The one word answer to this? Linux.
The three word rebuttal?
Banking on GrapheneOS
What happened to running what you wanted on your own machine?
201–210 of 315 posts
Re: What happened to running what you wanted on your own machine?
#202Earlier quoted context omitted.
His issue is that saying "assault" to mean "sex with someone" is dishonest, even if that person is 17. Which is obviously is. Any sane person hears "assault" and thinks that means "assault" instead it means something else. What is happening is that the meaning of words are being changed for the purpose of using pre-existing laws. Example, you think that Bla is very bad and isn't punished enough by the law. There's la…
Ok, but surely there are more important thing going on there than the wording. It feels like Stallman wants to defend his friend, but doesn't really have any way to do that. So, instead, he pivots to pedantry. Like ok, assuming that Marvin really did not know, it's wrong to label him as a sexual assaulter(?). Though legally a sexual assault still occured. But, it still doesn't explain, justify or deny that he alleged…
> Ok, but surely there are more important thing going on there than the wording.
Correct, it's the abuse of the legal system.
> Though legally a sexual assault still occured.
Just because something is true legally doesn't mean it's ok, good, correct, moral or ethical.
Re: What happened to running what you wanted on your own machine?
#203Earlier quoted context omitted.
> we could genuinely lose general purpose computing. > At the moment, anyone can use Linux; it's better and easier than ever. Maybe Linux will save us. This was a fascinating thing to watch for me (pewdiepie telling people to install Linux): https://www.youtube.com/watch?v=pVI_smLgTY0 My bet is that the momentum is strong enough that: - A critical mass of PC makers will continue to offer a Linux preinstalled option,…
I love Linux, but if 90% of the US were on Linux the same commercial / political pressures would apply and Linux would just look like Android or ChromeOS. Can you run an alternate OS on your smartphone? Yes, but you can't run your banking app. Linux alone cannot save us.
But I don't want to run a banking "app" on my computer.
I am happy to use a browser on my computer to log into my bank's website.
Re: What happened to running what you wanted on your own machine?
#204What happened was people ended up putting a lot of money and sensitive data on their computers and desired a system which wouldn’t expose that just because they ran the wrong software.
"Wash me but don't get me wet." (Is this a saying in english?)
I'm reminded of a meme involving a dog with a ball: "Please throw? No take. Only throw."
Re: What happened to running what you wanted on your own machine?
#205Earlier quoted context omitted.
It can be turned off on your Mac if that is what you want.
So far, yes. It's getting hardware with every release. First you had to click approve in a dialog to launch unsigned software. Later you had to right click -> "open" -> then approve. Now you have to open system settings to find the button to show the approval prompt. Meanwhile to install a kernel extension you now have to reboot into safe mode and disable part of system integrity protection (with big warnings that it…
Devil's advocating here... when have kernel extensions _ever been_ a part of the average user's experience?
Re: What happened to running what you wanted on your own machine?
#206Earlier quoted context omitted.
Heh, I'm working on a blog post about this very topic. Passkeys are ... weird. There's a lot of potential for gatekeeping, where websites can indeed require you to use device-bound passkeys through device attestation, and where becoming a vendor requires interacting with the fido alliance.... I would say "I'm sure the mean well", but given that parties like Yubico benefit from not getting more competitors, the cynic…
> I would say "I'm sure they mean well", Yeah, I wouldn't say that. It's clear from their public comments[1,2,3] that the spec authors don't believe the private key actually belongs to the user to do what they want with. They see services restricting what users may do with their own logins as a feature of Passkeys. It's really a shame it went in this direction. Replacing passwords with an easy-to-use keypair auth sys…
It is particularly odd in the case of open-source clients (or indeed any client that runs outside of some very locked down hardware) because a) there's nothing that prevents the user exfiltrating keys anyway, and b) attestation also means relatively little for such an implementation.
Re: What happened to running what you wanted on your own machine?
#207Please complain here: https://developer.android.com/developer-verification/guides/... (there's a link at the end).
Probably won't help, but it is something.
Re: What happened to running what you wanted on your own machine?
#208Earlier quoted context omitted.
You could have used an open source client to manage your passkeys as you like, including backing them up in your own storage format. I wrote about it here: https://www.smokingonabike.com/2025/01/04/passkey-marketing-... > I was quite excited about it... until I found out that the Passkey spec authors have warned that client that it may face server-side bans because it lets you manage your own private key how you want…
Reading these comments, I'm happy to see that I'm not the only passkey skeptic.
You'll probably enjoy this article from one of the original creators of the Passkey ecosystem:
> Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity.
https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
Fingers crossed the Passkey user experience remains so bad no one accepts them & they just die on the vine.
Re: What happened to running what you wanted on your own machine?
#209Earlier quoted context omitted.
History tells us there will always be a “low cost” vendor with exploitable hardware, or if production becomes more tightly controlled, inevitable cost cutting and declining standards will provide a way in. Not that we shouldn’t oppose locked down hardware, but locking things down creates pressure and motivation for the people who like things to be unlocked.
Your untampered device will be enrolled with a verified ID provider and they’ll be part of the attestation. The tamper resistance hardware benefits from decades of hacking. Plus you’re not talking about things like compromising a single long lived key or similar like you could with physical media or players. We’ll probably get to the point where you need a verified id to buy a phone that does attestation. Tamper with…
Even if things get that locked down, I suspect that leaked attestation keys and fake/stolen ID verification will always be a problem. There’s a lot of money to be made in this, and someone will inevitably decide not to leave that money on the table, legality be damned. This risk only goes up with manufacturing that crosses borders, and despite the push to renationalize production, it’s going to be a long time before that is feasible at a mass scale.
A small, hardly exclusive list of things we have been unable to protect through technology:
- DVD/Blu Ray/HDMI copy protection
- Windows product registration
- Device jailbreaking (manufacturers are constantly running to keep ahead of this but old versions are frequently unlocked even with iOS)
- Classified diplomatic documents
- Classified details of warfighting equipment
- Identities of federal employees (and even covert agents)
- Nuclear secrets
Technical measures aren’t always the weak point—bribery works just as well. As the US tech stack continues to decouple from China, they will also have the motivation to break our systems.
Re: What happened to running what you wanted on your own machine?
#210Earlier quoted context omitted.
> I would say "I'm sure they mean well", Yeah, I wouldn't say that. It's clear from their public comments[1,2,3] that the spec authors don't believe the private key actually belongs to the user to do what they want with. They see services restricting what users may do with their own logins as a feature of Passkeys. It's really a shame it went in this direction. Replacing passwords with an easy-to-use keypair auth sys…
It is particularly odd in the case of open-source clients (or indeed any client that runs outside of some very locked down hardware) because a) there's nothing that prevents the user exfiltrating keys anyway, and b) attestation also means relatively little for such an implementation.
Yes, the problems are obvious and the spec authors definitely know & understand the issues. Their refusal to have a public discussion about it indicates they just don't care, and their maintenance of a "naughty client list" shows Passkeys are intentionally hostile to user freedom.