3 ms·

In other cases where enterprises wanted something that consumers cared little about (ECC RAM comes to mind, or the artificial limit on number of concurrent conn

In other cases where enterprises wanted something that consumers cared little about (ECC RAM comes to mind, or the artificial limit on number of concurrent connections in non-server Windows editions), manufacturers were happy to cripple their product for consumers, so they could charge a premium to less price-sensitive enterprises. But when it comes to Pluton, or the AMD and Intel management engines, they're making sure you can't buy a product without them at any price. > it was designed to prevent unauthorized access to hardware. Yes and it's all a big coincidence there's no owner override, so that only the manufacturer decides what is "authorized".

naikrovek 4y ago
I'm talking about PCs. the administrator gets to decide what is turned on and how it is used. the administrator has back doors in, that are more involved and more secure than the front door. the private keys don't go to the manufacturer, but are created by the owner, etc. there is always owner override in the case of the PC. consoles are locked down because we have demonstrated to console manufacturers again and again, for 40 years, that we will pirate games for the console if it is at all possible. we have left zero room for interpretation with this message. we WILL steal if there is any way to steal. so in the case of consoles, yes. manufacturer only.
- nobodyandproud 4y ago
  Has Microsoft changed its TPM requirements for Windows 11? If not, then there is no override.
  - naikrovek 4y ago
    set the registry key and the requirement goes away. the tpm doesn't hide things from you, it hides things from attackers. if you don't want your disk encrypted, then decrypt it. you can do that. it's very easy.
    - car_analogy 4y ago
      And now you're straight up lying. The whole purpose of the TPM is to hide cryptographic keys from anyone with physical access, including the owner. There is no override an owner can perform (via, say, a password set on first boot, that may be used to dump all the keys from the TPM into RAM). It may not by itself force you to encrypt your disk, but it does enable all the abuses listed in https://en.wikipedia.org/wiki/Trusted_Computing#Criticism https://en.wikipedia.org/wiki/Trusted_Computing#Criticism, that I won't waste summarizing, as it's becoming increasingly obvious you're arguing in bad faith.
    - nobodyandproud 4y ago
      The requirement for TPM 2.0 goes away, but Windows 11 still requires TPM 1.2 even with said registry key. In short, there is no opting out barring an alternative OS.
      - naikrovek 4y ago
        then turn on the firmware TPM...
        nobodyandproud 4y ago
        > Has Microsoft changed its TPM requirements for Windows 11? > If not, then there is no override. So going back to my question: The answer is a resounding no. It’s hard to believe you’re participating in good faith at this point.
- car_analogy 4y ago
  > there is always owner override in the case of the PC. Oh, the owner can tell Pluton to fake attestation results, so that, for example, it would report to a program that it's being executed in Genuine™ Microsoft Windows® 11, even if the program is actually being ran in a sandbox on linux? Because if not, then there is no owner override, and it's a scheme to foist hardware-backed DRM onto PCs.
  - naikrovek 4y ago
    you have no idea what you're talking about. set up the environment properly, so that the attestation can happen, and it will happen.
    - car_analogy 4y ago
      Are you trying to dispel concerns about remote attestation with "set up the environment properly"? Because that is exactly what has people worried - what is "proper" and who decides it. Or have I misunderstood you, and you're claiming that Pluton either does not support remote attestation, or allows the owner to fake it? Because as far as I can tell from available information on Pluton and TPM modules, both those claims are false.
  - native_samples 4y ago
    BitLocker type solutions don't rely on remote attestation. RA has never really taken off in any context. Regardless, arguments against remote attestation are always very tricky. You're acting like it's morally clear cut but it's not. RA is designed to stop you lying about what you're running to other people. It doesn't stop you running things, but it may mean others choose not to trade or engage with you based on what you're doing with the computer. So this is a direct translation to standard libertarian philosophy. You can choose your own terms but you can't force your preferred terms on others - you have to negotiate a contract that's mutually acceptable and then that contract needs to be enforced. RA is a kind of technologically enforced contract, instead of relying exclusively on the legal system. That's why arguments that RA is evil always skip a few steps. The argument goes: - I want to run X (typically some Linux distro) - Some service Y won't trade with me unless X will do Z (typically enforcing some sort of agreement e.g. anti-cheat or license). - X chooses not to do Z but I want Y to service me anyway. So I want to lie to them and feel entitled to being able to do that without being caught. This is moral because Linux. Often with a helping of "I'm afraid that actually service Y might be most services". The concerns here are valid - it would suck to no longer be able to use Linux with various remote services - but if you look at how the TPM and related tech are designed there's no actual technical reason you couldn't make Linux satisfy remote attestations. It's simply that Linux users would usually refuse to do so on philosophical grounds. Well, that's fine, but from a political and philosophical perspective it's reasonable for your counterparty to want some assurance that you'll actually implement the agreement you're claiming you will.

naikrovek 4y ago

I'm talking about PCs. the administrator gets to decide what is turned on and how it is used. the administrator has back doors in, that are more involved and more secure than the front door. the private keys don't go to the manufacturer, but are created by the owner, etc. there is always owner override in the case of the PC. consoles are locked down because we have demonstrated to console manufacturers again and again, for 40 years, that we will pirate games for the console if it is at all possible. we have left zero room for interpretation with this message. we WILL steal if there is any way to steal. so in the case of consoles, yes. manufacturer only.

nobodyandproud 4y ago
Has Microsoft changed its TPM requirements for Windows 11? If not, then there is no override.
- naikrovek 4y ago
  set the registry key and the requirement goes away. the tpm doesn't hide things from you, it hides things from attackers. if you don't want your disk encrypted, then decrypt it. you can do that. it's very easy.
  - car_analogy 4y ago
    And now you're straight up lying. The whole purpose of the TPM is to hide cryptographic keys from anyone with physical access, including the owner. There is no override an owner can perform (via, say, a password set on first boot, that may be used to dump all the keys from the TPM into RAM). It may not by itself force you to encrypt your disk, but it does enable all the abuses listed in https://en.wikipedia.org/wiki/Trusted_Computing#Criticism https://en.wikipedia.org/wiki/Trusted_Computing#Criticism, that I won't waste summarizing, as it's becoming increasingly obvious you're arguing in bad faith.
  - nobodyandproud 4y ago
    The requirement for TPM 2.0 goes away, but Windows 11 still requires TPM 1.2 even with said registry key. In short, there is no opting out barring an alternative OS.
    - naikrovek 4y ago
      then turn on the firmware TPM...
      - nobodyandproud 4y ago
        > Has Microsoft changed its TPM requirements for Windows 11? > If not, then there is no override. So going back to my question: The answer is a resounding no. It’s hard to believe you’re participating in good faith at this point.
car_analogy 4y ago
> there is always owner override in the case of the PC. Oh, the owner can tell Pluton to fake attestation results, so that, for example, it would report to a program that it's being executed in Genuine™ Microsoft Windows® 11, even if the program is actually being ran in a sandbox on linux? Because if not, then there is no owner override, and it's a scheme to foist hardware-backed DRM onto PCs.
- naikrovek 4y ago
  you have no idea what you're talking about. set up the environment properly, so that the attestation can happen, and it will happen.
  - car_analogy 4y ago
    Are you trying to dispel concerns about remote attestation with "set up the environment properly"? Because that is exactly what has people worried - what is "proper" and who decides it. Or have I misunderstood you, and you're claiming that Pluton either does not support remote attestation, or allows the owner to fake it? Because as far as I can tell from available information on Pluton and TPM modules, both those claims are false.
- native_samples 4y ago
  BitLocker type solutions don't rely on remote attestation. RA has never really taken off in any context. Regardless, arguments against remote attestation are always very tricky. You're acting like it's morally clear cut but it's not. RA is designed to stop you lying about what you're running to other people. It doesn't stop you running things, but it may mean others choose not to trade or engage with you based on what you're doing with the computer. So this is a direct translation to standard libertarian philosophy. You can choose your own terms but you can't force your preferred terms on others - you have to negotiate a contract that's mutually acceptable and then that contract needs to be enforced. RA is a kind of technologically enforced contract, instead of relying exclusively on the legal system. That's why arguments that RA is evil always skip a few steps. The argument goes: - I want to run X (typically some Linux distro) - Some service Y won't trade with me unless X will do Z (typically enforcing some sort of agreement e.g. anti-cheat or license). - X chooses not to do Z but I want Y to service me anyway. So I want to lie to them and feel entitled to being able to do that without being caught. This is moral because Linux. Often with a helping of "I'm afraid that actually service Y might be most services". The concerns here are valid - it would suck to no longer be able to use Linux with various remote services - but if you look at how the TPM and related tech are designed there's no actual technical reason you couldn't make Linux satisfy remote attestations. It's simply that Linux users would usually refuse to do so on philosophical grounds. Well, that's fine, but from a political and philosophical perspective it's reasonable for your counterparty to want some assurance that you'll actually implement the agreement you're claiming you will.