11 ms·

Like most ordinary folks, my threat model is the use of TPM for DRM. Netflix playing at lower resolution for example. Widespread TPM is actively harmful for m

Like most ordinary folks, my threat model is the use of TPM for DRM. Netflix playing at lower resolution for example. Widespread TPM is actively harmful for most people, and the biggest blow to general purpose computing in recent years.

dist-epoch 3y ago
> Netflix playing at lower resolution for example. Nobody is forcing you to use Netflix. If you don't like it, leave for a better DRM-free service. That's the free market at work.
- yjftsjthsd-h 3y ago
  The alternatives also use DRM, because licensing means that it's not a free market.
  - kenjackson 3y ago
    Why does licensing mean it’s not a free market?
    - HideousKojima 3y ago
      It's not the licensing, but rather theat copyright is literally a government enforced monopoly on intellectual property that makes it not a free market.
      - kenjackson 3y ago
        Thanks. That makes sense.
    - yjftsjthsd-h 3y ago
      Because the vast majority of content is owned by a tiny number of copyright owners (studios, IIRC, but it doesn't really matter who, just how many), who then impose artificial constraints. Netflix didn't decide to implement DRM on its own, it passed through requirements that would be imposed on anyone else too.
- ForkMeOnTinder 3y ago
  I love how this comment subtly acknowledges piracy is the only true unencumbered free-market choice.
  - pixl97 3y ago
    Depending on what the definition of unencumbered is. Clicking on some link and getting your computer encrypted sounds like it's own means of encumbrance.
  - dist-epoch 3y ago
    Yes, if 90% of the market moves to piracy, the free market will indeed work and content producers will stop producing stuff. Or maybe they will all move to TikTok and live from advertising and you'll get a chance to complain about how you hate ads then.
- alpaca128 3y ago
  > leave for a better DRM-free service Which one? Is it a free market if 99.9% of companies copy the single most profitable approach to stay afloat (see smartphones), or the entire market is dominated by content rights holders that would make you pay license fees to use the toilet if they could?
  - immibis 3y ago
    the other commenter pointed out the only good DRM-free service is thepiratebay and the like
  - Mindwipe 3y ago
    There is more DRM free video available in 2023 than literally any other point in human history. That doesn't entitle you to a specific video unprotected. But the video market is pretty unquestionably not dominated by content right holders (if by that we mean major studios).
    - alpaca128 3y ago
      If there's such an unprecedented amount of it I am sure you can give an example?
      - Mindwipe 3y ago
        YouTube.
cyberax 3y ago
> Like most ordinary folks, my threat model is the use of TPM for DRM. TPM is pretty much useless for DRM.
- dmm 3y ago
  TPM/measured boot can provide proof that a DRM stack is in place.
  - deleted 3y ago
    [deleted]
  - mjg59 3y ago
    In an abstract sense, yes, but were anyone to do that in a widely deployed manner there are fairly easy and cheap ways to circumvent it.
    - immibis 3y ago
      Such as?
      - mjg59 3y ago
        Such as plugging in a TPM after boot and programming the PCRs however you want
        Nextgrid 3y ago
        To be fair, firmware-based TPMs which are part of the CPU/SoC should be invulnerable to that? However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective. That's impossible due to the number of device drivers (which need kernel-level access by design) and various other privileged components a general-purpose OS requires (security software, etc), not to mention the attack surface of all that. For a hypothetical TPM-backed DRM to work, you'd need Netflix to ship you an entire OS image that you can boot (which the TPM will prove to them that you've booted), and that OS image needs to magically have all the drivers for every potential PC their customers might have, and you need to convince people to reboot their machine every time they want to watch it. This is all unnecessary considering the current status-quo of DRM is good enough, Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry.
mjg59 3y ago
Netflix doesn't make use of the TPM.
- FirmwareBurner 3y ago
  Yeah, but that goes to show you how limited in know-how people complaining about TPM are, and they keep spreading FUD like this and others keep buying it. And this is a supposedly tech focused platform where the tech literacy is at its highest. I wouldn't be surprised to read comments that TPM is used by Bill Gates to give you Covid.
  - aseipp 3y ago
    My rule of thumb is that I don't listen to anyone who can't write exploits for modern software stacks (OS kernels, browsers.) And even then, you can still ignore 50% of those people too, as they are cranks. In contrast, most of the people here in every one of these threads couldn't overflow an integer if you let them write the for loop. > I wouldn't be surprised to read comments that TPM is used by Bill Gates to give you Covid. One time on here, someone linked an academic paper describing an HTTP PCIe accelerator. One of the (eight) authors was from Tsinghua, and so naturally someone in the comments started freaking out about how this was a plan by the Chinese Deep State to fund this for mass surveillance. When I asked him how this would work and what threat he expected, he described an elaborate Tom Clancy plotline where these PCIe cards will actually be snooping every key exchange, keeping them in memory, and they would be secretly equipped and manufactured with short wave radio devices that would allow Chinese agents to "exfiltrate private keys" (whatever that means) by posing as janitors and technicians in the datacenter and beaming those radio messages to them. That was his threat model for "thing you literally plug into your fucking server and put on a shared memory bus." Now, how this is expected to work when most HTTP accelerators don't do key exchange (and never ever see long term keys), or how these keys would benefit them when presumably many encrypted comms do not go through cables controlled and spliced by the nefarious, evil-loving CCP -- well, that's left as an exercise for you!
    - egberts1 3y ago

dist-epoch 3y ago

> Netflix playing at lower resolution for example. Nobody is forcing you to use Netflix. If you don't like it, leave for a better DRM-free service. That's the free market at work.

yjftsjthsd-h 3y ago
The alternatives also use DRM, because licensing means that it's not a free market.
- kenjackson 3y ago
  Why does licensing mean it’s not a free market?
  - HideousKojima 3y ago
    It's not the licensing, but rather theat copyright is literally a government enforced monopoly on intellectual property that makes it not a free market.
    - kenjackson 3y ago
      Thanks. That makes sense.
  - yjftsjthsd-h 3y ago
    Because the vast majority of content is owned by a tiny number of copyright owners (studios, IIRC, but it doesn't really matter who, just how many), who then impose artificial constraints. Netflix didn't decide to implement DRM on its own, it passed through requirements that would be imposed on anyone else too.
ForkMeOnTinder 3y ago
I love how this comment subtly acknowledges piracy is the only true unencumbered free-market choice.
- pixl97 3y ago
  Depending on what the definition of unencumbered is. Clicking on some link and getting your computer encrypted sounds like it's own means of encumbrance.
- dist-epoch 3y ago
  Yes, if 90% of the market moves to piracy, the free market will indeed work and content producers will stop producing stuff. Or maybe they will all move to TikTok and live from advertising and you'll get a chance to complain about how you hate ads then.
alpaca128 3y ago
> leave for a better DRM-free service Which one? Is it a free market if 99.9% of companies copy the single most profitable approach to stay afloat (see smartphones), or the entire market is dominated by content rights holders that would make you pay license fees to use the toilet if they could?
- immibis 3y ago
  the other commenter pointed out the only good DRM-free service is thepiratebay and the like
- Mindwipe 3y ago
  There is more DRM free video available in 2023 than literally any other point in human history. That doesn't entitle you to a specific video unprotected. But the video market is pretty unquestionably not dominated by content right holders (if by that we mean major studios).
  - alpaca128 3y ago
    If there's such an unprecedented amount of it I am sure you can give an example?
    - Mindwipe 3y ago
      YouTube.

cyberax 3y ago

> Like most ordinary folks, my threat model is the use of TPM for DRM. TPM is pretty much useless for DRM.

dmm 3y ago
TPM/measured boot can provide proof that a DRM stack is in place.
- deleted 3y ago
  [deleted]
- mjg59 3y ago
  In an abstract sense, yes, but were anyone to do that in a widely deployed manner there are fairly easy and cheap ways to circumvent it.
  - immibis 3y ago
    Such as?
    - mjg59 3y ago
      Such as plugging in a TPM after boot and programming the PCRs however you want
      - Nextgrid 3y ago
        To be fair, firmware-based TPMs which are part of the CPU/SoC should be invulnerable to that? However, TPM-backed DRM on general-purpose OSes is impossible in the current world and is fear-mongering. The TPM can attest to a remote party that you've booted a certain OS, but this OS would need to maintain that chain of trust all the way for it to be effective. That's impossible due to the number of device drivers (which need kernel-level access by design) and various other privileged components a general-purpose OS requires (security software, etc), not to mention the attack surface of all that. For a hypothetical TPM-backed DRM to work, you'd need Netflix to ship you an entire OS image that you can boot (which the TPM will prove to them that you've booted), and that OS image needs to magically have all the drivers for every potential PC their customers might have, and you need to convince people to reboot their machine every time they want to watch it. This is all unnecessary considering the current status-quo of DRM is good enough, Widewine does not require a TPM and relies entirely on security by obscurity and it's considered good enough by the industry.

mjg59 3y ago

Netflix doesn't make use of the TPM.

FirmwareBurner 3y ago
Yeah, but that goes to show you how limited in know-how people complaining about TPM are, and they keep spreading FUD like this and others keep buying it. And this is a supposedly tech focused platform where the tech literacy is at its highest. I wouldn't be surprised to read comments that TPM is used by Bill Gates to give you Covid.
- aseipp 3y ago
  My rule of thumb is that I don't listen to anyone who can't write exploits for modern software stacks (OS kernels, browsers.) And even then, you can still ignore 50% of those people too, as they are cranks. In contrast, most of the people here in every one of these threads couldn't overflow an integer if you let them write the for loop. > I wouldn't be surprised to read comments that TPM is used by Bill Gates to give you Covid. One time on here, someone linked an academic paper describing an HTTP PCIe accelerator. One of the (eight) authors was from Tsinghua, and so naturally someone in the comments started freaking out about how this was a plan by the Chinese Deep State to fund this for mass surveillance. When I asked him how this would work and what threat he expected, he described an elaborate Tom Clancy plotline where these PCIe cards will actually be snooping every key exchange, keeping them in memory, and they would be secretly equipped and manufactured with short wave radio devices that would allow Chinese agents to "exfiltrate private keys" (whatever that means) by posing as janitors and technicians in the datacenter and beaming those radio messages to them. That was his threat model for "thing you literally plug into your fucking server and put on a shared memory bus." Now, how this is expected to work when most HTTP accelerators don't do key exchange (and never ever see long term keys), or how these keys would benefit them when presumably many encrypted comms do not go through cables controlled and spliced by the nefarious, evil-loving CCP -- well, that's left as an exercise for you!
  - egberts1 3y ago