4 ms·

I didn’t think he was wearing a tinfoil hat. I agreed with RMS back then insofar as he saw things like TPM coming. However, he did not understand then and still

I didn’t think he was wearing a tinfoil hat. I agreed with RMS back then insofar as he saw things like TPM coming. However, he did not understand then and still does not understand that by using any device as complex as a computer, the user must trust _somebody_. His free software ideals lead him to think that if the user can read the source and modify it, he can trust it. But this is true of no one, regardless of his technical acumen. The software is too large, too complex for any one user to audit. So the user must trust someone. Typically this is going to be at a minimum his OS vendor. He might also have to trust other software vendors, and maybe hardware vendors and network operators. That the vendor provides Free Software makes no difference. I have a machine running Debian. I still have to trust Debian. What TPM does is give the OS vendor another tool so I can be assured that I’m running what the vendor provided. Of course the vendor can abuse this. But if he does, I have bigger problems. I want the vendor to be able to provide me with what I asked for and therefore I welcome technologies like TPM. I don’t disagree with RMS because he’s paranoid. I disagree with him because he thinks Freedom is an elixir.

theonemind 6y ago
Well, the saying goes that democracy is the worst form of government, besides every other form of government we've tried. Freedom's no elixir, but proprietary isn't either. You have to trust someone, but in a better world, that's a community of experts reviewing freedom respecting software. Sometimes, the benefits of that centralized control are real, but the concomitant abuse of said centralization appears almost axiomatically inevitable at this point, so you have to ask yourself if the benefits are even worth it. Microsoft's OS itself has nearly turned into spyware. It'll be signed spyware, assured that it's doing what Microsoft wants it to do. If I'm going to get exploited, I can at least get exploited while remaining free. There's a real chance that maybe I'm not getting exploited if I'm free, but just about 0% chance if I'm not even free. I'm no ideologue, just sayin'.
saagarjha 6y ago
I don't think Stallman would have an issue with a vendor being the default trusted entity on a system–but it must be possible to replace this with your own root of trust if you so desire. The issue is that companies hear the first part and go "oh boy, TPM time, let's lock out the user!"
vbezhenar 6y ago
I value free software because it's independent from its author. If author decides to abandon it, someone will continue its work, if that software is worthy for enough people. That's not the case for proprietary software. And TPM does not allow other people to maintain that software.
giantDinosaur 6y ago
Somewhat misleading to claim that 'one user' would be all there is auditing software. It's not 'one user' that audits your Linux distribution. Can something be snuck in that nobody notices into the source? Of course. But it's incredibly disingenuous to claim that because one user cannot audit all the software running on their machine that we should abandon the concept of auditable software in general and accept corporate lockdown. There's a massive difference between 'my operating system's code is open and many people have at least glanced at it' and 'this is a total secret beholden only to one corporate identity and nobody can have a look even if they had all the technical knowledge in the world'.
- tenuousemphasis 6y ago
  You're missing the point. How do you verify that the bootloader or OS running on your hardware is the same as what the community verified? Hashes? How do you know the hash checking software is genuine without a TPM?
  - dane-pgp 6y ago
    How do you know the TPM is correctly validating the hash checking software unless you built the TPM firmware yourself?
TeMPOraL 6y ago
Software freedom isn't about every user being capable of evaluating and modifying software they run by themselves. It may have started this way, back in the times where end users were also competent at working with computers. The point is that end users can delegate trust on their own. It's the same idea as with Right to Repair - the movement isn't expecting everyone to learn how to use a soldering iron and a chip programmer; is to allow local communities to have their own specialists capable of repairing hardware. Similarly, with free software, my mother isn't going to look or modify the code herself, but she may ask me to help with it. Or a different neighbourhood tech whiz, who may even take payment for the service. Software freedom is in part enabling local markets to work.

theonemind 6y ago

Well, the saying goes that democracy is the worst form of government, besides every other form of government we've tried. Freedom's no elixir, but proprietary isn't either. You have to trust someone, but in a better world, that's a community of experts reviewing freedom respecting software. Sometimes, the benefits of that centralized control are real, but the concomitant abuse of said centralization appears almost axiomatically inevitable at this point, so you have to ask yourself if the benefits are even worth it. Microsoft's OS itself has nearly turned into spyware. It'll be signed spyware, assured that it's doing what Microsoft wants it to do. If I'm going to get exploited, I can at least get exploited while remaining free. There's a real chance that maybe I'm not getting exploited if I'm free, but just about 0% chance if I'm not even free. I'm no ideologue, just sayin'.

saagarjha 6y ago

I don't think Stallman would have an issue with a vendor being the default trusted entity on a system–but it must be possible to replace this with your own root of trust if you so desire. The issue is that companies hear the first part and go "oh boy, TPM time, let's lock out the user!"

vbezhenar 6y ago

I value free software because it's independent from its author. If author decides to abandon it, someone will continue its work, if that software is worthy for enough people. That's not the case for proprietary software. And TPM does not allow other people to maintain that software.

giantDinosaur 6y ago

Somewhat misleading to claim that 'one user' would be all there is auditing software. It's not 'one user' that audits your Linux distribution. Can something be snuck in that nobody notices into the source? Of course. But it's incredibly disingenuous to claim that because one user cannot audit all the software running on their machine that we should abandon the concept of auditable software in general and accept corporate lockdown. There's a massive difference between 'my operating system's code is open and many people have at least glanced at it' and 'this is a total secret beholden only to one corporate identity and nobody can have a look even if they had all the technical knowledge in the world'.

tenuousemphasis 6y ago
You're missing the point. How do you verify that the bootloader or OS running on your hardware is the same as what the community verified? Hashes? How do you know the hash checking software is genuine without a TPM?
- dane-pgp 6y ago
  How do you know the TPM is correctly validating the hash checking software unless you built the TPM firmware yourself?

TeMPOraL 6y ago

Software freedom isn't about every user being capable of evaluating and modifying software they run by themselves. It may have started this way, back in the times where end users were also competent at working with computers. The point is that end users can delegate trust on their own. It's the same idea as with Right to Repair - the movement isn't expecting everyone to learn how to use a soldering iron and a chip programmer; is to allow local communities to have their own specialists capable of repairing hardware. Similarly, with free software, my mother isn't going to look or modify the code herself, but she may ask me to help with it. Or a different neighbourhood tech whiz, who may even take payment for the service. Software freedom is in part enabling local markets to work.