now though that NEW criteria are taking into account, namely sovereignty, they precisely might despite their limitations, including performances. If though it's just political signalling without any actual will and subsequent advantage and in reality only performance matters, they still won't be used.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 76 points 5 months ago (3 children)

    This article doesn't even mention ASML so I consider it pretty moot.

    ASML is the leading international semiconductor machine supplier and is a Dutch company.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 22 points 5 months ago (2 children)

    Who follow American export rules

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 18 points 5 months ago

    Laughs in ARM...

  • permalink
  • fedilink
  • source
    •
    [–] 26 points 5 months ago (1 child)

    It is almost like non technical people who can not follow technical advice are making all the decisions.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 23 points 5 months ago* (last edited 5 months ago) (3 children)

    The real tech revolution won't be until we can make our own hardware ; enthusiast designed and made processors and semiconductors using consumer grade tools, similar to how you could make your own metal chains out of tools at the hardware store. Until then we'll be beholden to the billionaire class to grant us access. What I'm saying is we need to make it cheaper and easier to make computers in the first place. No amount software is gonna save you if you don't have independent hardware.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 4 points 5 months ago*

    I don't think you understand just how difficult that would be. The reason Taiwan has become such a hotly contested area between China and literally the rest of the world is because they have built up the infrastructure to produce processors and memory. Which includes huge clean rooms to prevent contamination by the air we've so completely polluted since the beginning of the industrial revolution.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 5 months ago (1 child)

    Modern CPU and GPUs are the pinnacle of human creation. Each step, from design to build is resting on the foundation of decades of learnings and millions of hours of highly trained and educated individuals. All of this knowledge and talent is guarded. I don't think you fathom the scale of which you discuss. At best we can play around as aggregated hobbiest and make perhaps a 1980s tech CPU.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago*

    1980s tech CPU

    So it can already run Wolfenstein and Linux...

    The story of the modern PC is about hobbyist, in my opinion. It was a bunch of tech guys slapping things together, figuring it out as they went and cowboy stuff like writing specifications on the plane on the way to a conference. I understand what you're saying about the limitations around design and production... but these things aren't impossible just difficult.

    Maybe a new discovery in physics or transistor manufacturing will be the key to this new era. Or a bunch of things like that adding up over time until one weirdo figures it out and changes the world.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 8 points 5 months ago*

    I am not saying this is not an issue, but it feels like the article is at best misunderstanding what sovereign cloud brings even with an ME backdoor under it and how international relations work.

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 5 months ago

    No, they didn't

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 5 months ago

    I still can't get over the fact that everyone is running minix on their silicon.

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 5 months ago (1 child)

    You take your choice: Mossad or the PLA.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    Anyone who wouldn't go with China over Amerisrael a million times over is simply a victim of unbelievable volume of propaganda.

    The US is by far the single worst, most oppressive country on the planet and it isn't even close.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 5 months ago

    step by step

  • permalink
  • fedilink
  • source
    •
    [+] -10 points 5 months ago (5 children)

    They also forgot about the software.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 11 points 5 months ago (2 children)

    Ah yes of course, only real Americans know how to write good software - like Windows and Teams. /s

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -2 points 5 months ago (1 child)

    That’s not what I’m saying. They forgot that cloud compute isn’t the only area where America holds EU by the balls. It’s also the software. You can set up 500 data centers all over Europe and companies still won’t migrate away from M365 or GWorkspace. Cloud compute is good, but there also needs to be an effort to reverse engineer American technology and start offering alternatives.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (1 reply)
    4 comments in c/privacy@programming.dev view that post
    [+] -16 points 1 month ago (3 children)

    If EU is going to start fabŋ ʧips𓇲, I am migratŋ ’morow. I need MPPA to come back. 🖕Harvard arχ.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 6 points 1 month ago (2 children)

    Why would EU fabricate chips for MPPA?

    Why would you use phonetic alphabet?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] -13 points 1 month ago (1 child)

    Because true sovereignty needs to be designed architecturally. MPPAs by design separate processes to 𓇲s. One process doesn't interfere with others. If EU wants to isolate and secure processes running on 𓇲s, it needs to parallel processes.. Your GPU already does this.

    ϕA

    Typŋ&bandwidθ speed&comp🗜️

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • 3 comments in c/technology@lemmy.zip view that post
    [+] 9 points 5 months ago* (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 8 points 5 months ago

    That's a known thing though. Sovereign tech is more about the software then hardware.

    Microsoft admits that if it receives a data request from the US government for data stored in a European Azure region owned by a European company with no US presence they will have to comply. Intel, AMD, Seagate, NetApp don't have that problem.

  • permalink
  • fedilink
  • source
    •