10 ms·

This seems like the kind of technology that could make the problem described in https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philoso

This seems like the kind of technology that could make the problem described in https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html a lot worse. Do you have any plans for making sure it doesn't get used for that?

enriquto 9mo ago
half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.
- stackghost 9mo ago
  My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.
  - seba_dos1 9mo ago
    This is already the world we live in when it comes to the most popular personal computing devices running Linux out there.
    - stefan_ 9mo ago
      This is already the world you live in just running some recent Ubuntu. Try writing, building and loading a kernel module! Of course its all nonsense make believe, the "trust root" is literally a Microsoft signed stub. For this dummy implementation you can't modify your own kernel anymore.
      - plagiarist 9mo ago
        And you cannot remove it on every motherboard because some of the firmware blobs are signed. You cannot remove their keys and leave only your own.
  - dijit 9mo ago
    Unfortunately the parent commenter is completely right. The attestation portion of those systems is happening on locked down devices, and if you gain ownership of the devices they no longer attest themselves. This is the curse of the duopoly of iOS and Android. BankID in Sweden will only run with one of these devices, they used to offer a card system but getting one seems to be impossible these days. So you're really stuck with a mobile device as your primary means of identification for banking and such. There's a reason that general purpose computers are locked to 720p on Netflix and Disney+; yet AppleTV's are not.
    - yxhuvud 9mo ago
      Afaik bankid will actually run as long as you can install play store (IE the device don't need Google certificate), which isn't great but a little bit better than what it could have been.
      - gcr 9mo ago
        That can't be right. My onyx boox note air 2 eInk tablet lets me install the google play store by registering myself as an AOSP developer and enrolling my device's serial number or GSF identifier with Google using some Google Form that some android team somewhere's automated by now. The device has no hardware security features from what I can tell. There's no way this platform would pass muster with any bank.
        dotancohen 9mo ago
        I have the successor device, the Boox Note Air 2, and don't remember how I installed Google Play on it, it was so easy as to be not even notable. Though almost everything I use is available on F-Droid other than my fancy calendar and contacts applications.
        VorpalWay 9mo ago
        At least BankId (digital ID thing in Sweden) and some of the Swedish banking apps don't care about if you are rooted on stock Android. I haven't tried custom ROMs in many years, but perhaps it is time for GrapheneOS these days. Now, if you want to use your phone as a debit/credit card substitute that is different (Google Pay cares, and I don't use it thus). Anyway, why should banking apps care? It is not like they care when I use the bank from Firefox on my Linux laptop.
  - JasonADrury 9mo ago
    Is the joke here that all of those things have already been happening for a while now?
  - anonym29 9mo ago
    Torrenting is becoming more popular again. The alternative to being allowed to pay to watch on an "insecure" device isn't switching to an attested device, it's to stop paying for the content at all. Games industry, same thing (or just play the good older games, the new ones suck anyway). Finances, just pay everything by cheque or physical pennies. Fight back. Starve the tyrants to death where you can, force the tyrants to incur additional costs and inefficiencies where you can't.
- blibble 9mo ago
  that's a silver lining the anti-user attestation will at least be full of security holes, and likely won't work at all
  - sam_lowry_ 9mo ago
    Dunno about the others but Pottering has proven himself to deliver software against the grain.
    - deleted 9mo ago
      [deleted]
    - dijit 9mo ago
      You think? It took us nearly a decade and a half to unfuck the pulseaudio situation and finally arrive at a simple solution (pipewire). SystemD has a lot more people refining it down but a clean (under the hood) implementation probably won't be witnessed in my lifetime.
      - blibble 9mo ago
        yeah, the fix for pulseaudio was to throw it away entirely for systemd, I don't think I have a single linux system that boots/reboots reliably 100% of the time these days
        dijit 9mo ago
        The trick is the same: use a popular linux distribution and don't fight the kinks. The people who had no issues with Pulseaudio; used a mainstream distribution. Those distributions did the heavy lifting of making sure stuff fit together in a cohesive way. SystemD is very opinionated, so you'd assume it wouldn't have the same results, but it does.. if you use a popular distro then they've done a lot of the hard work that makes systemd function smooth. I was today years old when I realised this is true for both bits of poetter-ware. Weird.
        9mo ago
cyphar 9mo ago
I'm Aleksa, one of the founding engineers. We will share more about this in the coming months but this is not the direction nor intention of what we are working on. The models we have in mind for attestation are very much based on users having full control of their keys. This is not just a matter of user freedom, in practice being able to do this is far more preferable for enterprises with strict security controls. I've been a FOSS guy my entire adult life, I wouldn't put my name to something that would enable the kinds of issues you describe.
- dTal 9mo ago
  Thanks for the reassurance, the first ray of sunshine in this otherwise rather alarming thread. Your words ring true. It would be a lot more reassuring if we knew what the business model actually was, or indeed anything else at all about this. I remain somewhat confused as to the purpose of this announcement when no actual information seems to be forthcoming. The negative reactions seen here were quite predictable, given the sensitive topic and the little information we do have.
- iamnothere 9mo ago
  Thanks, this would be helpful. I will follow on by recommending that you always make it a point to note how user freedom will be preserved, without using obfuscating corpo-speak or assuming that users don’t know what they want, when planning or releasing products. If you can maintain this approach then you should be able to maintain a good working relationship with the community. If you fight the community you will burn a lot of goodwill and will have to spend resources on PR. And there is only so much that PR can do! Better security is good in theory, as long as the user maintains control and the security is on the user end. The last thing we need is required ID linked attestation for accessing websites or something similar.
- deleted 9mo ago
  [deleted]
- michaelmrose 9mo ago
  This is extremely bad logic. The technology of enforcing trusted software is without inherent value good or ill depending entirely on expected usage. Anything that is substantially open will be used according to the values of its users not according to your values so we ought instead to consider their values not yours. Suppose you wanted to identify potential agitators by scanning all communication for indications in a fascist state one could require this technology in all trusted environments and require such an environment to bank, connect to an ISP, or use Netflix. One could even imagine a completely benign usage which only identified actual wrong doing alongside another which profiled based almost entirely on anti regime sentiment or reasonable discontent. The good users would argue that the only problem with the technology is its misuse but without the underlying technology such misuse is impossible. One can imagine two entirely different parallel universes one in which a few great powers went the wrong way in part enabled by trusted computing and the pervasive surveillance enabled by the capability of AI to do the massive and boring task of analyzing a massive glut of ordinary behaviour and communication + tech and law to ensure said surveillance is carried out. Even those not misusing the tech may find themselves worse off in such a world. Why again should we trust this technology just because you are a good person?
qmr 9mo ago
"At long last, we have created the Torment Nexus from classic sci-fi novel Don't Create The Torment Nexus."

enriquto 9mo ago

half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.

stackghost 9mo ago
My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.
- seba_dos1 9mo ago
  This is already the world we live in when it comes to the most popular personal computing devices running Linux out there.
  - stefan_ 9mo ago
    This is already the world you live in just running some recent Ubuntu. Try writing, building and loading a kernel module! Of course its all nonsense make believe, the "trust root" is literally a Microsoft signed stub. For this dummy implementation you can't modify your own kernel anymore.
    - plagiarist 9mo ago
      And you cannot remove it on every motherboard because some of the firmware blobs are signed. You cannot remove their keys and leave only your own.
- dijit 9mo ago
  Unfortunately the parent commenter is completely right. The attestation portion of those systems is happening on locked down devices, and if you gain ownership of the devices they no longer attest themselves. This is the curse of the duopoly of iOS and Android. BankID in Sweden will only run with one of these devices, they used to offer a card system but getting one seems to be impossible these days. So you're really stuck with a mobile device as your primary means of identification for banking and such. There's a reason that general purpose computers are locked to 720p on Netflix and Disney+; yet AppleTV's are not.
  - yxhuvud 9mo ago
    Afaik bankid will actually run as long as you can install play store (IE the device don't need Google certificate), which isn't great but a little bit better than what it could have been.
    - gcr 9mo ago
      That can't be right. My onyx boox note air 2 eInk tablet lets me install the google play store by registering myself as an AOSP developer and enrolling my device's serial number or GSF identifier with Google using some Google Form that some android team somewhere's automated by now. The device has no hardware security features from what I can tell. There's no way this platform would pass muster with any bank.
      - dotancohen 9mo ago
        I have the successor device, the Boox Note Air 2, and don't remember how I installed Google Play on it, it was so easy as to be not even notable. Though almost everything I use is available on F-Droid other than my fancy calendar and contacts applications.
      - VorpalWay 9mo ago
        At least BankId (digital ID thing in Sweden) and some of the Swedish banking apps don't care about if you are rooted on stock Android. I haven't tried custom ROMs in many years, but perhaps it is time for GrapheneOS these days. Now, if you want to use your phone as a debit/credit card substitute that is different (Google Pay cares, and I don't use it thus). Anyway, why should banking apps care? It is not like they care when I use the bank from Firefox on my Linux laptop.
- JasonADrury 9mo ago
  Is the joke here that all of those things have already been happening for a while now?
- anonym29 9mo ago
  Torrenting is becoming more popular again. The alternative to being allowed to pay to watch on an "insecure" device isn't switching to an attested device, it's to stop paying for the content at all. Games industry, same thing (or just play the good older games, the new ones suck anyway). Finances, just pay everything by cheque or physical pennies. Fight back. Starve the tyrants to death where you can, force the tyrants to incur additional costs and inefficiencies where you can't.
blibble 9mo ago
that's a silver lining the anti-user attestation will at least be full of security holes, and likely won't work at all
- sam_lowry_ 9mo ago
  Dunno about the others but Pottering has proven himself to deliver software against the grain.
  - deleted 9mo ago
    [deleted]
  - dijit 9mo ago
    You think? It took us nearly a decade and a half to unfuck the pulseaudio situation and finally arrive at a simple solution (pipewire). SystemD has a lot more people refining it down but a clean (under the hood) implementation probably won't be witnessed in my lifetime.
    - blibble 9mo ago
      yeah, the fix for pulseaudio was to throw it away entirely for systemd, I don't think I have a single linux system that boots/reboots reliably 100% of the time these days
      - dijit 9mo ago
        The trick is the same: use a popular linux distribution and don't fight the kinks. The people who had no issues with Pulseaudio; used a mainstream distribution. Those distributions did the heavy lifting of making sure stuff fit together in a cohesive way. SystemD is very opinionated, so you'd assume it wouldn't have the same results, but it does.. if you use a popular distro then they've done a lot of the hard work that makes systemd function smooth. I was today years old when I realised this is true for both bits of poetter-ware. Weird.
        9mo ago

cyphar 9mo ago

I'm Aleksa, one of the founding engineers. We will share more about this in the coming months but this is not the direction nor intention of what we are working on. The models we have in mind for attestation are very much based on users having full control of their keys. This is not just a matter of user freedom, in practice being able to do this is far more preferable for enterprises with strict security controls. I've been a FOSS guy my entire adult life, I wouldn't put my name to something that would enable the kinds of issues you describe.

dTal 9mo ago
Thanks for the reassurance, the first ray of sunshine in this otherwise rather alarming thread. Your words ring true. It would be a lot more reassuring if we knew what the business model actually was, or indeed anything else at all about this. I remain somewhat confused as to the purpose of this announcement when no actual information seems to be forthcoming. The negative reactions seen here were quite predictable, given the sensitive topic and the little information we do have.
iamnothere 9mo ago
Thanks, this would be helpful. I will follow on by recommending that you always make it a point to note how user freedom will be preserved, without using obfuscating corpo-speak or assuming that users don’t know what they want, when planning or releasing products. If you can maintain this approach then you should be able to maintain a good working relationship with the community. If you fight the community you will burn a lot of goodwill and will have to spend resources on PR. And there is only so much that PR can do! Better security is good in theory, as long as the user maintains control and the security is on the user end. The last thing we need is required ID linked attestation for accessing websites or something similar.
deleted 9mo ago
[deleted]
michaelmrose 9mo ago
This is extremely bad logic. The technology of enforcing trusted software is without inherent value good or ill depending entirely on expected usage. Anything that is substantially open will be used according to the values of its users not according to your values so we ought instead to consider their values not yours. Suppose you wanted to identify potential agitators by scanning all communication for indications in a fascist state one could require this technology in all trusted environments and require such an environment to bank, connect to an ISP, or use Netflix. One could even imagine a completely benign usage which only identified actual wrong doing alongside another which profiled based almost entirely on anti regime sentiment or reasonable discontent. The good users would argue that the only problem with the technology is its misuse but without the underlying technology such misuse is impossible. One can imagine two entirely different parallel universes one in which a few great powers went the wrong way in part enabled by trusted computing and the pervasive surveillance enabled by the capability of AI to do the massive and boring task of analyzing a massive glut of ordinary behaviour and communication + tech and law to ensure said surveillance is carried out. Even those not misusing the tech may find themselves worse off in such a world. Why again should we trust this technology just because you are a good person?

qmr 9mo ago

"At long last, we have created the Torment Nexus from classic sci-fi novel Don't Create The Torment Nexus."