4 ms·

> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer.

by geofft 8y ago

> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. It still does. The only thing is we've distinguished physical ownership and mere physical possession. It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my freedom - both my computing freedom and my physical freedom - if I can leave a laptop in my hotel room while seeing tourist sights. It protects me from the government if a border control agent looking through my bag, or a cop who's seized my laptop, can't get in. (The iPhone is an existence proof that such defense against the government is possible, and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.) Of course software freedom requires access control. My freedom over my possessions involves other people's lack of freedom over my possessions. I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to. This control is essential liberty; pretending that anyone with physical access is an owner because it's easier than crypto and key management has been decades of temporary convenience, and I'm glad it's coming to an end. I can turn secure boot on and off with an admin password, which I set when I first booted the machine because that's what demonstrates physical ownership and not mere possession. (And systems that don't permit me to do so, like Microsoft or Apple ARM devices, are in fact an affront to software freedom.) But nobody else can.

eikenberry 8y ago
You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.
- lisper 8y ago
  This can't be stressed enough. Freedom (indeed "ownership") means that I should be able to run any app I want on my device without having to create an account with Apple. It would be great if I could have both freedom and security, but Apple has decided that is not an option. I have to choose one or the other. I choose freedom.
  - kartickv 8y ago
    You disable Gatekeeper and thus run run any app without having an account with Apple.
  - geofft 8y ago
    That's literally what I said. There's a checkbox for you to choose freedom inside System Preferences. You, as a device owner, can check that box. Someone with temporary access to your computer cannot. This is a step forward for most users and not a step backwards for any users. Sure, it would be better to let you enroll your own keys. But as it is you have more options than you have previously, and you as device owner are the only person who can decide between those options - attackers have no more options than they had previously. Go, buy a Mac, choose freedom, you can do that.
    - vetinari 8y ago
      With UEFI Secure Boot, you can enroll your own "Machine Owner Key" and use the private part for signing, thus having both, freedom and to a certain degree security (the hardware has firmware, that with high degree of probability won't be signed by your key, so you will have to keep someone else key enrolled too; so it is not perfect either). Platforms like T2, which allow only on/off, but not key enrollments, are a step back.
    - lisper 8y ago
      > This is a step forward for most users and not a step backwards for any users. Maybe. What happens when the check box goes away on a future version of MacOS? If my freedom depends entirely on an obscure checkbox rather than the ability to install my own keys, that seems like a thin reed to me.
      - geofft 8y ago
        Er, the option to install your own keys could go away too as easily, right?
        8y ago
michaelmrose 8y ago
Even if you turn secure boot off you cannot grant for love or any amount of money permission for software of your choosing to access the built in storage which is pretty much required for normal people to be able to run software of their choosing on the machine. Few people will buy equivalent external ssd storage for 300-500 and carry it around with them to have access to a second OS. There is absolutely no reason to believe that they will ever act to increase your ownership of your own device and every reason to believe that you will ultimately have about the same privileges as someone using their employers machine at work while being expected to fall full freight. It's especially bemusing when you understand that evil maid is almost nonexistent in reality while your actual loss of freedom has real effects now.
- bengale 8y ago
  This is a driver issue.
- kartickv 8y ago
  Huh? You can absolutely grant software of your choosing permission to access the built in storage. How else does Windows or Linux on Mac work?
  - dahfizz 8y ago
    I believe they are referring to the fact that linux (and non boot camp windows) cannot access the SSD on T2 equiped macbooks. People seem to disagree if it's the T2 itself or just a driver issue with apples proprietary controller.
    - kartickv 8y ago
      According to https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-linux https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-... you just have to turn off the extra security.
      - michaelmrose 8y ago
tremon 8y ago
The only thing is we've distinguished physical ownership and mere physical possession. From a legal standpoint, when you buy a John Deere tractor, do you attain physical ownership or is the object merely in your physical possession?
bjpbakker 8y ago
> I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to This is exactly why _you_ must be in control of what software can boot and not Apple or some other company. It's not exactly freedom if you must disable the secure boot feature to run your own software, it's a work-around. If Apple really cared about freedom they would provide you with your own _unique_ key to sign your own software, so you can ensure that your system actually runs _your_ software.
HeadsUpHigh 8y ago
>and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.) Purism did. But this requires hardware too which the free software people don't have access to.

by geofft 8y ago

eikenberry 8y ago

You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.

lisper 8y ago
This can't be stressed enough. Freedom (indeed "ownership") means that I should be able to run any app I want on my device without having to create an account with Apple. It would be great if I could have both freedom and security, but Apple has decided that is not an option. I have to choose one or the other. I choose freedom.
- kartickv 8y ago
  You disable Gatekeeper and thus run run any app without having an account with Apple.
- geofft 8y ago
  That's literally what I said. There's a checkbox for you to choose freedom inside System Preferences. You, as a device owner, can check that box. Someone with temporary access to your computer cannot. This is a step forward for most users and not a step backwards for any users. Sure, it would be better to let you enroll your own keys. But as it is you have more options than you have previously, and you as device owner are the only person who can decide between those options - attackers have no more options than they had previously. Go, buy a Mac, choose freedom, you can do that.
  - vetinari 8y ago
    With UEFI Secure Boot, you can enroll your own "Machine Owner Key" and use the private part for signing, thus having both, freedom and to a certain degree security (the hardware has firmware, that with high degree of probability won't be signed by your key, so you will have to keep someone else key enrolled too; so it is not perfect either). Platforms like T2, which allow only on/off, but not key enrollments, are a step back.
  - lisper 8y ago
    > This is a step forward for most users and not a step backwards for any users. Maybe. What happens when the check box goes away on a future version of MacOS? If my freedom depends entirely on an obscure checkbox rather than the ability to install my own keys, that seems like a thin reed to me.
    - geofft 8y ago
      Er, the option to install your own keys could go away too as easily, right?
      - 8y ago

michaelmrose 8y ago

Even if you turn secure boot off you cannot grant for love or any amount of money permission for software of your choosing to access the built in storage which is pretty much required for normal people to be able to run software of their choosing on the machine. Few people will buy equivalent external ssd storage for 300-500 and carry it around with them to have access to a second OS. There is absolutely no reason to believe that they will ever act to increase your ownership of your own device and every reason to believe that you will ultimately have about the same privileges as someone using their employers machine at work while being expected to fall full freight. It's especially bemusing when you understand that evil maid is almost nonexistent in reality while your actual loss of freedom has real effects now.

bengale 8y ago
This is a driver issue.
kartickv 8y ago
Huh? You can absolutely grant software of your choosing permission to access the built in storage. How else does Windows or Linux on Mac work?
- dahfizz 8y ago
  I believe they are referring to the fact that linux (and non boot camp windows) cannot access the SSD on T2 equiped macbooks. People seem to disagree if it's the T2 itself or just a driver issue with apples proprietary controller.
  - kartickv 8y ago
    According to https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-linux https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-... you just have to turn off the extra security.
    - michaelmrose 8y ago

tremon 8y ago

The only thing is we've distinguished physical ownership and mere physical possession. From a legal standpoint, when you buy a John Deere tractor, do you attain physical ownership or is the object merely in your physical possession?

bjpbakker 8y ago

> I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to This is exactly why _you_ must be in control of what software can boot and not Apple or some other company. It's not exactly freedom if you must disable the secure boot feature to run your own software, it's a work-around. If Apple really cared about freedom they would provide you with your own _unique_ key to sign your own software, so you can ensure that your system actually runs _your_ software.

HeadsUpHigh 8y ago

>and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.) Purism did. But this requires hardware too which the free software people don't have access to.