It is really about the presence of multiple Intel x86 CPUs on a single motherboard each running its own "kernel", but where the user only controls one of these kernels, and what control the user's kernel has over the hardware is easily subverted by the others.
SMM - can disable
UEFI - can replace
ME - can remove components
ISH - not discussed
IE - not discussed
The crunched binary for intramfs is written in Go and yet only 5.9MB. No systemd. Everything, even init scripts, is written in Go.
This is quite good.
It is really about the presence of multiple Intel x86 CPUs on a single motherboard each running its own "kernel", but where the user only controls one of these kernels, and what control the user's kernel has over the hardware is easily subverted by the others.
The crunched binary for intramfs is written in Go and yet only 5.9MB. No systemd. Everything, even init scripts, is written in Go.