3 ms·

> Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. Is the first part even tru

> Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. Is the first part even true? It does seem to me that there are a class of tasks, the most obvious being competitive video games, that do require that the user not have complete control over the hardware and software they're using.

altairprime 4y ago
It is absolutely possible to fully implement an open source hardware stack that builds up from an HSM secure store into a UEFI secure boot chained ti a signed, reproducible-buildable Linux kernel that can launch signed, reproducible-buildable applications and attest, with cryptographic signatures chaining from the hardware HSM clear to the kernel to the application. This is wildly unpalatable, but it’s already fully implemented and available on macOS and enterprise Windows 10+ today. (Seriously: Safari can, on stock macOS, attest to a website that you’re booted securely into an unmodified Apple kernel and OS, so long as your motherboard has the HSM boot chip.) Whether this system is implemented as closed source or as open source is wholly irrelevant to secure attestation, which could be done exactly as it is today even if the complete source code were available. The difficulty is that, for anti-cheat, someone other than the user must have signed the key inside the HSM, or else it can’t be trusted to be unmodified. This is why Secure Boot with Attestation, and the entire objection to Microsoft Proton, turns out to be about repurposeability — people want the right to repurpose hardware without a third-party services, such as anti-cheating checks, being able to exclude them based on their modifications. That’s not about open source at all. That debate is not about open source, and with the advent of widespread secure attestation computing, it’s overdue for serious conversations.
- smoldesu 4y ago
  > people want the right to repurpose hardware without a third-party services Is that wrong? Third-party services are temporary. Hardware lasts forever. If hardware attestation comes at the cost of ephemerally-usable hardware, it's not worth it. It's certainly not worth forcing it onto devices that would otherwise be usable, but instead become landfill because their previous IT team went insolvent. People can (and should) get mad at this, and doing so with the Open Source community is not a mistake. Open Source represents leverage (AKA "Freedom") against corporations that would otherwise harm you for profit. You can excuse this behavior with all sorts of DRM and anticheat, but you'll never win until the kernel stops processing digital input and output. It's a snipe chase, and it's not worth pretending it's not a power grab.
  - altairprime 4y ago
    Whether repurposeability should take precedence over secure attestation and antitheft is the correct question here. I’m glad to see you’re considering this in those terms now. I hope others do too. Note, however, that as Apple takes back all products they’ve ever produced for electronics recycling, in each case where an Apple product does reach a landfill, that could have been avoided. If, as in your example, an IT department refuses to recycle Apple electronics responsibly, then that’s not sufficient to declare repurposeability a landfill-prevention measure. So I worry greatly when I see such arguments refer to Apple and landfills, because they’re easily undercut, and that’s then used as an excuse to ignore the repurposeability debate I that I consider most important here.
    - deleted 4y ago
      [deleted]
    - smoldesu 4y ago
      Your repurposability debate is right to be ignored. Apple does not deserve the ultimate authority on device usability; case closed. If you want further deliberation, watch European regulators do battle with Apple's copywriters. Either way you cut it, this fantasy of Apple products being "built different" doesn't make sense on an international scale. People want to hold Apple (the world's richest company) accountable. Why shouldn't they?
      - altairprime 4y ago
        I’d absolutely like this to be decided at a regulatory level one way or another, and I support Apple being compelled to adhere to whatever outcomes occur from that. Using this “Apple products in landfill” sensational headline to make the regulatory case is easily defeated by Apple PR, however, so find an argument that holds more water. For example: what’s the recycling story for Microsoft, Samsung, Google, and Lenovo handheld and laptop products? Do they all take back any of their mobile computing products for recycling? If not, using whichever of them refuse to recycle as an example will go a lot further towards making a case for regulation than using the one of them that takes back absolutely everything.
- tshaddox 4y ago
  Then isn’t the HSM just the part of your hardware that you don’t control? Isn’t that the complaint?
  - altairprime 4y ago
    You would still absolutely control the HSM, in this example, and whether you installed an HSM provided by a third-party or your own would be entirely your choice. It’s just another open source hardware component. Microsoft could release the source code to the Pluton HSM and it would still be just as effective at secure attestation. If you want Microsoft’s online gaming services to trust your computing environment in ranked competitive play, then you may find that booting with a self-signed certificate in your HSM isn’t sufficient for them to allow you into ranked play; they might choose to require a Pluton HSM. That has nothing to do with “open source”, though; the signing keys stored in an HSM’s secure vault are not part of its schematic or software source code, any more than the SSL certificate for a Wordpress blog hosted on Linux is part of the Wordpress or Linux source code.

altairprime 4y ago

It is absolutely possible to fully implement an open source hardware stack that builds up from an HSM secure store into a UEFI secure boot chained ti a signed, reproducible-buildable Linux kernel that can launch signed, reproducible-buildable applications and attest, with cryptographic signatures chaining from the hardware HSM clear to the kernel to the application. This is wildly unpalatable, but it’s already fully implemented and available on macOS and enterprise Windows 10+ today. (Seriously: Safari can, on stock macOS, attest to a website that you’re booted securely into an unmodified Apple kernel and OS, so long as your motherboard has the HSM boot chip.) Whether this system is implemented as closed source or as open source is wholly irrelevant to secure attestation, which could be done exactly as it is today even if the complete source code were available. The difficulty is that, for anti-cheat, someone other than the user must have signed the key inside the HSM, or else it can’t be trusted to be unmodified. This is why Secure Boot with Attestation, and the entire objection to Microsoft Proton, turns out to be about repurposeability — people want the right to repurpose hardware without a third-party services, such as anti-cheating checks, being able to exclude them based on their modifications. That’s not about open source at all. That debate is not about open source, and with the advent of widespread secure attestation computing, it’s overdue for serious conversations.

smoldesu 4y ago
> people want the right to repurpose hardware without a third-party services Is that wrong? Third-party services are temporary. Hardware lasts forever. If hardware attestation comes at the cost of ephemerally-usable hardware, it's not worth it. It's certainly not worth forcing it onto devices that would otherwise be usable, but instead become landfill because their previous IT team went insolvent. People can (and should) get mad at this, and doing so with the Open Source community is not a mistake. Open Source represents leverage (AKA "Freedom") against corporations that would otherwise harm you for profit. You can excuse this behavior with all sorts of DRM and anticheat, but you'll never win until the kernel stops processing digital input and output. It's a snipe chase, and it's not worth pretending it's not a power grab.
- altairprime 4y ago
  Whether repurposeability should take precedence over secure attestation and antitheft is the correct question here. I’m glad to see you’re considering this in those terms now. I hope others do too. Note, however, that as Apple takes back all products they’ve ever produced for electronics recycling, in each case where an Apple product does reach a landfill, that could have been avoided. If, as in your example, an IT department refuses to recycle Apple electronics responsibly, then that’s not sufficient to declare repurposeability a landfill-prevention measure. So I worry greatly when I see such arguments refer to Apple and landfills, because they’re easily undercut, and that’s then used as an excuse to ignore the repurposeability debate I that I consider most important here.
  - deleted 4y ago
    [deleted]
  - smoldesu 4y ago
    Your repurposability debate is right to be ignored. Apple does not deserve the ultimate authority on device usability; case closed. If you want further deliberation, watch European regulators do battle with Apple's copywriters. Either way you cut it, this fantasy of Apple products being "built different" doesn't make sense on an international scale. People want to hold Apple (the world's richest company) accountable. Why shouldn't they?
    - altairprime 4y ago
      I’d absolutely like this to be decided at a regulatory level one way or another, and I support Apple being compelled to adhere to whatever outcomes occur from that. Using this “Apple products in landfill” sensational headline to make the regulatory case is easily defeated by Apple PR, however, so find an argument that holds more water. For example: what’s the recycling story for Microsoft, Samsung, Google, and Lenovo handheld and laptop products? Do they all take back any of their mobile computing products for recycling? If not, using whichever of them refuse to recycle as an example will go a lot further towards making a case for regulation than using the one of them that takes back absolutely everything.
tshaddox 4y ago
Then isn’t the HSM just the part of your hardware that you don’t control? Isn’t that the complaint?
- altairprime 4y ago
  You would still absolutely control the HSM, in this example, and whether you installed an HSM provided by a third-party or your own would be entirely your choice. It’s just another open source hardware component. Microsoft could release the source code to the Pluton HSM and it would still be just as effective at secure attestation. If you want Microsoft’s online gaming services to trust your computing environment in ranked competitive play, then you may find that booting with a self-signed certificate in your HSM isn’t sufficient for them to allow you into ranked play; they might choose to require a Pluton HSM. That has nothing to do with “open source”, though; the signing keys stored in an HSM’s secure vault are not part of its schematic or software source code, any more than the SSL certificate for a Wordpress blog hosted on Linux is part of the Wordpress or Linux source code.