5 ms·

I've been thinking about this for a while, and my proposal is pretty simple: --- Legally - prohibit selling physical goods that contain digital locks unless t

I've been thinking about this for a while, and my proposal is pretty simple: --- Legally - prohibit selling physical goods that contain digital locks unless the owner is given a key. Period. --- That's all you have to do. If I own the device, I get the keys for the physical locks, and the keys for the digital locks. I'm completely ok with manufacturers locking down computers for security, in much the same way that I appreciate that cars have door/ignition locks. But if I own it - I get all the keys. I may never use them, but they are mine, as part of ownership.

FredPret 5y ago
That makes sense. With these treadmills, gyms can simply keep their NordicTracks locked to prevent people messing with them. And if you buy one for yourself, you can watch Netflix. All at the owners’ risk. Treat adults like adults. I like it.
dont__panic 5y ago
Yeah, it's fine for a corporate device or a child's device to have some safety rails in place. But it's bullshit that an iOS device I purchased won't run any application or customization or OS version that I want.
AndrewOMartin 5y ago
Yeah, wouldn't it be great if there was a foundation to advocate for being able to have the keys to your digital locks? We could call it something like the Freedom from Locks on Software Foundation, or maybe something a bit snapper.
- horsawlarway 5y ago
  My take is not nearly as strong as the fsf's. I'm fine not being provided with source code, and not being able to distribute the original code itself. Basically - I don't expect to have companies hand me code they wrote to run the device (I happen to like it, so I tend to support companies that do), but I don't believe that's a reasonable (or particularly useful) practice when so many functions depend on external web services. I do expect to have them legally prevented from blocking me from writing my own code to run or repair the device.
  - enriquto 5y ago
    > My take is not nearly as strong as the fsf's. Your take is much stronger than that of the FSF. The FSF advocates for people to choose free software, and for governments to not force people to use non-free software. You say that non-free software (i.e., software for which you don't have the key) should be illegal. The FSF has never advocated for such an extreme viewpoint.
    - pjerem 5y ago
      No he didn’t said that. He said that he wanted the keys blocking him to run its own software, not that he wanted the code of the running software. Much like you don’t need Windows source code to install Linux, but you need to be provided the UEFI password if there is one.
    - horsawlarway 5y ago
      > You say that non-free software (i.e., software for which you don't have the key) should be illegal. I don't think I'm saying that. I'm saying that hardware sold to me should be usable by me without company approval. I should be able to unlock any bootloader/bios/flash that the vendor does as a part of normal repair or operation. Basically - if it has RAM, I should be able to write to it. If it has ROM the company flashes from outside the device - I should be able to flash it from outside the device. In many cases you could simplify this to - I should have root access on any computing hardware that supports software with the concept of root access (and it's a surprisingly large amount these days) I don't mind the company not sharing tooling or documentation. I certainly am not asking for non-binary source code. I think you should be able to sell software as a service just fine (I don't own that hardware, you do) - but I'm opposed to a company being able to intentionally sell a product that contains a cryptographic software lock that prevents the owner from later taking advantage of that hardware. basically - I'm much softer on the requirements, but I'd prefer they be enforced.
judge2020 5y ago
How do you give the owner a key without enabling an evil maid attack? a physical usb device unique to the phone that will unlock it to run whatever when it's plugged in? something deep in settings that requires you do a dance and enter the konami code?
- pjerem 5y ago
  There is a new technology that I learnt of recently. It’s called paper. It can be used to create instruction booklets or, by adding glue, it can become a sticker. We could print those keys on it.
- nybble41 5y ago
  A device-specific "owner password" would be fine. Physical access is not proof of ownership, so there is no need to open the device up to trivial "evil maid"-style attacks. Of course some owners will lose their passwords, so some provision would need to be made to ensure that owner-access is not permanently lost.
- GauntletWizard 5y ago
  For my treadmill: Who cares? If my maid is evil and reporgrams my treadmill to randomly throw me off, there's a dozen more effective and hard to detect ways she could set traps in my house, like setting up common household cleaning products to mix and fill the house with chlorine gas. Evil Maid attacks are real, but you don't need perfect security for your household appliances.
deleted 5y ago
[deleted]

FredPret 5y ago

That makes sense. With these treadmills, gyms can simply keep their NordicTracks locked to prevent people messing with them. And if you buy one for yourself, you can watch Netflix. All at the owners’ risk. Treat adults like adults. I like it.

dont__panic 5y ago

Yeah, it's fine for a corporate device or a child's device to have some safety rails in place. But it's bullshit that an iOS device I purchased won't run any application or customization or OS version that I want.

AndrewOMartin 5y ago

Yeah, wouldn't it be great if there was a foundation to advocate for being able to have the keys to your digital locks? We could call it something like the Freedom from Locks on Software Foundation, or maybe something a bit snapper.

horsawlarway 5y ago
My take is not nearly as strong as the fsf's. I'm fine not being provided with source code, and not being able to distribute the original code itself. Basically - I don't expect to have companies hand me code they wrote to run the device (I happen to like it, so I tend to support companies that do), but I don't believe that's a reasonable (or particularly useful) practice when so many functions depend on external web services. I do expect to have them legally prevented from blocking me from writing my own code to run or repair the device.
- enriquto 5y ago
  > My take is not nearly as strong as the fsf's. Your take is much stronger than that of the FSF. The FSF advocates for people to choose free software, and for governments to not force people to use non-free software. You say that non-free software (i.e., software for which you don't have the key) should be illegal. The FSF has never advocated for such an extreme viewpoint.
  - pjerem 5y ago
    No he didn’t said that. He said that he wanted the keys blocking him to run its own software, not that he wanted the code of the running software. Much like you don’t need Windows source code to install Linux, but you need to be provided the UEFI password if there is one.
  - horsawlarway 5y ago
    > You say that non-free software (i.e., software for which you don't have the key) should be illegal. I don't think I'm saying that. I'm saying that hardware sold to me should be usable by me without company approval. I should be able to unlock any bootloader/bios/flash that the vendor does as a part of normal repair or operation. Basically - if it has RAM, I should be able to write to it. If it has ROM the company flashes from outside the device - I should be able to flash it from outside the device. In many cases you could simplify this to - I should have root access on any computing hardware that supports software with the concept of root access (and it's a surprisingly large amount these days) I don't mind the company not sharing tooling or documentation. I certainly am not asking for non-binary source code. I think you should be able to sell software as a service just fine (I don't own that hardware, you do) - but I'm opposed to a company being able to intentionally sell a product that contains a cryptographic software lock that prevents the owner from later taking advantage of that hardware. basically - I'm much softer on the requirements, but I'd prefer they be enforced.

judge2020 5y ago

How do you give the owner a key without enabling an evil maid attack? a physical usb device unique to the phone that will unlock it to run whatever when it's plugged in? something deep in settings that requires you do a dance and enter the konami code?

pjerem 5y ago
There is a new technology that I learnt of recently. It’s called paper. It can be used to create instruction booklets or, by adding glue, it can become a sticker. We could print those keys on it.
nybble41 5y ago
A device-specific "owner password" would be fine. Physical access is not proof of ownership, so there is no need to open the device up to trivial "evil maid"-style attacks. Of course some owners will lose their passwords, so some provision would need to be made to ensure that owner-access is not permanently lost.
GauntletWizard 5y ago
For my treadmill: Who cares? If my maid is evil and reporgrams my treadmill to randomly throw me off, there's a dozen more effective and hard to detect ways she could set traps in my house, like setting up common household cleaning products to mix and fill the house with chlorine gas. Evil Maid attacks are real, but you don't need perfect security for your household appliances.

deleted 5y ago

[deleted]