6 ms·

This is the crux of the matter. Maybe conceptually you will be able to run some kind of open operating system with your own code, but it will be unable to acce

This is the crux of the matter. Maybe conceptually you will be able to run some kind of open operating system with your own code, but it will be unable to access software or services provided by corporate or governmental entities. This has been obvious for some time, and as soon as passkeys started popping up the endgame became clear. Pleading to the government definitely can't save us now though, because they want the control just as much as the corporations do.

pishpash 1y ago
Should have made open-source components in some key nodes of the ecosystem popular and profitable. But that was a tall order.
- nine_k 1y ago
  Open-source software permeates the Internet infrastructure. Netflix is one of the biggest contributors to FreeBSD code. Tons of TVs run OSS-based stack. But once it touches the money-extraction path, like DRM, things expectedly lock up.
kibwen 1y ago
> Maybe conceptually you will be able to run some kind of open operating system with your own code Why do you think they would even allow this? If you think that governments don't have the incentives or the means to criminalize running non-approved OSes, or the unauthorized use of non-approved hardware, you're insufficiently cynical.
- nine_k 1y ago
  It's hard to enforce, and not dangerous enough. Accessing something serious from this unapproved code is the opposite, and is being locked down. Try running your own code on your phone's baseband processor, or boot your own OS with Secure Boot on.
reddalo 1y ago
> as soon as passkeys started popping up the endgame became clear That's why I'm 100% against passkeys. I'll never use them and I'll make sure nobody I know does. They're just a lock-in mechanism.
- kleiba 1y ago
  For someone who hasn't spent any time thinking about that matter, could you please elaborate your point?
  - progval 1y ago
    "Passkeys are incompatible with open-source software" https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
    - fragmede 1y ago
      Then how come KeePassXC has them?
      - indigo945 1y ago
        The linked blog post explains it. The spec can be implemented by open source software, but the upcoming (or now current?) update to the spec enables attestation, that is, it allows the auth provider to cryptographically verify which implementation the client is using. Under this scheme, auth providers can simply choose to no longer support open source implementations like KeePassXC, and since the spec authors have already claimed that KeePassXC is "non-compliant" because it doesn't ask for a PIN on every auth request, it seems likely that that would happen.
        tadfisher 1y ago
        Attestation is dead outside of corporate environments. Apple will not implement it except through MDM.
acac10 1y ago
> passkeys started popping up the endgame became clear. This logical leap puzzles me, as it is completely unrelated to HW lock-in and a rather generic medium. This is more of a case of OP diverting a topic to shove in his pet peeve on technology they don’t like or understand.
tadfisher 1y ago
Ironically, if everyone adopted passkeys (the real deal tied to secure enclaves or TPMs), then Android malware could not steal your credentials through any kind of social engineering.

pishpash 1y ago

Should have made open-source components in some key nodes of the ecosystem popular and profitable. But that was a tall order.

nine_k 1y ago
Open-source software permeates the Internet infrastructure. Netflix is one of the biggest contributors to FreeBSD code. Tons of TVs run OSS-based stack. But once it touches the money-extraction path, like DRM, things expectedly lock up.

kibwen 1y ago

> Maybe conceptually you will be able to run some kind of open operating system with your own code Why do you think they would even allow this? If you think that governments don't have the incentives or the means to criminalize running non-approved OSes, or the unauthorized use of non-approved hardware, you're insufficiently cynical.

nine_k 1y ago
It's hard to enforce, and not dangerous enough. Accessing something serious from this unapproved code is the opposite, and is being locked down. Try running your own code on your phone's baseband processor, or boot your own OS with Secure Boot on.

reddalo 1y ago

> as soon as passkeys started popping up the endgame became clear That's why I'm 100% against passkeys. I'll never use them and I'll make sure nobody I know does. They're just a lock-in mechanism.

kleiba 1y ago
For someone who hasn't spent any time thinking about that matter, could you please elaborate your point?
- progval 1y ago
  "Passkeys are incompatible with open-source software" https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
  - fragmede 1y ago
    Then how come KeePassXC has them?
    - indigo945 1y ago
      The linked blog post explains it. The spec can be implemented by open source software, but the upcoming (or now current?) update to the spec enables attestation, that is, it allows the auth provider to cryptographically verify which implementation the client is using. Under this scheme, auth providers can simply choose to no longer support open source implementations like KeePassXC, and since the spec authors have already claimed that KeePassXC is "non-compliant" because it doesn't ask for a PIN on every auth request, it seems likely that that would happen.
      - tadfisher 1y ago
        Attestation is dead outside of corporate environments. Apple will not implement it except through MDM.

acac10 1y ago

> passkeys started popping up the endgame became clear. This logical leap puzzles me, as it is completely unrelated to HW lock-in and a rather generic medium. This is more of a case of OP diverting a topic to shove in his pet peeve on technology they don’t like or understand.

tadfisher 1y ago

Ironically, if everyone adopted passkeys (the real deal tied to secure enclaves or TPMs), then Android malware could not steal your credentials through any kind of social engineering.