The Dangers of Microsoft Pluton

The goal is not to prevent you from running Linux, is to make it so that Linux cannot access the content you are interested in.

Remote Attestation establishes a root of trust that can be used to verify that all of the software down the line is "approved":

- You won't be able to browse sites or use apps with ads unless you run a 'trusted' device, OS and browser that does not block ads.

- You won't be able to browse sites with captchas unless you run a 'trusted' device, OS and browser that does not allow bots to interact with the browser.

- You won't be able to run Netflix unless you run a 'trusted' device, OS and browser so that you can't record the content.

- You won't be able to play online games unless, again, you run a 'trusted' device and OS so that you cannot cheat, or more importantly modify it in any way (why would you purchase skins if you can mod them in?).

- You won't be able to use online banking unless you use a trusted OS because banks.

Remote Attestation is pretty terrifying and it will be here soon unless it is regulated out of existence, which is unlikely.

You really nailed it with that car analogy.

Most "car people" would agree that changing the oil in your car is super easy. To me, it is not easy. It's not something I'm willing to do, even though I know the steps of how to do it. I just don't know what I don't know. When I have my oil changed, the mechanic tells me what I should be concerned about. He tells me what upcoming work I need to have done, how much it will cost, and what could happen if I don't do it. He has experience, expertise, and specialized tools. He had knowledge gathered over years to be highly proficient in his profession.

I could do those things. I could read, and listen, and learn. I could be under my car every day learning new things about how to install this, or replace that. But I don't really have the drive or inclination to do so. I'd rather leave it to the pro. I also have the added novice-worry of screwing something up, and hurting myself or others as a result. I don't want that kind of pressure. I don't want my car breaking down while doing some long journey - I just want it to run when I need it to run, without any scary warning lights coming up on my dashboard.

To bring the analogy back to computers, I still know people - people in their 20's or 30's - who do not know how to copy and paste with keyboard shortcuts. I will sit there and see them highlight, right-click, click copy, move their cursor, left-click, right-click, choose paste. I'll tell them how much time they could save if they "just did ..." and get a basic "Yeah...I just don't really care though, ya know? This works." The thing is, there is no investment on their part to want or need to do that more efficiently. They get by well enough with not bothering.

They could get super into computers, and learn something as "technical" as `git clone https: //github.com/some/repo` and follow the process to configure and run a script. They could learn to do those things. But they don't really have that time to invest in it, or don't have that passion for it, or have a professional investment in needing to do it.

They want it to work. They want to not get hacked. They want to not have to think about computers at all. Computers are the interface to do "the thing" more easily. And if the computer breaks? They want it fixed so it won't happen again. The computer "does the internet thing". And I can respect that because they focus their energy into knowledge into other topics that I don't have a clue about, the same way I don't have a clue about cars, even if I know oil changes are "easy".

This atrocious attitude is absolutely why software is such a hellscape of shitty UI and lack of features.

Normies should be eating our table scraps, not dictating how the software is written.

Normies learned how to drive a car. They can learn how to properly compute. And if they don't like the tech, they don't have to use the tech.

OSS is the last bastion of computing for people who know/like computing, because the armies of "designers" aren't selfless enough to donate their time like programmers are. And frankly it is better off that way, the prevailing trends in design seem to be all about limiting options.

Hard, powerful software over push-button appliances any day.

And, to use the car analogy, BMW gets away with this approach just fine.

The statement was why Stallman specifically has not had much of an impact, not Linux writ large. and, you're right. The rape comments came late. But let me remind you that it's emblematic of a larger... issue with Stallman's ability to communicate effectively. If you don't think the way Stallman behaves is at least partly to blame for people's ability to take him seriously, I don't know what to tell you.

https://daringfireball.net/2019/09/richard_stallmans_disgrac...

It’s worth distinguishing between security against software attacks and security against physical “attacks”.

I absolutely don’t want my internet connected pet cam to be accessed remotely (outside the set of companies i’ve decided to trust, namely the manufacturer.)

Protection against hardware tempering is less good and probably mostly anti-consumer. The most legitimate cases I’ve heard:

- Protection from (some) supply chain attacks

- Leasing models. Where you acquire the item for less than it’s hardware cost and pay over time.

But honestly I’m not convinced of either.

Disclosure: I worked on Azure Sphere, the first place Pluton was developed outside Xbox.

Edit: I’ve read the whole article now. These scenarios are really bad and really realistic. Pluton is bad.