13 ms·

> "Winning" doesn't have to mean owning every transistor It absolutely does. Corporations are pushing remote attestation now. They can detect if we "tampered"

> "Winning" doesn't have to mean owning every transistor It absolutely does. Corporations are pushing remote attestation now. They can detect if we "tampered" with our devices now. They discriminate against us for it. Installed your own open source software? All services denied. Can't even log into your own bank account. We're marginalized. Second class citizens. There is no choice, it's either corporate owned computers or nothing. What good is free software if we can't run it?

almostgotcaught 1y ago
[flagged]
- tinfoilhatter 1y ago
  [dead]
nebula8804 1y ago
Its a lost battle not a lost war. You have to adapt for the circumstances of the time. Today that seems to be using a device that is closed but gapped only to get the essentials done(government services, banking etc.) For everything else continue to use and improve the open offerings. In the meantime, keep fighting and supporting organizations to get laws pushed to ensure open devices can access essential services. (Administrations change, whats dire now may be hope tomorrow). I've come to realize that a lot of closed digital services are just fluff and not needed. So I try to accept that I dont need them. Its a journey.
- Gigachad 1y ago
  Multiple devices is the answer. Otherwise you end up with people having their banking hacked because they installed a game mod.
  - Zak 1y ago
    This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?
    - b_e_n_t_o_n 1y ago
      Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
      - Zak 1y ago
        Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
        Gigachad 1y ago
        There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
        deleted 1y ago
        [deleted]
        antisol 1y ago
        lolwut define "malware".
        beeflet 1y ago
        I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
- amlib 1y ago
  This may sound silly but I think desktop linux "winning" is of the utmost importance right now. Free software is pretty much shut off from the appliance/mobile computing platforms but if a sizable portion of personal computers remain using free software it will be hard for the big corporations to fully close the web or make platform attestation truly required for everything. Preserving such mindshare into the future might enable us to show people why they should care about free software and perhaps finally obviate how much malfeasance the perpetrators of closed platforms can do contrasted to the remaining open platforms on pcs (assuming people don't just completely abandon pcs...). This may also help push and convince law makers into legislating in favor of free software and open platforms.
  - matheusmoreira 1y ago
    Agreed. It's all about leverage. Without huge numbers of users, we have no leverage. Corporations can afford to just drop us because of our software preferences. That would not be the case if there were more of us.
  - deleted 1y ago
    [deleted]
  - baq 1y ago
    Desktop is still useful, but it doesn’t matter. Everything important to non-techies outside of work life is happening on the smartphone, which has had hardware attestation since forever.
    - gsf_emergency_4 1y ago
      Those are vital points! Mobile is the battleground. No company now or ever working on classical hardware attestation will understand cryptographic engineering at a basic level.. Thus FOSS has plenty of time (decades to centuries) to learn from for-profit tech's mistakes
      - Imustaskforhelp 1y ago
        Mobile is the battleground but you are forgetting how damn easy it is on android (atleast right now before google's attestation) it is to install f-droid and then install open source. People don't even do that. They don't even search for software on f-droid first and try the UI. Nope they go to play store and search software which is going to advocate for closed software because ads/review buying... You really have to expect something from the general populus as well imo. Maybe they don't know about f-droid but people say to me its not about knowledge but rather caring, they don't care and I don't know wtf to say to that. It's a very weird chicken and egg problem.
andrepd 1y ago
Yes. This is not even an exaggeration as it is, and they've barely even started.
shadowgovt 1y ago
You can run it, I'm just under no obligation to let your machine send signals to my machine that my machine will respond to if you are running software I do not trust. And that's the complexity of this era of computing. We just got finished convincing people that it made sense that they should have the right to run whatever software they wanted on hardware they owned... And then immediately the technology shifted so that most things no longer get done using exclusively hardware that you own. The RMS four freedoms approach is only chipping away at the larger problem: capitalism (I mean that literally in that the problem is that the machines that do the work, the capital, are owned by a tiny ownership class).
- ThrowawayR2 1y ago
  If the future hopes for openness in computing rely on ending capitalism, we're already toast. Nobody's going to be building the next generation of chip fabs without gargantuan amounts of funding.
  - shadowgovt 1y ago
    Capitalism isn't a necessary prerequisite for gargantuan amounts of funding.
- Dylan16807 1y ago
  > You can run it, I'm just under no obligation to let your machine send signals to my machine that my machine will respond to if you are running software I do not trust. If some piece of software I'm running is the only reason for you to refuse the connection, then you should be obligated. It's slightly similar to how protected class laws work. You can block me for no reason, but not that reason. This is especially important when I just want to run my own OS and not have people go out of their way to deliberately break things because of that.
  - shadowgovt 1y ago
    > If some piece of software I'm running is the only reason for you to refuse the connection, then you should be obligated. In general, the obligation has been soft: "If everything adheres to the protocols, it will interoperate" is how we got the Internet. And the Internet was generally useful and so self-incentivized making software work with it with minimal stumbling blocks; nobody was gating FTP clients on only working with Oracle-branded FTP servers because then you couldn't access all the other FTP servers. But that's not the only model, and I don't see an obvious argument for why should enters into it here. How does that "should" work? Is there legal compulsion? On what moral or philosophical grounds? > It's slightly similar to how protected class laws work. You can block me for no reason, but not that reason. Yes, and instituting those laws was a messy uphill battle over immutable properties of human beings. That is a far philosophical cry from "No thank you; I'd like to use all that Apple cloud tech without buying an Apple computer please." I suppose, unless we break the back of capitalism as a societal structuring model, in which case... Yep. We can make whatever laws we want if we throw out the current system.
avalys 1y ago
What are you talking about?
- Dylan16807 1y ago
  Remote attestation on Android is one of the primary examples. Banking apps and a bunch of other apps that will cut you off if you do something like root your phone.
- matheusmoreira 1y ago
  Smartphones have cryptographic hardware that can provide proof that a device has not been "tampered with". This is called attestation. The hardware attests to the fact trust has been preserved since boot. Your device will not attest to this if you install your own operating system, if you root your phone, if you do anything that they don't like, anything at all. You install your bank's app and try to use it. The bank's servers ask for the attestation. You will not have one. They decide you cannot be trusted and deny you service. Even if you can program your own keys into your device, nobody is gonna trust those keys. Why would your bank trust your own keys? They'll trust Google's keys, Apple's keys, the government's keys. You? You don't get to participate. The corporations and governments want to own your computer. They demand cryptographic proof that your device is owned by them and that they have complete control. If you don't provide it, you're banned and ostracized from everything.
  - leidenfrost 1y ago
    The most absurd part is that you totally can access the home banking from your desktop PC with Linux, without any need of hardware attestation. Suddenly it's mandatory because the device is a phone?
    - Hackbraten 1y ago
      People in Europe no longer can, thanks to PSD2.
      - 1y ago
codedokode 1y ago
This looks like a loser's move, but if your bank has no other options except for mobile app, you can buy a cheap phone for that app only, and connect it over WiFi (without SIM card) so the bank would only get your IP address from this and nothing more.
- antonvs 1y ago
  > This looks like a loser's move, but if your bank has no other options except for mobile app, you can… …switch banks.
  - DaSHacka 1y ago
    I think it's easier just to buy a shitty iPhone...
    - antonvs 1y ago
      Why would you stick with such a bad or incompetent bank? I just don’t understand that mentality.
      - matheusmoreira 1y ago
        In my country, creating a new bank used to require presidential approval. That was the status quo until only a few years ago. Things only started to improve after that requirement went away, and they certainly haven't improved enough. It's hard to describe just how deeply entrenched institutions like banks are. Normal people see all of this stuff and they do not even react at all. It's all just mindless bureaucracy that they have to put up with. Nothing can be done about it. Can't be helped, so they just accept it. So it's not wise to treat banks like normal corporations which compete with each other on the open market. They are directly legally and financially incentivized to do everything we are fighting against. For example, our banks still require us to install "security modules" on our computers in order to log into our accounts. Once upon a time I tried to reverse engineer one of those things to see why they made the computer so unusably slow. I caught it intercepting every single network connection. Told me all I needed to know. At some point society has to simply determine that it's immoral and make it illegal. It doesn't matter how much money they lose to fraud of whatever, just write it off as a business expense or something.
nzeid 1y ago
Come on, this kind of defeatism only emboldens entrenched players. Yes, we're awkwardly cornered - hardware used to be open or easily reverse-engineered. Now it isn't. The solution is to demonstrate the demand for open hardware. No one is going to walk away from money that can be made even if the market is smaller. This movement was strong enough that the incumbents themselves offered Linux-friendly hardware. We continue to see momentum in the mobile space as well with /e/OS, Fairphone, etc. GrapheneOS is pursuing alternatives to Pixel. Be brave!
- bigstrat2003 1y ago
  > No one is going to walk away from money that can be made even if the market is smaller. Unfortunately the tech industry has shown us that isn't true. For example, look at the iPhone mini - I forget the exact sales numbers others have cited, but it sold very well. There is clearly a solid market there, even if it is smaller. But Apple isn't willing to chase it, and nor are the various Android OEMs. The same may well prove true for open hardware.
  - walterbell 1y ago
    > Apple isn't willing to chase it They are, it returns next year as iPhone Fold for $2K.
  - NetMageSCW 1y ago
    Sold very well for your home business is very different than sold very well for Apple. At the time the first Mini was released, when the previous regulat iPhone (5s) was available for cheap and the new Mini had few compromises not dictated by size, it was may be 1/6 of Apple’s sales in the first year and dropped precipitously after that. It never sold well.
- bawolff 1y ago
  > Yes, we're awkwardly cornered - hardware used to be open or easily reverse-engineered. Now it isn't. When exactly was that? The 1980s? Linux hardware support is better now than its ever been.
glitchc 1y ago
> It absolutely does. I'm not sure I follow. Corporations are free to impose requirements for access to their platforms. FOSS didn't start by demanding that MS release the source code for Windows and Office. It started with developers writing their own alternatives. What helped was the open and standardized nature of the IBM/PC stack that made it all possible. Without it, FOSS would have died before birth.
- tinfoilhatter 1y ago
  When BlackRock has stake in 95% of fortune 500 companies, and we are forced to use software and services provided by them because no viable FOSS alternatives exist, it becomes, and already is, a big problem. You have to own a phone to participate in society these days. I need one to even log onto my laptop for work. Eventually I'm sure some form of digital ID / biometric information will be required for verifying my online identity. It's a slippery slope, and we're sliding into the abyss.
- cyphar 1y ago
  > Corporations are free to impose requirements for access to their platforms. To wit, hardware that I bought is not "their platform", but many corporations sure like to pretend it is. It's already not illegal to reverse engineer hardware you have bought (for the purpose of maintaining it or compatibility), regardless of how much IP lawyers like to pretend otherwise. (And even if it were illegal, I would contend that reverse engineering is a fundamental right that laws cannot rob you of.)
- matheusmoreira 1y ago
  > Corporations are free to impose requirements for access to their platforms. Yeah? They shouldn't be. Any attempt to deny us service on the basis of the software we use should be classified as discrimination. It should be a crime of the same caliber as racial discrimination.
  - glitchc 1y ago
    Sure, I can get behind that statement for certain things that we consider essential to a person's dignity and safety. Demanding access to Gmail or Facebook doesn't sound like it.
827a 1y ago
Here's a take on this which might be unpopular: Open source software lost in this domain fair and absolutely square. Desktop linux has been an extremely accessible and decent option desktops and laptops for, what, three decades; it lost in the open market. I'm typing this comment on arch linux, but even so: It failed to become a force sizable enough to fight back against the tide of corporate-owned attested consumer hardware. Android has been an option for nearly two decades. Its reasonably successful, globally. Google is now toggling the doomsday switch everyone knew they had, to force all applications to go through the Google Mothership. Samsung could fight back; they won't. Motorola could fight back; they won't. The market could revolt; it won't. Software being open source is not enough to change the tide on what the market wants. Should service providers be forced (e.g. by regulation) to support consumer hardware stacks they prefer not to? By what mechanism do you propose we stop a bank from saying "we'll only support connections from iOS devices", if not the democratic market force of ensuring enough of their customers demand access from devices running free and open source software? You get there by building products people want. Anything else is succumbing to the same authoritarian forces that you're hoping free software will stop, by forcing service providers to behave against their own interests. If that was unpopular, here's where it gets really unpopular: I don't see a doomsday-level problem with a world where, in addition to whatever awesome FOSS hardware I might have, I also have an iPhone 12 ($130 on swappa) as my "attested device" to do "attested stuff" with, like store my drivers license, banking, whatever. To me, this is... fine. Not ideal; but fine. We should fight like hell to score wins where we can, like in right to repair, parts availability, ensuring old devices are kept up to date for as long as possible (Apple is pretty good at this); but if I have to carry an old iPhone in my backpack to access my bank because they refuse to support my hypothetical GnuPhone 5, the world isn't going to end. We need nerds who care about this to stop typing on hackernews and go start a phone hardware company. That's it.
- DaSHacka 1y ago
  > To me, this is... fine. Not ideal; but fine. We should fight like hell to score wins where we can, like in right to repair, parts availability, ensuring old devices are kept up to date for as long as possible (Apple is pretty good at this); but if I have to carry an old iPhone in my backpack to access my bank because they refuse to support my hypothetical GnuPhone 5, the world isn't going to end. But even as you say, as you're using Arch as your desktop computer, things may be fine now, but they're only going to get worse. Should we all have to carry two laptops because anything running a free software core is just utterly unusable due to remote attestation? > We need nerds who care about this to stop typing on hackernews and go start a phone hardware company. That's it. Didn't you just spend most of your comment talking about how the market forces don't care anyway? Would good is starting up a phone hardware company that will ultimately go bust due to total apathy of the general consumer?
denote-demote 1y ago
Absolutely. The takeover of "free software" by the enemies of freedom is not the "winning" of free software.
bhawks 1y ago
This is one of the reasons to embrace crypto - having an intermediary with direct control over your finances is absurd.
- mulmen 1y ago
  That’s the value proposition of banks actually. Unfortunately we have let them delegate responsibility for fraud.
- matheusmoreira 1y ago
  I agree. I really like Monero.
- DaSHacka 1y ago
  This, and especially when the intermediaries attempt to police what you can and can't purchase with your own money when you wish to purchase a fully legal good/service (see: Visa and Mastercard fiasco)
- phs318u 1y ago
  Are you able to source all (or even the majority) of goods and services that YOU use, within the crypto ecosystem? Are you getting paid directly in crypto (or if you offer goods/services, do you only accept crypto)? i.e. direct exchange of crypto for goods and services? If not, you are using an intermediary to convert crypto into fiat and vice-versa. Do you invest in ANY non-crypto assets? If not, you are relying on a financial intermediary. Do you practice true self-custody of your crypto? If not, you are relying on intermediaries. For all the theory about the being financially independent of intermediaries, in practice it is nigh on impossible for most folks living in the real economy. Meaning that for most of them, even the crypto-knowledgeable, "embracing crypto" means a compromise with the "absurd" as you put it.
- bawolff 1y ago
  Nothing is stopping your crypto exchange from requiring remote attestation. Nothing is stopping you from keeping fiat under your mattress. This isn't really a crypto issue.
- 1y ago
wizardforhire 1y ago
(This is not directed to you but the wider community writ large, you just happened to be the one to kick the hornets nest) You know… there was time before this latest generation started calling everyone that complained to a manager a karen… that complaining to manager would resolve issues… and if that failed, publishing your story and refusing to do business with someone was seen as proper conduct. Banks!!! Lol! Are the most fragile institutions ever! Fdic, exists for a reason… get enough people to withdraw their money all at once and see what happens. Open source people that want to stick to your grit… don’t work with banks that won’t let you use open source software. Oh is that too hard for ya? If you’re not compiling your own slackware distro than you have no leg to stand on (/s) But seriously, use a local bank and try solving human problems by dealing with human’s. Quit trying to tech everything… if the open source community would get unified and actualize… thats a fuck ton of people! Here’s another crazy concept that the oss community could do… they could literally just open their own bank… voila (its not as hard as it seems and takes way less money than you think)
- eduction 1y ago
  M-x dispute-charge
- matheusmoreira 1y ago
  > try solving human problems by dealing with human’s Welp. I actually tried it. Here's my experience. I contacted my banks and got in touch with their managers and devs. They do have APIs. I wanted to use those to create my own software with read only access to my account. I didn't even want to transfer money anywhere, just get my transactions for accounting purposes. I was using ledger at the time and was getting tired of manually inputting everything into the journal. I eventually discovered I would need to incorporate and beg the central bank for permission to touch the financial system.
  - signaleleven 1y ago
    I left a startup around 6 months ago. We were around 30 employees and we had working software and were starting to get some users. We couldn't get the banks to work with us. We were able to get some access through third-party companies and it sucked. I went to a meeting a few years ago with a big investment company. They had a team of 30 people trying to figure out how to reliably read financial documents to get people's financial information to serve it back to them. At this startup we spent a ton of time doing similar things, and paying another company to read our user's financial documents so we could get their info. My point is, even if you incorporated and begged I'm not sure you'd have success.
marcodiego 1y ago
As I said other times: we need a Free Hardware Foundation now like we needed the Free Software Foundation for many years. The GSD (GNU software distribution) is basically a standard GNU-Linux distro using GUIX as the package manager seems very interesting, but if you want to run 100% free software on a RYF-certified device you'll have to pay a lot of extra money for 15 years old class hardware. We need the equivalent of a Linus Torvalds + Richard Stallman but hardware. We were lucky to have had both for software at the same time. We need the same luck again now.
- matheusmoreira 1y ago
  Pointless. Silicon fabs currently cost billions of dollars. They are single points of failure. Even if the market starts trending towards openness, governments can just regulate a backdoor into these fabs. They have every incentive in the world to do it. Democratized access to cryptography is subversive. We need some kind of 3D printer that can print computer chips. We need the ability to make our own hardware at home, just like we can make our own software at home. Democratized electronics fabrication. That's the only way we'll be saved.
  - necovek 1y ago
    While I, for the most part, agree to this in principle, at the moment, general compute hardware production is relatively safe (or so it seems). But when it comes to humongous costs, the fact that even "open source AI models" don't have their training data available (the actual "source") is one thing, but even if it was, it'd be impossible to retrain a model "at home". But if data was available, I am sure any of the existing free software foundations, or a new one, could rally users around sponsoring one DC. We are back in the "mainframe" days where top-end compute is accessible only to few (with lots of money).
userbinator 1y ago
Y'all should've pushed back far more strongly against their "security" long ago... but now the only way forward is to keep fighting.
- DaSHacka 1y ago
  But they did, there's even people in this thread saying the FSF/GNU is too strict with their requirements and is akin to the "old man yelling at cloud". What else are they supposed to do then? Start Luigi'ing people?
  - shadowgovt 1y ago
    Often times the problem is literally yelling at Cloud. Cloud doesn't have an automatic philosophical match to the way the Freedoms were justified originally. The Freedoms are based on the notion that you should have the right to do what you will with hardware you own; you don't own someone else's hardware in the Cloud.
    - matheusmoreira 1y ago
      > The Freedoms are based on the notion that you should have the right to do what you will with hardware you own Then why do they keep trying to own our devices? Why do we have all this attestation nonsense designed to subvert our ability to do what we will with the hardware we own? > you don't own someone else's hardware in the Cloud Then they should keep their ownership in the cloud where it belongs. My software will talk to their software through the network boundary. All is well. Dictating what software I can or can't use on my machine to talk to their software is an invasion of my territory. It shouldn't matter whether I use their official app, my own custom client or some curl script to achieve my own ends. If they're going to try and usurp control of my machine, then I'm gonna start relativizing their "freedoms" as well.
      - shadowgovt 1y ago
        The problem is that the philosophy doesn't extend to networking. You are free to do whatever you want with your hardware. Rip the chip out and install firmware that will boot anyway when the missing chip doesn't POST. ... and when you try to connect to my server, I will send a challenge-response that you needed that chip to answer. When that fails, I'm free to do what I want with my hardware. Which is drop or reject your incoming request because I don't trust you. So far, this situation has been stable because it's a lot more valuable to me to trust you than not; the benefit I get from having you as a user outweighs the harm that can happen if your machine has been modified and does something that breaks my protocols. In fact, the rule on the Internet has basically been "What happens in your house you have control over; what comes in from the outside is assumed to be pure screaming madness until it's validated" for that reason (among others). ... but validation is expensive and I can see why some companies would want to push the whole validation story onto "We use attestation to confirm that we can trust the software works the way we expect it to on the other side of the machine." I personally think it's a bit of a dumb experiment (I don't trust attestation itself to succeed, not when the end-user fundamentally still owns the device and every hacker on the planet can attack the attestation protocol all day if they want; I haven't seen a system that pretends it controls both sides of the network ultimately succeed yet and I don't expect I will this time either). But if companies want to win stupid prizes I don't think we need to do anything more than "not work with them" to help them along. It's hard to do otherwise without doing injury to the core concept "You own your own machine" whether 'you' is one person with a smartphone or a corporation with a datacenter.
deleted 1y ago
[deleted]
mariusor 1y ago
Where does this resigned opinion that open source can not do attestation come from? Do you really think it's impossible to build the attestation mechanisms inside open source OSs?
- dvdkon 1y ago
  Checking what software a user is running can be done with open source software, but actually doing so takes away the user's right to run modified copies of software. The fact that it basically needs hardware-backed DRM also doesn't help.
  - mariusor 1y ago
    I see, it makes sense. But I feel like it is a worth while compromise. Attestation as I understand it is to allow third parties to trust a user's computing device for purposes of handling their sensitive data (both from the user's and the third party's point of view) in a way that doesn't rely strictly on the user's savvy for keeping everything leak proof. Even if this data belongs to me - as said user - I still think that the existence of open source attested software is a net benefit in the bigger picture because the future looks more and more dependent on secure computation.
willtemperley 1y ago
I think free software has to adapt. I find it very difficult to run QGIS on a modern Mac with an up-to-date OS. It won't run for genuine security reasons, not because some corporation doesn't want me to run free software.
eleveriven 1y ago
I think it's worth distinguishing between what "winning" should mean and what's still possible in the world we're in. We may not win by owning every transistor, but we sure as hell lose if we stop demanding the right to.
Hnrobert42 1y ago
If you're definition of winning is owning every transistor, then it is an unproductive definition. Under that definition, we have and will always lose.
indymike 1y ago
> Corporations are pushing remote attestation now. They can detect if we "tampered" with our devices now. This is not new, and has been the case since the mid 1990s. > Installed your own open source software? All services denied. I access five different banks with linux every day. I've never had this problem. > We're marginalized. I've made a great life for my family largely using free software to do so. I don't feel marginalized.

almostgotcaught 1y ago

[flagged]

tinfoilhatter 1y ago
[dead]

nebula8804 1y ago

Its a lost battle not a lost war. You have to adapt for the circumstances of the time. Today that seems to be using a device that is closed but gapped only to get the essentials done(government services, banking etc.) For everything else continue to use and improve the open offerings. In the meantime, keep fighting and supporting organizations to get laws pushed to ensure open devices can access essential services. (Administrations change, whats dire now may be hope tomorrow). I've come to realize that a lot of closed digital services are just fluff and not needed. So I try to accept that I dont need them. Its a journey.

Gigachad 1y ago
Multiple devices is the answer. Otherwise you end up with people having their banking hacked because they installed a game mod.
- Zak 1y ago
  This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?
  - b_e_n_t_o_n 1y ago
    Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
    - Zak 1y ago
      Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
      - Gigachad 1y ago
        There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
        deleted 1y ago
        [deleted]
        antisol 1y ago
        lolwut define "malware".
        beeflet 1y ago
        I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
amlib 1y ago
This may sound silly but I think desktop linux "winning" is of the utmost importance right now. Free software is pretty much shut off from the appliance/mobile computing platforms but if a sizable portion of personal computers remain using free software it will be hard for the big corporations to fully close the web or make platform attestation truly required for everything. Preserving such mindshare into the future might enable us to show people why they should care about free software and perhaps finally obviate how much malfeasance the perpetrators of closed platforms can do contrasted to the remaining open platforms on pcs (assuming people don't just completely abandon pcs...). This may also help push and convince law makers into legislating in favor of free software and open platforms.
- matheusmoreira 1y ago
  Agreed. It's all about leverage. Without huge numbers of users, we have no leverage. Corporations can afford to just drop us because of our software preferences. That would not be the case if there were more of us.
- deleted 1y ago
  [deleted]
- baq 1y ago
  Desktop is still useful, but it doesn’t matter. Everything important to non-techies outside of work life is happening on the smartphone, which has had hardware attestation since forever.
  - gsf_emergency_4 1y ago
    Those are vital points! Mobile is the battleground. No company now or ever working on classical hardware attestation will understand cryptographic engineering at a basic level.. Thus FOSS has plenty of time (decades to centuries) to learn from for-profit tech's mistakes
    - Imustaskforhelp 1y ago
      Mobile is the battleground but you are forgetting how damn easy it is on android (atleast right now before google's attestation) it is to install f-droid and then install open source. People don't even do that. They don't even search for software on f-droid first and try the UI. Nope they go to play store and search software which is going to advocate for closed software because ads/review buying... You really have to expect something from the general populus as well imo. Maybe they don't know about f-droid but people say to me its not about knowledge but rather caring, they don't care and I don't know wtf to say to that. It's a very weird chicken and egg problem.

andrepd 1y ago

Yes. This is not even an exaggeration as it is, and they've barely even started.

shadowgovt 1y ago

You can run it, I'm just under no obligation to let your machine send signals to my machine that my machine will respond to if you are running software I do not trust. And that's the complexity of this era of computing. We just got finished convincing people that it made sense that they should have the right to run whatever software they wanted on hardware they owned... And then immediately the technology shifted so that most things no longer get done using exclusively hardware that you own. The RMS four freedoms approach is only chipping away at the larger problem: capitalism (I mean that literally in that the problem is that the machines that do the work, the capital, are owned by a tiny ownership class).

ThrowawayR2 1y ago
If the future hopes for openness in computing rely on ending capitalism, we're already toast. Nobody's going to be building the next generation of chip fabs without gargantuan amounts of funding.
- shadowgovt 1y ago
  Capitalism isn't a necessary prerequisite for gargantuan amounts of funding.
Dylan16807 1y ago
> You can run it, I'm just under no obligation to let your machine send signals to my machine that my machine will respond to if you are running software I do not trust. If some piece of software I'm running is the only reason for you to refuse the connection, then you should be obligated. It's slightly similar to how protected class laws work. You can block me for no reason, but not that reason. This is especially important when I just want to run my own OS and not have people go out of their way to deliberately break things because of that.
- shadowgovt 1y ago
  > If some piece of software I'm running is the only reason for you to refuse the connection, then you should be obligated. In general, the obligation has been soft: "If everything adheres to the protocols, it will interoperate" is how we got the Internet. And the Internet was generally useful and so self-incentivized making software work with it with minimal stumbling blocks; nobody was gating FTP clients on only working with Oracle-branded FTP servers because then you couldn't access all the other FTP servers. But that's not the only model, and I don't see an obvious argument for why should enters into it here. How does that "should" work? Is there legal compulsion? On what moral or philosophical grounds? > It's slightly similar to how protected class laws work. You can block me for no reason, but not that reason. Yes, and instituting those laws was a messy uphill battle over immutable properties of human beings. That is a far philosophical cry from "No thank you; I'd like to use all that Apple cloud tech without buying an Apple computer please." I suppose, unless we break the back of capitalism as a societal structuring model, in which case... Yep. We can make whatever laws we want if we throw out the current system.

avalys 1y ago

What are you talking about?

Dylan16807 1y ago
Remote attestation on Android is one of the primary examples. Banking apps and a bunch of other apps that will cut you off if you do something like root your phone.
matheusmoreira 1y ago
Smartphones have cryptographic hardware that can provide proof that a device has not been "tampered with". This is called attestation. The hardware attests to the fact trust has been preserved since boot. Your device will not attest to this if you install your own operating system, if you root your phone, if you do anything that they don't like, anything at all. You install your bank's app and try to use it. The bank's servers ask for the attestation. You will not have one. They decide you cannot be trusted and deny you service. Even if you can program your own keys into your device, nobody is gonna trust those keys. Why would your bank trust your own keys? They'll trust Google's keys, Apple's keys, the government's keys. You? You don't get to participate. The corporations and governments want to own your computer. They demand cryptographic proof that your device is owned by them and that they have complete control. If you don't provide it, you're banned and ostracized from everything.
- leidenfrost 1y ago
  The most absurd part is that you totally can access the home banking from your desktop PC with Linux, without any need of hardware attestation. Suddenly it's mandatory because the device is a phone?
  - Hackbraten 1y ago
    People in Europe no longer can, thanks to PSD2.
    - 1y ago

codedokode 1y ago

This looks like a loser's move, but if your bank has no other options except for mobile app, you can buy a cheap phone for that app only, and connect it over WiFi (without SIM card) so the bank would only get your IP address from this and nothing more.

antonvs 1y ago
> This looks like a loser's move, but if your bank has no other options except for mobile app, you can… …switch banks.
- DaSHacka 1y ago
  I think it's easier just to buy a shitty iPhone...
  - antonvs 1y ago
    Why would you stick with such a bad or incompetent bank? I just don’t understand that mentality.
    - matheusmoreira 1y ago
      In my country, creating a new bank used to require presidential approval. That was the status quo until only a few years ago. Things only started to improve after that requirement went away, and they certainly haven't improved enough. It's hard to describe just how deeply entrenched institutions like banks are. Normal people see all of this stuff and they do not even react at all. It's all just mindless bureaucracy that they have to put up with. Nothing can be done about it. Can't be helped, so they just accept it. So it's not wise to treat banks like normal corporations which compete with each other on the open market. They are directly legally and financially incentivized to do everything we are fighting against. For example, our banks still require us to install "security modules" on our computers in order to log into our accounts. Once upon a time I tried to reverse engineer one of those things to see why they made the computer so unusably slow. I caught it intercepting every single network connection. Told me all I needed to know. At some point society has to simply determine that it's immoral and make it illegal. It doesn't matter how much money they lose to fraud of whatever, just write it off as a business expense or something.

nzeid 1y ago

Come on, this kind of defeatism only emboldens entrenched players. Yes, we're awkwardly cornered - hardware used to be open or easily reverse-engineered. Now it isn't. The solution is to demonstrate the demand for open hardware. No one is going to walk away from money that can be made even if the market is smaller. This movement was strong enough that the incumbents themselves offered Linux-friendly hardware. We continue to see momentum in the mobile space as well with /e/OS, Fairphone, etc. GrapheneOS is pursuing alternatives to Pixel. Be brave!

bigstrat2003 1y ago
> No one is going to walk away from money that can be made even if the market is smaller. Unfortunately the tech industry has shown us that isn't true. For example, look at the iPhone mini - I forget the exact sales numbers others have cited, but it sold very well. There is clearly a solid market there, even if it is smaller. But Apple isn't willing to chase it, and nor are the various Android OEMs. The same may well prove true for open hardware.
- walterbell 1y ago
  > Apple isn't willing to chase it They are, it returns next year as iPhone Fold for $2K.
- NetMageSCW 1y ago
  Sold very well for your home business is very different than sold very well for Apple. At the time the first Mini was released, when the previous regulat iPhone (5s) was available for cheap and the new Mini had few compromises not dictated by size, it was may be 1/6 of Apple’s sales in the first year and dropped precipitously after that. It never sold well.
bawolff 1y ago
> Yes, we're awkwardly cornered - hardware used to be open or easily reverse-engineered. Now it isn't. When exactly was that? The 1980s? Linux hardware support is better now than its ever been.

glitchc 1y ago

> It absolutely does. I'm not sure I follow. Corporations are free to impose requirements for access to their platforms. FOSS didn't start by demanding that MS release the source code for Windows and Office. It started with developers writing their own alternatives. What helped was the open and standardized nature of the IBM/PC stack that made it all possible. Without it, FOSS would have died before birth.

tinfoilhatter 1y ago
When BlackRock has stake in 95% of fortune 500 companies, and we are forced to use software and services provided by them because no viable FOSS alternatives exist, it becomes, and already is, a big problem. You have to own a phone to participate in society these days. I need one to even log onto my laptop for work. Eventually I'm sure some form of digital ID / biometric information will be required for verifying my online identity. It's a slippery slope, and we're sliding into the abyss.
cyphar 1y ago
> Corporations are free to impose requirements for access to their platforms. To wit, hardware that I bought is not "their platform", but many corporations sure like to pretend it is. It's already not illegal to reverse engineer hardware you have bought (for the purpose of maintaining it or compatibility), regardless of how much IP lawyers like to pretend otherwise. (And even if it were illegal, I would contend that reverse engineering is a fundamental right that laws cannot rob you of.)
matheusmoreira 1y ago
> Corporations are free to impose requirements for access to their platforms. Yeah? They shouldn't be. Any attempt to deny us service on the basis of the software we use should be classified as discrimination. It should be a crime of the same caliber as racial discrimination.
- glitchc 1y ago
  Sure, I can get behind that statement for certain things that we consider essential to a person's dignity and safety. Demanding access to Gmail or Facebook doesn't sound like it.

827a 1y ago

Here's a take on this which might be unpopular: Open source software lost in this domain fair and absolutely square. Desktop linux has been an extremely accessible and decent option desktops and laptops for, what, three decades; it lost in the open market. I'm typing this comment on arch linux, but even so: It failed to become a force sizable enough to fight back against the tide of corporate-owned attested consumer hardware. Android has been an option for nearly two decades. Its reasonably successful, globally. Google is now toggling the doomsday switch everyone knew they had, to force all applications to go through the Google Mothership. Samsung could fight back; they won't. Motorola could fight back; they won't. The market could revolt; it won't. Software being open source is not enough to change the tide on what the market wants. Should service providers be forced (e.g. by regulation) to support consumer hardware stacks they prefer not to? By what mechanism do you propose we stop a bank from saying "we'll only support connections from iOS devices", if not the democratic market force of ensuring enough of their customers demand access from devices running free and open source software? You get there by building products people want. Anything else is succumbing to the same authoritarian forces that you're hoping free software will stop, by forcing service providers to behave against their own interests. If that was unpopular, here's where it gets really unpopular: I don't see a doomsday-level problem with a world where, in addition to whatever awesome FOSS hardware I might have, I also have an iPhone 12 ($130 on swappa) as my "attested device" to do "attested stuff" with, like store my drivers license, banking, whatever. To me, this is... fine. Not ideal; but fine. We should fight like hell to score wins where we can, like in right to repair, parts availability, ensuring old devices are kept up to date for as long as possible (Apple is pretty good at this); but if I have to carry an old iPhone in my backpack to access my bank because they refuse to support my hypothetical GnuPhone 5, the world isn't going to end. We need nerds who care about this to stop typing on hackernews and go start a phone hardware company. That's it.

DaSHacka 1y ago
> To me, this is... fine. Not ideal; but fine. We should fight like hell to score wins where we can, like in right to repair, parts availability, ensuring old devices are kept up to date for as long as possible (Apple is pretty good at this); but if I have to carry an old iPhone in my backpack to access my bank because they refuse to support my hypothetical GnuPhone 5, the world isn't going to end. But even as you say, as you're using Arch as your desktop computer, things may be fine now, but they're only going to get worse. Should we all have to carry two laptops because anything running a free software core is just utterly unusable due to remote attestation? > We need nerds who care about this to stop typing on hackernews and go start a phone hardware company. That's it. Didn't you just spend most of your comment talking about how the market forces don't care anyway? Would good is starting up a phone hardware company that will ultimately go bust due to total apathy of the general consumer?

denote-demote 1y ago

Absolutely. The takeover of "free software" by the enemies of freedom is not the "winning" of free software.

bhawks 1y ago

This is one of the reasons to embrace crypto - having an intermediary with direct control over your finances is absurd.

mulmen 1y ago
That’s the value proposition of banks actually. Unfortunately we have let them delegate responsibility for fraud.
matheusmoreira 1y ago
I agree. I really like Monero.
DaSHacka 1y ago
This, and especially when the intermediaries attempt to police what you can and can't purchase with your own money when you wish to purchase a fully legal good/service (see: Visa and Mastercard fiasco)
phs318u 1y ago
Are you able to source all (or even the majority) of goods and services that YOU use, within the crypto ecosystem? Are you getting paid directly in crypto (or if you offer goods/services, do you only accept crypto)? i.e. direct exchange of crypto for goods and services? If not, you are using an intermediary to convert crypto into fiat and vice-versa. Do you invest in ANY non-crypto assets? If not, you are relying on a financial intermediary. Do you practice true self-custody of your crypto? If not, you are relying on intermediaries. For all the theory about the being financially independent of intermediaries, in practice it is nigh on impossible for most folks living in the real economy. Meaning that for most of them, even the crypto-knowledgeable, "embracing crypto" means a compromise with the "absurd" as you put it.
bawolff 1y ago
Nothing is stopping your crypto exchange from requiring remote attestation. Nothing is stopping you from keeping fiat under your mattress. This isn't really a crypto issue.
1y ago

wizardforhire 1y ago

(This is not directed to you but the wider community writ large, you just happened to be the one to kick the hornets nest) You know… there was time before this latest generation started calling everyone that complained to a manager a karen… that complaining to manager would resolve issues… and if that failed, publishing your story and refusing to do business with someone was seen as proper conduct. Banks!!! Lol! Are the most fragile institutions ever! Fdic, exists for a reason… get enough people to withdraw their money all at once and see what happens. Open source people that want to stick to your grit… don’t work with banks that won’t let you use open source software. Oh is that too hard for ya? If you’re not compiling your own slackware distro than you have no leg to stand on (/s) But seriously, use a local bank and try solving human problems by dealing with human’s. Quit trying to tech everything… if the open source community would get unified and actualize… thats a fuck ton of people! Here’s another crazy concept that the oss community could do… they could literally just open their own bank… voila (its not as hard as it seems and takes way less money than you think)

eduction 1y ago
M-x dispute-charge
matheusmoreira 1y ago
> try solving human problems by dealing with human’s Welp. I actually tried it. Here's my experience. I contacted my banks and got in touch with their managers and devs. They do have APIs. I wanted to use those to create my own software with read only access to my account. I didn't even want to transfer money anywhere, just get my transactions for accounting purposes. I was using ledger at the time and was getting tired of manually inputting everything into the journal. I eventually discovered I would need to incorporate and beg the central bank for permission to touch the financial system.
- signaleleven 1y ago
  I left a startup around 6 months ago. We were around 30 employees and we had working software and were starting to get some users. We couldn't get the banks to work with us. We were able to get some access through third-party companies and it sucked. I went to a meeting a few years ago with a big investment company. They had a team of 30 people trying to figure out how to reliably read financial documents to get people's financial information to serve it back to them. At this startup we spent a ton of time doing similar things, and paying another company to read our user's financial documents so we could get their info. My point is, even if you incorporated and begged I'm not sure you'd have success.

marcodiego 1y ago

As I said other times: we need a Free Hardware Foundation now like we needed the Free Software Foundation for many years. The GSD (GNU software distribution) is basically a standard GNU-Linux distro using GUIX as the package manager seems very interesting, but if you want to run 100% free software on a RYF-certified device you'll have to pay a lot of extra money for 15 years old class hardware. We need the equivalent of a Linus Torvalds + Richard Stallman but hardware. We were lucky to have had both for software at the same time. We need the same luck again now.

matheusmoreira 1y ago
Pointless. Silicon fabs currently cost billions of dollars. They are single points of failure. Even if the market starts trending towards openness, governments can just regulate a backdoor into these fabs. They have every incentive in the world to do it. Democratized access to cryptography is subversive. We need some kind of 3D printer that can print computer chips. We need the ability to make our own hardware at home, just like we can make our own software at home. Democratized electronics fabrication. That's the only way we'll be saved.
- necovek 1y ago
  While I, for the most part, agree to this in principle, at the moment, general compute hardware production is relatively safe (or so it seems). But when it comes to humongous costs, the fact that even "open source AI models" don't have their training data available (the actual "source") is one thing, but even if it was, it'd be impossible to retrain a model "at home". But if data was available, I am sure any of the existing free software foundations, or a new one, could rally users around sponsoring one DC. We are back in the "mainframe" days where top-end compute is accessible only to few (with lots of money).

userbinator 1y ago

Y'all should've pushed back far more strongly against their "security" long ago... but now the only way forward is to keep fighting.

DaSHacka 1y ago
But they did, there's even people in this thread saying the FSF/GNU is too strict with their requirements and is akin to the "old man yelling at cloud". What else are they supposed to do then? Start Luigi'ing people?
- shadowgovt 1y ago
  Often times the problem is literally yelling at Cloud. Cloud doesn't have an automatic philosophical match to the way the Freedoms were justified originally. The Freedoms are based on the notion that you should have the right to do what you will with hardware you own; you don't own someone else's hardware in the Cloud.
  - matheusmoreira 1y ago
    > The Freedoms are based on the notion that you should have the right to do what you will with hardware you own Then why do they keep trying to own our devices? Why do we have all this attestation nonsense designed to subvert our ability to do what we will with the hardware we own? > you don't own someone else's hardware in the Cloud Then they should keep their ownership in the cloud where it belongs. My software will talk to their software through the network boundary. All is well. Dictating what software I can or can't use on my machine to talk to their software is an invasion of my territory. It shouldn't matter whether I use their official app, my own custom client or some curl script to achieve my own ends. If they're going to try and usurp control of my machine, then I'm gonna start relativizing their "freedoms" as well.
    - shadowgovt 1y ago
      The problem is that the philosophy doesn't extend to networking. You are free to do whatever you want with your hardware. Rip the chip out and install firmware that will boot anyway when the missing chip doesn't POST. ... and when you try to connect to my server, I will send a challenge-response that you needed that chip to answer. When that fails, I'm free to do what I want with my hardware. Which is drop or reject your incoming request because I don't trust you. So far, this situation has been stable because it's a lot more valuable to me to trust you than not; the benefit I get from having you as a user outweighs the harm that can happen if your machine has been modified and does something that breaks my protocols. In fact, the rule on the Internet has basically been "What happens in your house you have control over; what comes in from the outside is assumed to be pure screaming madness until it's validated" for that reason (among others). ... but validation is expensive and I can see why some companies would want to push the whole validation story onto "We use attestation to confirm that we can trust the software works the way we expect it to on the other side of the machine." I personally think it's a bit of a dumb experiment (I don't trust attestation itself to succeed, not when the end-user fundamentally still owns the device and every hacker on the planet can attack the attestation protocol all day if they want; I haven't seen a system that pretends it controls both sides of the network ultimately succeed yet and I don't expect I will this time either). But if companies want to win stupid prizes I don't think we need to do anything more than "not work with them" to help them along. It's hard to do otherwise without doing injury to the core concept "You own your own machine" whether 'you' is one person with a smartphone or a corporation with a datacenter.

deleted 1y ago

[deleted]

mariusor 1y ago

Where does this resigned opinion that open source can not do attestation come from? Do you really think it's impossible to build the attestation mechanisms inside open source OSs?

dvdkon 1y ago
Checking what software a user is running can be done with open source software, but actually doing so takes away the user's right to run modified copies of software. The fact that it basically needs hardware-backed DRM also doesn't help.
- mariusor 1y ago
  I see, it makes sense. But I feel like it is a worth while compromise. Attestation as I understand it is to allow third parties to trust a user's computing device for purposes of handling their sensitive data (both from the user's and the third party's point of view) in a way that doesn't rely strictly on the user's savvy for keeping everything leak proof. Even if this data belongs to me - as said user - I still think that the existence of open source attested software is a net benefit in the bigger picture because the future looks more and more dependent on secure computation.

willtemperley 1y ago

I think free software has to adapt. I find it very difficult to run QGIS on a modern Mac with an up-to-date OS. It won't run for genuine security reasons, not because some corporation doesn't want me to run free software.

eleveriven 1y ago

I think it's worth distinguishing between what "winning" should mean and what's still possible in the world we're in. We may not win by owning every transistor, but we sure as hell lose if we stop demanding the right to.

Hnrobert42 1y ago

If you're definition of winning is owning every transistor, then it is an unproductive definition. Under that definition, we have and will always lose.

indymike 1y ago

> Corporations are pushing remote attestation now. They can detect if we "tampered" with our devices now. This is not new, and has been the case since the mid 1990s. > Installed your own open source software? All services denied. I access five different banks with linux every day. I've never had this problem. > We're marginalized. I've made a great life for my family largely using free software to do so. I don't feel marginalized.