6 ms·

The strongest part of the article is piecing together the motivation and purpose behind Pluton: In order to perhaps peek behind Microsoft's curtain a bit, let

• schoen 4y ago
  When I was at EFF, I often made arguments like this. I was surprised to find that, in the video game console context, a pretty significant number of gamers vocally disagreed! Basically, they felt that a "good" console ecosystem was a rare and precious thing, and that it required things like curation, and inducement to developers to invest, which in turn required extensive control over players to make sure that they used their consoles only in approved ways, with approved software. I'm trying to think of analogies to make this make more sense to me or other people like me. I think there is some comparison to be made to security checkpoints that someone might try to require before giving the public access to some place or activity. Probably not coincidentally, I don't like those either and don't want to see them expanded to more places and circumstances and parts of life. However, someone might sympathize with the concerns of the people creating the checkpoints strongly enough as to say "although these measures are intrusive and could be viewed as intruding on my rights, I feel that realistically the likely alternative is not getting to (fly|meet the president|meet the Queen|hold this expensive diamond) and that I can't see a path to getting to do that otherwise, so the choice for me seems like I should naturally accept the intrusions in order to get to do the thing". Some of the gamers were saying, well, I want to play games that cost many millions of dollars to make, and the people who make those games say they want to target platforms where they get certain guarantees about restrictions on the players, otherwise they won't be able to invest that kind of money. Some possible responses that come to mind, both in the analogy and the world we live in: * We should have more Schelling fences to stop the spread of restrictions and control into more areas of life. * We should find other ways of addressing the legitimate parts of other people's concerns, without intruding on individual freedoms as much. * These rights should be treated as sacred, so too bad if other people aren't willing to respect them, or if they then don't do things that you wanted. (Or maybe activities that require certain levels of intrusion in order to be feasible or safe should just not occur at all.) * Maybe people are lying, or mistaken, about the level of control that they actually need in order to let you do the things you want. Can we coordinate to call their bluff? It's also a little complicated if you include the cheating part alongside the illegal copying part (and the games -- or HPC applications! -- developed with no royalty to the console maker part). There, many gamers do see gamers-in-general as the enemy, though not necessarily themselves; like "we're not trustworthy, as a group, so we need measures to stop the numerous cheaters among us from ruining things for the rest of us". I was genuinely surprised to see many of these phenomena. (In a couple of cases, I think EFF announced some kind of support for people who were reverse engineering hardware to make it able to run unofficial software, and some gamers said "hey, you're supporting the bad guys here"!) But I'd like to hear other people's ideas about how to contend with them.
  • car_analogy 4y ago
    The concerns about cheating are valid, but we already have consoles to address them. I dread the possibilities of control in moving more activities, not just gaming, to the console model. Forget ad-blockers, there are already sites that prevent even copy-pasting of text unless one disables javascript. > Maybe people are lying, or mistaken, about the level of control that they actually need in order to let you do the things you want. Can we coordinate to call their bluff? They were lying when they claimed home taping was killing music, and that VCRs [0] were to film producers "as the Boston strangler is to the woman home alone" [1], and more recently, a EU-funded study that found piracy causes little harm was suppressed [2], so they should certainly not be taken at their word. > When I was at EFF Thank you for your service :) [0] Ironic that, with how difficult saving video has become from streaming sites and services, we have largely lost the abilities the VCR afforded us. A good example of how quickly technology is turned against us. [1] https://en.wikipedia.org/wiki/Videocassette_recorder#Legal_challenges https://en.wikipedia.org/wiki/Videocassette_recorder#Legal_c... [2] https://juliareda.eu/2017/09/secret-copyright-infringement-study/ https://juliareda.eu/2017/09/secret-copyright-infringement-s...
    • dane-pgp 4y ago
      > there are already sites that prevent even copy-pasting of text unless one disables javascript. Worse, there are sites that prevent even viewing of text unless one enables JavaScript. Anyway, to assist the GPP, and inspired by your user name, let me suggest that requiring TPM checks for people running (games on) PCs is like requiring your car to breathalyze you before starting the engine. (As Doctorow famously said "A car is a computer you put your body into"). The public would never allow that, right? https://www.forensicmag.com/578254-Infrastructure-Bill-Would-Require-Breathalyzers-for-All-New-Cars/ https://www.forensicmag.com/578254-Infrastructure-Bill-Would...
      • Affric 4y ago
        >let me suggest that requiring TPM checks for people running (games on) PCs is like requiring your car to breathalyze you before starting the engine. There are situations where this would make an individual less safe but for people who have received DUI this is a reasonable and existing practice. I don't think it maps to computers, where rarely are lives on the line.
• naikrovek 4y ago
  > it was designed to provide security against the owner no. no, no, no, no, no. holy crap, no. no. it was designed to prevent unauthorized access to hardware. corporations own computers, too. and you know what is on a lot of the computers they own? trade secrets. who wants those trade secrets? competitors, copycats, and so on. what is something that such motivated actors have a large amount of? money. money to hire thieves. money to buy expensive equipment. people to attempt to circumvent security measures. Pluton is designed to address situations like this. no one cares about John and Jane computer owner. Pluton will not be used against John or Jane unless John or Jane allow it, in some unforeseen situation I can't imagine. Pluton is a very good weapon for corporate IT admins trying to secure their devices. "BUT TPMs ALREADY DO THAT" not unless you require a PIN on boot, and PINs on boot are a pain in the ass. no one likes them, no one wants them. they often have huge complexity requirements and can be easily forgotten. PINs suck. they suck so much that some unfortunate companies decide against the PIN requirement and implement things like BitLocker using the TPM alone, and that is extremely insecure to anyone with physical access to a device because TPM traffic can be captured. "that seems like something that is very difficult and will never happen." it's very easy: https://news.ycombinator.com/item?id=29258879 https://news.ycombinator.com/item?id=29258879 Pluton was designed for the same thing that the Intel Management Engine and other related technologies were designed for: corporate IT administrators.
  • car_analogy 4y ago
    In other cases where enterprises wanted something that consumers cared little about (ECC RAM comes to mind, or the artificial limit on number of concurrent connections in non-server Windows editions), manufacturers were happy to cripple their product for consumers, so they could charge a premium to less price-sensitive enterprises. But when it comes to Pluton, or the AMD and Intel management engines, they're making sure you can't buy a product without them at any price. > it was designed to prevent unauthorized access to hardware. Yes and it's all a big coincidence there's no owner override, so that only the manufacturer decides what is "authorized".
    • naikrovek 4y ago