11 ms·

Honestly TPM is probably creating more bad than good at this point. Every time I think about the millions of computers that will be declared worthless this yea

Honestly TPM is probably creating more bad than good at this point. Every time I think about the millions of computers that will be declared worthless this year, it makes me a little bit more angrier.

judge2020 3y ago
> Every time I think about the millions of computers that will be declared worthless this year, it makes me a little bit more angrier. What is this a reference to? Every computer I've found will let you boot into the bios and disable secure boot or add new keys to the trust store.
- r2_pilot 3y ago
  Microsoft is edging closer and closer to dropping support for Windows 10(even a computer I built in 2017 that's still running perfectly fine can't upgrade). But for many users, changing to another OS besides Windows is tantamount to not functioning, so planned obsolescence continues apace.
  - babypuncher 3y ago
    That's not happening until 2025, GP said "this year".
  - Workaccount2 3y ago
    I wish there was a linux distro made by people who love windows, not linux.
    - spsesk117 3y ago
      I've always felt that $BIG_BRAND_DISTRO+KDE got pretty close. It's still Linux, so not quite the same, but as far as look and feel, it's pretty close I think.
      - ilyt 3y ago
        I remember some videos where people pretended some KDE theme is how new windows version looks and people had no problems believing it.
    - somat 3y ago
      There is a aphorism. Bsd was made by people who love unix, linux was made by people who hate windows.
      - Aleklart 3y ago
        I think they hate unix, not windows, because they dragged all legacy nonsense unix had for hardware reasons straight into modern times so everyone can laugh on it.
    - asynchronous 3y ago
      If I may suggest, ZorinOS is about as close to windows on Linux as it gets. Found it through a HN comment myself.
    - PrimeMcFly 3y ago
      There have been several, but what makes Windows Windows is the ecosystem, and no distro can replicate that.
      - galangalalgol 3y ago
        What is that ecosystem now? What do households with windows use that isn't on the cloud?
        PrimeMcFly 3y ago
        A lot of stuff is moving to web/cloud stuff, but we are not there entirely. As one example, I had to take a proctored exam recently, and the only supported OS was Windows or MacOS. Linux was not an option. Then there is games, Proton is great but plenty of AAA titles are still not compatible. Just for starters.
        galangalalgol 3y ago
        Games for sure, the exam software is disappointing.
        officeplant 3y ago
        The problem with the cloud is how often I've run into blanket linux/bsd support bans. Especially when it comes to professional certifications done online. I had one website refusing to work on my FreeBSD or Debian installs. It would just get to a certain point and not let me proceed and multiple buttons refusing to work properly. Got on the phone with support and they were dumbfounded. Got the idea to just spoof my user agent as a windows box on edge and it worked perfectly afterwards. Even if not done on purpose there is a lot of crufty shit online that breaks in unsuspecting ways when I'm on a linux/BSD box. Especially if interfacing with the government websites and webapps. Our state fire code website looks straight out of 2002 and has multiple warnings about making sure to use IE6... in 2023. Maybe its just my use case (fire industry / local government), but it helps to have a mac or windows machine lying around as backup.
    - red-iron-pine 3y ago
      Use any Unbutu distribution with MATE or Cinnamon. Like shit dawg, I got my grandma using Linux Mint with MATE. Changed the background to match the same one on her old laptop and added some desktop icons, and boom 99% of her experience was the same. Had to help her a little with the LibreOffice -- that's a little different -- but otherwise functionally similar to Windows 7 / Win10. I'm using linux as a daily driver and at this point there isn't anything I can't do on Windows. The hold out for a while was games, but Proton w/ Steam works well and I can play big titles like Cyberpunk 2077.
    - xxpor 3y ago
      This is what I ran in 2002 or so: https://en.wikipedia.org/wiki/Linspire https://en.wikipedia.org/wiki/Linspire
    - MisterTea 3y ago
      Sounds like the last time you used Linux was 20 years ago. Linux been as easy as Windows to install and use for at least 10 years now. My mothers laptop runs Linux Mint and she doesn't know its not Windows even though the colors are all wrong. Why? It's all about the DE - if it looks like windows, walks like windows and quacks like windows, its windows. If she can click on the menu and find the internet then it's a win. Installation was was as easy as windows and everything worked out of the box. Hell, I installed the Chicago95 XFCE theme on my main system to see how well it emulated the look and feel of Windows 95 and wound up liking it. Why? Because even though it looks dated, the icons were immediately familiar and I felt navigation instantly become easier. Do not underestimate the power of familiarity. Many of us grew up on DOS/Windows playing games and typing school work up in Word so moving away from those familiar waters is HARD. It's like being an immigrant moving to a new country - you have to put in extra effort to learn to adjust to culture and language. Some can, some cant. YMMV.
  - doubled112 3y ago
    I did find it odd that my Ryzen 7 1700X (8 cores, 16 threads, 3.4GHz) was suddenly "not good enough" to run the OS.
    - bo1024 3y ago
      Really crystallizes how what matters is "good enough" for Microsoft's goals, not the user's.
    - tester756 3y ago
      Isn't this about Spectre/Meltdown vulns instead of the perf. specs?
      - CircleSpokes 3y ago
        IIRC it has more to do with that series of chip not having GMET (AMD Guest-Mode Execute Trap for NPT) which is used in Windows 10/11s virtualization based protection. Microsoft requires this option for all new PCs from their partners but you can install windows 11 and run it fine without this CPU feature (there is a performance hit if you leave virtualization based protection on though since it has to be done in software).
    - jeroenhd 3y ago
      It'll work fine, Microsoft even explains how to upgrade: https://support.microsoft.com/en-us/windows/installing-windows-11-on-devices-that-don-t-meet-minimum-system-requirements-0b2dc4a2-5933-4ad4-9c09-ef0a331518f1 https://support.microsoft.com/en-us/windows/installing-windo... They chose an arbitrary cut-off date for hardware support for their new OS. They decided not to support old stuff anymore and they had to pick a date/technology platform. It was always going to be arbitrary. In my opinion they should've picked a clearer distinction (i.e. require a certain level of AVX support so all binaries can be built with AVX optimizations enabled) but I can see why they chose to do this. After all, they're going to have to support the OS for ten years, that four year old CPU is fourteen years old by the time Windows 11 goes out of support.
      - 3y ago
  - reisse 3y ago
    Dropping support, so what? That does not make these PCs obsolescent in any way. People still use Windows 7, and even Windows XP. Especially in the many contexts where "security" is not important at all.
  - nly 3y ago
    You can install W11 without a TPM with a workaround. Microsoft should be forced to allow it by default.
  - criley2 3y ago
    Microsoft said they were ending support in 2025, which is what 8 year life for the OS? I don't even think Apple hits 8 for OSX updates. They obsolete the laptops more quickly than that, even if they do hit 6-7 years regularly.
    - daveoc64 3y ago
      Windows 10 was released in 2015, so they will have offered 10 years of support, which was the standard policy in place ever since Windows Vista (Windows Vista, 7, 8/8.1, 10). Apple does not support any macOS version for that long, and is unlikely to support a current version of macOS on any given device for that long.
      - Aleklart 3y ago
        You say “support” like the moment they stop it, OS cease to work. OSX Leopard is usable for most of tasks. Lot of people still running Windows 7 and Windows XP without any need for “support”. Windows 10 will be even better without constant “support” reboots. Can’t say this for Windows 11, as it so tightly stuffed with spyware and online integrations, it might just not boot if MS plug some server switch.
        daveoc64 3y ago
        I would not want to run an unsupported OS of any variety. Modern web browsers will stop working on older operating systems - so will other apps. Not only is it a massive security risk, but it will simply become impractical for most users. Besides, if you're afraid of the TPM vulnerability described in this article, you ought to be more worried about running an out of date OS!
        BlueTemplar 3y ago
        Windows 7 is only starting to get obsoleted now : while Microsoft is still updating it with critical security fixes, Qt and Chromium dropping it is pretty much the end for non-legacy usage. (Good bye Windows I guess...)
  - ekianjo 3y ago
    Don't reward them for that. The only solution is to move to another OS, that's the only thing they will ultimately understand - no matter how inconvenient it might be.
    - gambiting 3y ago
      That's not an option if you use your machine for work and your Dev tools only work on windows. PS5/Xbox toolchains only work on windows, as a gamedev I don't really have a choice.
      - ekianjo 3y ago
        You can always target other platforms and still make money as a gamedev.
        gambiting 3y ago
        I don't have any choice in that matter, I work for a publisher that releases games on these platforms.
- salawat 3y ago
  ARM that are microsoft certified will specifically not give you that option. You are probably largely using x86_64 which come with the option to do so, but there has been a lot of push around moving to things like ARM for energy efficiency reasons.
  - mastax 3y ago
    > there has been a lot of push around moving to things like ARM for energy efficiency reasons There has? Where? Specifically for Windows PCs, not chromebooks or apples.
    - als0 3y ago
      Not got a reference but one of the new Lenovo ARM laptops claims to have 26 hour battery life. If true then that's pretty compelling.
      - Mindwipe 3y ago
        Not running any software is very helpful for battery life.
        officeplant 3y ago
        Even as a ARM/RISC-V cultist I had to chuckle at that.
      - hypercube33 3y ago
        An AMD Lenovo Laptop supposedly gets 16 hours of battery life and again, this is subject to what you're running, but it runs x86 stuff natively instead of having to translate it. Isnt this 'good enough' for most people? I know we have people wanting week long laptop batteries, but over 12 solid, real world hours should be good enough for the majority of users, I'd think.
- DoItToMe81 3y ago
  I've had laptops where secure boot was permanently on unless you used legacy bios, and I've fixed several, both PCs and laptops, where there was no option to disable secure boot or use legacy bios. This was some years ago, and the situation has improved a lot since then.
neilv 3y ago
Debian Stable welcomes refugees: https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/ https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/ (Or, for laptops with closed WiFi and no Ethernet, use this installer: https://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/current/amd64/iso-dvd/ https://cdimage.debian.org/cdimage/unofficial/non-free/cd-in... )
- einpoklum 3y ago
  [flagged]
  - whynotmaybe 3y ago
    I'm a windows user since 3.1 and don't know much about linux except the few trials and my pihole. What's the impact of having systemd (or not) for the everyday layman like me that just uses Visual Studio Code to build flutter apps ?
    - roblabla 3y ago
      Nothing. Systemd is a suite of software that handle a lot of the low-level operations on Linux (In particular, the service manager, some network configuration, along with some other stuff). Historically, those operations were handled by different services (like SysvInit). A lot of people are mad about it for a lot of reasons, but if you're not a system administrator, it's probably better to stick with systemd, since it's what most of the linux community has standardized on, and thus it's much easier to find information online about using those systems.
      - dralley 3y ago
        >but if you're not a system administrator And even, probably, if you are.
      - nightfly 3y ago
        I _am_ a system administrator and systemd has been an overwhelmingly net positive for me
sidewndr46 3y ago
It's called the TPM because it is trusted. The real question is, who is it that trusted that thing?
- brookst 3y ago
  Eh, not a great bit of rhetoric. TPM = Trusted Platform Module. Trusted is an adjective modifying platform. The business case is that software should not run on untrusted platforms because hardware can always attack software. So, the promise is that TPM will allow software to guarantee* to users that the hardware is not malicious. * as much as one can guarantee anything in tech
  - sidewndr46 3y ago
    I agree, my rhetoric on TPM is rather elementary. From my perspective TPM is mostly about compliance with security directives. Actual security engineers would realize the TPM's security provided is about as far as you can throw it. You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you.
    - CameronNemo 3y ago
      You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you Wait, what? In most cases you 100% know who designed and manufactured it. Regarding "swapping out" a TPM, how do you do that for fTPMs or TPMs that are on the same die as the CPU? Come up with a perfect replica AMD CPU with a bugged TPM? Desolder the original CPU and put the replica in?
      - sidewndr46 3y ago
        I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) include a complete lockset. I tell you that the lockset is totally secure. I offer you volumes of academic research and attestations that this is true. But there is no practical means by which you can establish the security of that lockset. Do you believe that no one else can open your front door?
Cheeeetah 3y ago
TPM allows government to request your data in the first place. So it should not be trusted by individuals from the beginning.
- wkat4242 3y ago
  Uhh what? How does that work? Where do they request it? The TPM manufacturer? Microsoft? TPMs aren't very secure and as a discrete component their connection to the CPU can be intercepted (unlike fTPM or apple's integrated solutions).. There's a big difference between having a deliberate backdoor and just a vulnerable design that can be exploited. I haven't seen them accused of being backdoored. Intel's ME (and AMD's equivalent) perhaps but that's not the TPM. TPMs can also be used to hide DRM keys from the user and I'm also opposed to that, but generally that stuff is hidden in other hardware. Like Google's wildvine stuff in mobile CPUs.
  - Cheeeetah 3y ago
    The manufacturers perhaps. They provide the keys in the modules anyway. BTW, there is Chinese passport law which states that the algorithm should be independently developed. The law once blocked TPM 1.0 but allows TPM 2.0
    - cryptonector 3y ago
      Yes, if you want to recover keys from a dTPM you have two options: - decap it, scan it with an electron scanning microscope, reverse engineer it (or have already done so), and read the seeds and all NVRAM on the chip - force the manufacturer to record the seeds even though they have processes to never do so, then force the manufacturer to reveal the seeds a dTPM shipped with given an EKpub for it A few nation states could probably pull off the latter, but probably very few. And I suspect they haven't bothered and won't until TPM usage finally gets in the way. This is pure speculation, and they may well have forced all the manufacturers already for all any one of us knows. More nation states could pull of the former. But again, they might not bother until TPM usage finally gets in the way. As long as BMCs and BIOSes continue to use non-encrypted sessions to talk to dTPMs there is no need to do any of this when the attacker has physical access to the motherboard.
candiddevmike 3y ago
There needs to be a way to measure and report on boot order. Hopefully there will be other options besides a TPM for this.
IYasha 3y ago
Good? It was never intended to do so. ) Also, made me remember (once again) decade old presentation on TPM: https://www.youtube.com/watch?v=XgFbqSYdNK4 https://www.youtube.com/watch?v=XgFbqSYdNK4
cryptonector 3y ago
> Honestly TPM is probably creating more bad than good at this point. The problem isn't the TPM. The problem is the CPU (SP) being vulnerable to voltage fault injection attacks. You could be using no TPM and still have all your secrets leak if the host is fully compromised.

judge2020 3y ago

> Every time I think about the millions of computers that will be declared worthless this year, it makes me a little bit more angrier. What is this a reference to? Every computer I've found will let you boot into the bios and disable secure boot or add new keys to the trust store.

r2_pilot 3y ago
Microsoft is edging closer and closer to dropping support for Windows 10(even a computer I built in 2017 that's still running perfectly fine can't upgrade). But for many users, changing to another OS besides Windows is tantamount to not functioning, so planned obsolescence continues apace.
- babypuncher 3y ago
  That's not happening until 2025, GP said "this year".
- Workaccount2 3y ago
  I wish there was a linux distro made by people who love windows, not linux.
  - spsesk117 3y ago
    I've always felt that $BIG_BRAND_DISTRO+KDE got pretty close. It's still Linux, so not quite the same, but as far as look and feel, it's pretty close I think.
    - ilyt 3y ago
      I remember some videos where people pretended some KDE theme is how new windows version looks and people had no problems believing it.
  - somat 3y ago
    There is a aphorism. Bsd was made by people who love unix, linux was made by people who hate windows.
    - Aleklart 3y ago
      I think they hate unix, not windows, because they dragged all legacy nonsense unix had for hardware reasons straight into modern times so everyone can laugh on it.
  - asynchronous 3y ago
    If I may suggest, ZorinOS is about as close to windows on Linux as it gets. Found it through a HN comment myself.
  - PrimeMcFly 3y ago
    There have been several, but what makes Windows Windows is the ecosystem, and no distro can replicate that.
    - galangalalgol 3y ago
      What is that ecosystem now? What do households with windows use that isn't on the cloud?
      - PrimeMcFly 3y ago
        A lot of stuff is moving to web/cloud stuff, but we are not there entirely. As one example, I had to take a proctored exam recently, and the only supported OS was Windows or MacOS. Linux was not an option. Then there is games, Proton is great but plenty of AAA titles are still not compatible. Just for starters.
        galangalalgol 3y ago
        Games for sure, the exam software is disappointing.
      - officeplant 3y ago
        The problem with the cloud is how often I've run into blanket linux/bsd support bans. Especially when it comes to professional certifications done online. I had one website refusing to work on my FreeBSD or Debian installs. It would just get to a certain point and not let me proceed and multiple buttons refusing to work properly. Got on the phone with support and they were dumbfounded. Got the idea to just spoof my user agent as a windows box on edge and it worked perfectly afterwards. Even if not done on purpose there is a lot of crufty shit online that breaks in unsuspecting ways when I'm on a linux/BSD box. Especially if interfacing with the government websites and webapps. Our state fire code website looks straight out of 2002 and has multiple warnings about making sure to use IE6... in 2023. Maybe its just my use case (fire industry / local government), but it helps to have a mac or windows machine lying around as backup.
  - red-iron-pine 3y ago
    Use any Unbutu distribution with MATE or Cinnamon. Like shit dawg, I got my grandma using Linux Mint with MATE. Changed the background to match the same one on her old laptop and added some desktop icons, and boom 99% of her experience was the same. Had to help her a little with the LibreOffice -- that's a little different -- but otherwise functionally similar to Windows 7 / Win10. I'm using linux as a daily driver and at this point there isn't anything I can't do on Windows. The hold out for a while was games, but Proton w/ Steam works well and I can play big titles like Cyberpunk 2077.
  - xxpor 3y ago
    This is what I ran in 2002 or so: https://en.wikipedia.org/wiki/Linspire https://en.wikipedia.org/wiki/Linspire
  - MisterTea 3y ago
    Sounds like the last time you used Linux was 20 years ago. Linux been as easy as Windows to install and use for at least 10 years now. My mothers laptop runs Linux Mint and she doesn't know its not Windows even though the colors are all wrong. Why? It's all about the DE - if it looks like windows, walks like windows and quacks like windows, its windows. If she can click on the menu and find the internet then it's a win. Installation was was as easy as windows and everything worked out of the box. Hell, I installed the Chicago95 XFCE theme on my main system to see how well it emulated the look and feel of Windows 95 and wound up liking it. Why? Because even though it looks dated, the icons were immediately familiar and I felt navigation instantly become easier. Do not underestimate the power of familiarity. Many of us grew up on DOS/Windows playing games and typing school work up in Word so moving away from those familiar waters is HARD. It's like being an immigrant moving to a new country - you have to put in extra effort to learn to adjust to culture and language. Some can, some cant. YMMV.
- doubled112 3y ago
  I did find it odd that my Ryzen 7 1700X (8 cores, 16 threads, 3.4GHz) was suddenly "not good enough" to run the OS.
  - bo1024 3y ago
    Really crystallizes how what matters is "good enough" for Microsoft's goals, not the user's.
  - tester756 3y ago
    Isn't this about Spectre/Meltdown vulns instead of the perf. specs?
    - CircleSpokes 3y ago
      IIRC it has more to do with that series of chip not having GMET (AMD Guest-Mode Execute Trap for NPT) which is used in Windows 10/11s virtualization based protection. Microsoft requires this option for all new PCs from their partners but you can install windows 11 and run it fine without this CPU feature (there is a performance hit if you leave virtualization based protection on though since it has to be done in software).
  - jeroenhd 3y ago
    It'll work fine, Microsoft even explains how to upgrade: https://support.microsoft.com/en-us/windows/installing-windows-11-on-devices-that-don-t-meet-minimum-system-requirements-0b2dc4a2-5933-4ad4-9c09-ef0a331518f1 https://support.microsoft.com/en-us/windows/installing-windo... They chose an arbitrary cut-off date for hardware support for their new OS. They decided not to support old stuff anymore and they had to pick a date/technology platform. It was always going to be arbitrary. In my opinion they should've picked a clearer distinction (i.e. require a certain level of AVX support so all binaries can be built with AVX optimizations enabled) but I can see why they chose to do this. After all, they're going to have to support the OS for ten years, that four year old CPU is fourteen years old by the time Windows 11 goes out of support.
    - 3y ago
- reisse 3y ago
  Dropping support, so what? That does not make these PCs obsolescent in any way. People still use Windows 7, and even Windows XP. Especially in the many contexts where "security" is not important at all.
- nly 3y ago
  You can install W11 without a TPM with a workaround. Microsoft should be forced to allow it by default.
- criley2 3y ago
  Microsoft said they were ending support in 2025, which is what 8 year life for the OS? I don't even think Apple hits 8 for OSX updates. They obsolete the laptops more quickly than that, even if they do hit 6-7 years regularly.
  - daveoc64 3y ago
    Windows 10 was released in 2015, so they will have offered 10 years of support, which was the standard policy in place ever since Windows Vista (Windows Vista, 7, 8/8.1, 10). Apple does not support any macOS version for that long, and is unlikely to support a current version of macOS on any given device for that long.
    - Aleklart 3y ago
      You say “support” like the moment they stop it, OS cease to work. OSX Leopard is usable for most of tasks. Lot of people still running Windows 7 and Windows XP without any need for “support”. Windows 10 will be even better without constant “support” reboots. Can’t say this for Windows 11, as it so tightly stuffed with spyware and online integrations, it might just not boot if MS plug some server switch.
      - daveoc64 3y ago
        I would not want to run an unsupported OS of any variety. Modern web browsers will stop working on older operating systems - so will other apps. Not only is it a massive security risk, but it will simply become impractical for most users. Besides, if you're afraid of the TPM vulnerability described in this article, you ought to be more worried about running an out of date OS!
        BlueTemplar 3y ago
        Windows 7 is only starting to get obsoleted now : while Microsoft is still updating it with critical security fixes, Qt and Chromium dropping it is pretty much the end for non-legacy usage. (Good bye Windows I guess...)
- ekianjo 3y ago
  Don't reward them for that. The only solution is to move to another OS, that's the only thing they will ultimately understand - no matter how inconvenient it might be.
  - gambiting 3y ago
    That's not an option if you use your machine for work and your Dev tools only work on windows. PS5/Xbox toolchains only work on windows, as a gamedev I don't really have a choice.
    - ekianjo 3y ago
      You can always target other platforms and still make money as a gamedev.
      - gambiting 3y ago
        I don't have any choice in that matter, I work for a publisher that releases games on these platforms.
salawat 3y ago
ARM that are microsoft certified will specifically not give you that option. You are probably largely using x86_64 which come with the option to do so, but there has been a lot of push around moving to things like ARM for energy efficiency reasons.
- mastax 3y ago
  > there has been a lot of push around moving to things like ARM for energy efficiency reasons There has? Where? Specifically for Windows PCs, not chromebooks or apples.
  - als0 3y ago
    Not got a reference but one of the new Lenovo ARM laptops claims to have 26 hour battery life. If true then that's pretty compelling.
    - Mindwipe 3y ago
      Not running any software is very helpful for battery life.
      - officeplant 3y ago
        Even as a ARM/RISC-V cultist I had to chuckle at that.
    - hypercube33 3y ago
      An AMD Lenovo Laptop supposedly gets 16 hours of battery life and again, this is subject to what you're running, but it runs x86 stuff natively instead of having to translate it. Isnt this 'good enough' for most people? I know we have people wanting week long laptop batteries, but over 12 solid, real world hours should be good enough for the majority of users, I'd think.
DoItToMe81 3y ago
I've had laptops where secure boot was permanently on unless you used legacy bios, and I've fixed several, both PCs and laptops, where there was no option to disable secure boot or use legacy bios. This was some years ago, and the situation has improved a lot since then.

neilv 3y ago

Debian Stable welcomes refugees: https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/ https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/ (Or, for laptops with closed WiFi and no Ethernet, use this installer: https://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/current/amd64/iso-dvd/ https://cdimage.debian.org/cdimage/unofficial/non-free/cd-in... )

einpoklum 3y ago
[flagged]
- whynotmaybe 3y ago
  I'm a windows user since 3.1 and don't know much about linux except the few trials and my pihole. What's the impact of having systemd (or not) for the everyday layman like me that just uses Visual Studio Code to build flutter apps ?
  - roblabla 3y ago
    Nothing. Systemd is a suite of software that handle a lot of the low-level operations on Linux (In particular, the service manager, some network configuration, along with some other stuff). Historically, those operations were handled by different services (like SysvInit). A lot of people are mad about it for a lot of reasons, but if you're not a system administrator, it's probably better to stick with systemd, since it's what most of the linux community has standardized on, and thus it's much easier to find information online about using those systems.
    - dralley 3y ago
      >but if you're not a system administrator And even, probably, if you are.
    - nightfly 3y ago
      I _am_ a system administrator and systemd has been an overwhelmingly net positive for me

sidewndr46 3y ago

It's called the TPM because it is trusted. The real question is, who is it that trusted that thing?

brookst 3y ago
Eh, not a great bit of rhetoric. TPM = Trusted Platform Module. Trusted is an adjective modifying platform. The business case is that software should not run on untrusted platforms because hardware can always attack software. So, the promise is that TPM will allow software to guarantee* to users that the hardware is not malicious. * as much as one can guarantee anything in tech
- sidewndr46 3y ago
  I agree, my rhetoric on TPM is rather elementary. From my perspective TPM is mostly about compliance with security directives. Actual security engineers would realize the TPM's security provided is about as far as you can throw it. You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you.
  - CameronNemo 3y ago
    You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you Wait, what? In most cases you 100% know who designed and manufactured it. Regarding "swapping out" a TPM, how do you do that for fTPMs or TPMs that are on the same die as the CPU? Come up with a perfect replica AMD CPU with a bugged TPM? Desolder the original CPU and put the replica in?
    - sidewndr46 3y ago
      I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) include a complete lockset. I tell you that the lockset is totally secure. I offer you volumes of academic research and attestations that this is true. But there is no practical means by which you can establish the security of that lockset. Do you believe that no one else can open your front door?

Cheeeetah 3y ago

TPM allows government to request your data in the first place. So it should not be trusted by individuals from the beginning.

wkat4242 3y ago
Uhh what? How does that work? Where do they request it? The TPM manufacturer? Microsoft? TPMs aren't very secure and as a discrete component their connection to the CPU can be intercepted (unlike fTPM or apple's integrated solutions).. There's a big difference between having a deliberate backdoor and just a vulnerable design that can be exploited. I haven't seen them accused of being backdoored. Intel's ME (and AMD's equivalent) perhaps but that's not the TPM. TPMs can also be used to hide DRM keys from the user and I'm also opposed to that, but generally that stuff is hidden in other hardware. Like Google's wildvine stuff in mobile CPUs.
- Cheeeetah 3y ago
  The manufacturers perhaps. They provide the keys in the modules anyway. BTW, there is Chinese passport law which states that the algorithm should be independently developed. The law once blocked TPM 1.0 but allows TPM 2.0
  - cryptonector 3y ago
    Yes, if you want to recover keys from a dTPM you have two options: - decap it, scan it with an electron scanning microscope, reverse engineer it (or have already done so), and read the seeds and all NVRAM on the chip - force the manufacturer to record the seeds even though they have processes to never do so, then force the manufacturer to reveal the seeds a dTPM shipped with given an EKpub for it A few nation states could probably pull off the latter, but probably very few. And I suspect they haven't bothered and won't until TPM usage finally gets in the way. This is pure speculation, and they may well have forced all the manufacturers already for all any one of us knows. More nation states could pull of the former. But again, they might not bother until TPM usage finally gets in the way. As long as BMCs and BIOSes continue to use non-encrypted sessions to talk to dTPMs there is no need to do any of this when the attacker has physical access to the motherboard.

candiddevmike 3y ago

There needs to be a way to measure and report on boot order. Hopefully there will be other options besides a TPM for this.

IYasha 3y ago

Good? It was never intended to do so. ) Also, made me remember (once again) decade old presentation on TPM: https://www.youtube.com/watch?v=XgFbqSYdNK4 https://www.youtube.com/watch?v=XgFbqSYdNK4

cryptonector 3y ago

> Honestly TPM is probably creating more bad than good at this point. The problem isn't the TPM. The problem is the CPU (SP) being vulnerable to voltage fault injection attacks. You could be using no TPM and still have all your secrets leak if the host is fully compromised.