Slashdot Mirror

← Back to Stories (view on slashdot.org)

Discuss BIOS and Palladium Issues With an AMIBIOS Rep

Posted by Roblimo on from the is-trustworthy-computing-trustworthy? dept.

After this Slashdot discussion about the relationship between BIOS biggie American Megatrends Inc. (AMI) and Palladium appeared, we got an email from AMI sales engineer (and former Linux.com contributor) Brian Richardson, who wrote, "I am a bit concerned that the information you provided misled your readers into thinking AMI was promoting Palladium or taking some sort of anti-open-source stance. This might be due to the fact that TCPA was mistakenly equated to Palladium, or questioning how Linux would run on a TCPA-enabled system ... or by the horde of angry Slashdot readers telling us they would never buy an AMI product because we were forcing standards on them." Brian offered himself up as (his words) a "Slashdot interview victim" to clear things up.(Update by RM: And, says Brian, he's happy to answer other BIOS questions as well.) So ask, already, and let's get things cleared up. (Usual Slashdot interview rules.)

32 of 453 comments (clear)

  1. What will happen with Linux systems. by matthew.thompson · · Score: 5, Interesting

    I understand that there should be no problems running Linux systems on these new bioses but can you promise that there will be no nasty wordings that are likely to frighten off users who are trying Linux for the first time?

    --
    Matt Thompson - Actuality - Insert product here.
  2. So what are the differences ... by Alien54 · · Score: 5, Interesting

    Okay. So what precisely are the differences between Palladium and your product, and what assurance do we have that it will not act as crippling ware for open source and other similar free (as in free speech) software endevors? Any thoughts on backward compatibility modes?

    --
    "It is a greater offense to steal men's labor, than their clothes"
  3. TCPA & Palladium by ignipotentis · · Score: 5, Interesting

    Perhaps you can clarify the differences between the two (TCPA & Palladium). After reading up on both of them, i still find that they seem to be pretty much the same, just marketed differently.

    --
    Don't waste time... procrastinate now!
  4. Something in everyone's mind by forged · · Score: 5, Interesting

    Will it be possible to disable on future motherboards which will implement DRM techniques ?

  5. Licensing by Arc04 · · Score: 5, Interesting

    Will OS manufacturers have to pay to get an "unlock code" that allows them to run their OS on the BIOS.

    That would be terrible as it would kill many under funded open source OSes that aren't as big as the Linux big players.

    Arc

    1. Re:Licensing by Windcatcher · · Score: 5, Interesting

      Here's a better one: will software vendors (either open-source or not) have to pay a license fee to be able to decrypt data files from competing products? What if you want to move your documents from Windows+MSOffice to Linux+StarOffice? Surely Office would use TCPA to encrypt the files.

      Gasp! MS would never do something as low as that!

  6. On the Exclusionary Uses of TCPA by the-banker · · Score: 5, Interesting

    Is it (will it be) possible to use TCPA to effectively lock-out certain operating evironments from various services (software, media, etc) solely because the operating environment is not backed by a company, and has no mechanism for paying certification fees and licenses? Specifically, could TCPA be used against free OS's like Free/Open/netBSD and Linux to prevent those users from accessing the same content users of commercial OS's can?

  7. Customization support? by ryanr · · Score: 5, Interesting

    I actually think this feature could be useful, if done "right". Along the lines of my idea of right... will I be able to, say, install my own set of public keys in the BIOS so that I can have a system that will only boot the software that I have signed?

  8. Do you think Palladium is a good thing? by Noryungi · · Score: 5, Interesting

    As the title says:

    Do you think Palladium is a good thing? Whether your answer is "yes" or "no", please explain.

    Knowing that Palladium is a Microsoft Technology, do you think AMI is making a smart move by adopting it? Again, please explain your position.

    Are you afraid that Microsoft may use its position to control, not just 90% of the software used on PC, but also the overall architecture of modern machines?

    Many thanks in advance.

    --
    The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
  9. General TC question by j3110 · · Score: 5, Interesting

    I actually like the concept of trusted computing quite a bit. So long as the user selects which code will be trusted, it has great potential for good. My question is, from your position, do you foresee trusted computing being more like web-browser applet signing applied in hardware (where the user can add and remove trust for certain companies) or more like the media industries idea (where the OS/hardware manufacturers select which code is trusted under penalty of DMCA)?

    --
    Karma Clown
  10. How can we confirm that NO BS is in your BIOSes by nenolod · · Score: 5, Interesting

    Are you going to release the source? Will the BIOS be auditable? Will the BIOS code contain some sort of monitoring code? Will the BIOS contain spyware? All of these questions are important... and how will we be able to confirm your answers to them?

    Can we really take the word of a conglomerate? Will you be able to ensure that what you are saying is accurate?

    Modern conglomerates usually misrepresent their products if they think it will generate more customers. How can we be sure that you wouldn't be doing this to us?

  11. Lockout by rtkluttz · · Score: 5, Interesting

    Be truthful. Is there even the slightest chance that someone other than me will be able to say what will run (or more importtantly will NOT run) on a PC that contains this technology? I'm not talking about purchased software that locks me out directly in one way or another due to licensing issues. But can this technology be used to stop me from exercising fair use rights if I decide to get around those blocks in purchased software? Or will they hinder me from writing my own code to do what I want, or downloading and compiling/running someone elses code?
    If ANY of these CAN be a side effect of this technology, it is bad. There are stumbling blocks, of course, but no one will have ultimate say over what does or does not run on my own computer.

    .

    --
    Digital is, by definition, imperfect. Analog is the way to go.
  12. Re:Here's a simple one... by jamie · · Score: 5, Interesting
    "Will Linux and other alternative operating systems continue to install and function properly on computers containing AMI BIOSes?"

    In answering this question, I would ask that our interview victim clarify whether there are any circumstances under which "alternative operating systems" would need to be cryptographically signed by an authority in order to boot, and if so, who is that authority?

    As Ross Anderson pointed out last year,

    Now here's another aspect of TCPA. You can use it to defeat the GPL.

    During my investigations into TCPA, I learned that HP has started a development program to produce a TCPA-compliant version of GNU/linux. I couldn't figure out how they planned to make money out of this. On Thursday, at the Open Source Software Economics conference, I figured out how they might.

    Making a TCPA-compliant version of GNU/linux (or Apache, or whatever) will mean tidying up the code and removing whatever features conflict with the TCPA security policy. The company will then submit the pruned code to an evaluator, together with a mass of documentation for the work that's been done, including a whole lot of analyses showing, for example, that you can't get root by a buffer overflow.

    The business model, I believe, is this. HP will not dispute that the resulting `pruned code' is covered by the GPL. You will be able to download it, compile it, check it against the binary, and do what you like with it. However, to make it into TCPA-linux, to run it on a TCPA-enabled machine in privileged mode, you need more than the code. You need a valid signature on the binary, plus a cert to use the TCPA PKI. That will cost you money (if not at first, then eventually).

    Anyone will be free to make modifications to the pruned code, but in the absence of a signature the resulting O/S won't enable users to access TCPA features. It will of course be open to competitors to try to re-do the evaluation effort for enhanced versions of the pruned code, but that will cost money; six figures at least. There will likely be little motive for commercial competitors to do it, as HP will have the first mover advantages and will be able to undercut them on price. There will also be little incentive for philanthropists to do it, as the resulting product would not really be a GPL version of a TCPA operating system, but a proprietary operating system that the philanthropist could give away free.

  13. Portability of software/licenses with TCPA by naarok · · Score: 5, Interesting

    Will TCPA compliant machines make it more difficult for a user to updgrade CPUs or change computers? Do you see users having to re-confirm their identity with external sources because the identity of their computer has changed? (I know this already happens, I just see it becoming more pervasive in the future and am afraid more software vendors will begin to license by specific computer).

  14. Performance hit by oliverthered · · Score: 5, Interesting

    I assume that data pathways with be signable or encripted in some way. What performance hit will the [operating system] take when using trusted system? e.g. How much extra data is added to form a signiture, what methods are used for signing. and how will this benifit the end-user.

    --
    thank God the internet isn't a human right.
  15. How would AMI response to market pressures? by CodeShark · · Score: 5, Interesting
    How would AMI respond to pressures from companies such as Microsoft, Intel, Sun, or to the combined companies in the MPAA or RIAA if those companies insisted that AMI only release "DRM compliant" BIOS chips, etc.

    Would AMI disclose that such pressures were being placed on them, or would this type of fact be kept hidden from consumer groups or individuals, etc. until it was too late for us to effectively respond?

    --
    ...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
  16. Have customers asked for TCPA features? by Sloppy · · Score: 5, Interesting
    AMI rep, the reason I think some people view your company with suspicion, is that we think it is unlikely that an AMI customer has asked for TCPA's "features." I suspect that anyone who is cooperating with that effort, is somehow being influenced by forces other than traditional market forces.

    So maybe you can set me straight: do you think your customers want TCPA? If so, why? Who are these customers? If this a case where customers are not the same as users?

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  17. Non-Linux, non-Microsoft operating systems by aridhol · · Score: 5, Interesting
    I see many people worried about Linux not working with Trusted Computing. What I'm wondering is if other operating systems will work. It has often been the case that something will come out for Windows, then get ported to Linux because they are the most visible minority group.

    One of the operating systems I use is FreeBSD. Will that still be usable, or will it be forced to deal with substandard or non-existant drivers (think NVidia until recently). I also use QNX. Will that work? How about a new OS that will be created sometime in the future?

    --
    I can't say that I don't give a fuck. I've just run out of fuck to give.
  18. How will I be affected??? by josepha48 · · Score: 5, Interesting

    How will I be affected by TCPA? I run several machines at home some running NetBSD, FreeBSD, Linux, and Windows. I generally build my machines, unless they are given to me by my employer (or its a laptop), and even then I reinstall the OS or install my own OS of choice. (Whatever I'm in the mood to run at time of install or what works). If I buy a new Motherboard from AMI with TCPA will I stil be able to do this? Will I have to do special tricks to get this done or will it be just like it is now?

    --

    Only 'flamers' flame!

  19. Straight-up products? by LostCluster · · Score: 5, Interesting

    No matter how many DRM technologies AMIBIOS does adopt, can you promise that AMIBIOS will continue to offer DRM-free BIOS products?

  20. Missing Idea by GreatOgre · · Score: 5, Interesting

    I think the idea that most of us our missing is this. Most PC users buy their computers from Dell, Gateway, or some other big vendor. These vendors will ultimately sell TCPA/Palladium enabled computers. So, the real question should be: In the future will those of us who build our own systems be able to escape the issue of having TCPA/Palladium on our systems courtesy of the big players?

  21. Hardware vendors by cybermace5 · · Score: 5, Interesting

    Since a BIOS is only part of a motherboard: what steps will hardware vendors have to take, in order to incorporate your BIOS? Will they have to adhere to certain hardware design rules or controls in order to maintain the TCPA? Is there going to be a licensing procedure for hardware manufacturers?

    --
    ...
  22. Technology can be used for good and evil by defile · · Score: 5, Interesting

    As we all know, technology can be used for the purposes of both good and evil. Here are things that I consider good about where TCPA is going, along with the evil.

    Good

    • Users can protect their computers from viruses or other unapproved malware.

    Evil

    • The BIOS can be feasibly configured to only boot only "approved" code.
    • By extension, "approved" code means that the Operating System must be a fresh, "blessed" install from a certain large proprietary software vendor.
    • Developing this further, this means that this certain large proprietary software vendor's OS can cease to function if any unapproved modifications are made to the system.
    • This gives the vendors, and anyone they do business with, incredible control over our PCs and the user is incapable of doing a damn thing about it unless they violate the DMCA and face criminal prosecution.

    There are many advantages for the hardware/software/content vendors if this is realized, but few of them seem consumer driven: the erosion of fair use, the control of speech, taking a cut of every e-commerce transation, eliminating standards and competition.

    Undoubtedly, your shareholders will push you to cooperate with the software/content vendors because it means big money for them and anyone who plays ball, but for us, it means we lose a lot. PR will say that it stops pirates from raising music/movie prices, and that it means ISVs can produce software that can't be warezed, no more cheating in online games, no more child porn, ad infinitum, and it's all for our own good.

    Unfortunately, the potential for abuse is extraordinary, and the last thing I want to see is more of my friends being locked up because they do something with their computers that some company doesn't agree with. And right now it looks like AMI wants just that to happen.

    Yes, right now your BIOS may offer choice, but hardware vendors seem committed to building an infrastructure that one day can make it very easy to eliminate this choice.

    Please explain why we do want TCPA, why we should support your company, and how we can be assured that our colleagues don't go to jail just for believing they still control systems they bought. Also, please explain why the system we have now is so inadequete.

    Thank you.

  23. I'm a little blurry on the details here.... by Malor · · Score: 5, Interesting

    If I understood the prior articles correctly, TCPA should provide a basic keystore, an authentication mechanism, and enough checking to insure that the boot sector is signed.

    If I want to install a new boot sector, do I generate my own key, install that, and self-sign the boot code? Or do the LILO or GRUB teams have to get a key issued and then sign things themselves?

    Who has ultimate control over the keys? CAN I install my own, or is it centralized somewhere? Who does TCPA *ultimately* trust? How can I be *certain* that it doesn't trust anyone I don't want it to? If I screw up and lose my key, how I recover access to the system?

    I assume there must be some master, uneraseable keys in TCPA; I just can't imagine that you'd ship it without implicitly trusting Microsoft, and I distrust Microsoft very much. And if there are recovery keys in there, do I have to ship my machine away to some lab to replace a lost key, or can I do it myself? And if there IS a master, unerasable key available for recovery purposes, why can't virus writers just sign their code with that key instead?

  24. Why are BIOSes closed source? by mcelrath · · Score: 5, Interesting
    Having recently had a lot of trouble with my laptop's BIOS, on an issue that I could most certainly fix if I had access to the code... I started wondering what benefit AMI and other vendors have by keeping BIOS code secret? I can think of none whatsoever.

    An open-source TCPA BIOS might go a long way to alleviating the fears of the open source community, since we could see exactly what it is you're forcing on us. And hey, no doubt you'd get a few bug-fixing patches in return for your efforts.

    So, is an open-source BIOS a possibility? (TCPA or otherwise)

    -- Bob

    --
    1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
  25. E-mail sent to marketing@ami by LarsG · · Score: 5, Interesting

    Brian,

    I sure would hate to be in your shoes right now. Putting yourself in front of a firing squad voluntarely takes guts.

    I sent an e-mail to marketing complaining about AMI supporting TCPA, and got the standard reply in return. My answer is below, and I am still waiting for a reply.

    Umbertina E. Vezzani wrote:

    Hello Laars,

    You can already find TCPA-enabled products on the market but they have a different BIOS.

    I am perfectly aware of that, and that is why I don't buy IBM laptops any more.

    The Security subsystem is intended for those users who want an extra security protection that is valid even outside the OS.

    The motherboard and system manufacturers will specify their system features, so I believe you will certainly be able to choose the features you want. I really don't think you will buy a motherboard with a hidden feature or "fritz".

    I am not afraid of hidden features. TCPA is merely the scaffolding which enables building "trusted applications"/"trusted clients". What I am afraid of, is how software vendors and the content industry will (ab)use TCPA.

    As for the reference to "fritz" - I think Ross Anderson went a little bit over the top in his critisism of TCPA. A much better overview of some of the technical problems with TCPA can be found here (I fully endorse Mr. Arbaugh's suggestions):
    http://www.cs.umd.edu/~waa/TCPA/TCP A-goodnbad.pdf

    TCPA is meant to answer to a demand of security from users, not something else.

    What demand exactly? TCPA doesn't solve any of the major security problems.

    TCPA only answers the question "has the basic components of this system been changed?", and makes it possible for 3rd parties to verify the state ("trustworthiness") of a system.

    The majority of security problems are on the OS or application level - macro/scripting vulnerabilities, virii, buffer overruns and similar. TCPA doesn't provide a solution for any of those. In fact, a software sandbox like Java or running certain applications in vmware virtual machines provides better protection against those real world problems.

    What exactly is TCPA supposed to solve? Don't give me some marketing fluff about "enhancing security for the user". I want cold, clear, technical examples of real world security problems that TCPA is supposed to solve.

    Also, which users are demanding TCPA? Users want protection against virii and similar, but TCPA doesn't solve those problems. Who are the end users that demand something like TCPA?

    I also believe that, if there is a solid foundation to the concerns for privacy people is expecting, the TCPA itself will improve its specification to address those concerns.

    So there is a real chance the next revision of the TCPA spec will include proper anonymous certificates a'la Chaum instead of the current "please trust the privacy CA" solution?

    It must be noted that AMI has not announced support for Palladium. Palladium is an initiative by an OS entity that is slated for the future.

    I know that. I also know that there is considerable disagreement going on between the Palladium and the TCPA proponents.

    To be honest, TCPA is a better specification than Palladium. However, TCPA does provide the scaffolding required for building "trusted systems" - i.e., that a 3rd party can control what is happening on my computer. TCPA is a Pandora's box - if abused, it could have a devastating effect on both innovation, privacy and consumer rights.

    Regarding the limitations of a system with TCPA I would offer the link below to the public specification for further information on compatibility with different OS's, and hardware. Based on that spec we can tell you that it does not limit the ability to run Linux (or any other open source solution).

    How is that supposed to make me feel good? I know that it is possible to disable (most of) TCPA. I know that my computer will continue to work even if the TCPA subsystem tell other computers out there that my computer has zero "trustworthiness".

    However, once digital commerce, streaming media and other online content start demanding TCPA enabled clients you are effectively a second rate citizen on the 'net and are locked out of a lot of content if TCPA is disabled on your computer.

    So:
    1) TCPA does not provide true anonymity (you have to trust the privacy CA).
    2) The scaffolding provided by TCPA can be abused by those who want to disable the Turing completeness of computers and instead turn them into locked down interactive content delivery platforms.
    3) The market effect will force people to use TCPA and TCPA enabled "trusted clients" even if they don't want to.
    4) TCPA is advertised as a security solution, but does not solve most of the real world security problems.

    With kind regards,
    Lars Gaarden

    --
    If J.K.R wrote Windows: Puteulanus fenestra mortalis!
  26. Platform owner by briancnorton · · Score: 5, Interesting

    Since microsoft is kind of vague on details about Palladium, I will hit you with a TCPA question. In the TCPA FAQ, it states that "Platform Owners" will decide which software runs on their platform. Who exactly is a "Platform Owner" and does microsoft have a simmilar "feature in palladium"

    --

    People who think they know everything really piss off those of us that actually do.

  27. Real Questions by Qzukk · · Score: 5, Interesting

    1) What does it take (steps,costs including any IP licensing fees) to make OS Foo boot on a TCPA computer?

    2) What does it take (steps, costs including licensing fees) to make application Bar run on Foo? On any other OS?

    Ignoring rampant paranoia, these are the questions that will actually affect open source development. It comes down to how much will it cost for us to run our programs?

    --
    If I have been able to see further than others, it is because I bought a pair of binoculars.
  28. Compatibility with Garage "Hacks" by Catiline · · Score: 5, Interesting

    I'm a hobbyist who builds his own computer, writes his own software, and (on rare occasions) will build hardware components (as in: with solder and chips). What assurance do I have that your "Trusted Computing" initiative won't interfere with my projects? Interference here is defined as reducing the operational capacities -- including networking features -- of the computer or reducing my ability to develop to my needs. In a way this is four separate questions: how software, Trusted vendor hardware, pre-Trust vendor hardware, and home-built hardware integrate into the "Trusted Computing" architecture.

    --
    Do you like Japanese imports?
  29. Technical Explanation of BIOS Settings by doppleganger871 · · Score: 5, Interesting

    I have been doing research on BIOS settings for many years, and I have found good articles on what the settings do, and how to tweak them for the best performance/stability mix. But, I would like to know if the BIOS manufacturer itself would be able to provide an in-depth manual of all the BIOS settings, and what exactly they do. All the manuals that come with motherboards are very short on explanations, and I would like to see someone within the company actually explain to us hardware enthusiasts the down 'n dirty, nitty gritty, dirt under the rug, needle in a haystack type of information that we could use to make our computers run the absolute best they can. Because, as we all know, optimizing software and firmware is a lot cheaper than upgrading parts.

    -Jay

    --
    -- Liberalism is a mental disorder.
  30. Who does TCPA envision the "Owner" to be? by BeBoxer · · Score: 5, Interesting

    The TCPA standard talks a lot about the "Owner" of the system, and how the "Owner" can initialize a new system so that it will begin generating keys and such using a password set up during the "ownership" process (See Section 2.6 of the Standard). My question is: who would the "Owner" of a system normally be in plain english? The actual end-user (or their administrator)? Or would the TPM get "owned" by the hardware vendor (Dell, HP, etc.) Or the OS vendor? Or the motherboard manufacturer?

    Second, will it be possible to completely reset the TPM to a non-owned state to allow used hardware to be sold "as new"? Or would the hardware refuse to allow a new owner?

  31. Who signs? by shyster · · Score: 5, Interesting
    Who will be the "trusted" signers of this code? What hoops (and dollars) must be jumped through?

    Most importantly, will a system admin be able to sign code as trusted (whether his or another coder's) for all machines in his control? By extension, will an individual be able to do the same for machine(s) under their control? Or will only Verisign, Thawte, etc. be trusted?