6 ms·

Is calling anyone who disagrees with you a "corporate mouthpiece" similar to how some people argue anyone who doesn't say "ACAB" is a boot licker? Here's my pe

Is calling anyone who disagrees with you a "corporate mouthpiece" similar to how some people argue anyone who doesn't say "ACAB" is a boot licker? Here's my personal take: No one is forced to use remote attestation merely to use their device. It's only if you want to use some other service. So - if you don't want to play by the requirements of the service, then just don't use the service? It seems pretty simple. There's a country club that I want to eat in, but they require me to wear a suit jacket. I don't want to wear a suit jacket - so what do I do? Simply not eat at that country club and go get food somewhere else that doesn't require a suit jacket, or do I start a PR campaign about how evil suit jackets are, and call anyone who doesn't mind wearing a suit jacket a shill for Big Golf?

game-of-throws 4y ago
The danger is one day there might be no options that don't require remote attestation on Windows and Chrome. Your bank doesn't allow Linux? Choose another bank! ... but what happens once every bank has those requirements?
- ryukafalz 4y ago
  Right, “just don’t use that service” rapidly becomes unreasonable when the service is your bank, the DMV, your university’s web portal, etc.
- googlryas 4y ago
  You can just bank in some other manner, like in person, or over the phone. You don't have a right to online banking on your mobile device. It's a convenience.
  - dento 4y ago
    Sure, and you can grow all food yourself as well, grocery stores are a convenience as well.
    - googlryas 4y ago
      They are far less of a convenience and far more of a necessity than online banking is.
- matheusmoreira 4y ago
  I agree with you. In my country, almost every bank mandates that users install "online security modules" on their own computers before they'll allow them to log into their account via browser. These software packages were causing massive instability and low performance on the computers of everyone I know. I reverse engineered one of these things and found kernel mode software intercepting every single network connection and doing god knows what with that information. "Just choose a company that doesn't abuse you" is absolutely invalid since abusing us gives them competitive advantage and they will compete to see who can get away with abusing us the most. Abuse should simply be illegal and the companies doing it shouldn't even be afforded the right to exist to begin with. People should not have to suffer abuse in order to learn their lesson and go elsewhere, abuse should simply not happen to begin with and any corporation violating this assumption needs to get fined out of existence.
no_time 4y ago
>There's a country club that I want to eat in, but they require me to wear a suit jacket. Bad example. Remote attestation is more like ordering takeout to eat in your own home but the delivery guy refusing to hand you the food you ordered unless you provide cryptographic proof that you will be eating while doing a handstand. Nevermind the fact that It's none of his business how you eat in your own house.
- googlryas 4y ago
  Ok, much better analogy. But it still points to a simple solution: Just don't order food from those people.
  - dento 4y ago
    The solution is ok while you have options. But when all banks require attestation to access your account, you can no longer choose.
userbinator 4y ago
The "use/build your own something else" argument is no longer valid when the ones imposing such requirements have effectively become a monopoly.
- googlryas 4y ago
  Can you name a single important service that will use this technology which has a monopoly on that type of service, where there is no alternative?
  - matheusmoreira 4y ago
    Everything on every single app store in existence today. Even Android apps now have the ability to require hardware attestation and lock out access to rooted phones.
    - charcircuit 4y ago
      No app store forces remote attestation. Some offer APIs to do it.
      - matheusmoreira 4y ago
        And eventually everything essential will be using those APIs and we'll be locked out.
manimino 4y ago
We all carry GPS trackers that send our personal info to large companies constantly. This has been normalized to the point where opting out is too expensive, even for people who would like to.
- aussieshibe 4y ago
  Asking from a place of ignorance, not argument: Is opting out of physical location tracking expensive? I just checked on my Pixel and was able to find a setting which ostensibly can disable location services after a few seconds of searching through settings. What am I missing here?
  - supertrope 4y ago
    You'll need to turn off the cellular modem to prevent network level location triangulation. At which point it's not really a cellphone any more.
  - jasonjayr 4y ago
    Even if you shut off GPS, your cell provider can trivially triangulate your position with acceptable precision based on your signal strength and ping response times. (Also, many Cell Service Providers have a backchannel API that websites can use to geolocate the source of a connection given an IP + Port)
alexhsamuel 4y ago
What if every restaurant within 50 miles of your home required a jacket to eat (or take out) from there... and also required that you had purchased that jacket from the very same restaurant, at a 30% markup?
- googlryas 4y ago
  Then I would probably start cooking more often.
aussieshibe 4y ago
I don't like knowing that my image is recorded by surveillance cameras when I go out in public. A few decades ago someone might have said, "Well, you can choose to just not go to those places which have surveillance cameras," and that would have been a perfectly valid suggestion to solve my immediate problem at the time. A few decades later, in 2022, the city that I live in has cameras and facial recognition everywhere. Avoiding them means never going to the supermarket, visiting the CBD, driving practically anywhere. I don't think the hypothetical person was a shill for "Big Camera". It seems much more likely that they don't believe or haven't considered the possibility that proliferation of surveillance could lead to a future where stepping out your front door will result in your image being sent to Amazon by your neighbours doorbell. Or that they're fine with that future, but have no sympathy for people who aren't I guess.
- googlryas 4y ago
  - aussieshibe 4y ago
    You are, of course, welcome to make whatever judgement you like about my preferences. "Abnormal psychology" seems a bit extreme though.
    - userbinator 4y ago
      Because to them, what they want "normal psychology" to be is a docile, obedient, bootlicking sheep.
Schroedingersat 4y ago
> Here's my personal take: No one is forced to use remote attestation merely to use their device. It's only if you want to use some other service. So - if you don't want to play by the requirements of the service, then just don't use the service? Completely and utterly disingenuously wrong. Safetynet is already required for most banks, and this will be followed by medical and government services and all forms of media. This free market 'vote with your wallet' bullcrap only works if there's an alternative to vote for.
- googlryas 4y ago
  Please reread my statement. Safetynet may be required if you want to use online banking for most banks. If you don't want to use online banking, then you aren't subject to the requirements for safetynet, and you're free to roll your own android.
  - Schroedingersat 4y ago
    I read your statement. It's still disingenuous nonsense. And what happens when all the physical branches within 100s of km of you shut down because 'online is so convenient' or your doctor starts using an app that requires it, or it's mandatory to do your university exam or log into your government's tax portal or the next covid where you need it to enter a shop? Or what about when every piece of hardware you can buy has a locked bootloader, or your local phone providers decide to require using their app that puts ads on your lock screen? Or your local taxis get price dumped out of business by uber which requires it?
    - userbinator 4y ago
      It's still disingenuous nonsense. How interesting that my original comment which called them out on this blatant shilling has been flagged. While it's not traditional politics, it certainly gives one an appreciation for the effort with which they're attempting to hide their true motives.
    - charcircuit 4y ago
zmmmmm 4y ago
> Simply not eat at that country club Your argument boils down to trivialising the imposition to the victim not being able to use a service. How do you justify the presumption that it's trivial? What if I need the service to access health care, a bank account, education, welfare etc? What if there aren't alternatives? And as victims of discrimination everywhere will say, why should I have to sacrifice things even if you think they are trivial, just because I have a preference? The real argument should be around what is the legitimate need for attestation. Where there is a genuine need then a discussion could be had. For example, if it will threaten the bank's security or liabilities (not mine) then its reasonable for them to at least evaluate the cost of me not providing that attestation and building it into their estimate of the cost of transacting with me (even up to the point of not doing business with me). That doesn't seem to be the discussion people want to have though.
- salawat 4y ago
  Everything we've done as a society up until now has not needed remote attestation. That we aren't yet in a computational dystopia is proof that enough that the privation of it has kept computing safe from getting so locked in that nobody can compete or navigate the barriers to entry. As soon as we start seeing remote attestation fetting implemented, that's gone. Period.

game-of-throws 4y ago

The danger is one day there might be no options that don't require remote attestation on Windows and Chrome. Your bank doesn't allow Linux? Choose another bank! ... but what happens once every bank has those requirements?

ryukafalz 4y ago
Right, “just don’t use that service” rapidly becomes unreasonable when the service is your bank, the DMV, your university’s web portal, etc.
googlryas 4y ago
You can just bank in some other manner, like in person, or over the phone. You don't have a right to online banking on your mobile device. It's a convenience.
- dento 4y ago
  Sure, and you can grow all food yourself as well, grocery stores are a convenience as well.
  - googlryas 4y ago
    They are far less of a convenience and far more of a necessity than online banking is.
matheusmoreira 4y ago
I agree with you. In my country, almost every bank mandates that users install "online security modules" on their own computers before they'll allow them to log into their account via browser. These software packages were causing massive instability and low performance on the computers of everyone I know. I reverse engineered one of these things and found kernel mode software intercepting every single network connection and doing god knows what with that information. "Just choose a company that doesn't abuse you" is absolutely invalid since abusing us gives them competitive advantage and they will compete to see who can get away with abusing us the most. Abuse should simply be illegal and the companies doing it shouldn't even be afforded the right to exist to begin with. People should not have to suffer abuse in order to learn their lesson and go elsewhere, abuse should simply not happen to begin with and any corporation violating this assumption needs to get fined out of existence.

no_time 4y ago

>There's a country club that I want to eat in, but they require me to wear a suit jacket. Bad example. Remote attestation is more like ordering takeout to eat in your own home but the delivery guy refusing to hand you the food you ordered unless you provide cryptographic proof that you will be eating while doing a handstand. Nevermind the fact that It's none of his business how you eat in your own house.

googlryas 4y ago
Ok, much better analogy. But it still points to a simple solution: Just don't order food from those people.
- dento 4y ago
  The solution is ok while you have options. But when all banks require attestation to access your account, you can no longer choose.

userbinator 4y ago

The "use/build your own something else" argument is no longer valid when the ones imposing such requirements have effectively become a monopoly.

googlryas 4y ago
Can you name a single important service that will use this technology which has a monopoly on that type of service, where there is no alternative?
- matheusmoreira 4y ago
  Everything on every single app store in existence today. Even Android apps now have the ability to require hardware attestation and lock out access to rooted phones.
  - charcircuit 4y ago
    No app store forces remote attestation. Some offer APIs to do it.
    - matheusmoreira 4y ago
      And eventually everything essential will be using those APIs and we'll be locked out.

manimino 4y ago

We all carry GPS trackers that send our personal info to large companies constantly. This has been normalized to the point where opting out is too expensive, even for people who would like to.

aussieshibe 4y ago
Asking from a place of ignorance, not argument: Is opting out of physical location tracking expensive? I just checked on my Pixel and was able to find a setting which ostensibly can disable location services after a few seconds of searching through settings. What am I missing here?
- supertrope 4y ago
  You'll need to turn off the cellular modem to prevent network level location triangulation. At which point it's not really a cellphone any more.
- jasonjayr 4y ago
  Even if you shut off GPS, your cell provider can trivially triangulate your position with acceptable precision based on your signal strength and ping response times. (Also, many Cell Service Providers have a backchannel API that websites can use to geolocate the source of a connection given an IP + Port)

alexhsamuel 4y ago

What if every restaurant within 50 miles of your home required a jacket to eat (or take out) from there... and also required that you had purchased that jacket from the very same restaurant, at a 30% markup?

googlryas 4y ago
Then I would probably start cooking more often.

aussieshibe 4y ago

I don't like knowing that my image is recorded by surveillance cameras when I go out in public. A few decades ago someone might have said, "Well, you can choose to just not go to those places which have surveillance cameras," and that would have been a perfectly valid suggestion to solve my immediate problem at the time. A few decades later, in 2022, the city that I live in has cameras and facial recognition everywhere. Avoiding them means never going to the supermarket, visiting the CBD, driving practically anywhere. I don't think the hypothetical person was a shill for "Big Camera". It seems much more likely that they don't believe or haven't considered the possibility that proliferation of surveillance could lead to a future where stepping out your front door will result in your image being sent to Amazon by your neighbours doorbell. Or that they're fine with that future, but have no sympathy for people who aren't I guess.

googlryas 4y ago
- aussieshibe 4y ago
  You are, of course, welcome to make whatever judgement you like about my preferences. "Abnormal psychology" seems a bit extreme though.
  - userbinator 4y ago
    Because to them, what they want "normal psychology" to be is a docile, obedient, bootlicking sheep.

Schroedingersat 4y ago

> Here's my personal take: No one is forced to use remote attestation merely to use their device. It's only if you want to use some other service. So - if you don't want to play by the requirements of the service, then just don't use the service? Completely and utterly disingenuously wrong. Safetynet is already required for most banks, and this will be followed by medical and government services and all forms of media. This free market 'vote with your wallet' bullcrap only works if there's an alternative to vote for.

googlryas 4y ago
Please reread my statement. Safetynet may be required if you want to use online banking for most banks. If you don't want to use online banking, then you aren't subject to the requirements for safetynet, and you're free to roll your own android.
- Schroedingersat 4y ago
  I read your statement. It's still disingenuous nonsense. And what happens when all the physical branches within 100s of km of you shut down because 'online is so convenient' or your doctor starts using an app that requires it, or it's mandatory to do your university exam or log into your government's tax portal or the next covid where you need it to enter a shop? Or what about when every piece of hardware you can buy has a locked bootloader, or your local phone providers decide to require using their app that puts ads on your lock screen? Or your local taxis get price dumped out of business by uber which requires it?
  - userbinator 4y ago
    It's still disingenuous nonsense. How interesting that my original comment which called them out on this blatant shilling has been flagged. While it's not traditional politics, it certainly gives one an appreciation for the effort with which they're attempting to hide their true motives.
  - charcircuit 4y ago

zmmmmm 4y ago

> Simply not eat at that country club Your argument boils down to trivialising the imposition to the victim not being able to use a service. How do you justify the presumption that it's trivial? What if I need the service to access health care, a bank account, education, welfare etc? What if there aren't alternatives? And as victims of discrimination everywhere will say, why should I have to sacrifice things even if you think they are trivial, just because I have a preference? The real argument should be around what is the legitimate need for attestation. Where there is a genuine need then a discussion could be had. For example, if it will threaten the bank's security or liabilities (not mine) then its reasonable for them to at least evaluate the cost of me not providing that attestation and building it into their estimate of the cost of transacting with me (even up to the point of not doing business with me). That doesn't seem to be the discussion people want to have though.

salawat 4y ago
Everything we've done as a society up until now has not needed remote attestation. That we aren't yet in a computational dystopia is proof that enough that the privation of it has kept computing safe from getting so locked in that nobody can compete or navigate the barriers to entry. As soon as we start seeing remote attestation fetting implemented, that's gone. Period.