4 ms·

iirc remote attestation is reliant on hardware attestation, which means these websites will only run on authorized DRM-enforcing hardware and architectures. Onl

iirc remote attestation is reliant on hardware attestation, which means these websites will only run on authorized DRM-enforcing hardware and architectures. Only Intel, AMD, Qualcomm and the like. No open-source firmwares, architectures or hardware.

detourdog 3y ago
It's important to remember they are only commercial efforts. If you can value something other than money it doesn't matter what the corporate web is doing compared to human ingenuity and the internet. Let them waste their time and money write their specs.
- mozball 3y ago
  As an example, Can you recommend a good tech/hacker video channel that is available somewhere else other than Youtube?
  - detourdog 3y ago
    That is why I call for federated publishing tools. Believe it or not I plan on launching such a channel and it will be self-hosted in the 90's meaning of the term. They only way the channel will grow an audience is if it is passed by word of mouth. The amount of effort that goes in to playing advertising metric games of YouTube is ridiculous to me. Anyone that says well people have to get paid I say maybe. Real creators create and don't need the like, subscribe, patreon, mantra. Most of the gunsmithing sights on YouTube are moving towards this idea. I don't believe in the discovery myth so many talk about as essential. It is only essential if you need inorganic growth. I would say it's an emerging trend and that the more they tighten their grip the more creators will slip through their fingers.
  - concordDance 3y ago
    Arent everyday astronaught, practical engineering and tom Scott available on their own websites?
    - mozball 3y ago
      I visited Practical engineering and tom scott's websites and AFAI seen they embed youtube videos in their websites. I couldn't find astronaught's website. Its not even linked to in his youtube channel.
      - OGWhales 3y ago
        He has article versions of his videos which you can find linked in the description of his YouTube videos. The videos on his website are just linked to YouTube however.
  - Stammon 3y ago
    Do Channels on Nebula count? Since Nebula is paid only, ads free and creator owned (as far as I understand), it might be the one prime example of a video platform not incentivized to restrict access to only consumers using proprietary, big tech OSes.
    - detourdog 3y ago
      I would say so.
  - korse 3y ago
    Not an answer but your question has me curious now. I'm not old but I've got a particular worldview that could use an update. Why video? Aside from entertainment or live collaboration, I've never found video compelling for productivity. Reliable machinery always has a shop manual, diagrams and prints. Programming languages have tomes of documentation, computing infrastructure has man pages and volumes of commentary, scholarship and trouble shooting have been committed to characters. Aside from the point and grunt visuals, solid presentations (viewed after the fact when the value of real time interaction is gone) work fine as text. If you're dyslexic, I get it but TTS systems are extremely solid these days. What is the point?
    - minimoose 3y ago
      Unfortunately we live in a time where the majority of people are practicing illiteracy.
- meepmorp 3y ago
  Normal people interact with the “corporate web,” because they feel compelled to do things like banking, buying stuff, etc.
  - detourdog 3y ago
    Those normal activities like banking is a corporate service and I'm happy with it's regulation and it makes sense to be regulated. Buying stuff is on a spectrum and I think a consumer should be able to chose a tightly regulated system for exchanging currency. Most everything else should be free to choose.
    - out_of_protocol 3y ago
      E.g. McDonald's android app, at this moment. It doesn't launch on devices which fail Safety Net checks, i.e. modified firmware
      - detourdog 3y ago
        I have been in the tank for Apple since the 80's. So no doubt I'm distorted but content. Financial transactions could become so streamlined that a "commerce fob" is likely to emerge. That would be a credit card with a screen and buttons. Think about how streamlined all these tasks have become. Putting those in a single ROM that has a screen and is tied into some legitimate network will emerge. It is only out of convenience that these services are currently tied to a "phone".
  - skydhash 3y ago
    I don't mind in these cases. Because I already have to present my ID card or my driver's license, when I'm doing most of this. I'd buy a cheap laptop, label it as a banking and ecommerce laptop/tablet, and use it to browse the corporate web. More friction, yes, but I'd welcome it as it would make me reluctant to interact with them. Any other sites that try would just end on my blacklist.
- concordDance 3y ago
  Unfortunately, the corporate Web has managed to monopolise how we communicate and learn about things (Facebook, reddit, twitter, YouTube, news sites, etc).
  - detourdog 3y ago
    This is a mistaken view. The closest thing I have to social media is HN. I did get a twitter account in the beginning and I was waiting for the right moment to tweet but it seems to have passed. The above is true only to the extent that you believe it. I don't believe it at all so I'm not part of the "you" I'm an "other". The "News" is a whole other problem closer to truth. So not technical entirely. Individuals started newspapers and individual will deliver the news. A big issue corporations currently face is that everything has become so cheap that their scale of effort is a hindrance. If a corporation is not acting ruthlessly efficient the economy of scale breaks down quickly. The crux of this will cause the success of many smaller scale efforts that don't hold the overhead of a corporation. The original promise of the public internet was the idea that broadcasting was dead and narrowcasting was the wave of the future. This was true up until ads became legal/common on the internet. Take away the commercial interest and you are left with passionate publishers and audiences.
jeroenhd 3y ago
What attestation the website accepts entirely depends on the configuration. There's nothing in the spec that will prevent attestations for Linux computers. Linux already works perfectly fine with secure boot and such, I don't see why a signed bootloader starting a signed attestation engine wouldn't be trusted by third party websites. It'll kill open platforms like the rare open source RISC-V implementations, but for almost any platform in use today this can be implemented. The real question is "but will it", and in practice websites will probably only whitelist Chrome, Edge, and (reluctantly) Safari.
- codedokode 3y ago
  > I don't see why a signed bootloader starting a signed attestation engine wouldn't be trusted by third party websites. Do you mean a kind of Linux where root cannot do anything he wants? Like Android?
  - jeroenhd 3y ago
    Yes, a kind of Linux like Ubuntu or Fedora that already boots with secure boot enabled with full support of TPMs and similar technologies. The kind of Linux 99% of Linux users are running today. More secure variants like Android, leveraging SELinux and such, help with sandboxing but I don't think that SELinux is a struct requirement.
    - raxxorraxor 3y ago
      They are not more secure at all.
    - codedokode 3y ago
      I mean if root can do anything then such system is not "trusted" from corporations point of view. Therefore, it won't be able to pass the attestation or play DRM content.
    - hollerith 3y ago
      Huh? Fedora defaults to secure boot's being off and it is complicated to get it turned on. Even after you manage to turn it on, it only verifies the kernel and cannot do anything about malware hiding in /usr. There is no Linux distro AFIAK that has verification of the entire system like ChromeOS, MacOS, iOS, Android and Windows have.
7e 3y ago
Remote attestation, including hardware attestation, is absolutely compatible with open source.

detourdog 3y ago

It's important to remember they are only commercial efforts. If you can value something other than money it doesn't matter what the corporate web is doing compared to human ingenuity and the internet. Let them waste their time and money write their specs.

mozball 3y ago
As an example, Can you recommend a good tech/hacker video channel that is available somewhere else other than Youtube?
- detourdog 3y ago
  That is why I call for federated publishing tools. Believe it or not I plan on launching such a channel and it will be self-hosted in the 90's meaning of the term. They only way the channel will grow an audience is if it is passed by word of mouth. The amount of effort that goes in to playing advertising metric games of YouTube is ridiculous to me. Anyone that says well people have to get paid I say maybe. Real creators create and don't need the like, subscribe, patreon, mantra. Most of the gunsmithing sights on YouTube are moving towards this idea. I don't believe in the discovery myth so many talk about as essential. It is only essential if you need inorganic growth. I would say it's an emerging trend and that the more they tighten their grip the more creators will slip through their fingers.
- concordDance 3y ago
  Arent everyday astronaught, practical engineering and tom Scott available on their own websites?
  - mozball 3y ago
    I visited Practical engineering and tom scott's websites and AFAI seen they embed youtube videos in their websites. I couldn't find astronaught's website. Its not even linked to in his youtube channel.
    - OGWhales 3y ago
      He has article versions of his videos which you can find linked in the description of his YouTube videos. The videos on his website are just linked to YouTube however.
- Stammon 3y ago
  Do Channels on Nebula count? Since Nebula is paid only, ads free and creator owned (as far as I understand), it might be the one prime example of a video platform not incentivized to restrict access to only consumers using proprietary, big tech OSes.
  - detourdog 3y ago
    I would say so.
- korse 3y ago
  Not an answer but your question has me curious now. I'm not old but I've got a particular worldview that could use an update. Why video? Aside from entertainment or live collaboration, I've never found video compelling for productivity. Reliable machinery always has a shop manual, diagrams and prints. Programming languages have tomes of documentation, computing infrastructure has man pages and volumes of commentary, scholarship and trouble shooting have been committed to characters. Aside from the point and grunt visuals, solid presentations (viewed after the fact when the value of real time interaction is gone) work fine as text. If you're dyslexic, I get it but TTS systems are extremely solid these days. What is the point?
  - minimoose 3y ago
    Unfortunately we live in a time where the majority of people are practicing illiteracy.
meepmorp 3y ago
Normal people interact with the “corporate web,” because they feel compelled to do things like banking, buying stuff, etc.
- detourdog 3y ago
  Those normal activities like banking is a corporate service and I'm happy with it's regulation and it makes sense to be regulated. Buying stuff is on a spectrum and I think a consumer should be able to chose a tightly regulated system for exchanging currency. Most everything else should be free to choose.
  - out_of_protocol 3y ago
    E.g. McDonald's android app, at this moment. It doesn't launch on devices which fail Safety Net checks, i.e. modified firmware
    - detourdog 3y ago
      I have been in the tank for Apple since the 80's. So no doubt I'm distorted but content. Financial transactions could become so streamlined that a "commerce fob" is likely to emerge. That would be a credit card with a screen and buttons. Think about how streamlined all these tasks have become. Putting those in a single ROM that has a screen and is tied into some legitimate network will emerge. It is only out of convenience that these services are currently tied to a "phone".
- skydhash 3y ago
  I don't mind in these cases. Because I already have to present my ID card or my driver's license, when I'm doing most of this. I'd buy a cheap laptop, label it as a banking and ecommerce laptop/tablet, and use it to browse the corporate web. More friction, yes, but I'd welcome it as it would make me reluctant to interact with them. Any other sites that try would just end on my blacklist.
concordDance 3y ago
Unfortunately, the corporate Web has managed to monopolise how we communicate and learn about things (Facebook, reddit, twitter, YouTube, news sites, etc).
- detourdog 3y ago
  This is a mistaken view. The closest thing I have to social media is HN. I did get a twitter account in the beginning and I was waiting for the right moment to tweet but it seems to have passed. The above is true only to the extent that you believe it. I don't believe it at all so I'm not part of the "you" I'm an "other". The "News" is a whole other problem closer to truth. So not technical entirely. Individuals started newspapers and individual will deliver the news. A big issue corporations currently face is that everything has become so cheap that their scale of effort is a hindrance. If a corporation is not acting ruthlessly efficient the economy of scale breaks down quickly. The crux of this will cause the success of many smaller scale efforts that don't hold the overhead of a corporation. The original promise of the public internet was the idea that broadcasting was dead and narrowcasting was the wave of the future. This was true up until ads became legal/common on the internet. Take away the commercial interest and you are left with passionate publishers and audiences.

jeroenhd 3y ago

What attestation the website accepts entirely depends on the configuration. There's nothing in the spec that will prevent attestations for Linux computers. Linux already works perfectly fine with secure boot and such, I don't see why a signed bootloader starting a signed attestation engine wouldn't be trusted by third party websites. It'll kill open platforms like the rare open source RISC-V implementations, but for almost any platform in use today this can be implemented. The real question is "but will it", and in practice websites will probably only whitelist Chrome, Edge, and (reluctantly) Safari.

codedokode 3y ago
> I don't see why a signed bootloader starting a signed attestation engine wouldn't be trusted by third party websites. Do you mean a kind of Linux where root cannot do anything he wants? Like Android?
- jeroenhd 3y ago
  Yes, a kind of Linux like Ubuntu or Fedora that already boots with secure boot enabled with full support of TPMs and similar technologies. The kind of Linux 99% of Linux users are running today. More secure variants like Android, leveraging SELinux and such, help with sandboxing but I don't think that SELinux is a struct requirement.
  - raxxorraxor 3y ago
    They are not more secure at all.
  - codedokode 3y ago
    I mean if root can do anything then such system is not "trusted" from corporations point of view. Therefore, it won't be able to pass the attestation or play DRM content.
  - hollerith 3y ago
    Huh? Fedora defaults to secure boot's being off and it is complicated to get it turned on. Even after you manage to turn it on, it only verifies the kernel and cannot do anything about malware hiding in /usr. There is no Linux distro AFIAK that has verification of the entire system like ChromeOS, MacOS, iOS, Android and Windows have.

7e 3y ago

Remote attestation, including hardware attestation, is absolutely compatible with open source.