4 ms·

I always say this when this topic comes up: remote attestation will be how our computing freedom dies. They've made it so that it doesn't even matter if they al

I always say this when this topic comes up: remote attestation will be how our computing freedom dies. They've made it so that it doesn't even matter if they allow you to install whatever you want. Anything that isn't corporate owned is banned. Own your device? You "tampered" with it. You're banned. From everything. You're ostracized from digital society. You're not even a citizen, much less a second class citizen. Enroll your own keys? It doesn't matter. You're not trusted. You're a fraudster terrorist money launderer drug dealer pedophile. While I am glad that people continue to struggle, that GrapheneOS continues to fight and speak out, these developments still fill me with a terrible sadness. The future is bleak. We inch ever closer to the complete destruction of everything the word "hacker" ever stood for. It's a deep loss.

repelsteeltje 6mo ago
Hardware attestation is like hardware DRM. It is intended to limit and restrict abundance. Abundance of clients (as a proxy for user attention) and abundance of copying, access and replay (as a proxy for "piracy"), resp. It won't matter to the masses, it won't hamper "bad actors" because hackers will find flaws instantly. It's just enshitfication.
- matheusmoreira 6mo ago
  I hope you're right. I truly do. > hackers will find flaws instantly Yeah. https://tee.fail/ https://tee.fail/ The ability to circumvent these cryptographic attestations and pretend to be a "pristine" corporate owned device while in fact being free will be a key strategic capability in the future. They will no doubt pour billions into improving the technology though. I'm not sure if such a capability can be maintained over the long term. We don't have the resources.
  - repelsteeltje 6mo ago
    It probably won't matter to the average user: buy Apple, buy Google and be (little bit less) happy while your access to the free web gets little more enshittified... ...But there is always at least one hacker. The issue with hardening DRM is that at the core it's hard to protect against an adversary that with physical access to the device that keeps the very secret. From the vendor perspective, the very customer paying you is your potential enemy. That means that the root of trust isn't itself protected with cryptography. Instead, it relies on security-through-obscurity, Faraday cages, fuses, anti-tampering and lots of glue. And it's a numbers game if there are thousands of different devices, potentially with different flaws while your adversaries are hidden among billions of customers. There is still a gap between the hacker and main-stream availability, though: laws and legalism, like DMCA that penalize disclosing how the obfuscation and all work.
charcircuit 6mo ago
Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? The user still maintains all the freedom of doing whatever computing they want on their own machine, but if they want to play with others who don't want to play with cheaters then they have to use the official client. For people who want a high degree of freedom and be able to access as many digital services as possible I foresee such people using a hypervisor that runs both a provable secure OS and another OS that is as free as they want.
- matheusmoreira 6mo ago
  > Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? No. It's the constant attempts to invade our computers and "prevent" the unwanted behavior that are problematic. See kernel level anticheat nonsense. They want to own our computers. > if they want to play with others who don't want to play with cheaters then they have to use the official client They should be able to play with whatever client they want. It's their computer, it should run whatever software they want.
  - charcircuit 6mo ago
    >See kernel level anticheat nonsense. This nonsense mainly exists only because the operating system is unable to attest that it the app is secure and the right app is what is running. >It's their computer, it should run whatever software they want. I agree, but companies shouldn't be forced to match cheaters with legitimate players. Cheaters just can't secretly be cheating.
    - matheusmoreira 6mo ago
      To defend my own freedom, I'm forced to defend scoundrels as well in a totally unhinged manner. So be it. > the operating system is unable to attest And it should remain unable. There should be no "attestation" of anything. The corporations who want such things should remain unsure of the device's "security". They should just accept it. Let them write it off as a cost of doing business or something. The optimal amount of fraud is non-zero, as they say. > the app is secure and the right app is what is running These machines are our personal computers. They are extensions of our minds. They are general purpose tools with limitless potential, just waiting to be shaped in accordance to our wills. There is no such thing as being "secure" from us. Not inside our own computers. The mere idea of it is offensive. It is an affront to us all. We are the gods of these machines. To attempt to "secure" a video game of all things against us is an attempt to usurp our power. > Cheaters just can't secretly be cheating. Now that remote attestation is in play, the ability to do that -- forge attestations to pretend to be a corporate owned machine while remaining free and subversive -- has become key. So I'm forced to say that cheaters absolutely should be able to secretly cheat. If the cheater wants to edit his computer's memory or whatever, it's his divine right as the owner of the machine. An inability to do that means our freedom is lost. Cheating in video games is literally nothing compared to the loss of our computer freedom. Let the entire industry go bankrupt if it must. We cannot sacrifice it no matter what, and certainly not over something as mundane such as video games. There is so much more at stake here. Ubiquitous access to cryptography. Adversarial interoperability. Our very self-determination in the digital world. Video games are nothing -- and that's coming from a fellow gamer.
userbinator 6mo ago
Keep fighting. Spread the word. Ensure that everyone you know is aware of the totalitarian implications. The only way to sure defeat is to surrender.
- matheusmoreira 6mo ago
  I will, but it doesn't look good.
  - kaliqt 6mo ago
    Then we should step it up a bit.
safety1st 6mo ago
While I agree, I think there's a better way to frame this with the public. We don't need to bring in pedo references. That looks very unhinged to most people. There's already a lot of support out there, in both public opinion and the law, for the idea that if I pay for something physical like a device, I own it. Any substantial alteration in its functionality, especially a reduction in what it can do, requires my consent. Reduction in what it can do should require my consent. Just because tech made it possible for the manufacturer to brick my phone or my car, start charging me extra for certain features I already paid for, or block the apps the OS vendor doesn't approve of doesn't mean they should or that it's even legal to do so. Additionally once I buy the device the vendor has zero business telling me how I can modify it, or whether I can repair it. I own the thing I bought, fucker. It's my property and I have property rights. The corp has no right to steal away part of the thing I bought or change the terms after the fact. It's potentially criminal if they try. This framing resonates with a lot of people. The guy who really exemplifies this positioning at the moment is Louis Rossman and by focusing on these widely understood and popular concepts, he's gained the ability to direct an enormous amount of attention to an issue. He can absolutely swamp a legislature with letters from angry constituents for example when he gives an issue visibility. Frame it as theft because it is. If they push an update without my consent that removes functionality or sabotages my ownership of the device, it's theft. At the very least product liability laws should apply. Some part of what I bought stops working, that goes to product liability. But I'd take it a step farther and say we're dealing with straight up theft.
- someguyornotidk 6mo ago
  The problem with the reasonable framing you suggest is that it gets thrown out of the window the moment someone utters Protect the Children®. I'm willing to bet that most people, including those with kids like myself, don't truly believe that surrendering our basic rights to better protect the children is a rational thing to do, but they would never dare to push their opinion publicly. The few that do get all but labeled as, you guessed it, fraudster terrorist money launderer drug dealer pedophiles. It's the the Emperor's New Clothes in real life but for morals. No amount of Rossmanning is going to help society walk back its collective hypocrisy.
Loic 6mo ago
For once, we may be "saved" thanks to Trump. Because of the brutal change in geopolitics he triggered, the EU is now actively looking at all the hard dependencies on US controlled systems. Android and iOS are two of them. I cannot tell if the alternative solution will be better, but I do think we will develop alternatives.
- trallnag 6mo ago
  Are they really tho? The EU is currently enforcing a digital ID that will depend on Android and iOS in most implementations
  - reddalo 6mo ago
    Not only that, they're also enforcing age verification, i.e. mass surveillance.
- severino 6mo ago
  The EU is only making these statements until the US has a new president (with the same ideas of Trump, as has always been the case, but saying nice things in public). Also, in the mean time, their announced "sovereign solutions for the European citizen" look ridiculous: now you'll be free from Visa and Mastercard for your payments but at the same time you'll need a phone approved by either Apple or Google.
  - ychnd 6mo ago
    And there is also "sovereign cloud" by microsoft!
bartekpacia 6mo ago
all "hackers" be vibe coding b2b saas these days the meaning of this word has diluted so much
timbooktwo 6mo ago
A fraudster, a terrorist, a money launderer, a drug dealer, a pedophile—these are actually a huge audience for whom the IT industry can release separate versions of the operating system and hardware. And that audience will pay for it. For the vast majority of ordinary people who consume IT benefits for free (being a commodity themselves), it makes sense to use controlled products.
- brigandish 6mo ago
  It doesn't have to be controlled in such a way that it produces monopolies or enables surveillance.
whstl 6mo ago
I love how this is a problem caused by Big Tech (AI), with “solutions” brought by Big Tech (FAANG etc) and “countermeasures” will also be brought in by future billion-dollar industries (domestic-proxy provider BrightData is 1B already) while we will depend on existing Big Tech for “protection” (Cloudflare will remain a big player). At this point the internet is exactly like the film Matrix, where humans are merely an implementation detail in the whole system.
locknitpicker 6mo ago
> You're ostracized from digital society. You're not even a citizen, much less a second class citizen. Before anyone downplays this concern as scaremongering ans slippery slope fallacy stuff, keep in mind that countries are shifting their national ID cars infrastructure to online services which are fundamentally designed around attestation. Moreover some class of services such as banking are progressively increasing requirements that your software and hardware needs to meet to allow you to manage your own property.
loup-vaillant 6mo ago
> these developments still fill me with a terrible sadness. I wish they filled you with anger instead. It’s not too late. You’re not alone.
avaer 6mo ago
The most dangerous thing in computing is safety. "Secure" is great. But when you hear "safe", that means there is some corp in the shadows predating on you because <insert boogeyman>. They decide what safe means, not you. They will abuse you to no end while keeping you "safe". That's why companies always remove the features that keep you "secure" and give you ones to keep you "safe".
ur2ndphone 6mo ago
> Own your device? You "tampered" with it. You're banned. From everything. Don't worry officer, my device is completely clean. Here you go check it. Why yes, I absolutely only ever use it for banking and updating linkedin on a suspiciously empty gmail, and keep it on silent 100% of the time. What's so odd about that? What? No, I just re-read a lot of books, that's my hobby, I read Catcher In The Rye 20 times a month. ... It's about time people realize the concept of a real phone and a civilian phone as one and the same is dead. In fact. You don't need a "real" phone. Just the civilian one. I use what's basically a portable retroconsole for entertainment. Including reading, incidentally. From its perspective, it is just a computer. Let's make it a competition, puny phones versus portable computing. Name me one thing you think it can't do, in return, I'll fire two YOUR phone can't right now, back at you. I'll forward two: It can run tmux and has a copyparty toggle for a portable filestorage on it. Yes, you can do both on the phone. But yours can't right now, and I you will suffer trying tog get it, while mine, it was 2 command lines and one config file each.
cft 6mo ago
I think it's quite telling that this comment was written in Brazil. The so-called Third World is the future source of freedom (or Western countries that become third world perhaps). It may not be a bad idea now to start building open compute and banking alternative ecosystems based in those countries, marketed at Western citizens.
- Magnusmaster 6mo ago
  The third world is also pushing Digital ID. In fact they would love it even more than the first world as it would allow for even more totalitarianism.

repelsteeltje 6mo ago

Hardware attestation is like hardware DRM. It is intended to limit and restrict abundance. Abundance of clients (as a proxy for user attention) and abundance of copying, access and replay (as a proxy for "piracy"), resp. It won't matter to the masses, it won't hamper "bad actors" because hackers will find flaws instantly. It's just enshitfication.

matheusmoreira 6mo ago
I hope you're right. I truly do. > hackers will find flaws instantly Yeah. https://tee.fail/ https://tee.fail/ The ability to circumvent these cryptographic attestations and pretend to be a "pristine" corporate owned device while in fact being free will be a key strategic capability in the future. They will no doubt pour billions into improving the technology though. I'm not sure if such a capability can be maintained over the long term. We don't have the resources.
- repelsteeltje 6mo ago
  It probably won't matter to the average user: buy Apple, buy Google and be (little bit less) happy while your access to the free web gets little more enshittified... ...But there is always at least one hacker. The issue with hardening DRM is that at the core it's hard to protect against an adversary that with physical access to the device that keeps the very secret. From the vendor perspective, the very customer paying you is your potential enemy. That means that the root of trust isn't itself protected with cryptography. Instead, it relies on security-through-obscurity, Faraday cages, fuses, anti-tampering and lots of glue. And it's a numbers game if there are thousands of different devices, potentially with different flaws while your adversaries are hidden among billions of customers. There is still a gap between the hacker and main-stream availability, though: laws and legalism, like DMCA that penalize disclosing how the obfuscation and all work.

charcircuit 6mo ago

Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? The user still maintains all the freedom of doing whatever computing they want on their own machine, but if they want to play with others who don't want to play with cheaters then they have to use the official client. For people who want a high degree of freedom and be able to access as many digital services as possible I foresee such people using a hypervisor that runs both a provable secure OS and another OS that is as free as they want.

matheusmoreira 6mo ago
> Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? No. It's the constant attempts to invade our computers and "prevent" the unwanted behavior that are problematic. See kernel level anticheat nonsense. They want to own our computers. > if they want to play with others who don't want to play with cheaters then they have to use the official client They should be able to play with whatever client they want. It's their computer, it should run whatever software they want.
- charcircuit 6mo ago
  >See kernel level anticheat nonsense. This nonsense mainly exists only because the operating system is unable to attest that it the app is secure and the right app is what is running. >It's their computer, it should run whatever software they want. I agree, but companies shouldn't be forced to match cheaters with legitimate players. Cheaters just can't secretly be cheating.
  - matheusmoreira 6mo ago
    To defend my own freedom, I'm forced to defend scoundrels as well in a totally unhinged manner. So be it. > the operating system is unable to attest And it should remain unable. There should be no "attestation" of anything. The corporations who want such things should remain unsure of the device's "security". They should just accept it. Let them write it off as a cost of doing business or something. The optimal amount of fraud is non-zero, as they say. > the app is secure and the right app is what is running These machines are our personal computers. They are extensions of our minds. They are general purpose tools with limitless potential, just waiting to be shaped in accordance to our wills. There is no such thing as being "secure" from us. Not inside our own computers. The mere idea of it is offensive. It is an affront to us all. We are the gods of these machines. To attempt to "secure" a video game of all things against us is an attempt to usurp our power. > Cheaters just can't secretly be cheating. Now that remote attestation is in play, the ability to do that -- forge attestations to pretend to be a corporate owned machine while remaining free and subversive -- has become key. So I'm forced to say that cheaters absolutely should be able to secretly cheat. If the cheater wants to edit his computer's memory or whatever, it's his divine right as the owner of the machine. An inability to do that means our freedom is lost. Cheating in video games is literally nothing compared to the loss of our computer freedom. Let the entire industry go bankrupt if it must. We cannot sacrifice it no matter what, and certainly not over something as mundane such as video games. There is so much more at stake here. Ubiquitous access to cryptography. Adversarial interoperability. Our very self-determination in the digital world. Video games are nothing -- and that's coming from a fellow gamer.

userbinator 6mo ago

Keep fighting. Spread the word. Ensure that everyone you know is aware of the totalitarian implications. The only way to sure defeat is to surrender.

matheusmoreira 6mo ago
I will, but it doesn't look good.
- kaliqt 6mo ago
  Then we should step it up a bit.

safety1st 6mo ago

While I agree, I think there's a better way to frame this with the public. We don't need to bring in pedo references. That looks very unhinged to most people. There's already a lot of support out there, in both public opinion and the law, for the idea that if I pay for something physical like a device, I own it. Any substantial alteration in its functionality, especially a reduction in what it can do, requires my consent. Reduction in what it can do should require my consent. Just because tech made it possible for the manufacturer to brick my phone or my car, start charging me extra for certain features I already paid for, or block the apps the OS vendor doesn't approve of doesn't mean they should or that it's even legal to do so. Additionally once I buy the device the vendor has zero business telling me how I can modify it, or whether I can repair it. I own the thing I bought, fucker. It's my property and I have property rights. The corp has no right to steal away part of the thing I bought or change the terms after the fact. It's potentially criminal if they try. This framing resonates with a lot of people. The guy who really exemplifies this positioning at the moment is Louis Rossman and by focusing on these widely understood and popular concepts, he's gained the ability to direct an enormous amount of attention to an issue. He can absolutely swamp a legislature with letters from angry constituents for example when he gives an issue visibility. Frame it as theft because it is. If they push an update without my consent that removes functionality or sabotages my ownership of the device, it's theft. At the very least product liability laws should apply. Some part of what I bought stops working, that goes to product liability. But I'd take it a step farther and say we're dealing with straight up theft.

someguyornotidk 6mo ago
The problem with the reasonable framing you suggest is that it gets thrown out of the window the moment someone utters Protect the Children®. I'm willing to bet that most people, including those with kids like myself, don't truly believe that surrendering our basic rights to better protect the children is a rational thing to do, but they would never dare to push their opinion publicly. The few that do get all but labeled as, you guessed it, fraudster terrorist money launderer drug dealer pedophiles. It's the the Emperor's New Clothes in real life but for morals. No amount of Rossmanning is going to help society walk back its collective hypocrisy.

Loic 6mo ago

For once, we may be "saved" thanks to Trump. Because of the brutal change in geopolitics he triggered, the EU is now actively looking at all the hard dependencies on US controlled systems. Android and iOS are two of them. I cannot tell if the alternative solution will be better, but I do think we will develop alternatives.

trallnag 6mo ago
Are they really tho? The EU is currently enforcing a digital ID that will depend on Android and iOS in most implementations
- reddalo 6mo ago
  Not only that, they're also enforcing age verification, i.e. mass surveillance.
severino 6mo ago
The EU is only making these statements until the US has a new president (with the same ideas of Trump, as has always been the case, but saying nice things in public). Also, in the mean time, their announced "sovereign solutions for the European citizen" look ridiculous: now you'll be free from Visa and Mastercard for your payments but at the same time you'll need a phone approved by either Apple or Google.
- ychnd 6mo ago
  And there is also "sovereign cloud" by microsoft!

bartekpacia 6mo ago

all "hackers" be vibe coding b2b saas these days the meaning of this word has diluted so much

timbooktwo 6mo ago

A fraudster, a terrorist, a money launderer, a drug dealer, a pedophile—these are actually a huge audience for whom the IT industry can release separate versions of the operating system and hardware. And that audience will pay for it. For the vast majority of ordinary people who consume IT benefits for free (being a commodity themselves), it makes sense to use controlled products.

brigandish 6mo ago
It doesn't have to be controlled in such a way that it produces monopolies or enables surveillance.

whstl 6mo ago

I love how this is a problem caused by Big Tech (AI), with “solutions” brought by Big Tech (FAANG etc) and “countermeasures” will also be brought in by future billion-dollar industries (domestic-proxy provider BrightData is 1B already) while we will depend on existing Big Tech for “protection” (Cloudflare will remain a big player). At this point the internet is exactly like the film Matrix, where humans are merely an implementation detail in the whole system.

locknitpicker 6mo ago

> You're ostracized from digital society. You're not even a citizen, much less a second class citizen. Before anyone downplays this concern as scaremongering ans slippery slope fallacy stuff, keep in mind that countries are shifting their national ID cars infrastructure to online services which are fundamentally designed around attestation. Moreover some class of services such as banking are progressively increasing requirements that your software and hardware needs to meet to allow you to manage your own property.

loup-vaillant 6mo ago

> these developments still fill me with a terrible sadness. I wish they filled you with anger instead. It’s not too late. You’re not alone.

avaer 6mo ago

The most dangerous thing in computing is safety. "Secure" is great. But when you hear "safe", that means there is some corp in the shadows predating on you because <insert boogeyman>. They decide what safe means, not you. They will abuse you to no end while keeping you "safe". That's why companies always remove the features that keep you "secure" and give you ones to keep you "safe".

ur2ndphone 6mo ago

> Own your device? You "tampered" with it. You're banned. From everything. Don't worry officer, my device is completely clean. Here you go check it. Why yes, I absolutely only ever use it for banking and updating linkedin on a suspiciously empty gmail, and keep it on silent 100% of the time. What's so odd about that? What? No, I just re-read a lot of books, that's my hobby, I read Catcher In The Rye 20 times a month. ... It's about time people realize the concept of a real phone and a civilian phone as one and the same is dead. In fact. You don't need a "real" phone. Just the civilian one. I use what's basically a portable retroconsole for entertainment. Including reading, incidentally. From its perspective, it is just a computer. Let's make it a competition, puny phones versus portable computing. Name me one thing you think it can't do, in return, I'll fire two YOUR phone can't right now, back at you. I'll forward two: It can run tmux and has a copyparty toggle for a portable filestorage on it. Yes, you can do both on the phone. But yours can't right now, and I you will suffer trying tog get it, while mine, it was 2 command lines and one config file each.

cft 6mo ago

I think it's quite telling that this comment was written in Brazil. The so-called Third World is the future source of freedom (or Western countries that become third world perhaps). It may not be a bad idea now to start building open compute and banking alternative ecosystems based in those countries, marketed at Western citizens.

Magnusmaster 6mo ago
The third world is also pushing Digital ID. In fact they would love it even more than the first world as it would allow for even more totalitarianism.