[flagged]
Lennart Poettering, Christian Brauner founded a new company
461–470 of 770 posts
Re: Lennart Poettering, Christian Brauner founded a new company
#462Trusted computing and remote attestation is like two people who want to have sex requiring clean STD tests first. Either party can refuse and thus no sex will happen. A bank trusting a random rooted smartphone is like having sex with a prostitute with no condom. The anti-attestation position is essentially "I have a right to connect to your service with an unverified system, and refusing me is oppression." Translate…
> You're just not entitled to have third parties trust that device with their systems and money.
But its a bank, right? Its my money.
Re: Lennart Poettering, Christian Brauner founded a new company
#463Why have the responses to the post from the CEO been moved to their own top-level posts? Also, why are replies disabled for the CEO post?
Re: Lennart Poettering, Christian Brauner founded a new company
#464[flagged]
You're right, they shouldn't have started a company, that would be better for diversity.
Re: Lennart Poettering, Christian Brauner founded a new company
#465Earlier quoted context omitted.
I’m not sure I understand the threat model for this. Why would I need to worry about my enclave being identifiable? Or is this a business use case? Or why buy used devices if this is a risk?
It's a privacy consideration. If you desire to juggle multiple private profiles on a single device extreme care needs to be taken to ensure that at most one profile (the one tied to your real identity) has access to either attestation or DRM. Or better yet, have both permanently disabled. Hardware fingerprinting in general is a difficult thing to protect from - and in an active probing scenario where two apps try to…
Which is why I personally filed off the VIN from my car's engine.
Re: Lennart Poettering, Christian Brauner founded a new company
#466I chuckle because their official adress is just 20 minutes from my home / current location.
I wish you great success
Re: Lennart Poettering, Christian Brauner founded a new company
#467Earlier quoted context omitted.
> I've been a FOSS guy my entire adult life, I wouldn't put my name to something that would enable the kinds of issues you describe. Until you get acquired, receive a golden parachute and use it when realizing that the new direction does not align with your views anymore. But, granted, if all you do is FOSS then you will anyway have a hard time keeping evil actors from using your tech for evil things. Might as well g…
You could tell this sort of insinuation to anyone. Including you. Argument should be technical.
That's a perfectly valid objection to this proposal. You only have to look at what happened to Hashicorp to see the risk.
Re: Lennart Poettering, Christian Brauner founded a new company
#468Remote attestation only works because your CPU's secure enclave has a private key burned-in (fused) into it at the factory. It is then provisioned with a digital certificate for its public key by the manufacturer. Every time you perform an attestation the public key (and certificate) is divulged which makes it a unique identifier, and one that can be traced to the point of sale - and when buying a used device, a poin…
I tend to buy such things with cash, in person.
People dislike cash for some strange reason, then complain about tracking. People also hand out their mobile number like candy. Same issue.
Re: Lennart Poettering, Christian Brauner founded a new company
#469Earlier quoted context omitted.
https://0pointer.net/blog/authenticated-boot-and-disk-encryp... Yes, system data should be locked to the system with a TPM. That way your system can refuse to boot if it's been modified to steal your user secrets.
And if Linux$oft suddenly decides every user's system needs a backdoor or that every system mus automatically phone home with your entire browsing data, then, well, too bad, so sad of course! Jesus.
How exactly would this happen.
Re: Lennart Poettering, Christian Brauner founded a new company
#470Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…
A silver lining, is it would likely be attempted via systemd. This may finally be enough to kick off a fork, and get rid of all the silly parts of it.
To anyone thinking not possibile, we already switched inits to systemd. And being persnickety saw mariadb replace mysql everywhere, libreoffice replace open office, and so on.
All the recent pushiness by a certain zealotish Italian debian maintainer, only helps this case. Trying to degrade Debian into a clone of Redhat is uncooth.