4 ms·

I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Cr

I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial. Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms. Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key? Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so. So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.

wmf 17y ago
I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.
- asciilifeform 17y ago
  > If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
  - tptacek 17y ago
    Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
    - asciilifeform 17y ago
      Let's posit that Sony (or another company) is in the consortium holding the TPM root key. They will then be able to install a truly undetectable and unremovable you-name-it. You are quite correct in implying that a TPM would prevent a repetition of the Sony scandal. It would do this simply by preventing discovery. Of course, it is also possible that Sony in particular would not be given access to the magic key. They may have to pay a steep tribute to, say, Microsoft, to slip the payload through. Whether currently sold TPM chipsets are capable of such feats is immaterial. The camel's nose is in the tent.

wmf 17y ago

I don't think tptacek is defending the AV industry; I suspect he's advocating systems that are either inherently virus-resistant or use whitelisting, which is pretty much the opposite of what we usually call "antivirus". If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing, if not necessarily exactly what TCG is proposing.

asciilifeform 17y ago
> If we ever want to escape from the current computer security morass, we're probably going to need something like trusted computing Limiting malware to an officially approved subset is a curious definition of "escape." And any program which causes my computer to deliberately act against my orders is malware, whether it was created by a script kiddie or a multi-billion-dollar media cartel.
- tptacek 17y ago
  Nobody here disagrees with that. What's funny is that it's the current situation that allows companies like Sony to do that to your computer.
  - asciilifeform 17y ago
    Let's posit that Sony (or another company) is in the consortium holding the TPM root key. They will then be able to install a truly undetectable and unremovable you-name-it. You are quite correct in implying that a TPM would prevent a repetition of the Sony scandal. It would do this simply by preventing discovery. Of course, it is also possible that Sony in particular would not be given access to the magic key. They may have to pay a steep tribute to, say, Microsoft, to slip the payload through. Whether currently sold TPM chipsets are capable of such feats is immaterial. The camel's nose is in the tent.