Aaron アーロン (@acapaaron)

Intel's platform is such a mess. I really dislike this. It usually is the "privacy go-to" because you can disable IME (you want to disable IME BTW. Not kidding around on that) but then there are a thousand other security pitfalls that sit in that platform because you can't see or know what the hell the CPU is doing when you enable certain features. VTx is a very common extension to enable. It allows the guest OS Kernel to bypass the host OS kernel for certain calls. Allowing it to directly interface with the hardware without needing to put a more expensive translation layer inside the Host OS kernel. In general you want to enable this in your BIOS if you're going to virtualize windows, but if you enable there is a chance this whole SEAM thing kicks in, and then suddenly this invisible guest OS shows up under the Intel Hypervisor, and it might be bleeding information out to the NSA. Everything from encryption keys, to passwords. Who TF knows how much data you're giving up simply by using an Intel chip? IME does this without VTx or any of that stuff being enabled. It runs Minix on an invisible layer with a full on network stack (that had a bunch of security vulnerabilities in it thankfully which allows us to rip that guest OS apart and disable it) You can get around this using AMD, but AMD also has it's own "Management Engine". It has a different name to it, but definitely does not have a network stack. At least that we know of (That doesn't make me feel much better about it really). The Spyware is in the chips themselves, and that is a problem that doesn't really have great solutions to. ARM is no different too, I just don't want to beat a dead horse here. What this guy is telling everyone sucks so utterly and completely, and there isn't much anybody can do about right now outside of bend over. OR live without technology. Even the Amish allow themselves cellphones, so not really a great option there either. The world works on it now... https://www.youtube.com/watch?v=sAw67SdBx4M