4 ms·

Remote attestation is literally a form of DRM

microtonal 9mo ago
There are genuine positive applications for remote attestation. E.g., if you maintain a set of servers, you can verify that it runs the software it should be running (the software is not compromised). Or if you are running something similar to Apple's Private Compute Cloud to run models, users can verify that it is running the privacy-preserving image that it is claiming to be running. There are also bad forms of remote attestation (like Google's variant that helps them let banks block you if you are running an alt-os). Those suck and should be rejected. Edit: bri3d described what I mean better here: https://news.ycombinator.com/item?id=46785123 https://news.ycombinator.com/item?id=46785123
- direwolf20 9mo ago
  I agree that DRM feels good when you're the one controlling it.
- egorfine 9mo ago
  > There are genuine positive applications for remote attestation No doubt. Fully agree with you on that. However Intel ME will make sure no system is truly secure and server vendors do add their mandatory own backdoors on top of that (iLO for HP, etc). Having said that, we must face the reality: this is not being built for you to secure your servers.
youarentrightjr 9mo ago
> Remote attestation is literally a form of DRM Let's say I accept this statement. What makes you think trusted boot == remote attestation?
- direwolf20 9mo ago
  Trusted boot is literally a form of DRM. A different one than remote attestation.
  - youarentrightjr 9mo ago
    > Trusted boot is literally a form of DRM. A different one than remote attestation. No, it's not. (And for that matter, neither is remote attestation) You're conflating the technology with the use. I believe that you have only thought about these technologies as they pertain to DRM, now I'm here to tell you there are other valid use cases. Or maybe your definition of "DRM" is so broad that it includes me setting up my own trusted boot chain on my own hardware? I don't really think that's a productive definition.
    - yencabulator 9mo ago
      It's possible to not implement remote attestation even when you implement secure boot. This company is explicitly all about implementing remote attestation (which is a form of DRM): https://amutable.com/events https://amutable.com/events > Remote Attestation of Imutable Operating Systems built on systemd > Lennart Poettering
      - youarentrightjr 9mo ago
        > This company is explicitly all about implementing remote attestation (which is a form of DRM): Is there a HN full moon out? Again, this is wrong. DRM is a policy. Remote attestation is a technology. You can use remote attestation to implement DRM. You can also use remote attestation to implement other things.
        PunchyHamster 9mo ago
        there are no other things. The entire point of remote attestation is to manage(i.e. take away) rights of user that runs it, unless you own entire chain, which you do not on any customer device
        youarentrightjr 9mo ago
        [dead]

There are genuine positive applications for remote attestation. E.g., if you maintain a set of servers, you can verify that it runs the software it should be running (the software is not compromised). Or if you are running something similar to Apple's Private Compute Cloud to run models, users can verify that it is running the privacy-preserving image that it is claiming to be running. There are also bad forms of remote attestation (like Google's variant that helps them let banks block you if you are running an alt-os). Those suck and should be rejected. Edit: bri3d described what I mean better here: https://news.ycombinator.com/item?id=46785123 https://news.ycombinator.com/item?id=46785123

direwolf20 9mo ago
I agree that DRM feels good when you're the one controlling it.
egorfine 9mo ago
> There are genuine positive applications for remote attestation No doubt. Fully agree with you on that. However Intel ME will make sure no system is truly secure and server vendors do add their mandatory own backdoors on top of that (iLO for HP, etc). Having said that, we must face the reality: this is not being built for you to secure your servers.

youarentrightjr 9mo ago

> Remote attestation is literally a form of DRM Let's say I accept this statement. What makes you think trusted boot == remote attestation?

direwolf20 9mo ago
Trusted boot is literally a form of DRM. A different one than remote attestation.
- youarentrightjr 9mo ago
  > Trusted boot is literally a form of DRM. A different one than remote attestation. No, it's not. (And for that matter, neither is remote attestation) You're conflating the technology with the use. I believe that you have only thought about these technologies as they pertain to DRM, now I'm here to tell you there are other valid use cases. Or maybe your definition of "DRM" is so broad that it includes me setting up my own trusted boot chain on my own hardware? I don't really think that's a productive definition.
  - yencabulator 9mo ago
    It's possible to not implement remote attestation even when you implement secure boot. This company is explicitly all about implementing remote attestation (which is a form of DRM): https://amutable.com/events https://amutable.com/events > Remote Attestation of Imutable Operating Systems built on systemd > Lennart Poettering
    - youarentrightjr 9mo ago
      > This company is explicitly all about implementing remote attestation (which is a form of DRM): Is there a HN full moon out? Again, this is wrong. DRM is a policy. Remote attestation is a technology. You can use remote attestation to implement DRM. You can also use remote attestation to implement other things.
      - PunchyHamster 9mo ago
        there are no other things. The entire point of remote attestation is to manage(i.e. take away) rights of user that runs it, unless you own entire chain, which you do not on any customer device
        youarentrightjr 9mo ago
        [dead]