Disabling the Intel Management Engine
The IME gets a lot of hate around here, but let's not get distracted by it: higher-privilege co-processors running code outside the main OS' control is becoming (or already is) the norm everywhere. Intel-based PCs are just one instance of it (and perhaps not even the most egregious one).Most hardware has evolved to effectively run the main OS under a sandbox where it "thinks" it is in control, but isn't.A nice talk on this: https://www.youtube.com/watch?v=36myc8wQhLo