3 ms·

Yeah, why is anybody posting about this garbage on HackerNews? There are no startup opportunities for "trustworthy" computing, because there simply aren't any

by barnaby 17y ago

Yeah, why is anybody posting about this garbage on HackerNews? There are no startup opportunities for "trustworthy" computing, because there simply aren't any customers for "you do it the way we tell you, or else" products.

asciilifeform 17y ago
Actually I am in favor of this article being on HN. Treacherous Computing is brewing, and will be served in generous helpings to all of us, whether we ask for it or not. Know thy enemy.
wmf 17y ago
HN is for hackers, not just entrepreneurs. As a hacker, my interest in the technical aspects of this project slightly outweighs my disdain for its evil nature.
- tptacek 17y ago
  Explain again how this is evil? If you can protect a computer from a virus, you can protect it from a DVD ripper.
  - asciilifeform 17y ago
    > If you can protect a computer from a virus, you can protect it from a DVD ripper. The antivirus vendors, champions of "Enumerating Badness", (http://tinyurl.com/8a2uk http://tinyurl.com/8a2uk) would like us to think so. Yet it is pure nonsense. It is much the same as saying that if a house is safe against burglars, it must also be "safe" against the owner engaging in officially forbidden sex acts in the master bedroom.
    - tptacek 17y ago
      Marcus Ranum also believes that closing holes in Linux is "enumerating badness", and counts as one of the "dumbest ideas in security". Since you didn't make an argument that refered to any technical detail of the antivirus/antimalware problem on general purpose operating systems, I'm content simply to point out that your sources are both comical and non authoritative. Also: let me strongly encourage you to run your views on computer security past Ranum, and report back his response. Warn me first so I can get a get a cold glass of milk to blast out my nose when you do.
      - asciilifeform 17y ago
        I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial. Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms. Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key? Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so. So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.
        wmf 17y ago
        I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.
        asciilifeform 17y ago
        > If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
        tptacek 17y ago
        Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
  - wmf 17y ago
    I don't see how remote attestation helps against malware.
    - tptacek 17y ago
      Any system that does local attestation can be opted in to a remote attestation scheme. Even if you design a VM with no opcodes to access network hardware, some trusted code base on the platform has to protect it, and it can DMA. The direct answer to your question is, because some antivirus systems want to work with a central server (or, in Oliver Friedrich's Immunet case, with a P2P network of collaborators). But that's besides the point. The thing to get upset about --- if you think this is worth getting upset about --- are "evil programs" running on the trusted platform. An evil program forbids you to copy data from media inserted into the computer.
      - asciilifeform 17y ago
        > Any system that does local attestation can be opted in to a remote attestation scheme. The very essence of remote attestation is that a digital policeman (a presumably tamper-resistant piece of hardware which cannot be seperated from your computer) pronounces that certain streams of bits which come out of your machine are "blessed," while others are not. All kinds of people (content oligopolies, politicians, etc.) are unhappy that your modem is currently incapable of ratting out your misbehavior. Remote attestation is nothing else than an attempt to correct this "problem." The very word "trusted" in the phrase "trusted computing" is a bold-faced lie. I would like to think that you have been duped into actually believing it, rather than spreading it knowingly. The implication is that I, as a user, ought to trust a "trusted" computer more than the one I presently own. The reality is quite different. The only thing a "trusted" computer is trusted (by its makers) to do is to betray me - to disobey my orders to display or flip certain bits, in the interest of serving a hostile third party.
        tptacek 17y ago
        I'm convinced that if I asked you questions about a real-world remote attestation system, you wouldn't be able to answer them. Suffice it to say that unless you consider yourself the "digital police" or you'll only ever own one computer, the "very essence" of remote attestation is nothing of the source.

by barnaby 17y ago

asciilifeform 17y ago

Actually I am in favor of this article being on HN. Treacherous Computing is brewing, and will be served in generous helpings to all of us, whether we ask for it or not. Know thy enemy.

wmf 17y ago

HN is for hackers, not just entrepreneurs. As a hacker, my interest in the technical aspects of this project slightly outweighs my disdain for its evil nature.

tptacek 17y ago
Explain again how this is evil? If you can protect a computer from a virus, you can protect it from a DVD ripper.
- asciilifeform 17y ago
  > If you can protect a computer from a virus, you can protect it from a DVD ripper. The antivirus vendors, champions of "Enumerating Badness", (http://tinyurl.com/8a2uk http://tinyurl.com/8a2uk) would like us to think so. Yet it is pure nonsense. It is much the same as saying that if a house is safe against burglars, it must also be "safe" against the owner engaging in officially forbidden sex acts in the master bedroom.
  - tptacek 17y ago
    Marcus Ranum also believes that closing holes in Linux is "enumerating badness", and counts as one of the "dumbest ideas in security". Since you didn't make an argument that refered to any technical detail of the antivirus/antimalware problem on general purpose operating systems, I'm content simply to point out that your sources are both comical and non authoritative. Also: let me strongly encourage you to run your views on computer security past Ranum, and report back his response. Warn me first so I can get a get a cold glass of milk to blast out my nose when you do.
    - asciilifeform 17y ago
      I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial. Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms. Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key? Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so. So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.
      - wmf 17y ago
        I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.
        asciilifeform 17y ago
        > If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
        tptacek 17y ago
        Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
- wmf 17y ago
  I don't see how remote attestation helps against malware.
  - tptacek 17y ago
    Any system that does local attestation can be opted in to a remote attestation scheme. Even if you design a VM with no opcodes to access network hardware, some trusted code base on the platform has to protect it, and it can DMA. The direct answer to your question is, because some antivirus systems want to work with a central server (or, in Oliver Friedrich's Immunet case, with a P2P network of collaborators). But that's besides the point. The thing to get upset about --- if you think this is worth getting upset about --- are "evil programs" running on the trusted platform. An evil program forbids you to copy data from media inserted into the computer.
    - asciilifeform 17y ago
      > Any system that does local attestation can be opted in to a remote attestation scheme. The very essence of remote attestation is that a digital policeman (a presumably tamper-resistant piece of hardware which cannot be seperated from your computer) pronounces that certain streams of bits which come out of your machine are "blessed," while others are not. All kinds of people (content oligopolies, politicians, etc.) are unhappy that your modem is currently incapable of ratting out your misbehavior. Remote attestation is nothing else than an attempt to correct this "problem." The very word "trusted" in the phrase "trusted computing" is a bold-faced lie. I would like to think that you have been duped into actually believing it, rather than spreading it knowingly. The implication is that I, as a user, ought to trust a "trusted" computer more than the one I presently own. The reality is quite different. The only thing a "trusted" computer is trusted (by its makers) to do is to betray me - to disobey my orders to display or flip certain bits, in the interest of serving a hostile third party.
      - tptacek 17y ago
        I'm convinced that if I asked you questions about a real-world remote attestation system, you wouldn't be able to answer them. Suffice it to say that unless you consider yourself the "digital police" or you'll only ever own one computer, the "very essence" of remote attestation is nothing of the source.