Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Computer Isn't Yours

sneak.berlin

Post reply on HN
Print view View original

271–280 of 764 posts

Re: Your Computer Isn't Yours

#271

Post by szc »

sliken wrote: post #237
szc wrote: post #127

I'm not going to comment on the linked article, other than say I think it contains serious mistakes in describing what OCSP is for and errors in other statements. In the background there is a war going on, but it isn't what you think. It is a war between malware creators and OS creators. From my perspective it goes like this: To "identify" malware you need signatures. Signatures need valid certificates. Signing keys…

This all sounds well and good. But why not just use signed binaries? Have a user editable keystore that includes the accepted signatures. The default would be apple, installing chrome would require accepting the Google signature, photoshop would require the adobe key. Then users could add their own for brew, firefox, or whatever community software they would use. This would give good protection against hackers, and n…

Mac users can already add any certificate to the Apple keychain and authorize them for code signing. The outage today, which what was being written about in the article, was caused by the OCSP.APPLE.COM service not responding. The OCSP service was likely being used to validate if an Apple Developer certificate was still valid.

Operating a "trusted" Certificate Authority generally requires operating under some rules. For example, the "Certification Authority Browser Forum" requires operating a CRLs (now considered bad) or a live OCSP endpoint.

Let's Encrypt does this, as does every other certificate issuer.

As is being discussed, separate OCSP is bad from a privacy standpoint - if a check of OCSP is being made, it gives telemetry on if you are trying to validate a certificate. If you can see the traffic it does reveal the certificate being checked.

FWIW, there is an OCSP Stapling method of attaching "recent" OCSP responses inside of TLS requests so that a TLS client doesn't have to make a separate request to an OCSP service.

Re: Your Computer Isn't Yours

#272

Post by Symbiote »

arcticbull wrote: post #124
est31 wrote: post #112

Earlier quoted context omitted.

You are totally right that Linux is only a single digit percentage in user share if you look at all computers deployed world-wide. However, in the developer sphere, GNU/Linux is way more represented. In the Stack Overflow 2020 survey, 26% of people said they were using a Linux based OS [0]. This number has been gradually increasing over the years so further growth is expectable. It's less than one percent less than t…

Every company I've worked at for the last 10 years has developed exclusively on macOS. Linux is fine, but it doesn't just work, and it needs to in order to gain a foothold not just in the developer community but with the general public -- that's the lesson Android has taught us. Until it does it will not budge the numbers. It just won't. The real apologism here comes from the Linux community, who believes that by vir…

The general public in Europe cares enough about privacy to pass the GDPR.

Choosing examples from the UK so people can search for them in English, they care when their healthcare data isn't secured, when dating apps leak information, when local councils abuse the rules to "snoop" on people.

If you explain that without a blocking extension (or Firefox's built-in one now?) most pages they visit are sent to Google, and Google maintains a detailed profile, they will ask how to install the extension.

You can say the common man doesn't care about free speech, but enough do care that we maintain it in Western countries.

Re: Your Computer Isn't Yours

#273

Post by elric »

zepto wrote: post #61
deadbunny wrote: post #16

Yet despite all the wailing and gnashing of teeth - both in the article and in the comments here in the various threads - people are still making excuses for continuing to use Apple/Google/Microsoft/et al products because the alternatives are a bit rough round the edges. These companies have repeatedly shown that they don't respect people's privacy and people have resoundingly responded that neither do they. I would…

The alternatives are still completely unusable by most people.

I disagree. It's a matter if taking a couple of minutes to educate people. You don't have to be a CS major to be able to use a modern Linux OS. "Most people" don't do anyhting on their Windows or Mac computer that they couldn't do on Linux. IMO it's a combination of fear of the unknown, and a lack of general availability.

Macs are shiny and their marketing department is fantastic. Windows has a monopoly with OEM preinstalls. Those are the main reasons why macos and Windows are so popular.

I've tried using Windows, it's "completely unusable" to me. I couldn't even figure out how to install it without creating a Microsoft account nor could I figure out how to turn off "telemetry".

Re: Your Computer Isn't Yours

#274

Post by nicbou »

jb1991 wrote: post #234

I don't really understand the tone here. Do people really believe there is "evil" motivations in Apple? How about Tesla and its control over your vehicle? Windows also phones home frequently and has advertising built-in. I get that many in the hacker crowd don't like this, so the obvious solution is, don't buy those products. But for everyone else, it's not this big downer of a problem. This is the only time this has…

> Do people really believe there is "evil" motivations in Apple?

I prefer them not to give them a chance to be evil, rather than trust them not to be.

You're right, life is too short to be upset about it, but at the same time, it's not something you should feel comfortable with.

Re: Your Computer Isn't Yours

#275

Post by sneak »

ArchOversight wrote: post #148
sneak wrote: post #140

Earlier quoted context omitted.

You're absolutely right, and I use a Pixelbook and an iPad Pro for much the same reason. The cryptographic protections are great. (They'd be even more great if I could blow my own bootrom CA into the fuses.) The phone-home is the issue, however. I've long understood the issue with certificate validity periods and the tradeoffs between short notAfter/frequent reissue and revocation check intervals. The side effect is…

Having OCSP encrypted would cause a chicken and egg problem... OCSP is supposed to validate a certificate, but how do you check the validity of the certificate if the OCSP endpoint also requires validation?

You could ignore the validity of the TLS certificate when checking OCSP. That way, passive listeners are foiled, and only active MITM would be able to see which certificates you're checking. It's better than HTTP plaintext, which is how it works now.

Most of the bulk surveillance, pattern-of-life IC stuff is passive, not active.

Ultimately, though, I should be able to opt out of app/binary signing (and associated certificate checking) entirely if I so desire, ideally with a preference setting, or at least with Little Snitch. It looks like I'm going to have to compromise platform security overall to disable it, or use external network filtering hardware.

Re: Your Computer Isn't Yours

#276

Post by eznzt »

zanny wrote: post #178
ThePhysicist wrote: post #143

What we poor souls didn't understand all these years is that we're effectively helping other companies to steal from Apple by running software that isn't distributed via their app store [1]. I think now that Apple has learned from iOS how profitable a walled garden business model is they are trying to bring that model to the PC world as well. Shipping hardware with their own processors is an important step in that di…

Good thing said hacker culture spent 15 years buying inflated laptops and desktops from them ultimately for convenience to give them the market presence to do this in the first place. Its the same thing with Windows. People will preach all day that they won't make any personal sacrifices to try to avoid feeding literal cancers that are eating the software industry and are shocked when said all consuming voids take aw…

And what do you expect us to do, install Linux and spend days configuring the touchpad?

Computers are a tool we use to do our work. Setting up the computer cannot become a job by itself.

Re: Your Computer Isn't Yours

#277

Post by preya2k »

damnencryption wrote: post #114
rsanheim wrote: post #103

Earlier quoted context omitted.

You pointed out a core problem here, and a common blindspot with the HN crowd: > continuing to use Apple/Google/Microsoft That is probably 98%+ of devices that most typical people use for everyday computing, across phone, laptop, and desktop. Whether it is an android device, an iPhone, a Dell laptop or a new M1 macbook you are beholden to a corporation that doesn't care about privacy. I would argue that Apple cares a…

> And before "have you tried this *nix distro??" comments appear, they are still too hard to setup and nowhere near as user-friendly for most people on an everyday basis. This isn't true. This perception continues to hurt the Linux community along with others. Use a properly supported -buntu distro and you are good.

Personally, I gotta disagree. This still absolutely true, even for large distributions.

Every 2 years or so, I give Linux another try on the desktop, and it always ends after a couple of weeks, because I'm just tired of fixing mouse and keyboard settings, touchpads, HI-DPI and multi-monitor settings, font rendering and video codecs.

I've tried Ubuntu, Mint and recently Manjaro and – don't get me wrong – all of them had great stuff in it and worked fast out of the box, but it's always the last little details where desktop linux fails for me.

Re: Your Computer Isn't Yours

#278

Post by q3k »

sliken wrote: post #257
q3k wrote: post #193

Earlier quoted context omitted.

How would that change anything?

By nature RISC-v machines will tend to be more open, have an open bootloader, and be friendly to running an open OS. Much less likely to block installing Linux, like Apple has done. Much less likely to block running linux, like on the Microsoft Surface. Sure some Apple like company could make a fork of RISC-v and then lock down the environment, spy on a user's network traffic, what binaries they run, etc.

How does RISC-V imply an open bootloader or open hardware? It's just an ISA, and there is currently no RISC-V extension that I'm aware of that goes into details like platform boot or platform boot security.

In fact, Si-Five have implemented their own from scratch [1], because there was no existing RISC-V blessed way of doing these things. And their implementation is open, but nothing prevents anyone else from implementing a closed, fused implementation. Or taking the Si-Five implementation and using it to prohibit any modifications by end-users, like vendors already do with U-Boot. [2]

I already have in my hands a RISC-V microcontroller that can be locked down by the firmware developers to prohibit me from reading it out or modifying it [3].

And finally - even running your code on a RISC-V core is not enough to actually make a platform usable. You need documentation for every single peripheral around the core (and/or core complex). And even when you have that, implementation is still a lot of work. See: how much effort it was to do a decent Linux port onto the Tegra X1 on the Nintendo Switch, which is extremely thoroughly and publicly documented (in comparison to other platforms in this class, at least). And the only blocker there was secure/fused boot. Which again, RISC-V will not prevent.

[1] - https://riscv.org/wp-content/uploads/2019/12/12.10-14.20-SiF...

[2] - https://www.denx.de/wiki/pub/U-Boot/MiniSummitELCE2013/U-Boo...

[3] - http://www.gd32mcu.com/data/documents/shujushouce/GD32VF103_... ; C-f security

Re: Your Computer Isn't Yours

#279

Post by nicbou »

istillwritecode wrote: post #51

The title should be "Your apple computer isn't yours".

I might be mistaken, but wasn't Windows well ahead of Apple on this one?

First it sneaked Windows 8 and 10 updates onto people's computers, then used every dark pattern imaginable to get them to consent to tracking, then slowly included ads in their operating system.

For the last 2-3 years, I thought "at least Apple isn't doing that", but that is changing.

Re: Your Computer Isn't Yours

#280

Post by eznzt »

deadbunny wrote: post #16

Yet despite all the wailing and gnashing of teeth - both in the article and in the comments here in the various threads - people are still making excuses for continuing to use Apple/Google/Microsoft/et al products because the alternatives are a bit rough round the edges. These companies have repeatedly shown that they don't respect people's privacy and people have resoundingly responded that neither do they. I would…

The alternatives are not "a bit rough round the edges". They are much, much worse.
Post reply on HN