Slashdot Mirror
Researchers Looking at Alternatives to Palladium
An anonymous reader writes "Some folks at Stanford have been looking at an alternative architecture for doing trusted computing (ala Palladium) based on using Virtual Machines. They presented a brief paper describing their work a couple weeks ago at the USENIX Workshop on Hot Topics in Operating Systems . In their paper they also discuss a bunch of non-DRM applications of Trusted Computing such as distributed firewalls, improving P2P security, preventing DDOS, and even strengthening civil liberty protections."
Anybody from trusting anybody else now. We could create distrib-firewalls if we wanted to.
The fact is DRM takes away the PEOPLES' rights to choose who to trust.
One good example is the google puzzle contest I'm sure many tried. You downloaded the .pdf before, and got a password when the time started. While nobody should go to jail for cracking the password, it was an example of a good (not evil) use of DRM.
-Libertarian secular transhumanist
Rather this alternative to Palladium does or doesn't work at the fact that OTHER companies are looking into creating this kind of system makes the future of Palladium-esque systems look a lot better. Competition is a Good Thing and handing the reigns to microsoft with out look bad is a bad thing, microsoft or not a company should not have that much power. If this market becomes more diversified we will see better products, rather from microsoft or not, and people will start listening to the peanut gallery ranting for a better system.
transmission_err
One is proposed by some folks in Stanford, the other is proposed by Microsoft and Intel.
Guess which one is going to matter?
"Much work is lost, for the lack of a little more." -Edward H. Harriman
1) A safeguard, especially one viewed as a guarantee of the integrity of social institutions: the Bill of Rights, palladium of American civil liberties.
2) A sacred object that was believed to have the power to preserve a city or state possessing it.
I believe that city is called Microsoft.
"Bill of Rights"... whaaaahahaha.
---
At any rate, I have only one more word to say about Palladium. You can read all about that word here
Moreso, would it be possible to fake out Palladium-dependent software by running it in an emulator that simulates the undelying Palladium subsystem?
What does a program REALLY KNOW about where it lives?
Wow, This is JUST like "The Matrix".
"Lawyers are for sucks."
- Doug McKenzie
With all the security patches MS has each week, I must admit I found it rather amusing that they were propsing a secure computing standard with Paladium.
Personally, I don't think they can pull it off. But with Stanford looking into an alternative now, this means we'll at least have choices down the line. And I'm sure that both sides will look at what each other does and rip off the good ideas.
Security is important and a verifiable identity is as well. Not just for e-commerce applications, either. Even such simple issues as banning some nimrod that wants to post stupidity on your board can be solved by a solid identity model.
Hopefully, one of em will pull it off.
What misleading terms they are. How can Palladium have anything to do with "trust" when they violate trust and anything else by intruding into my computer and controlling my content?
How can DRM "protect rights" when it denies basic rights of fair use?
Don't blame Durga. I voted for Centauri.
So from MS we get Trusted Computing where "trusted" means trusted by big corporations who want to sell you stuff without any chance of copying.
From these guys we get Trusted Computing where trusted means trusted by the guys building the network.
So, which would you choose?
Do you mind, your karma has just run over my dogma.
Why is it called "trusted computing" after all, when it violates trust?
The problem is we are looking at the wrong definition of trust. Most of us have in mind the primary definition: "Firm reliance on the integrity, ability, or character of a person or thing" or "Custody; care"
You have to look down the list to find the definition of "trust" that fits perfectly with Microsoft, RIAA/MPAA and the Palladium idea:
"A combination of firms or corporations for the purpose of reducing competition and controlling prices throughout a business or an industry."
Might as well called it "monopolized computing". Means the same thing.
Don't blame Durga. I voted for Centauri.
"Computers started out simplistic, under the user's complete control..."
No, they started out controlled by men in white coats in clean rooms.
The microcomputer and PC revolution changed all this.
The regressive trend back to "Master Control" started with Scott McNelly of Sun Microsystems. I remember when he first laid out his grand vision of returning everything to central control via the Internet. Java was part of this. Microsoft copied the rhetoric, announcing a time when your Word app and even your Word docs would all be on Microsoft's central servers.
Don't blame Durga. I voted for Centauri.
... not to use any DRM at all ...
Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
"If the Riaa and Mpaa do not trust people with the media, why show it? They, in effect, release the idea to everybody when they put some show/song in mass media."
Not only that, but the MPAA commonly encourages piracy.
Let's say I want to see "The Two Towers". It is no longer in theatres, can't go there. It is a LONG time before they sell a DVD; so I can't pay them that way by buying a DVD. The only alternative is to obtain somehow a pirated DVD copy of "The Two Towers".
No way should they whine about money-loss to piracy when they aren't selling it in the first place! There is a demand for their product, and in this example, they refuse to meet it in any way.
Don't blame Durga. I voted for Centauri.
The problem is that the trusted layer *must* be small so that it can be completely verified. Applications can't be so easily verified and it would still be possible to compromise Outlook, for example to send unwanted EMail. All the signature does is to say that the software hasn't been modified, but we know that applications don't need bad code to misbehave, they only need the right kind of bad data. Once the code has been signed, it must be signed again verey time it is patched. A far from simple logistical problem.
OTOH, smaller code may be more easily verified - so a driver for a Smart Card reader could be protected, as could SSL. However a programmer can still make a mistake and allow the code to be compromised.
See my journal, I write things there