8 ms·

How big brother and big media can put the Internet genie back in the bottle.

54 points by hmart 14y ago

asiekierka 14y ago
This article seems to focus on closed-source solutions. What about Linux? If the Trusted Computing code would be open-source, that creates another rather huge problem for the big brother and big media. Does that mean Linux machines would be unable to connect to the internet? Or would they need closed-source Trusted Computing drivers instead?
- Jach 14y ago
  From the article: > Consequently, a trusted computing platform must validate the signature of an operating system before booting it. Operating systems not certified as implementing all the requirements of Trusted Computing will not be issued certificates, and may not be booted on such systems. This has already happened with Windows 8 verified hardware. If you want to run another OS, you (or rather, the OS maintainers) have to pay the $99 Microsoft (ed: VeriSign, see below) tax to get a Microsoft-signed bootloader and kernel. (Fedora has already done this.) A decent write-up is here with some comments from Linus: http://www.zdnet.com/blog/open-source/linus-torvalds-on-windows-8-uefi-and-fedora/11187 http://www.zdnet.com/blog/open-source/linus-torvalds-on-wind... It's kind of disturbing when the main reassurance is "Hackers will get around it. Probably."
  - yuhong 14y ago
    The $99 goes to VeriSign.
    - Jach 14y ago
      Thanks for the correction.
    - rbanffy 14y ago
      Why only VeriSign? Shouldn't there be more than one trusted root?
  - daeken 14y ago
    > This has already happened with Windows 8 verified hardware. If you want to run another OS, you (or rather, the OS maintainers) have to pay the $99 Microsoft tax to get a Microsoft-signed bootloader and kernel. No. While that is an option -- if you want to use Secure Boot -- MS is requiring certified x86 machines to allow disabling Secure Boot entirely. Does that make it more difficult to install? Marginally, yes; it adds additional steps. Does it mean that you have to jump through the signing hoops? Absolutely not.
    - Jach 14y ago
      For now. The story is different for ARM devices, however, unless there has been an update to that policy that I missed.
      - daeken 14y ago
        Yes, ARM still doesn't allow unsigned kernels to run; I mentioned x86 specifically in my post. That said, the "For now." is fearmongering. It's very possible that MS could change things, but that doesn't mean we should make that assumption -- that's just FUD. There are plenty of legitimate things to gripe about around the Secure Boot stuff, but potential future changes to the policies aren't high on the list.
        Jach 14y ago
        Fair point. While I think some concern is warranted in Microsoft's case given their history, FUD is FUD. Apart from whether MS will change its policies, I'm interested to see what the responses will be if the private signing key is compromised.
        pgeorgi 14y ago
        It's like they handled mandantory driver signing on win64: One of the reasons 32bit wasn't affected is that this requirements breaks old drivers. Similarily, on x86 you have two inhibiting factors: old systems without UEFI+secureboot that can run windows 8, and new systems that have to run older windows versions for some reasons (business requirements). In a couple of years, there are only secureboot-capable Windows versions out there (and still relevant), and only secureboot-capable systems to run windows 10 on. That's a much more comfortable situation to pull the plug on non-secureboot boot.
batgaijin 14y ago
Wait, can someone explain what the hell is going on?!?! Last I heard the no-images-except-signed ones was for for ARM devices only. Did MS just put this into x86? Can you turn it off in the BIOS?
- InclinedPlane 14y ago
  No, nothing's changed except for people getting hot and bothered at the possibility that it could be turned off for x86.
  - acabal 14y ago
    Which, I think, is a valid fear to have considering MS is basically just decreeing this. Like they say, rights disappear in degrees.
  - rbanffy 14y ago
    That's how we lose freedoms. Little by painless little. This way, most people don't realize until it's too late. If ever.
- throwaway64 14y ago
  Microsoft has mandated that OEMs must provide a way for users to disable secure boot, and a way for them to add their own keys, however we still do not know the exact nature of what "turning it off" entails. The Microsoft requirements are very vague on this point, if early hardware is indication, disabling it could be quite complicated and error prone, IE having to re flash the firmware. The biggest problem IMO is Microsoft is completely free to change this requirement at any time, and with stuff like ARM already being mandated as having no way to disable secure boot, or load keys, I don't think this is particularly far fetched. Also consider the fact they never mandated having a way to disable it previously, until there was a massive outcry.
c3d 14y ago
Microsoft wants ARM machines to be locked in Windows 8 mode, probably to block Android. From what I can tell, it goes both ways. Existing Android tablets are not Windows8-certified, so they won't run it. Microsoft being the runner-up in the tablet market, I find the move puzzling. What do they have to gain? Why would vendors want to lock themselves in the hands of Microsoft, given MS's past behavior? More puzzling yet: what is the force in the Microsoft DNA that prompts them to systematically return to this kind of anti-competitive behaviors as soon as they get a chance?
- Maakuth 14y ago
  People pretty much never change the operating system of their ARM devices anyway. They are a lot more heterogenous thing than PCs and getting any OS to run on some specific ARM device is always quite big a task. There's of course some examples of this happening, say TouchPad or N9 Android ports, but these devices already ran Linux kernel.
  - Supermighty 14y ago
    But it doesn't have to be that way. Even with locked bootloaders on Android devices people are finding ways to install custom builds of Android. Why not custom builds of GNU/Linuix, FreeBSD or even Windows.
    - Maakuth 14y ago
      Yeah, I agree that it's bad this wouldn't be possible anymore. It could be that it becomes more popular as it'll be something that's forbidden ;)
    - mhurron 14y ago
      How many people do that to their PC? The vast minority. The situation that is on phones and tablets isn't all that different than what people do by choice. The majority of people don't care. If the people don't care, why would a company do it?
  - rbanffy 14y ago
neilk 14y ago
This is from 2003. It's not entirely outdated, but it is rather quaint. The author foresees a future where everyone has to use personal certificates to communicate, which has various pros and cons - while enabling commerce, it could be the end of anonymity. He didn't anticipate a world where the government is simply hoovering up all the plaintext.
- accountoftheday 14y ago
  These personal certificates are turning out to be Facebook accounts, which is arguably worse.
  - antithesis 14y ago
    Are there any important sites (like news / discussion sites) that require this?
bugmenot 14y ago
read this in 2005, it gave me chills, I dare not read it again.
dnpfwfyuta 14y ago
How was this peer-to-peer Internet actually put to use, and why isn't it used that way anymore? I think I could name Usenet, but what else? Most of things I do on the Internet nowadays is using the www - a hierarchical structure. But were there p2p equivalents of any of the websites we use today?

54 points by hmart 14y ago

This article seems to focus on closed-source solutions. What about Linux? If the Trusted Computing code would be open-source, that creates another rather huge problem for the big brother and big media. Does that mean Linux machines would be unable to connect to the internet? Or would they need closed-source Trusted Computing drivers instead?

Jach 14y ago
From the article: > Consequently, a trusted computing platform must validate the signature of an operating system before booting it. Operating systems not certified as implementing all the requirements of Trusted Computing will not be issued certificates, and may not be booted on such systems. This has already happened with Windows 8 verified hardware. If you want to run another OS, you (or rather, the OS maintainers) have to pay the $99 Microsoft (ed: VeriSign, see below) tax to get a Microsoft-signed bootloader and kernel. (Fedora has already done this.) A decent write-up is here with some comments from Linus: http://www.zdnet.com/blog/open-source/linus-torvalds-on-windows-8-uefi-and-fedora/11187 http://www.zdnet.com/blog/open-source/linus-torvalds-on-wind... It's kind of disturbing when the main reassurance is "Hackers will get around it. Probably."
- yuhong 14y ago
  The $99 goes to VeriSign.
  - Jach 14y ago
    Thanks for the correction.
  - rbanffy 14y ago
    Why only VeriSign? Shouldn't there be more than one trusted root?
- daeken 14y ago
  > This has already happened with Windows 8 verified hardware. If you want to run another OS, you (or rather, the OS maintainers) have to pay the $99 Microsoft tax to get a Microsoft-signed bootloader and kernel. No. While that is an option -- if you want to use Secure Boot -- MS is requiring certified x86 machines to allow disabling Secure Boot entirely. Does that make it more difficult to install? Marginally, yes; it adds additional steps. Does it mean that you have to jump through the signing hoops? Absolutely not.
  - Jach 14y ago
    For now. The story is different for ARM devices, however, unless there has been an update to that policy that I missed.
    - daeken 14y ago
      Yes, ARM still doesn't allow unsigned kernels to run; I mentioned x86 specifically in my post. That said, the "For now." is fearmongering. It's very possible that MS could change things, but that doesn't mean we should make that assumption -- that's just FUD. There are plenty of legitimate things to gripe about around the Secure Boot stuff, but potential future changes to the policies aren't high on the list.
      - Jach 14y ago
        Fair point. While I think some concern is warranted in Microsoft's case given their history, FUD is FUD. Apart from whether MS will change its policies, I'm interested to see what the responses will be if the private signing key is compromised.
      - pgeorgi 14y ago
        It's like they handled mandantory driver signing on win64: One of the reasons 32bit wasn't affected is that this requirements breaks old drivers. Similarily, on x86 you have two inhibiting factors: old systems without UEFI+secureboot that can run windows 8, and new systems that have to run older windows versions for some reasons (business requirements). In a couple of years, there are only secureboot-capable Windows versions out there (and still relevant), and only secureboot-capable systems to run windows 10 on. That's a much more comfortable situation to pull the plug on non-secureboot boot.

batgaijin 14y ago

Wait, can someone explain what the hell is going on?!?! Last I heard the no-images-except-signed ones was for for ARM devices only. Did MS just put this into x86? Can you turn it off in the BIOS?

InclinedPlane 14y ago
No, nothing's changed except for people getting hot and bothered at the possibility that it could be turned off for x86.
- acabal 14y ago
  Which, I think, is a valid fear to have considering MS is basically just decreeing this. Like they say, rights disappear in degrees.
- rbanffy 14y ago
  That's how we lose freedoms. Little by painless little. This way, most people don't realize until it's too late. If ever.
throwaway64 14y ago
Microsoft has mandated that OEMs must provide a way for users to disable secure boot, and a way for them to add their own keys, however we still do not know the exact nature of what "turning it off" entails. The Microsoft requirements are very vague on this point, if early hardware is indication, disabling it could be quite complicated and error prone, IE having to re flash the firmware. The biggest problem IMO is Microsoft is completely free to change this requirement at any time, and with stuff like ARM already being mandated as having no way to disable secure boot, or load keys, I don't think this is particularly far fetched. Also consider the fact they never mandated having a way to disable it previously, until there was a massive outcry.

c3d 14y ago

Microsoft wants ARM machines to be locked in Windows 8 mode, probably to block Android. From what I can tell, it goes both ways. Existing Android tablets are not Windows8-certified, so they won't run it. Microsoft being the runner-up in the tablet market, I find the move puzzling. What do they have to gain? Why would vendors want to lock themselves in the hands of Microsoft, given MS's past behavior? More puzzling yet: what is the force in the Microsoft DNA that prompts them to systematically return to this kind of anti-competitive behaviors as soon as they get a chance?

Maakuth 14y ago
People pretty much never change the operating system of their ARM devices anyway. They are a lot more heterogenous thing than PCs and getting any OS to run on some specific ARM device is always quite big a task. There's of course some examples of this happening, say TouchPad or N9 Android ports, but these devices already ran Linux kernel.
- Supermighty 14y ago
  But it doesn't have to be that way. Even with locked bootloaders on Android devices people are finding ways to install custom builds of Android. Why not custom builds of GNU/Linuix, FreeBSD or even Windows.
  - Maakuth 14y ago
    Yeah, I agree that it's bad this wouldn't be possible anymore. It could be that it becomes more popular as it'll be something that's forbidden ;)
  - mhurron 14y ago
    How many people do that to their PC? The vast minority. The situation that is on phones and tablets isn't all that different than what people do by choice. The majority of people don't care. If the people don't care, why would a company do it?
- rbanffy 14y ago

neilk 14y ago

This is from 2003. It's not entirely outdated, but it is rather quaint. The author foresees a future where everyone has to use personal certificates to communicate, which has various pros and cons - while enabling commerce, it could be the end of anonymity. He didn't anticipate a world where the government is simply hoovering up all the plaintext.

accountoftheday 14y ago
These personal certificates are turning out to be Facebook accounts, which is arguably worse.
- antithesis 14y ago
  Are there any important sites (like news / discussion sites) that require this?

bugmenot 14y ago

read this in 2005, it gave me chills, I dare not read it again.

dnpfwfyuta 14y ago

How was this peer-to-peer Internet actually put to use, and why isn't it used that way anymore? I think I could name Usenet, but what else? Most of things I do on the Internet nowadays is using the www - a hierarchical structure. But were there p2p equivalents of any of the websites we use today?