3 ms·

Exactly. In particular, see the "Powerful, Reliable Software Can Be Bad" section of <https://www.gnu.org/philosophy/open-source-misses-the-point.en.html https:/

Exactly. In particular, see the "Powerful, Reliable Software Can Be Bad" section of <https://www.gnu.org/philosophy/open-source-misses-the-point.en.html https://www.gnu.org/philosophy/open-source-misses-the-point....>. It'll take careful engineering to keep this from being useful for DRM, which I'm worried won't get done.

mindslight 4y ago
Actually even with the requirements I laid out, DRM would still work. A manufacturer could ship a device with decryption keys for DRM content. If the end-owner decided to liberate their device, then the decryption keys would be erased and DRM content could no longer be played. The owner would be left with a blank device ready to accept new software, likely open source, and the device wouldn't be relegated to becoming e-waste.
- p_l 4y ago
  That's how it works with some of the hw backed DRM schemes that for example try to use remote Attestation with TPM, or secure media pathways on intel me or AMD PSP. The DRM software simply stops working, while you get to run everything you build yourself still.
- cryptonector 4y ago
  There's no stopping walled gardens -- not with technology as the vendors would choose not to use such technology. The most choice users will ever get to make (per-device) is whether to be locked-into or locked-out-of the walled gardens.
- josephcsible 4y ago
  Huh, good point. I wonder how that would be fixable too.
  - mindslight 4y ago
    Does it need to be? I'm a staunch supporter of libre software, but I don't see the harm.
    - mschuster91 4y ago
      > I'm a staunch supporter of libre software, but I don't see the harm. The harm is we're still perpetuating DRM crap. The music industry has accepted that Spotify's DRM can be trivially broken and completely given up trying to police BitTorrent... it's time for the movie industry to realize the same. Sadly, Netflix failed to get enough dominance to bend over and cane the movie industry into submission, and regulatory agencies worldwide just accepted happily that movie studios went all-in on vertical integration again.
      - mindslight 4y ago
        The concept of DRM was initially created on general purpose open computers. No TPM, no code signing, no remote attestation. Just plain old proprietary software running on open systems was enough to create something with DRM functionality, and put blood in the water for the control freaks. Having a device be able to store and use secure keying material that cannot be read back out seems like a very useful basic property. A basic property which directly implies being able to store keys for decrypting media content, thus making for a better DRM scheme than could be achieved with a fully-debugger-able processor. Of course, I could missing a way that this property could tweaked to neutralize some of its downsides - akin to how my original comment laid out slight modifications to the usual TPM/SE requirements that would prevent much abuse of TPMs/SEs by centralizing entities.
  - cryptonector 4y ago
    It can't be "fixed" with technology. It's a matter of market power, and maybe legislation.
    - EMIRELADERO 4y ago
      The fix would be to make "persons who choose to gain full control and code execution of the device" a protected class.
cryptonector 4y ago
The TCG got this right in that TPMs do not force you into a DRM world, but they certainly enable it. I say that's right because any TPM-like technology that could let you secure boot could also let the platform vendor lock you into a DRM world -or lock you out of the walled garden if you opt out- but the TCG took a neutral approach that lets the user opt out.
- p_l 4y ago
  By making it only possible to verify that you run on certain stack (which enforces your DRM) they made a very simple but powerful scheme that doesn't in fact infringe on users rights (No matter what FSF's FUD campaign said)
  - cryptonector 4y ago
    There's more to it. A TPM comes with an endorsement key certificate, and the platform to which the TPM is attached can come with platform certificates, and the OS can require those to exist and be valid and that the TPM still have the corresponding private keys. An OS can use those keys and certificates to implement a garden walled by secured boot + attestation. The user gets to change the relevant key hierarchy seeds, thus causing those private keys to no longer be available, and those certificates to be useless, and the OS to no longer be able to do attestation using those keys and certificates -- but then the OS vendor gets to lock that device out of the walled garden.
  - mindslight 4y ago
    > they made a very simple but powerful scheme that doesn't in fact infringe on users rights This is straight up false in the standard model where protocols are what mediates between otherwise-independent parties. If a remote party can verify the software I am running on my machine against my wishes, that creates a security vulnerability that prevents me from running software of my choice.
    - cryptonector 4y ago
      > > they [the TCG] made a very simple but powerful scheme that doesn't in fact infringe on users rights > This is straight up false in the standard model where protocols are what mediates between otherwise-independent parties. I've answered this elsewhere. TPMs are neutral technology enabling technology that you might approve of and technology you might disapprove of. > If a remote party can verify the software I am running on my machine against my wishes, that creates a security vulnerability that prevents me from running software of my choice. TPMs do not prevent you from having opt-out. The matter of whether someone can give you only a binary choice of opting into or out of walled gardens is a market/political problem. I don't see how to prevent walled gardens using technology, especially when walled gardens vendors can make it so you can only access the walled gardens on devices that they manufacture (or bless) -- it's their tech, so what can you do to make it not possible for them to implement lock-in? It's just not possible.

mindslight 4y ago

Actually even with the requirements I laid out, DRM would still work. A manufacturer could ship a device with decryption keys for DRM content. If the end-owner decided to liberate their device, then the decryption keys would be erased and DRM content could no longer be played. The owner would be left with a blank device ready to accept new software, likely open source, and the device wouldn't be relegated to becoming e-waste.

p_l 4y ago
That's how it works with some of the hw backed DRM schemes that for example try to use remote Attestation with TPM, or secure media pathways on intel me or AMD PSP. The DRM software simply stops working, while you get to run everything you build yourself still.
cryptonector 4y ago
There's no stopping walled gardens -- not with technology as the vendors would choose not to use such technology. The most choice users will ever get to make (per-device) is whether to be locked-into or locked-out-of the walled gardens.
josephcsible 4y ago
Huh, good point. I wonder how that would be fixable too.
- mindslight 4y ago
  Does it need to be? I'm a staunch supporter of libre software, but I don't see the harm.
  - mschuster91 4y ago
    > I'm a staunch supporter of libre software, but I don't see the harm. The harm is we're still perpetuating DRM crap. The music industry has accepted that Spotify's DRM can be trivially broken and completely given up trying to police BitTorrent... it's time for the movie industry to realize the same. Sadly, Netflix failed to get enough dominance to bend over and cane the movie industry into submission, and regulatory agencies worldwide just accepted happily that movie studios went all-in on vertical integration again.
    - mindslight 4y ago
      The concept of DRM was initially created on general purpose open computers. No TPM, no code signing, no remote attestation. Just plain old proprietary software running on open systems was enough to create something with DRM functionality, and put blood in the water for the control freaks. Having a device be able to store and use secure keying material that cannot be read back out seems like a very useful basic property. A basic property which directly implies being able to store keys for decrypting media content, thus making for a better DRM scheme than could be achieved with a fully-debugger-able processor. Of course, I could missing a way that this property could tweaked to neutralize some of its downsides - akin to how my original comment laid out slight modifications to the usual TPM/SE requirements that would prevent much abuse of TPMs/SEs by centralizing entities.
- cryptonector 4y ago
  It can't be "fixed" with technology. It's a matter of market power, and maybe legislation.
  - EMIRELADERO 4y ago
    The fix would be to make "persons who choose to gain full control and code execution of the device" a protected class.

cryptonector 4y ago

The TCG got this right in that TPMs do not force you into a DRM world, but they certainly enable it. I say that's right because any TPM-like technology that could let you secure boot could also let the platform vendor lock you into a DRM world -or lock you out of the walled garden if you opt out- but the TCG took a neutral approach that lets the user opt out.

p_l 4y ago
By making it only possible to verify that you run on certain stack (which enforces your DRM) they made a very simple but powerful scheme that doesn't in fact infringe on users rights (No matter what FSF's FUD campaign said)
- cryptonector 4y ago
  There's more to it. A TPM comes with an endorsement key certificate, and the platform to which the TPM is attached can come with platform certificates, and the OS can require those to exist and be valid and that the TPM still have the corresponding private keys. An OS can use those keys and certificates to implement a garden walled by secured boot + attestation. The user gets to change the relevant key hierarchy seeds, thus causing those private keys to no longer be available, and those certificates to be useless, and the OS to no longer be able to do attestation using those keys and certificates -- but then the OS vendor gets to lock that device out of the walled garden.
- mindslight 4y ago
  > they made a very simple but powerful scheme that doesn't in fact infringe on users rights This is straight up false in the standard model where protocols are what mediates between otherwise-independent parties. If a remote party can verify the software I am running on my machine against my wishes, that creates a security vulnerability that prevents me from running software of my choice.
  - cryptonector 4y ago
    > > they [the TCG] made a very simple but powerful scheme that doesn't in fact infringe on users rights > This is straight up false in the standard model where protocols are what mediates between otherwise-independent parties. I've answered this elsewhere. TPMs are neutral technology enabling technology that you might approve of and technology you might disapprove of. > If a remote party can verify the software I am running on my machine against my wishes, that creates a security vulnerability that prevents me from running software of my choice. TPMs do not prevent you from having opt-out. The matter of whether someone can give you only a binary choice of opting into or out of walled gardens is a market/political problem. I don't see how to prevent walled gardens using technology, especially when walled gardens vendors can make it so you can only access the walled gardens on devices that they manufacture (or bless) -- it's their tech, so what can you do to make it not possible for them to implement lock-in? It's just not possible.