Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lockdown: The coming war on general-purpose computing (2011)

boingboing.net

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Lockdown: The coming war on general-purpose computing (2011)

#21

Post by stcredzero »

saagarjha wrote: post #20

> People who took the software without paying for it were untouched. This is a fundamental issue of DRM: people who "break the rules" end up better for it. If you annoy people, they will find ways around your rules, and then you won't be able to touch them.

On the other hand, such rules are more easily applied to corporations and government organizations. I say we should start making big companies use Trusted Execution technologies to use people's data, so we can keep the keys and take away their access when we want to.

Re: Lockdown: The coming war on general-purpose computing (2011)

#22

Post by [deleted] »

ClassyJacket wrote: post #18
nixpulvis wrote: post #4

Earlier quoted context omitted.

Or maybe they'll slowly replace it, while you lie dying in bed unaware as to the problem.

Apple is already doing this. They've recently required that ALL software run on Mac is signed by them, even apps from outside of the App Store. https://developer.apple.com/news/?id=04102019a Not much longer until we can't run software Apple doesn't like at all. Because I shouldn't get a say in what I run on my four thousand dollar computer, of course.

[deleted]

Re: Lockdown: The coming war on general-purpose computing (2011)

#23

Post by ultrarunner »

musicale wrote: post #11

>"fix the Internet so that thepiratebay.org no longer resolves," sounds a lot like .. “take that pizzeria on the corner off the phone network," and not like an attack on the fundamental principles of internetworking. I don't get this - disconnecting the pizzeria from the phone network seems more severe than simply removing it from the yellow pages. If you remove thepiratebay from DNS you can still reach it via its IP…

DNS is a fundemental component of the internet. Currently, computers trust their upstream DNS servers to resolve correctly. Imagine if tpb resolves incorrectly on some networks. People on those networks may choose to use a different DNS server that resolves TPB correctly, but maybe has a grudge against Google and resolves an IP for Yahoo instead. Other DNS servers may have other grudges, or policies, or political pressures.

The end result is that DNS cannot be trusted, and so the design entirely breaks. Imagine ordering a package but not knowing if the delivery driver will see your address at your house or someone else’s.

This isn’t just removing something from the yellow pages, it’s introducing distrust into the phone system itself.

Re: Lockdown: The coming war on general-purpose computing (2011)

#24

Post by mr_toad »

ultrarunner wrote: post #23
musicale wrote: post #11

>"fix the Internet so that thepiratebay.org no longer resolves," sounds a lot like .. “take that pizzeria on the corner off the phone network," and not like an attack on the fundamental principles of internetworking. I don't get this - disconnecting the pizzeria from the phone network seems more severe than simply removing it from the yellow pages. If you remove thepiratebay from DNS you can still reach it via its IP…

DNS is a fundemental component of the internet. Currently, computers trust their upstream DNS servers to resolve correctly. Imagine if tpb resolves incorrectly on some networks. People on those networks may choose to use a different DNS server that resolves TPB correctly, but maybe has a grudge against Google and resolves an IP for Yahoo instead. Other DNS servers may have other grudges, or policies, or political pre…

> Imagine if tpb resolves incorrectly on some networks.

It already does. DNS can’t be totally trusted now. Arguably it’s already broken.

Re: Lockdown: The coming war on general-purpose computing (2011)

#25

Post by bawana »

ClassyJacket wrote: post #18
nixpulvis wrote: post #4

Earlier quoted context omitted.

Or maybe they'll slowly replace it, while you lie dying in bed unaware as to the problem.

Apple is already doing this. They've recently required that ALL software run on Mac is signed by them, even apps from outside of the App Store. https://developer.apple.com/news/?id=04102019a Not much longer until we can't run software Apple doesn't like at all. Because I shouldn't get a say in what I run on my four thousand dollar computer, of course.

Too much fud. Can you download code from github and type ‘make’?

Then you can run anything

Re: Lockdown: The coming war on general-purpose computing (2011)

#26

Post by bobbiechen »

ultrarunner wrote: post #23
musicale wrote: post #11

>"fix the Internet so that thepiratebay.org no longer resolves," sounds a lot like .. “take that pizzeria on the corner off the phone network," and not like an attack on the fundamental principles of internetworking. I don't get this - disconnecting the pizzeria from the phone network seems more severe than simply removing it from the yellow pages. If you remove thepiratebay from DNS you can still reach it via its IP…

DNS is a fundemental component of the internet. Currently, computers trust their upstream DNS servers to resolve correctly. Imagine if tpb resolves incorrectly on some networks. People on those networks may choose to use a different DNS server that resolves TPB correctly, but maybe has a grudge against Google and resolves an IP for Yahoo instead. Other DNS servers may have other grudges, or policies, or political pre…

As briefly mentioned in the article, SOPA proposed DNS-level blacklisting against copyright-infringing websites. But the fact that you are able to choose what DNS server you use almost guarantees that at some point someone would set up a DNS server outside of the US that would bypass these blocks anyways.

Savvy users could simply bypass a SOPA-enabled recursive DNS server by pointing their DNS settings to an off-shore recursive DNS server... What would happen to users if an infringer decided to setup a “free, non-SOPA” recursive DNS server for users to use – one that additionally hijacked legitimate banking, ecommerce and business websites, too? [1]

[1] https://dyn.com/blog/sopa-breaking-dns-parasite-stop-online-...

Re: Lockdown: The coming war on general-purpose computing (2011)

#28

Post by nine_k »

bawana wrote: post #25
ClassyJacket wrote: post #18

Earlier quoted context omitted.

Apple is already doing this. They've recently required that ALL software run on Mac is signed by them, even apps from outside of the App Store. https://developer.apple.com/news/?id=04102019a Not much longer until we can't run software Apple doesn't like at all. Because I shouldn't get a say in what I run on my four thousand dollar computer, of course.

Too much fud. Can you download code from github and type ‘make’? Then you can run anything

As long as your build toolchain is available, that is, signed.

Signing software is a good idea. Which signatures to trust should be a user's decision, though, with sane defaults.

Re: Lockdown: The coming war on general-purpose computing (2011)

#29

Post by nixpulvis »

nine_k wrote: post #28
bawana wrote: post #25

Earlier quoted context omitted.

Too much fud. Can you download code from github and type ‘make’? Then you can run anything

As long as your build toolchain is available, that is, signed. Signing software is a good idea. Which signatures to trust should be a user's decision, though, with sane defaults.

I agree with this.

Re: Lockdown: The coming war on general-purpose computing (2011)

#30

Post by Wowfunhappy »

ClassyJacket wrote: post #18
nixpulvis wrote: post #4

Earlier quoted context omitted.

Or maybe they'll slowly replace it, while you lie dying in bed unaware as to the problem.

Apple is already doing this. They've recently required that ALL software run on Mac is signed by them, even apps from outside of the App Store. https://developer.apple.com/news/?id=04102019a Not much longer until we can't run software Apple doesn't like at all. Because I shouldn't get a say in what I run on my four thousand dollar computer, of course.

All it takes to disable Gatekeeper is a single Terminal command. All it takes to disable System Integrity Protection is a single Terminal command run from recovery mode. By my count, that is ten minutes of work at most to allow not just unsigned software but unsigned drivers that run at a super low level.

Add in a few more Terminal commands and you can even disable really arcane things like amfi [1]. I don't know why you'd ever want to do that, and it's probably a bad idea, but you can, so by all means please go nuts.

When Apple starts taking away Terminal commands you are free to start screaming, and I'll be there with you. For now, all Apple has ever done on macOS is remove UI options, which keeps inexperienced users from running into them.

---

[1] https://github.com/stek29/nvram-liber-macos

P.S. Microsoft, by contrast, does not let you permanently disable driver signing on 64 bit Windows 8/10. This perpetually drives me nuts, but no one else seems to care for some reason...

Post reply on HN