Will Microsoft Code-Checking Plans Cripple the GPL?

Infonaut was one of many readers to point out that "Thomas C. Green at The Register seems to think Microsoft is after far more than the 'ubiquitous security' they're pitching to the mainstream press. In this lengthy article, he contends that Microsoft's latest plans are in many ways an attempt to kill Linux by rendering GPL'ed software unusable. Yep, that's freedom to innovate, I'd say."

Comments

Bah.

[EvilNight]

Don't worry about Microsoft. They're on their way to being a footnote. I chuckle that they think that when forced to choose between MS and GPL, people will go with MS. That's not a safe assumption to make... not a safe one at all.

Just keep coding. Millions of happy hackers > politics and license agreements.

The Sky Isn't Falling Yet

[colmore]

The general thrust of the article is that under the new security system, GPL programs will not be able to be "trusted" by MS' hardware/software security system, so GPL based systems (like Apache web servers) will become unusable with mainstream computers.

I doubt this will happen.

Because, frankly, the invisible success of opensource is too widespread. I haven't looked at server statistics recently, but a significant percentage of webservers run on some manner of opensource program. Microsoft isn't going to be able to force half of the web servers in the world to switch over, and if people know that buying this new board from MS/Intel (which has few tangible benefits) will render half of the internet unusable, nobody is going to go for it. I'm not even beginning to think about the various governments that have begun to standardize around Linux, the opensource core of Apple's OS X, etc. etc.

Frankly opensource is too big. If Microsoft renders its systems incompatible with the GPL, then it will be Microsoft, and not the OS community, that suffers.

I say, let 'em try.

Re:The Sky Isn't Falling Yet

[GigsVT]

Need I break out browser market share statistics from 1996?

We need to fight every battle as if it is our last, things change too fast in the IT world to trust things like market share.

Re:The Sky Isn't Falling Yet

[serps]

Frankly opensource is too big. If Microsoft renders its systems incompatible with the GPL, then it will be Microsoft, and not the OS community, that suffers.

I say, let 'em try.

You think? I believe you're not looking at the bigger picture. The open source movement is a t a point where big business is starting to take it seriously. What Longhorn attepts to do is is dump linux from the desktop, because all the client progams will barf when they don't see MS-certified keys when they install. That's only half the story, though. You need those killer applications otherwise people will just install some other OS, and you've lost your leverage with the OEMshardware makers, and your momentum stops.

The other half is the network services. What if your online bank rejected non-WindowsDRM compliant Operating Systems? What if all the websites you wanted to go to required Passport, or conversely if those websites HAD to run .NET-compatible OSes in order to be accessed by WindowsDRM machines? Microsoft doesn't own the web, but if they make their own proprietary internetworking system (*cough*.NET*cough*) then they've won half the war. They can afford to play nice and let .NET become really popular before introducing "optional" security settings, then embrace and extend to taste. They need critical mass in both the server and the client to win the war, but they only need to break Linux's interoperability with Windows to relegate Linux into a niche market - an OS which doesn't "work" with the new Net.

Re:The Sky Isn't Falling Yet

[rseuhs]

Not only Open-Source is too big, their own installed base is too big, too.

The majority of users still use Win98, a 4 year old OS - which is only a minor step up of Win95, a 7 year old OS. (And Win95 is also still used by over 10% of users.)

So if we extrapolate this figures:

If MS starts this scheme in 2 years, it will take another 7 years until 90% of their users have it (and that's still not enough because 10% is still too much to lose).

And because Linux is starting to make inroads (Governments of South-Korea, Germany, France, Israel and many other organizations are getting Linux on desktops) it will be too late for them in a couple of years anyway. Even if Linux only captures 10% within the next 5 years, this is enough to make such schemes fail.

I don't even have to talk about the server-side because you already did.

So, yes I agree, let them try.

This will be the next Hailstorm.

Re:The Sky Isn't Falling Yet

[colmore]

For that to be a relevant comparason, the entire OS community would have to stop putting out meaningful updates and upgrades, make no feature additions ever, decide to scrap their codebase, and refuse to acknowledge that competition is occuring.

Netscape died by their own hand. I wonder at what point the execs said "oh well we can retire on AOL money anyway, who cares?"

Re:The Sky Isn't Falling Yet

[nehril]

FYI: there is NO source for accurate, unbiased information. All information you receive from others (especially from journalists) is inherently biased in some way. Consider that even "accurate" information is still subject to selection and "errors of omission." given that this is the case, it is your job as an intelligent reader to find the bias and extract what useful information you can.

the worst sources are the ones that seem to be "fair," because they tend to make you less alert to the bias that inevitably exists.

Re:The Sky Isn't Falling Yet

[Saint Fnordius]

The sky may not be falling, but it also fits in with vilefying emulators and their ilk, as Microsoft really *is* running scared. Now that Intel and IBM are working so closely with Linux, and Apple maneuvering itself to becoming the developer's platform of choice, Microsoft sees its comfortable monopoly under attack.

Microsoft is paranoid about becoming irrelevant, about anybody doing to them what they did to IBM. They aren't truly innovative, and they know it. It even shows with this re-hashing of Intel's unique identifier plan as a way to lock out the competition. The wierd thing is, this comes just as experts (even from Microsoft itself!) are debunking technological security schemes!

Another thing I noticed is that this whole "Palladium" is still speculative vaporware. It's as if Microsoft wants *us* to define it with our hopes and fears, or as if they heard of another meme and wanted to claim that they thought of it first.

So maybe the sky *is* falling...from Microsoft's point of view.

Re:The Sky Isn't Falling Yet

[colmore]

The internet wouldn't have changed if netscape had tried.

Nobody trying to make any money on the web will render their services incompatible with user's browsers. Especially if you think about how many corporate surfers (lunchbreak ebay time... why isn't it working?) are using non-Palladium machines to connect. It doesn't matter what's on your desk, it matters what's in the network closet.

I really believe that Microsoft is flushing money down the toilet, or perhaps appeasing investors by saying "ignore those reports of poor security, look at what we're going to do"

They'll need something like a 95% installed base before they can make this into anything other than a "check here to not see this warning again" feature, and that won't happen for at least 5 years, many more if the current slowdown in hardware purchasing is more than a temporary snag (hint: it is, what widely used apps make full use of even two year old systems?)

the hardware upgrade cycle is rapidly moving away from the old 2.5 year average, and that alone will kill any chance of this thing working.

Re:The Sky Isn't Falling Yet

[colmore]

Yes, but we're talking about much more than OSes here, think about how many corporate sites run custom scripts and apps.

Big Biz does NOT want to update their codebase. The Airlines still use traffic control software written in the mid-70s. It is expensive to update custom software.

Secondly, I see a far more likely response to Microsoft's threat of "this site is not safe to visit, tell them to upgrade to IIS" is a massive class-action lawsuit. This tactic amounts to nothing more than a protection racket, and CEOs (once things are explained to them in baby words by IT) won't stand for it.

Regardless, it IS a threat, but only if we roll over and take it. We've got several years to fight this thing, are we men or are we netscape?

Re:The Sky Isn't Falling Yet

[colmore]

There's a difference between a free client that comes with the OS that comes with the Dell, and a $100,000 upgrade for every server in the company.

This is a problem that will be dealt with on the server level, and corporate customers, while certainly not beyond being sold by MS' bullshit, are far less sheeplike than their customers. Especially when we're dealing with tons of money.

Also, another factor that I hadn't considered. If a formerly Linux based webservice has to make the switch to IIS, they will likely have to replace or retrain their entire IT department, which in many cases, could be almost the entire company. People cost much more than software, and MS may well be offering struggling e-businesses little more than a chance to go bankrupt.

Re:The Sky Isn't Falling Yet

[Nygard]

Another thing I noticed is that this whole "Palladium" is still speculative vaporware. It's as if Microsoft wants *us* to define it with our hopes and fears, or as if they heard of another meme and wanted to claim that they thought of it first.

That's a very good point. I think that's exactly what they did with .Net. They announced a bunch of vague stuff a few years ago and listened closely to whatever dreams people projected onto the formless name. Then they built that, or at least relabeled other things to fulfill the half-expressed wishes that they got back from the community.

It's like marketing by sonar. Send out a flat ping, and see what shape it takes when it reflects off of the industry.

wrecking common standards

[sbuckhopper]

In other words, what MS is attempting to do here is the same thing they've done all along.

1. Take a perfectly good command standard.
2. Bastardize it for their own use.
3. Make it not-backwards compatible.

However this time they really win the game if they're succesfull. This is because if they can really implement this, they actually don't have to do the work of bastardizing the standard interfaces, they've inherintly done it.

What they're trying to do is make it so that a common interface is a MicroSoft interface from the start.

How many antitrust lawsuites do they want brought against them? I guess $30B can buy a lot of lawyers.

Re:wrecking common standards

[Anonymous Coward]

It's INSANE that one competitor "volunteers" to set standards for an industry and police it, and the industry actually considers letting them. Microsoft doesn't act like a competitive company, they act like a branch of the government.

How about this one:

"Whoops! Can't connect to the Net with Mozilla, since Operasoft has set the standard and declared all non-Opera browsers are banned at the ISP."

(Of course, Opera isn't nearly as SCUMMY as Microsoft, but this is just for illustration.)

"What do you mean Sony TV's can't get channel 11?"

"Why won't Wonder Bread fit in this damn toaster, but the other kind will?"

"I can't sit at the front of the bus *WHY*???"

Zoober

Well after all...

[o'reor]

Not everybody is using Hotmail or MSN. Alternative solutions to MS Passport or "Palladium" exist, supported by big brands such as Sun, Oracle and so on. Why would everybody suddenly turn to an all-M$ solution ? Besides, that "Palladium" thing is still a long way down the road : no release before 2006 AFAIK. Right now, there are plenty of governments and organizations that are considering migrating part or all of their administration to Linux or other open-source based solutions, one of the main reasons being (surprise !) the openness of those products and the availability of the source code.

This means that they have weighed in all the involved costs (migration, maintenance, training and so on), and they are not likely to go backwards to a proprietary M$ solution in 5 years (which would involve another heap of money for training, data migration, etc.)

Since M$ is not going to release any major rework of its flagship OS for the next 5 years or so, I see a chance for Linux and other free software OSes to dramatically increase their respective user bases in the meantime. And if the users turn out to be major organizations / administrations / companies, they will be in a position to negociate an open-source (or at least, much less restrictive) alternative to M$ Palladium from the contents providers / secured businesses they might have to deal with.

Just my 0.02 euros anyway...

Their installed base will work against them

[tkrotchko]

I think its a chicken or egg problem.

If there were no PC's, this scheme might work because there is no "untrusted" installed base.

But since there are already billions of PCs out there already that can't or won't work with this scheme, they it can't be adopted because a merchant or web site owner would risk locking out huge portions of their customers.

This reminds me of the whole Passport authentication scheme that had everyone in an uproar last year. In the end it amounted to NOTHING because it never had critical mass.

I agree with most of the analysis, I just don't think anyone has enough control over the computing ecosphere to make this work.

Re:ARE WE SURPRISD?!?

[purpledinoz]

Why does everyone always assume that all of Microsoft's actions have a sinister undertone in them? I admit, I will look at these new security measures by MS with scrutiny, but I will give them the benefit of the doubt.

This is going to cause problems...

[spagma]

The reason I say this, is that I do technical support for a local ISP, we have both Unix and W2K webservers on our system and a couple thousand customers that don't know the difference. I would say that most people wont even know they are getting these boards whent they purchase a new machine. Then they will be calling me up to find out why they cant view their favorite webpages. The answer, "Your hardware is restricting your access to the site" is just going to blow right over their head, they are not going to understand why. They are just going to be pissed at us for not being able to help them, probably switch to AOL or something before they find out the real problem, but by then it is way to late. They will just deal with it. Complacency is the name of the game, this is the same reason why companies offer rebates, because a good portion of the customers are not going to bother doing anything about it. Sure some will, or try to return their hardware, but most will not, they will assume it is the new standard and everyone else will have to change to meet it. After all, their stuff is brand new, how could it be wrong?

interesting article. but...

[kipple]

you have a chip ON THE mobo that tells you if you can run an application. what if you're disconnected from any network? the chip must have some key that, applied to the application, will make it usable. Or will decrypt the application. Or will act as a general key to allow the cpu to run some code.

Still, it is something you have ON YOUR MOTHERBOARD. Like the CSS key... it's there, it will be just a matter of time before those evil linux users will find a way to bypass it, fake it, and run whatever they want. Bringing havoc on the pristine, certified, public-key signed microsoft world. Like a cancer...

....or at least I hope so. I have much more trust in a 15-years old linux north-european user, than in any chunk of Microsoft Engineers that live in their golden world, without Windows (hah! pun!) on the outside world.

However, this palladium-thing looks like the whole .NET thing. Just marketing hypes, nothing else. We've all seen what .NET has become... bugs even before it was launched. Palladium is just a way to scare vendors which would like to try linux.

Those guys at Microsoft are just playing the scary-announcement thing: to scare people before they make the next move. Then make them wait, then provide them a lot of useless marketing, then -before they will realize it- they have been embraced. And the empire extends itself.

Whops! sorry folks, I don't believe a word of this palladium thing until I see a working chip, and I see that it works better than current systems. THEN we can start talking about that, and hacking it. Unless the new DMCA won't make it illegal and punisheable by death ;)

cheers.

Re:interesting article. but...

[mikeee]

Unless the new DMCA won't make it illegal and punisheable by death

Ding! The existing DMCA makes this illegal. Since Palladium provides DRM (by attempting to provide a 'trusted' client, ie one that obeys MS and not its owner), subverting it is a DMCA violation. Do not pass Go, do not collect $200.

Now, arguably, the interoperabality/reverse-engineering clauses of the DMCA clear you here, but if those meant anything the whole DMCA becomes mostly a non-op anyway, so the courts appear to be just ignoring them.

Re:interesting article. but...

[mjh]

you have a chip ON THE mobo that tells you if you can run an application. what if you're disconnected from any network? the chip must have some key that, applied to the application, will make it usable. Or will decrypt the application. Or will act as a general key to allow the cpu to run some code.

Ok, but this will be done by installing a certificate (i.e. a signed public key) into the mobo, not a secret key? The certificate will be used to verify that Red Hat (for example) has signed the binary that was distributed. Nothing secret is needed to accomplish this verification. The secret is stored in Red Hat's secret key (stored at red hat) and in the root level secret key (stored, presumably at Microsoft).

So what happens is that Red Hat attaches the cert that they used to sign the app to the app. The mobo cert can verify that it's a red hat cert because the root cert is installed on the mobo. Then the mobo uses the red hat cert to verify that the app has been signed by red hat. No secret keys required. Only publically available knowledge required.

If you're able to break this, then you've broken all public/private key encryption under whatever algorithm was in use.

This is very different from CSS because CSS tries to encrypt (hide) the content. With CSS a huge number of people need to be able to see that content: legitimate customers, none of which have their own private key. So somehow the customer needs to be able to get access to a secret key to see the data. So CSS put a secret key into every DVD player, so that customers could see the data.

But with this, they're not trying to hide anything. They're trying to verify that the data (in this case a computer program) hasn't been altered. Doing that securely does not require wide distribution of a secret key. It requires wide distribution of a certificate (i.e. a public key) but so what? It's a public key. As long as the software provider has a cert signed by microsoft and as long as microsoft keeps their secret key secret, this is going to be very difficult to break.

I think this is very scary, and I think it's quite clever. It basically makes the problem of exercising the GPL the equivalant of cracking public/private key encryption. And that doesn't even mention the amount of power than Microsoft can impose through forced upgrades? Certificates expire. Microsoft can impose that all software providers certificates will expire every year, or 6 months or whatever. At which point, the software will no longer verify correctly. Which means you need to go back to your provider to get an upgrade with a new certificate! You thought forced upgrades were bad before? And what happens if Red Hat decides to divulge their secret key so that the GPL can continue to be exercised? Or if they make it easy to get signed apps? Well then Microsoft simply decides *not* to issue them a new certificate when their current one expires.

This is clever in a very sinister way... unless I'm missing something.

Ignorant FUD

[NearlyHeadless]

The article begins

Yesterday, as we all know, Microsoft fed an 'exclusive' story about its new 'Palladium' DRM/PKI Trust Machine to Newsweek hack Steven Levy (a guy who writes without irony of "high-level encryption"), presumably because they trusted him not to grasp the technology well enough to question it seriously.

This is the Steven Levy who has been writing about computers for two decades now, whose books include:

• Crypto : how the code rebels beat the government--saving privacy in the digital age
  
• Insanely great : the life and times of Macintosh, the computer that changed everything
  
• Hackers : heroes of the computer revolution
  

Obviously, with titles like these, he must be an ignorant Microsoft toady. On the other hand, Thomas C Greene, who has never spoken with anybody involved with the project, knows everything about it and what it is really about.

Palladium is all about sales

[standards]

Let's be honest here - Microsoft has trouble on it's horizon.

Microsoft has sold a lot of Windows 95 and Windows 98. And sad to say, these so-called "operating systems" are good enough for my mom and dad (and sister and grandfather and girlfriend and boss).

Now what? What is Microsoft releasing that would convince my family to upgrade their PCs? To be honest, nothing but hardware failure will convince them to do that. They're happy with their 5 year old PCs, and such longevity is sure to hit Microsoft's bottom line.

The answer? A new security scheme that makes it impossible to run new programs on old hardware. A scheme that also negatively impacts unauthorized vendors (including "open source"). And a scheme that forces users to upgrade on a period basis just so programs will work.

Let's be honest - microsoft has some of the best business people in the world. And they're smart. They recognize this issue and plan to leverage it for profit.... not for innovation or customer experience.

The answer? Disable Outlook - in my opinion, Outlook is the biggest computer security issue ever. It's a nice email client (in general terms), but the security issues have been out of control.

Lets look at the GPL for inspiration

[fishbot]

A quote from the GPL:

"6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License." (emphasis added)

As there is no specific mention that the GPL applies only to source (it applies to computer programs, including binaries and object code, as specified in section 3), one can only take this to mean that forcing it to comply with Palladium would be imposing further restriction on the users ability to excercise the rights given to them by the GPL. This is itself breaking the GPL.

Just something for the GNU friendly legal types to chew on :)

Palladium and Interpreted Languages...

[Anonymous Coward]

One way around the signed binaries problem is to move to an interpreted or byte-compiled language. Once you've got a signed java, python, or (gasp!) tcl interpreter loaded, you can run whatever you want.

Now sound or video hardware that looks for signatures, that's another, harder problem

-- ac at work

Why the anti-trust suit is important

[Ibag]

Microsoft has enough money and enough clout that something like this getting implemented is a real possiblity. Switching over to a different OS might be feasable for some people, but for the vast majority of users, it is not. If palladium is implemented and microsoft does succeed with it, what will happen?

Since we will lose alot of interoperability, the computing world will be split into microsoft and non-microsoft which end up roughly indipendent from eachother. As I see it, there are three possibilities depending upon how deeply the hardware manufacturers and government get invoved. Either those who use microsoft are cut off from those who don't use microsoft, those who use x86 are forced to use microsoft (or at least their authentication system), or it becomes illegal not to use the system and everybody is forced into microsoft's death grip. None of these possibilities are very appealing.

The only way things won't completely suck is if this is never implemented, but if they have as much industry support (and presure from the bill formerly known as SSSCA) as I think they do, then the outlook doesn't look good. That is why microsoft's power should be limited, why they should be punished, and why they need to be monitored to prevent them from doing things that are anti-competitive (even if not overtly so). That is why I hope that, in the end, MS recieves at least a slap on the wrist from the antitrust suit, if not something slightly more meaningful. Of course, with Bush in the white house, I have serious doubts...if only more people realized that just because something is good for a big company doesn't mean that it is neccesarily the best thing for the economy or the citizens of the country...*sigh*

Very polite...

[crath]

That's gotta be the most polite request to cease and desist that I've ever read.

Re:Who will 'force them'??

[vidarh]

You don't get it. Of course they won't make new PCs refuse to run unauthenticated binaries right away. That would of course kill them.

The "safer" way for Microsoft, is to make their next version of Windows warn you whenever you try to do something "unsafe". Imagine if each time you connect to a webserver not running this security stuff, you get a window saying that you are connecting to an insecure site and that you should ask the site operator to upgrade to a secure system.

Then give users the option of blocking unsafe sites permanently.

Then after somewhere around 70-80% of all systems are "secure" they issue an upgrade that make your machine refuse to deal with unsafe data by default, hiding an option deep down in Windows to allow it. Possibly allowing you to "self authenticate" old applications.

After a while, you then make the authentication mandatory.

This has the possibility of working, if they aren't met with solid opposition from the start, and if they have the sense to do it gradually enough to not alienate too many people.

Keep in mind that Windows is based on obsoleting things. There's so much old software that stops working between versions of Windows, that that argument simply don't hold - your Windows software WILL become worthless sooner or later, but people still stick with it.

And as for switching to Linux, you might not have that option, as the entire point about Palladium was that it is mean to be enforced in hardware via alliances with Intel and AMD (for now).

Microsoft may be evil, but they aren't stupid... People can't afford to take the risk of discounting their ideas.

Make themselves irrelevent

[d3xt3r]

I think this is another step in the wrong direction for MSFT. However, I am glad to see it happening because the more aggressively they attack free software (and non-MS software in general), the more quickly they postion themselves to be irrelevent.

Think about this in conjuction with their plans to make Longhorn debut in 2006 as a radically new OS. Do you know what "radically" new says to me? It says completely incompatible. And not simply with Unix/Linux/et al, but with former Microsoft products as well.

Bear with me for a minute.... let's say for a minute that Longhorn is to Windows XP what Mac OS X is to OS 9 - a complete rewrite, completely incompatible, and arguably 100 times better. But adoption is slow. People are entrenched in thier current OS of choice, OS 9 or even 8 for some. So when Microsoft prepares to move the masses to their radically new OS in late 2006, a great deal of segmentation will occur.

Now let's pretend that Linux is ready for the masses (on the desktop) by 2006, and it has a stronghold in the server market. Now you're looking at two paths (at least for corporate types): 1. Continue to allow MS to shove upgrades down your throat and keep following the Windows donkey cart. Further, subject yourself to the new DRM of Longhorn and face issues of your free software and possbily other commercial software (IE Oracle and other DBMS) not working correctly. 2. Switch to Linux or maybe Macs. When companies are forced off Win 2k/XP and forced onto Longhorn via MSFT, we'll see how many are willing to comply. Continuing to use XP/2k may not be an option, but ditching MS entirely may be a reality in 4 years.

I know it took a long time to get to my point but it's a complex issue. Far more complex even than I have portrayed above. But seriously, I think MS is going down a road to making themselves irrelevant. However, never count out the power or marketing! What MS lacks in software reliablity they make up for with a powerful marketing department and an unfortunate following of corporate weenies.

Oh yes it is. You're just not looking far enough.

[hoggy]

If MS starts this scheme in 2 years, it will take another 7 years until 90% of their users have it (and that's still not enough because 10% is still too much to lose).

Microsoft can afford to take the long view. The biggest driving force of Palladium/Longhorn will be the DRM technology. People want to consume media and the media companies will require rights management. The media companies can also afford to take the long view. They only need to keep crushing P2P upstarts through sheer weight until the laws and technology to support DRM are widespread.

If only "trusted" apps running on a "trusted" operating system can play music and video, then people will buy those. Remember the vast majority of people aren't interested in their rights - and before anyone starts, I didn't see any groundswell of ordinary people defeating the DMCA.

There is no "Linux" to defeat this. There are only distributions. The big commercial distros are the ones that will end up on ordinary people's desktops and they can either play along or not play - it'll be that simple. When it comes to pleasing shareholders I can guarantee that they will chose to play along.

You just can't afford to be complacent on this issue. This is the biggest failing of the Open Source movement - there is no movement, just a bunch of people writing open source software. This works fine when there's no threat to the freedom, but when there is there's no organisation.

The closest thing free software has ever had to a movement with principles and goals is the Free Software Foundation - and look at how ridiculed RMS has become.

People like sitting on their butts and whining a lot more than they like actively campaigning.

Re:Thomas, are you there ?

[tomhudson]

At's even more trivial to defeat the whole thing - after all, once you've bootstrapped a modern os, you don't need the bios anymore.

Put a patch in the os (isn't open source great - you can't do that with closed source) that intercepts all bios calls, and gives back the response you want to give.

Next, we'd see patches for flashing the rom to disable the mobo code - again no problemo!

The only people who wouldn't be able to accept this solution are proprietary os loosers^H^H^H^H^H^H^H^Huseres.

This way, you can even imitate another user and pc by copying their hash key - talk about yet another gaping security hole.

Now you won't even have to root their box to own them

I guess this is Bill Gates latest insecurity model

Micro$oft - you fix it, they break it in the next version!

Like DVD region locking?

[SailFly]

Embedded security into a hardware device to restrict its use? Sounds similar to me.

I wonder how many firmware/BIOS patches will show up that disable or fool the hardware device like how you can disable region locking in your DVD drive -- not that I would ever condone such behavior :)

Nothing to worry about...

[gillbates]

Microsoft cannot implement this without going out of business, or losing a substantial amount of the desktop PC market to Linux.

Here's why:

1. Microsoft's dominance in the PC market has been fueled by the fact that their software has been backward compatible; existing desktop users have always found it easier to upgrade Windows than switch to Linux.
2. The appeal of Windows for the average user is that it is compatible with almost all of the hardware and software available today. Take away this compatibility, and there will be little reason for the average desktop user to adopt it.
3. Many businesses, including mine, depend on the backward compatibility of Windows to run many of our mission critical applications. We don't even have the source code for some of these, so switching to a Paladium Windows(TM) isn't even an option. Even in the cases for which we do have source code, we would still be forced to use Linux because Paladium Windows (TM) wouldn't run our unsigned code.

Paladium is pure speculation by Microsoft. They cannot afford to release this to the public, because they would lose their monopoly on desktop operating systems if they did.

Free Equivalent - Public Trust Clearinghouse

[Bob9113]

What is the free equivalent to this? I propose the following:

Microsoft is banking on the fact that companies will trust it to authenticate good software because they trust the Microsoft reputation. Historically, Open Source has developed its trustworthy reputation by banking on actual users who state that the software is trustworthy.

So here is a Free alternative to Palladium - a public trust clearinghouse. Much as DCC authenticates spam, and the GPG repositories authenticate public keys, a public trust clearinghouse could be an expression of the corporate trust of software.

As an example, imagine giving each member of the Wilshire 5000 a number of votes equal to 10000 minus their position in the Wilshire 5000 (IE, the biggest company gets the most votes). Each can submit any mix of those votes to the "trust this software" and "don't trust this software" bins, and can move them as the wish. New software would have very few votes. Established software would have many votes. The decision to trust could be based on both the number of votes and the percentage of positive votes.

Yes, I think using the Wilshire 5000 is a requirement, because corporations don't trust the general public with business decisions any more than you and I trust Joe Six-pack with firewall settings.

The question then is how to incentivize corporations to participate. Perhaps a license requiring that those 5000 companies submit a certain number of votes per month to be allowed to access the trust repository... just spitballing.

Regardless of how it is done, I think Microsoft has hit on a genuine chink in the O/S armour - it does not have any officially responsible party. Coming up with a way to state authoritatively to business that version 3.142 of SuperDaemon is trustworthy would go a long way to countering Palladium if it catches on. And frankly, I would be far more likely to trust 5000 parties who are objective on average than to trust the manufacturer of the software.

Quality of life.

[Jennifer E. Elaan]

Actually, corporatized industrialization has lowered the quality of life for humans. Starting with the beginnings of the industrial age, where women and children were being forced to work in terrible conditions, to now, when the average work day has not decreased at all (and increased in a lot of professions). In fact, now we have the problem of North American excesses lowering the quality of life elsewhere in the world, especially in developing countries that can get more money from selling their crops as cattle feed in the US than from selling it to their populace. Guess which they choose?

And, to top it all off, in the past 30 years or so, incidences of stress-related mental illness has increased by something like 500% (I forget which study I read that in, but anyway).

And what do we have to show for it? Do we have more time to spend with our friends and families? No, all we have is a few new toys (although, as a geek myself, I have to admit that they are fun toys). If we see an average person working one day a week and making enough money to support themselves and their families, then that would be a massive improvement in quality of life.

In fact, we have seen the opposite; the two-income family is so common that it has become difficult to be one-income anymore. The quality of life has decreased enough that the average two-income family now lives about the same as an average one-income family in the 1920's.

Remember, those who do not understand history are doomed to repeat it.

Re:Quality of life.

[Anonymous Coward]

> Actually, corporatized industrialization has lowered the quality of life for humans.

Yes, all those extra humans alive with extra life expectancy because of industrialization must really regret not being dead.

> Starting with the beginnings of the industrial age, where women and children were being forced to work in terrible conditions,

Which must explain the mass movement of people from the countryside to the cities then.

> to now, when the average work day has not decreased at all (and increased in a lot of professions).

Perhaps not, but I'd rather spend 40 hours punching a keyboard, than down a coalmine.

> In fact, now we have the problem of North American excesses lowering the quality of life elsewhere in the world, especially in developing countries that can get more money from selling their crops as cattle feed in the US than from selling it to their populace. Guess which they choose?

Well, not many do, because farm subsidies in the developed world prevent 3rd world countries exporting. Those which do export - like the USA, Europe, China etc, export surpluses.

> And, to top it all off, in the past 30 years or so, incidences of stress-related mental illness has increased by something like 500% (I forget which study I read that in, but anyway).

(a) Prove that figure
(b) Even if true, prove this is because the actual level of stress is higher, and it's not just because people have started to measure something that was aleady there.

> And what do we have to show for it? Do we have more time to spend with our friends and families? No, all we have is a few new toys (although, as a geek myself, I have to admit that they are fun toys).

If people make dumb choices, that's their problem. Anyone who'd rather play with a toy than spend timne with their kid probably deserves to be alone, stressed and unhappy.

> If we see an average person working one day a week and making enough money to support themselves and their families, then that would be a massive improvement in quality of life.

That has to take the prize as the most tautological and stupid comment of the day.

> In fact, we have seen the opposite; the two-income family is so common that it has become difficult to be one-income anymore.

And why do you think that is? It's because women now have reproductive freedom thanks to the pill and *can* earn a separate income.

> The quality of life has decreased enough that the average two-income family now lives about the same as an average one-income family in the 1920's.

How? Prove this!

> Remember, those who do not understand history are doomed to repeat it.

Or repeat cliches.

Re:Quality of life.

[markmoss]

Starting with the beginnings of the industrial age, where women and children were being forced to work in terrible conditions, as opposed to the wonderful conditions on medieval farms, where since most peasants couldn't afford an ox they'd hitch their wife to the plow, medical care was unavailable to the poor (90% of the population) and downright hazardous to the rich, the population was kept in balance by starvation if plague and warfare didn't kill enough, and even the upper classes ate so poorly as to average almost a foot shorter than today.

the average work day has not decreased at all (and increased in a lot of professions. It depends on how you count all the "work" time I spend on /. ;-)

developing countries that can get more money from selling their crops as cattle feed in the US. Really? I thought most third-world farmers couldn't afford to ship their crops to the ports or the cities (whether for sale locally as food, or to ship overseas) - maybe because most of the foreign aid went into Swiss bank accounts rather than things like roadbuilding, or tractors and fertilizer to make the food farms more efficient. Or their government pressures them to grow cash crops for export (to get more hard money for those Swiss bank accounts) rather than food. Agricultural subsidies in most first-world countries do screw their own consumer/taxpayers as well as third world farmers, but the bigger problem is with the third world governments.

in the past 30 years or so, [Diagnoses] of stress-related mental illness has increased by something like 500%. Maybe now doctors call it "mental illness", where 30 years ago they'd just say "take a vacation". Unfortunately, that doesn't mean they are better at diagnosing mental illness, but rather that they've better learned how to phrase it so as to get the medical insurance to pay. And to whatever extent there is a real increase in stress: It may be hard for you kids to believe this, but 30 years ago the industrialized countries were already fully industrialized and had been for 50-100 years. Maybe "Republicanization" is causing increased stress to US workers, or maybe it's that 4-6 months a year we work just to pay the goddammed taxes, but if stress was due to industrialization, it would have peaked long ago.

And do you think medieval peasants, Roman slaves, Egyptian peasants in 3,000 BC, or any other lower classes in the old days were free from stress? No, they _died_ instead of just getting a little squirrelly.

the two-income family is so common that it has become difficult to be one-income anymore. (1) It's quite possible to raise a family on a single moderate income. Mennonites do it all the time. They just don't buy toys, fashionable clothes, prepared foods, etc. And, because my wife can't hold a job for more than a week before she starts telling the boss how to run it, I raised two children on my one paycheck - and for the first 8 years, it was the tiny paycheck of an enlisted serviceman. Just don't think you've got to buy everything they show you on TV.

2) A pre-industrial farmwife worked much, much harder than a modern working mother. Yes, I know it's hard to get home from 9 or 10 hours of work, toss dinner in the microwave, run the vacuum around the floor, get the kids ready for bed, and toss the clothes in the washing machine. Try cooking food from scratch on a wood fire, washing those clothes by hand. and cleaning the carpets by taking them out to the clothesline and beating them. If you can't afford to hire help, you'll soon be happy to go back to a dirt floor and greatly lower your expectations of personal cleanliness - even if you don't have anything better to do all day.

(3) You don't know how the average one-income family lived in the 1920's. You only see the top 10%. For the rest, no refrigerator, no car, electricity and running water optional, and generally the wife was working outside the house too as much as childbearing and care allowed.

working one day a week and making enough money to support themselves and their families. Scale your lifestyle back to that of Abraham Lincoln's parents, and it ought to be possible. If not, it's because of the ridiculous tax burden we have allowed our local, state, and federal governments to impose. I do know people who support themselves on less than 1 day a week work, but they get their wages in untaxed cash and the cardboard crates they live in have so far escaped the notice of the tax assessors...

The Real Reason: DRM Gatekeeper

[Airline_Sickness_Bag]

THe real reason why Microsoft is doing this is they want to be the DRM gatekeeper. All digital media will end up going through them, and they will come up with new standards and schemes to get a percentage on all of this information. Look at the new Mpeg 4 standard - they are planning to charge for the data stream. It's where MS wants to go today.

Killing Linux and the GPL is an added benefit.

-asb

Don't make this work

[phpdeb]

A message to all open source, or any, developers out there, "Do not make this work. Do not try and hack a Linux solution to make this work. Make sure your stuff doesn't work with this new system. Make sure your site doesn't work with these whacked mobos. Do not allow Microsoft to succeed."

If we hack out a solution that will kinda sorta allow Linux to function in this system of stupidity, we will be forced to deal with it for ever. The best way to fight this latest attack is to make users uncomfortable. Don't allow your apps to run on systems that MS has locked down. People will quickly get pissed when they can't get to their favorite pron site or whatever.

Re:Thomas, are you there ?

[tomhudson]

See the thread a few days ago on emulation - anything that can be done in hardware can be done in software.

1.Intercept the bios calls, and return whatever you want, including "signed" data. Or return nothing. Or return values you've sniffed from someone else's box.

2. Back up your bios first, then look through the bin file (doing this on 2 mobos with the same bios, and running a diff will give you the bios key)

3. If sites don't allow people in who aren't authenticated, this means that, eventually, as authentication becomes all-pervasive, unauthenicated users will become "invisible". Once nobody will be able to see them, and nobody's checking for them anymore, they'll be able to roam the net free of constraints.

Also, we could run the data stream through a firewall that could strip out any key data, or replace it with whatever we want.

There are also privacy concerns that would require that the ID be able to be changed, or deleted. You can be sure that the NSA, etc., will insist on a back door for their "trusted users". How long before someone else finds it?

If you don't think people will be able to do this, check out how many are using hacked satellite TV cards.

Not going to happen, here's why.

[zerofoo]

Hailstorm failed for one BIG reason: No one in their right mind trusts Microsoft with security sensitive data. Corporations from AmEx to the average joe consumer didn't buy the claim that Microsoft would protect all this confidential data.

Now, we are to trust Microsoft to develop an all encompasing security platform? How do those bone-heads at Microsoft Marketing/Engineering think anyone at all will buy into this?

It takes a very long time to build security into your products, and an even longer time to build trust with customers. Microsoft has not done either, and this security platform will fail without the support of hardware vendors, software vendors, and people like you and me.

-ted