9 ms·

half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.

stackghost 9mo ago
My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.
- seba_dos1 9mo ago
  This is already the world we live in when it comes to the most popular personal computing devices running Linux out there.
  - stefan_ 9mo ago
    This is already the world you live in just running some recent Ubuntu. Try writing, building and loading a kernel module! Of course its all nonsense make believe, the "trust root" is literally a Microsoft signed stub. For this dummy implementation you can't modify your own kernel anymore.
    - plagiarist 9mo ago
      And you cannot remove it on every motherboard because some of the firmware blobs are signed. You cannot remove their keys and leave only your own.
- dijit 9mo ago
  Unfortunately the parent commenter is completely right. The attestation portion of those systems is happening on locked down devices, and if you gain ownership of the devices they no longer attest themselves. This is the curse of the duopoly of iOS and Android. BankID in Sweden will only run with one of these devices, they used to offer a card system but getting one seems to be impossible these days. So you're really stuck with a mobile device as your primary means of identification for banking and such. There's a reason that general purpose computers are locked to 720p on Netflix and Disney+; yet AppleTV's are not.
  - yxhuvud 9mo ago
    Afaik bankid will actually run as long as you can install play store (IE the device don't need Google certificate), which isn't great but a little bit better than what it could have been.
    - gcr 9mo ago
      That can't be right. My onyx boox note air 2 eInk tablet lets me install the google play store by registering myself as an AOSP developer and enrolling my device's serial number or GSF identifier with Google using some Google Form that some android team somewhere's automated by now. The device has no hardware security features from what I can tell. There's no way this platform would pass muster with any bank.
      - dotancohen 9mo ago
        I have the successor device, the Boox Note Air 2, and don't remember how I installed Google Play on it, it was so easy as to be not even notable. Though almost everything I use is available on F-Droid other than my fancy calendar and contacts applications.
      - VorpalWay 9mo ago
        At least BankId (digital ID thing in Sweden) and some of the Swedish banking apps don't care about if you are rooted on stock Android. I haven't tried custom ROMs in many years, but perhaps it is time for GrapheneOS these days. Now, if you want to use your phone as a debit/credit card substitute that is different (Google Pay cares, and I don't use it thus). Anyway, why should banking apps care? It is not like they care when I use the bank from Firefox on my Linux laptop.
      - seba_dos1 9mo ago
        > There's no way this platform would pass muster with any bank "Any bank"? Although the bank I use locks NFC payments behind such checks (which is not a big loss since a physical debit card offers the same functionality), anything else still works otherwise. Most of the things are available through the website (which fits well on mobile too), and mobile BLIK payments can be done from the Android app which works inside Waydroid with microG. There's no reason other banks can't work the same way and it's outraging when they don't. Look around for a better bank.
- JasonADrury 9mo ago
  Is the joke here that all of those things have already been happening for a while now?
- anonym29 9mo ago
  Torrenting is becoming more popular again. The alternative to being allowed to pay to watch on an "insecure" device isn't switching to an attested device, it's to stop paying for the content at all. Games industry, same thing (or just play the good older games, the new ones suck anyway). Finances, just pay everything by cheque or physical pennies. Fight back. Starve the tyrants to death where you can, force the tyrants to incur additional costs and inefficiencies where you can't.
blibble 9mo ago
that's a silver lining the anti-user attestation will at least be full of security holes, and likely won't work at all
- sam_lowry_ 9mo ago
  Dunno about the others but Pottering has proven himself to deliver software against the grain.
  - deleted 9mo ago
    [deleted]
  - dijit 9mo ago
    You think? It took us nearly a decade and a half to unfuck the pulseaudio situation and finally arrive at a simple solution (pipewire). SystemD has a lot more people refining it down but a clean (under the hood) implementation probably won't be witnessed in my lifetime.
    - blibble 9mo ago
      yeah, the fix for pulseaudio was to throw it away entirely for systemd, I don't think I have a single linux system that boots/reboots reliably 100% of the time these days
      - dijit 9mo ago
        The trick is the same: use a popular linux distribution and don't fight the kinks. The people who had no issues with Pulseaudio; used a mainstream distribution. Those distributions did the heavy lifting of making sure stuff fit together in a cohesive way. SystemD is very opinionated, so you'd assume it wouldn't have the same results, but it does.. if you use a popular distro then they've done a lot of the hard work that makes systemd function smooth. I was today years old when I realised this is true for both bits of poetter-ware. Weird.
        9mo ago

My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.

seba_dos1 9mo ago
This is already the world we live in when it comes to the most popular personal computing devices running Linux out there.
- stefan_ 9mo ago
  This is already the world you live in just running some recent Ubuntu. Try writing, building and loading a kernel module! Of course its all nonsense make believe, the "trust root" is literally a Microsoft signed stub. For this dummy implementation you can't modify your own kernel anymore.
  - plagiarist 9mo ago
    And you cannot remove it on every motherboard because some of the firmware blobs are signed. You cannot remove their keys and leave only your own.
dijit 9mo ago
Unfortunately the parent commenter is completely right. The attestation portion of those systems is happening on locked down devices, and if you gain ownership of the devices they no longer attest themselves. This is the curse of the duopoly of iOS and Android. BankID in Sweden will only run with one of these devices, they used to offer a card system but getting one seems to be impossible these days. So you're really stuck with a mobile device as your primary means of identification for banking and such. There's a reason that general purpose computers are locked to 720p on Netflix and Disney+; yet AppleTV's are not.
- yxhuvud 9mo ago
  Afaik bankid will actually run as long as you can install play store (IE the device don't need Google certificate), which isn't great but a little bit better than what it could have been.
  - gcr 9mo ago
    That can't be right. My onyx boox note air 2 eInk tablet lets me install the google play store by registering myself as an AOSP developer and enrolling my device's serial number or GSF identifier with Google using some Google Form that some android team somewhere's automated by now. The device has no hardware security features from what I can tell. There's no way this platform would pass muster with any bank.
    - dotancohen 9mo ago
      I have the successor device, the Boox Note Air 2, and don't remember how I installed Google Play on it, it was so easy as to be not even notable. Though almost everything I use is available on F-Droid other than my fancy calendar and contacts applications.
    - VorpalWay 9mo ago
      At least BankId (digital ID thing in Sweden) and some of the Swedish banking apps don't care about if you are rooted on stock Android. I haven't tried custom ROMs in many years, but perhaps it is time for GrapheneOS these days. Now, if you want to use your phone as a debit/credit card substitute that is different (Google Pay cares, and I don't use it thus). Anyway, why should banking apps care? It is not like they care when I use the bank from Firefox on my Linux laptop.
    - seba_dos1 9mo ago
      > There's no way this platform would pass muster with any bank "Any bank"? Although the bank I use locks NFC payments behind such checks (which is not a big loss since a physical debit card offers the same functionality), anything else still works otherwise. Most of the things are available through the website (which fits well on mobile too), and mobile BLIK payments can be done from the Android app which works inside Waydroid with microG. There's no reason other banks can't work the same way and it's outraging when they don't. Look around for a better bank.
JasonADrury 9mo ago
Is the joke here that all of those things have already been happening for a while now?
anonym29 9mo ago
Torrenting is becoming more popular again. The alternative to being allowed to pay to watch on an "insecure" device isn't switching to an attested device, it's to stop paying for the content at all. Games industry, same thing (or just play the good older games, the new ones suck anyway). Finances, just pay everything by cheque or physical pennies. Fight back. Starve the tyrants to death where you can, force the tyrants to incur additional costs and inefficiencies where you can't.

blibble 9mo ago

that's a silver lining the anti-user attestation will at least be full of security holes, and likely won't work at all

sam_lowry_ 9mo ago
Dunno about the others but Pottering has proven himself to deliver software against the grain.
- deleted 9mo ago
  [deleted]
- dijit 9mo ago
  You think? It took us nearly a decade and a half to unfuck the pulseaudio situation and finally arrive at a simple solution (pipewire). SystemD has a lot more people refining it down but a clean (under the hood) implementation probably won't be witnessed in my lifetime.
  - blibble 9mo ago
    yeah, the fix for pulseaudio was to throw it away entirely for systemd, I don't think I have a single linux system that boots/reboots reliably 100% of the time these days
    - dijit 9mo ago
      The trick is the same: use a popular linux distribution and don't fight the kinks. The people who had no issues with Pulseaudio; used a mainstream distribution. Those distributions did the heavy lifting of making sure stuff fit together in a cohesive way. SystemD is very opinionated, so you'd assume it wouldn't have the same results, but it does.. if you use a popular distro then they've done a lot of the hard work that makes systemd function smooth. I was today years old when I realised this is true for both bits of poetter-ware. Weird.
      - 9mo ago