5 ms·
It's important to understand that we could genuinely lose general purpose computing. I don't think it's in serious danger at the moment, but we've been in the m
by everdrive 1y ago
It's important to understand that we could genuinely lose general purpose computing. I don't think it's in serious danger at the moment, but we've been in the midst of a slide in that direction for the last 10-15 years. Part of it is mobile phones, part of it is TPM, part of it is market forces. The latest turn is strictly political. We've really foolishly built the technology necessary for authoritarianism just a few years head of a general global trend towards authoritarianism. At the moment, anyone can use Linux; it's better and easier than ever. Will the laws of your country make it harder or more difficult to avoid? Will major vendors lock you out of basic functions? Will age verification require an agent run on your Windows or macOS computer? (or worse, require the use of a smart phone just to use the internet?)
We're not anywhere there yet, but we're closer than we've ever been, and things keep moving in the wrong direction.
- nxor 1y ago[flagged]
- everdrive 1y agoCertainly there was more authoritarianism in past times, but we haven't previously had authoritarian movements at the same time that we've the internet and ubiquitous computing. Authoritarianism isn't meant to be a scare word; in the US, you have the total fecklessness of Congress, the expansion of the executive under every single president in the 21st century. (it's still authoritarianism even if some people like what is being done unilaterally by the executive. eg: both Trump and Biden sought and acted with expanded executive powers. Even if you like the outcomes, it's still actually quite bad. Neither party seems capable of imagining that someone they disagree with could be elected and use those same powers. It's baffling.) You have a lot of governmental changes in parts of Europe, etc. I think it's pretty uncontroversial that there is a global trend towards authoritarianism, but I'm happy to hear other opinions.
- cool_man_bob 1y agoThat’s a cute soapbox, but I fail to see what it has to do with software freedom.
- poszlem 1y agoDon’t think of it as one side against the other. It’s a dialectical process, two extremes, like communists and fascists, seemingly locked in mortal opposition, yet through their struggle, pushing the same totalitarian machinery forward. That old pattern feels disturbingly familiar today.
- andai 1y agoSo it's just about incentives right? Who has the power to make these decisions, and what are they likely to decide, given their incentives?
- mrkeen 1y ago* Government makes services available via auth app of their choosing. * Auth app deploys to one or two app stores. No financial incentive to do otherwise. * App stores remain within walled gardens. Tracking, DRM, proprietary drivers come with.
- timefirstgrav 1y agoOh wow... The idea of losing general purpose computing is a terrifying thought I've never considered before.
- bo1024 1y ago"The Coming War on General Computation", Cory Doctorow (2011). Speech: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg Transcript: https://en.wikisource.org/wiki/The_Coming_War_on_General_Computation https://en.wikisource.org/wiki/The_Coming_War_on_General_Com... (Of course, Stallman warned of this type of thing much earlier as well.)
- chipsrafferty 1y ago[flagged]
- ekjhgkejhgk 1y agoHe didn't assault anyone. He said a bunch of things. They've all been collected here: https://stallman-report.org/ https://stallman-report.org/ What I love about that report is that the author created it with the intention of making Stallman look bad. And if you look at the author's summaries, he looks bad. However, the author also made us the favour of collecting all the statements in one single place. And if you look at the things that Stallman actually said (as opposed to the author's summaries) he doesn't look bad, he looks strictly correct.
- fsflover 1y agoAnd there's a reply to that: https://geoff.greer.fm/2019/09/30/in-defense-of-richard-stallman/ https://geoff.greer.fm/2019/09/30/in-defense-of-richard-stal... via https://news.ycombinator.com/item?id=21113414 https://news.ycombinator.com/item?id=21113414
- ekjhgkejhgk 1y ago
- walterbell 1y agoEU CRA (enforced Dec 2027) prohibits shipment of non-certified binaries for "critical" software, including firmware and hypervisors. Operating systems like Linux are categorized as "important" software, https://www.whitecase.com/insight-alert/cyber-resilience-act-clock-ticking-compliance https://www.whitecase.com/insight-alert/cyber-resilience-act...
- skywal_l 1y agoI might be wrong but I don't think that open source software are subject to the CRA. If you look at article (18) here [0] it seems to explicitly exclude free software that you download from the internet. [0] https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng
- walterbell 1y agoThat depends on the definition of "commercial activity". Some groups have influenced the legislation to exclude specific activity. Some supply chain roles, including developers who contribute patches, are excluded. Others can seek guidance on interpreting the legal text. - software that are not monetised by their manufacturers should not be considered to be a commercial activity. - supply of products with digital elements qualifying as free and open-source software components intended for integration by other manufacturers into their own products with digital elements should be considered to be making available on the market only if the component is monetised by its original manufacturer. - development of products with digital elements qualifying as free and open-source software by not-for-profit organisations should not be considered to be a commercial activity provided that the organisation is set up in such a way that ensures that all earnings after costs are used to achieve not-for-profit objectives. - does not apply to natural or legal persons who contribute with source code to products with digital elements qualifying as free and open-source software that are not under their responsibility.
- rcxdude 1y agoThis doesn't in general inhibit hobbyists, and for the most part for companies it just adds some fairly sensible requirements around handling security vulnerabilities and making updates available. It is in theory a framework that could be used to add more onerous requirements in future, of course.
- elric 1y agoDeath by a thousand cuts. TPM, secure attestation, age verification, DRM, and probably more things I'm forgetting right now.
- coldpie 1y agoPasskeys are another brick in this wall. The authors of the spec built in client software identification and attestation, which means authenticating parties can require you to only use certain, closed-source passkey clients. It's not hard to imagine a future where only blessed Passkey clients, such as Microsoft's, Apple's, and Google's implementations, are allowed by most services.
- elric 1y agoHeh, I'm working on a blog post about this very topic. Passkeys are ... weird. There's a lot of potential for gatekeeping, where websites can indeed require you to use device-bound passkeys through device attestation, and where becoming a vendor requires interacting with the fido alliance.... I would say "I'm sure the mean well", but given that parties like Yubico benefit from not getting more competitors, the cynic in me is a bit worried.
- coldpie 1y ago> I would say "I'm sure they mean well", Yeah, I wouldn't say that. It's clear from their public comments[1,2,3] that the spec authors don't believe the private key actually belongs to the user to do what they want with. They see services restricting what users may do with their own logins as a feature of Passkeys. It's really a shame it went in this direction. Replacing passwords with an easy-to-use keypair auth system would be a massive security improvement. But the Passkey ecosystem is poisoned at this point. Unless they remove the client ID & attestation anti-features, it should be considered a proprietary big tech protocol. [1] Threatening an open-source passkey client with server-side bans because they don't implement passkey storage on the client device in the way the spec authors prefer. https://github.com/keepassxreboot/keepassxc/issues/10406 https://github.com/keepassxreboot/keepassxc/issues/10406 [2] Maintaining a list of "non-compliant" clients, including the above open-source one, presumably for use in server-side bans. https://passkeys.dev/docs/reference/known-issues/ https://passkeys.dev/docs/reference/known-issues/ [3] While writing an article about this on my website, I actually emailed the two involved spec authors on the above issue, politely asking how their interpretation of the Passkey spec could possibly be compatible with open source software. Neither replied.
- pizlonator 1y ago> we could genuinely lose general purpose computing. > At the moment, anyone can use Linux; it's better and easier than ever. Maybe Linux will save us. This was a fascinating thing to watch for me (pewdiepie telling people to install Linux): https://www.youtube.com/watch?v=pVI_smLgTY0 https://www.youtube.com/watch?v=pVI_smLgTY0 My bet is that the momentum is strong enough that: - A critical mass of PC makers will continue to offer a Linux preinstalled option, or at least some path to installing Linux. - If Windows and macOS take more rights away, it'll just help Linux's market share. So Linux's share will probably grow not only because Linux is getting better but because the corpo OSes trying to take away general purpose computing
- everdrive 1y agoI love Linux, but if 90% of the US were on Linux the same commercial / political pressures would apply and Linux would just look like Android or ChromeOS. Can you run an alternate OS on your smartphone? Yes, but you can't run your banking app. Linux alone cannot save us.
- pizlonator 1y agoBut I don't want to run a banking "app" on my computer. I am happy to use a browser on my computer to log into my bank's website.
- 01HNNWZ0MV43FF 1y agoIf nobody participates in government, the banks and entertainment industry will get whatever they want, which is to lock down your computer into a portable kiosk
- pizlonator 1y agobut is Android locking down something because government?
- 1y ago
- marcosdumay 1y ago> We've really foolishly built the technology necessary for authoritarianism just a few years head of a general global trend towards authoritarianism. Hum... It was foolish, but it was decades after the trend started. Looks to me that the real trend was started mostly by the wide distribution of TV and the subsequent media consolidation (that happened everywhere). Also, who is "we" here? Because it was exactly the authoritarian-wannabes that created most of it.
- stephen_cagle 1y agoI think it is unfortunate how many resources are put into making things secure with TPM's and how little resource is put into basically having secure and simple sandboxing... All I really want is a computer that allows me to fully control the permissions and filesystem access of all the programs that I manually install on my system. Almost every program (in my case) needs 0 filesystem access outside of what it installed itself and shouldn't be looking or snooping at anything that isn't in its own process space. I want a clear and simple way to limit the blast radius of how badly a program could actually screw up my system or have access to my files. I recently experienced the opposite of this on Android, where I tried to install a very well reviewed ebook reader called MoonReader. But MoonReader seems to require complete access to every file on my Android device to work correctly. That is insane. I looked it up a bit more and it seems that Google has simplified (or something) permissions, but now there isn't much choice other than asking for full file access (I just want to give it access to one directory). Anywho, just a minor vent, that we are insisting that the only way to make things secure is this sort of attestation path, but we don't spend any energy just making it possible to limit the blast radius of software on most OS'.
- bhelkey 1y agoAnother simple permission is network access. Why can't I restrict, say, a calculator app from accessing the internet on either iOS or Android?
- grebc 1y agoHow else are they going to get their “analytics” if they prompt permission for network access?
- nekusar 1y agoIts not 100% what you're looking for. Probably an 80% case.. But try looking into QubesOS. You create domains where applications can do whatever in the domain (a contained VM). So your personal domain is separate from your bank domain, which is separate from your media domain. Of course, domains themselves can do naughty things. But they cant cross over to others. And system resources are a separate domain, as is networking. Some downsides - gaming is a no go mostly. And if you do SDR stuff, the USB domain is a heavy hit on performance. You really need dedicated machines for those things.
- codyb 1y agoI sincerely doubt it'll do much, but my next computer will not be Apple. Sadly, I just upgraded a year and a half or so ago, and sadly, good lord those damn arm chips are nice. So hopefully in 8 years or so when I need a new machine, there's some decent options available to me. But nice aint worth the cost when it comes at the expense of supporting something which is undermining everything else you believe in.
- robotnikman 1y ago>At the moment, anyone can use Linux; it's better and easier than ever. Will the laws of your country make it harder or more difficult to avoid? Will major vendors lock you out of basic functions? Somewhat related, but if x86 loses dominance it will be even more difficult if not impossible to install Linux or other alternate OS's on ARM devices. The majority of consumer ARM electronics make it hard enough, and normally requires you to run a specific patched (and most likely outdated) Linux kernel in order to boot. There are ARM devices which meet the ARM System Ready standard which allows you to boot whatever OS you want, but they are mostly enterprise devices such as servers. Cheapest one I've seen which your average consumer might buy was an ARM workstation with a starting price of about $1500
- rini17 1y agoRaspberry Pi and clones/alikes are ARM devices with perfect Linux support.
- bigfatkitten 1y agoRaspberry Pi is one of the least open platforms around. Broadcom SOCs preferred by Raspberry Pi require proprietary blobs to function, and much of their functionality is buried under a mountain of NDAs.
- Rohansi 1y agoThat's the current norm for GPUs, no? The Raspberry Pi just happens to use a SoC where the GPU is the primary processor. I wouldn't say it's worse - it's maybe slightly better but still close to par.
- fragmede 1y agoWe're both closer than any of us believe. Insofar that ChromeOS is and isn't Linux, it's already locked down signed boot. But also we're further from it because general computing isn't going anywhere soon as long as people keep buying general purpose computers. Still until Qubes or similar sandboxed computing becomes the norm, blaming victims for getting malware onto their system only goes so far, and even if banks don't require it, regular people will start having a banking only computer because oh god please don't steal all my money.
- rolandog 1y agoThis! I think we were all too naïve in having "we would never let it happen, right?" be the motto for our complacency and inaction. I hope more people come around and recognize that Richard Stallman deserves a big, resounding "you were right, we're sorry" after being attacked for his dislike of "trusted computing" and TPMs [0]. [0]: https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
- narrator 1y agoIf you've ever looked at the plans for Absolute Zero 2050, they predict a world with no shipping or commercial air travel, among many other restrictions. That sort of thing could only be implemented under an authoritarian government. I think that's where all this is coming from.