3 ms·
Right now it's just defence in depth, to protect you if Amazon screws up their physical security. It will make more sense as confidential computing[1] becomes
by rwmj 4y ago
Right now it's just defence in depth, to protect you if Amazon screws up their physical security. It will make more sense as confidential computing[1] becomes more common. This is because the data can't be accessed by the cloud vendor, assuming the key is generated inside the trusted VM.
[1] The trust moves to the CPU vendors instead of the cloud vendors, but if you don't trust CPU vendors then you're going to have a hard time doing anything with computers in the modern world.
- cyberpunk 4y agoIs there any tooling you’re aware of in this space? I know of one small group in Europe making something but it’s closed source..
- rwmj 4y agoAttestation is a big mess right now, but there's a consortium working on it, with Red Hat involved: https://www.redhat.com/en/blog/what-confidential-containers-project https://www.redhat.com/en/blog/what-confidential-containers-... https://www.redhat.com/en/blog/understanding-confidential-containers-attestation-flow https://www.redhat.com/en/blog/understanding-confidential-co... (Note confidential containers builds on top of confidential hardware VMs)