3 ms·

> don't support owner override Asus talks about how to disable it: https://www.asus.com/support/FAQ/1047459/ https://www.asus.com/support/FAQ/1047459/ As do

> don't support owner override Asus talks about how to disable it: https://www.asus.com/support/FAQ/1047459/ https://www.asus.com/support/FAQ/1047459/ As do many other manufacturers, its a thing.

josephcsible 4y ago
You misunderstand what owner override is. It's not the ability to disable the TPM from functioning. It's having a way to tell the TPM to attest "yes, this system is totally running Microsoft/Hollywood-approved software" when it really isn't, if that's what the owner wants it to do.
- worthless-trash 4y ago
  I must misunderstand what override. Wouldn't the "override" term in this case be better served as being called "customised validated attestation state" ? Its doesn't roll of the tongue but correct terms matter.
- jdoss 4y ago
  Then don't run that software or don't buy that hardware in the first place? There are plenty of options here. A TPMs main role in our current hardware ecosystem is to provide device identity and attestation. This has been driven by businesses that want an easier time to bootstrap hardware for their needs. Which means controlling what software is run on company owned hardware. All of the FUD about lost of hardware freedom comes some from the fact that IT teams were tired of having to keep inventory and they needed a solution to enable the on boarding and off boarding of hardware. Look at what Apple is doing with their hardware and OS right now. It's not to take away more individual freedoms of their users. It is to help businesses and edu manage their Apple stuff stuff. The other vendors are trying to fix those pain points too. Managed device attestation is the SBOM new new hotness of 2023 and you don't need to be a big business to take advantage of it. Go look up what kind of cool things you can do with a TPM. For example https://systemd.io/CREDENTIALS/ https://systemd.io/CREDENTIALS/ is pretty cool. So is using it to make your life easier with LUKS encrypted volumes. https://gist.github.com/jdoss/777e8b52c8d88eb87467935769c98a95 https://gist.github.com/jdoss/777e8b52c8d88eb87467935769c98a...
  - selfhoster11 4y ago
    The “vote with your feet” argument has always been BS. The trend is overwhelmingly towards the introduction of DRM. It may be that there are options now, but soon there won’t be any.
  - matheusmoreira 4y ago
    > Then don't run that software or don't buy that hardware in the first place? There are plenty of options here. Yeah, right. Just don't use any proprietary software. Just don't use any mobile app. Just don't buy any mainstream hardware and products. Enjoy all those ridiculously old FSF RYF certified laptops that won't run anything requiring the latest cryptographic user control features anyway. How in the world is this a solution? These corporations should be forced by law not to do this stuff. The hardware and software should be open and free and they should have no choice but to run on it on our terms if they want to reach customers at all. > Look at what Apple is doing with their hardware and OS right now. It's not to take away more individual freedoms of their users. You gotta be kidding me. It is literally impossible for a user to run software on an iOS device without Apple digitally signing it. "Manage their Apple stuff"? What a bunch of BS. More like create their own digital fiefdom where they own users, determine what they can and can't do and sell access to them to third party developers like they were cattle. You said it yourself, it's about "controlling what software is run on company owned hardware". We don't own these devices, the companies do. There is no freedom to be had here, we're all playing on their playgrounds.
    - KatrKat 4y ago
      Not all proprietary software currently insists that you get into a TPM-mediated Dom/sub relationship with its developers. Its currently possible, and might be ethically necessary, not to buy those ones, and instead to buy the other ones. But it's also probably important to pursue a political avenue as well. The government should absolutely not be using this stuff, and shouldn't be advising citizens to do it to access government services. We could even pass a law requiring purchased hardware and software to meet a fiduciary standard towards its users.
    - jdoss 4y ago
- matheusmoreira 4y ago
  Yeah. There's little point in overriding anything since these days everything requires remote attestation that software hasn't been "tampered with". What good is installing custom software if the applications we need refuse to run because we "tampered" with stuff?
- sokoloff 4y ago
  I can see why people would want that, but I can also see why people would want to have an additional certified copy of an important document, artwork, or piece of sports memorabilia, if that’s what the owner of that object wants.
  - matheusmoreira 4y ago
    > certified copy of an important document, artwork, or piece of sports memorabilia, if that’s what the owner of that object wants I don't see how this is relevant. Real world objects can't be exactly duplicated, certificates of authenticity make sense in that context. Data is just bits, any copy will be exact reproductions. There is no need to certify that.
    - sokoloff 4y ago
      If you had an exact copy of the data/OS/config of the system in question, it would obviously validate (properly) as being unmodified. What this thread is discussing is modified copies validating as unmodified copies.
      - matheusmoreira 4y ago
        Yes but I don't see how that's in any way comparable to wanting a certified collector's item. Validating our software as unmodified is really just digital oppression. It's a violation of our dignity as users and human beings. We have all these corporations shipping literal data harvesting and advertisement displaying malware and there's not a thing we can do about it because they have usurped control of our computers. Who does this "validation" serve? Not us. It serves the "stakeholders". It gives them confidence that we won't be running software that harms their interests.

> don't support owner override Asus talks about how to disable it: https://www.asus.com/support/FAQ/1047459/ https://www.asus.com/support/FAQ/1047459/ As do many other manufacturers, its a thing.

josephcsible 4y ago

You misunderstand what owner override is. It's not the ability to disable the TPM from functioning. It's having a way to tell the TPM to attest "yes, this system is totally running Microsoft/Hollywood-approved software" when it really isn't, if that's what the owner wants it to do.

worthless-trash 4y ago
I must misunderstand what override. Wouldn't the "override" term in this case be better served as being called "customised validated attestation state" ? Its doesn't roll of the tongue but correct terms matter.
jdoss 4y ago
Then don't run that software or don't buy that hardware in the first place? There are plenty of options here. A TPMs main role in our current hardware ecosystem is to provide device identity and attestation. This has been driven by businesses that want an easier time to bootstrap hardware for their needs. Which means controlling what software is run on company owned hardware. All of the FUD about lost of hardware freedom comes some from the fact that IT teams were tired of having to keep inventory and they needed a solution to enable the on boarding and off boarding of hardware. Look at what Apple is doing with their hardware and OS right now. It's not to take away more individual freedoms of their users. It is to help businesses and edu manage their Apple stuff stuff. The other vendors are trying to fix those pain points too. Managed device attestation is the SBOM new new hotness of 2023 and you don't need to be a big business to take advantage of it. Go look up what kind of cool things you can do with a TPM. For example https://systemd.io/CREDENTIALS/ https://systemd.io/CREDENTIALS/ is pretty cool. So is using it to make your life easier with LUKS encrypted volumes. https://gist.github.com/jdoss/777e8b52c8d88eb87467935769c98a95 https://gist.github.com/jdoss/777e8b52c8d88eb87467935769c98a...
- selfhoster11 4y ago
  The “vote with your feet” argument has always been BS. The trend is overwhelmingly towards the introduction of DRM. It may be that there are options now, but soon there won’t be any.
- matheusmoreira 4y ago
  > Then don't run that software or don't buy that hardware in the first place? There are plenty of options here. Yeah, right. Just don't use any proprietary software. Just don't use any mobile app. Just don't buy any mainstream hardware and products. Enjoy all those ridiculously old FSF RYF certified laptops that won't run anything requiring the latest cryptographic user control features anyway. How in the world is this a solution? These corporations should be forced by law not to do this stuff. The hardware and software should be open and free and they should have no choice but to run on it on our terms if they want to reach customers at all. > Look at what Apple is doing with their hardware and OS right now. It's not to take away more individual freedoms of their users. You gotta be kidding me. It is literally impossible for a user to run software on an iOS device without Apple digitally signing it. "Manage their Apple stuff"? What a bunch of BS. More like create their own digital fiefdom where they own users, determine what they can and can't do and sell access to them to third party developers like they were cattle. You said it yourself, it's about "controlling what software is run on company owned hardware". We don't own these devices, the companies do. There is no freedom to be had here, we're all playing on their playgrounds.
  - KatrKat 4y ago
    Not all proprietary software currently insists that you get into a TPM-mediated Dom/sub relationship with its developers. Its currently possible, and might be ethically necessary, not to buy those ones, and instead to buy the other ones. But it's also probably important to pursue a political avenue as well. The government should absolutely not be using this stuff, and shouldn't be advising citizens to do it to access government services. We could even pass a law requiring purchased hardware and software to meet a fiduciary standard towards its users.
  - jdoss 4y ago
matheusmoreira 4y ago
Yeah. There's little point in overriding anything since these days everything requires remote attestation that software hasn't been "tampered with". What good is installing custom software if the applications we need refuse to run because we "tampered" with stuff?
sokoloff 4y ago
I can see why people would want that, but I can also see why people would want to have an additional certified copy of an important document, artwork, or piece of sports memorabilia, if that’s what the owner of that object wants.
- matheusmoreira 4y ago
  > certified copy of an important document, artwork, or piece of sports memorabilia, if that’s what the owner of that object wants I don't see how this is relevant. Real world objects can't be exactly duplicated, certificates of authenticity make sense in that context. Data is just bits, any copy will be exact reproductions. There is no need to certify that.
  - sokoloff 4y ago
    If you had an exact copy of the data/OS/config of the system in question, it would obviously validate (properly) as being unmodified. What this thread is discussing is modified copies validating as unmodified copies.
    - matheusmoreira 4y ago
      Yes but I don't see how that's in any way comparable to wanting a certified collector's item. Validating our software as unmodified is really just digital oppression. It's a violation of our dignity as users and human beings. We have all these corporations shipping literal data harvesting and advertisement displaying malware and there's not a thing we can do about it because they have usurped control of our computers. Who does this "validation" serve? Not us. It serves the "stakeholders". It gives them confidence that we won't be running software that harms their interests.