7 ms·

I saw the writing on the wall the moment they could sloppily justify the TPM requirement. Then I got into arguments with people proclaiming that it's just Micr

I saw the writing on the wall the moment they could sloppily justify the TPM requirement. Then I got into arguments with people proclaiming that it's just Microsoft enforcing it for the casual user's safety, and that I'm a Microsoft hater. Who? Me, whose first programming language was C#, who worked as an Windows server administrator for years, and my operating systems have been nothing than Windows for 2 decades. And I'm suddenly a hater for daring to raise an eyebrow and question their design motivation? I'm very convinced that the desktop world is at its worse. You have the commonly owned yet absurdly powerful tool known as a desktop computer have its market dominated by a single company, with no competitors whatsoever. Even worse, Microsoft's deal with hardware vendors ensure that even if a competitor were to rise they'll have to earn their favor as well. The game is lost for any competitor before it even starts. And with the PC dominance under their thumb they test the waters to see with how much they can get away with, an approach they cannot even afford to consider when it comes to their other products like Azure or even the C# programming language. They also did their best to make Visual Studio Code great, until you realize that this also follows the same pattern.

ChuckNorris89 5y ago
>I saw the writing on the wall the moment they could sloppily justify the TPM requirement. Microsoft doxed itself on the TPM limitation being purely arbitrary when Windows 11 compatibility checks passed on a Pentium 4 CPU and installed just fine due to a mistake from Microsoft where they forgot to blacklist that CPU family lol. https://twitter.com/Carlos_SM1995/status/1448561898035851264?s=20 https://twitter.com/Carlos_SM1995/status/1448561898035851264...
- FDSGSG 5y ago
  >purely arbitrary As if years of experience hasn't taught us that opt-in security is stupid. This would be arbitrary if the TPM was useless, but it isn't.
  - ChuckNorris89 5y ago
    We have to disagree here. The threat models where the security that TPM offers are mostly applicable to the enterprise and business sectors where all devices on the network/AD/VPN have to be trusted and their storage encrypted. There TPM makes perfect sense. You average consumer/home user does not benefit at all from the features of TPM since they're not subject to the same threat model. Here TPM, and also stuff of the UEFI security chain like Management Engine and Secure Boot in the past, act more like hostile wall-gardening that limit what a user can install on his system (remember how enabling secure boot originally meant you couldn't install any linux distro?) rather than add any meaningful security (will TPM and Secure Boot prevent grandma from getting her PC infected by malware off some shady phishing site? No? Then don't force those requirements for private users)
    - EvanAnderson 5y ago
      To give an example harm caused by the TPM / disk encryption feature in the consumer space: A recently-deceased friend's wife contacted me about getting personal data off from her late husband's computers. I ended up being able to get nothing for her. My friend, no doubt influenced by dementia and paranoia he was feeling, changed the passwords, made no note of them, and subsequently died. The computers in question run Windows 10 using Bitlocker and key storage in the TPM. The data is effectively gone. I believe he was using encrypted backups to a "cloud" storage provider, too, but I'm also fairly certain the key is only on these computers. (The Windows accounts on these machines are local accounts so the Bitlocker recovery keys weren't saved on Microsoft's servers either.) Matters were arguably handled poorly on my friend's part prior to his becoming of unsound mind. He wasn't terribly technically savvy and I'm not sure he considered the "losing my own mind" threat model. Nonetheless, it adds insult to injury that Bitlocker, which added no security for his day-to-day use, effectively caused the loss of his data.
      - lupire 5y ago
        That has nothing to do with TPM. It's the opposite, in fact. That's software that obeyed user commmands.
- gruez 5y ago
  >Microsoft doxed itself Does "dox" mean "anything vaguely secret" now? I still remember the days when it meant "personal information".
iforgotpassword 5y ago
And they will get away with it. The generation that grew up with smartphones primarily, getting a computer only later on (if at all) will find this totally normal. Even Android is getting locked up more and more over the couple last releases too, even most Chinese vendors stopped letting you unlock the bootloader, and nobody complained.
HeckFeck 5y ago
I genuinely miss the days of playing with DOS, Windows 9x and then all the excitement of Windows XP. All on my own hardware, which was whatever I could scrape from parents, savings, neighbours. I could do what I wanted with these old PCs. There was an openness that existed in the world of computing. Despite all that was said of Microsoft back then, and much of the complaints about proprietary software were true then also, it wasn't anywhere near as bad as this. Back then, new releases actually did improve my experience of computing. Every time I use Windows 10 I feel like I'm constantly in battle with the PC. Every new piece of news I read, every new feature in software and now hardware I read and shudder, thinking, how much more of my privacy will it cost? What other aspect of my life is being invaded? And because of the network effect, I'm trapped in their clutches. I have to use these services or I can't work, can't talk to friends. All well and good saying 'use Matrix' but a chat program with no friends is just a note taker. Such a seismic shift and it was only two decades. I just want this hostility to end. A computer is a machine, which is an elaborate tool, for Pete's sake. I don't feel the same way towards my garden hose or washing machine. (And I increasingly wonder, were we freer back then because there was still some empathy towards customer needs at Microsoft, or because they were simply stifled from their real intentions by technological limitations?)
- paulryanrogers 5y ago
  That early era also included some controversy over Windows XP requiring online activation. It was a watershed moment, soon followed by their authenticity check to install certain updates. We are firmly in a new era of increasing DRM within the OS. As a producer I can see the desire but am saddened as a consumer with fond memories of a freer time.
- no_time 5y ago
  I have a theory that this seismic shift is the result a demographic shift of PC users. It gradually went from engineers, businessmen and hackers to a much wider audience including younger people who have trouble grasping concepts such as folders[0] This by itself is not bad, problems arise when companies use this to justify deny control even from those who can be responsible with it. [0]: https://www.pcgamer.com/students-dont-know-what-files-and-folders-are-professors-say/ https://www.pcgamer.com/students-dont-know-what-files-and-fo...
matheusmoreira 5y ago
The issue isn't the TPM, it's who owns the keys to the machine. If the user configures their own keys, it becomes an empowering technology that allows them to verify their boot process hasn't been tampered with. If Microsoft owns the keys, they own the computer and the technology becomes their means of control over the user. They will use this technology to oppressively deny the user their software freedom while simultaneously extracting rent out of any developer who wants to reach that person. Those who own the keys own the machine. We must ensure we are the ones holding the keys at all times or suffer the consequences.
- ngneer 5y ago
  Insightful analysis, though "oppressively deny" sounds harsh to me. There is not a blatant malice in TCG per se, mainly a neutral desire for control and by proxy profit. The treacherous versus trusted computing debate really does boil down to control. Do we trust vendors to be stewards of control on our platforms? Do we even have a choice? I do not recall giving the keys to anyone, and yet it feels like the person building your house is telling you that they can pop in for dinner and lock you out should the need arise (deny you the ability to run your choice of software and your control is forfeit). There is something flagrant when the question is brought home to the personal computer. No user complains too much about not being able to replace the firmware for some faraway BGP router, yet that router is also part of the infrastructure like the PC and the OS installed on it. If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little. Naturally, the PC does both, but since the two are at odds with one another, the PC has conflicting interests, serving two masters. A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot. Granted, debug is control for the sake of helping the user and does not deny the user the ability to run software (the OS and app store do that). This just leaves the problem of where can a user actually go to do secure compute. An abacus works nicely, but is impractical. Free open source hardware (FOSH) is really the only option.
  - matheusmoreira 5y ago
    > A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot. You cannot be serious. How do I know if this can happen to me? > Free open source hardware (FOSH) is really the only option. Yes. > No user complains too much about not being able to replace the firmware for some faraway BGP router The network is a very clear line to me. The BGP router is not my computer. It's the ISP who should be demanding free software from their hardware manufacturers, so that they too could enjoy complete control and trust. > If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little. In these cases, the user is not using a computer. They're using appliances that just happen to have computers inside. Modern consumer products make every effort to hide the computer. There is no computing freedom if there are no computers we can use. We must oppose all "consumer" products, all "fully integrated and converged" solutions. Computing is about simple parts in the form of hardware and software; from these parts, powerful systems emerge. Consumer appliances are these whole things that have swallowed up the entire system. They are indivisible, non-interoperable, uncontrollable, they only do what was foreseen by the corporation that made them despite the perfectly capable computer inside. I can't interface directly with the computer controlling my air conditioner, I need an infrared controller for that. This article is linked from Stallman's website, it covers this matter with a lot of depth: http://contemporary-home-computing.org/RUE/ http://contemporary-home-computing.org/RUE/ > We are giving up our last rights and freedoms for “experiences,” for the questionable comfort of “natural interaction.” > But there is no natural interaction, and there are no invisible computers, there only hidden ones. Until the moment when, like in the episode with The Guardian, the guts of the personal computer are exposed. > Every victory of experience design: a new product “telling the story,” or an interface meeting the “exact needs of the customer, without fuss or bother” widens the gap in between a person and a personal computer. > The morning after “experience design:” interface-less, desposible hardware, personal hard disc shredders, primitive customization via mechanical means, rewiring, reassembling, making holes into hard disks, in order to to delete, to logout, to “view offline.”

ChuckNorris89 5y ago

>I saw the writing on the wall the moment they could sloppily justify the TPM requirement. Microsoft doxed itself on the TPM limitation being purely arbitrary when Windows 11 compatibility checks passed on a Pentium 4 CPU and installed just fine due to a mistake from Microsoft where they forgot to blacklist that CPU family lol. https://twitter.com/Carlos_SM1995/status/1448561898035851264?s=20 https://twitter.com/Carlos_SM1995/status/1448561898035851264...

FDSGSG 5y ago
>purely arbitrary As if years of experience hasn't taught us that opt-in security is stupid. This would be arbitrary if the TPM was useless, but it isn't.
- ChuckNorris89 5y ago
  We have to disagree here. The threat models where the security that TPM offers are mostly applicable to the enterprise and business sectors where all devices on the network/AD/VPN have to be trusted and their storage encrypted. There TPM makes perfect sense. You average consumer/home user does not benefit at all from the features of TPM since they're not subject to the same threat model. Here TPM, and also stuff of the UEFI security chain like Management Engine and Secure Boot in the past, act more like hostile wall-gardening that limit what a user can install on his system (remember how enabling secure boot originally meant you couldn't install any linux distro?) rather than add any meaningful security (will TPM and Secure Boot prevent grandma from getting her PC infected by malware off some shady phishing site? No? Then don't force those requirements for private users)
  - EvanAnderson 5y ago
    To give an example harm caused by the TPM / disk encryption feature in the consumer space: A recently-deceased friend's wife contacted me about getting personal data off from her late husband's computers. I ended up being able to get nothing for her. My friend, no doubt influenced by dementia and paranoia he was feeling, changed the passwords, made no note of them, and subsequently died. The computers in question run Windows 10 using Bitlocker and key storage in the TPM. The data is effectively gone. I believe he was using encrypted backups to a "cloud" storage provider, too, but I'm also fairly certain the key is only on these computers. (The Windows accounts on these machines are local accounts so the Bitlocker recovery keys weren't saved on Microsoft's servers either.) Matters were arguably handled poorly on my friend's part prior to his becoming of unsound mind. He wasn't terribly technically savvy and I'm not sure he considered the "losing my own mind" threat model. Nonetheless, it adds insult to injury that Bitlocker, which added no security for his day-to-day use, effectively caused the loss of his data.
    - lupire 5y ago
      That has nothing to do with TPM. It's the opposite, in fact. That's software that obeyed user commmands.
gruez 5y ago
>Microsoft doxed itself Does "dox" mean "anything vaguely secret" now? I still remember the days when it meant "personal information".

iforgotpassword 5y ago

And they will get away with it. The generation that grew up with smartphones primarily, getting a computer only later on (if at all) will find this totally normal. Even Android is getting locked up more and more over the couple last releases too, even most Chinese vendors stopped letting you unlock the bootloader, and nobody complained.

HeckFeck 5y ago

I genuinely miss the days of playing with DOS, Windows 9x and then all the excitement of Windows XP. All on my own hardware, which was whatever I could scrape from parents, savings, neighbours. I could do what I wanted with these old PCs. There was an openness that existed in the world of computing. Despite all that was said of Microsoft back then, and much of the complaints about proprietary software were true then also, it wasn't anywhere near as bad as this. Back then, new releases actually did improve my experience of computing. Every time I use Windows 10 I feel like I'm constantly in battle with the PC. Every new piece of news I read, every new feature in software and now hardware I read and shudder, thinking, how much more of my privacy will it cost? What other aspect of my life is being invaded? And because of the network effect, I'm trapped in their clutches. I have to use these services or I can't work, can't talk to friends. All well and good saying 'use Matrix' but a chat program with no friends is just a note taker. Such a seismic shift and it was only two decades. I just want this hostility to end. A computer is a machine, which is an elaborate tool, for Pete's sake. I don't feel the same way towards my garden hose or washing machine. (And I increasingly wonder, were we freer back then because there was still some empathy towards customer needs at Microsoft, or because they were simply stifled from their real intentions by technological limitations?)

paulryanrogers 5y ago
That early era also included some controversy over Windows XP requiring online activation. It was a watershed moment, soon followed by their authenticity check to install certain updates. We are firmly in a new era of increasing DRM within the OS. As a producer I can see the desire but am saddened as a consumer with fond memories of a freer time.
no_time 5y ago
I have a theory that this seismic shift is the result a demographic shift of PC users. It gradually went from engineers, businessmen and hackers to a much wider audience including younger people who have trouble grasping concepts such as folders[0] This by itself is not bad, problems arise when companies use this to justify deny control even from those who can be responsible with it. [0]: https://www.pcgamer.com/students-dont-know-what-files-and-folders-are-professors-say/ https://www.pcgamer.com/students-dont-know-what-files-and-fo...

matheusmoreira 5y ago

The issue isn't the TPM, it's who owns the keys to the machine. If the user configures their own keys, it becomes an empowering technology that allows them to verify their boot process hasn't been tampered with. If Microsoft owns the keys, they own the computer and the technology becomes their means of control over the user. They will use this technology to oppressively deny the user their software freedom while simultaneously extracting rent out of any developer who wants to reach that person. Those who own the keys own the machine. We must ensure we are the ones holding the keys at all times or suffer the consequences.

ngneer 5y ago
Insightful analysis, though "oppressively deny" sounds harsh to me. There is not a blatant malice in TCG per se, mainly a neutral desire for control and by proxy profit. The treacherous versus trusted computing debate really does boil down to control. Do we trust vendors to be stewards of control on our platforms? Do we even have a choice? I do not recall giving the keys to anyone, and yet it feels like the person building your house is telling you that they can pop in for dinner and lock you out should the need arise (deny you the ability to run your choice of software and your control is forfeit). There is something flagrant when the question is brought home to the personal computer. No user complains too much about not being able to replace the firmware for some faraway BGP router, yet that router is also part of the infrastructure like the PC and the OS installed on it. If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little. Naturally, the PC does both, but since the two are at odds with one another, the PC has conflicting interests, serving two masters. A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot. Granted, debug is control for the sake of helping the user and does not deny the user the ability to run software (the OS and app store do that). This just leaves the problem of where can a user actually go to do secure compute. An abacus works nicely, but is impractical. Free open source hardware (FOSH) is really the only option.
- matheusmoreira 5y ago
  > A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot. You cannot be serious. How do I know if this can happen to me? > Free open source hardware (FOSH) is really the only option. Yes. > No user complains too much about not being able to replace the firmware for some faraway BGP router The network is a very clear line to me. The BGP router is not my computer. It's the ISP who should be demanding free software from their hardware manufacturers, so that they too could enjoy complete control and trust. > If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little. In these cases, the user is not using a computer. They're using appliances that just happen to have computers inside. Modern consumer products make every effort to hide the computer. There is no computing freedom if there are no computers we can use. We must oppose all "consumer" products, all "fully integrated and converged" solutions. Computing is about simple parts in the form of hardware and software; from these parts, powerful systems emerge. Consumer appliances are these whole things that have swallowed up the entire system. They are indivisible, non-interoperable, uncontrollable, they only do what was foreseen by the corporation that made them despite the perfectly capable computer inside. I can't interface directly with the computer controlling my air conditioner, I need an infrared controller for that. This article is linked from Stallman's website, it covers this matter with a lot of depth: http://contemporary-home-computing.org/RUE/ http://contemporary-home-computing.org/RUE/ > We are giving up our last rights and freedoms for “experiences,” for the questionable comfort of “natural interaction.” > But there is no natural interaction, and there are no invisible computers, there only hidden ones. Until the moment when, like in the episode with The Guardian, the guts of the personal computer are exposed. > Every victory of experience design: a new product “telling the story,” or an interface meeting the “exact needs of the customer, without fuss or bother” widens the gap in between a person and a personal computer. > The morning after “experience design:” interface-less, desposible hardware, personal hard disc shredders, primitive customization via mechanical means, rewiring, reassembling, making holes into hard disks, in order to to delete, to logout, to “view offline.”