Trusted Computing

derrickoswald writes "John Walker, one of the founders of Autodesk, has posted The Digital Imprimatur, a monograph on technologies such as the Trusted Computing initiative. Some of the prognostications and conclusions reached may not be palatable to Slashdot readers."

Comments

Already slow

[mamer-retrogamer]

This is Google's cache of http://www.fourmilab.to/documents/digital-imprimat ur/

Re:Already slow

[buus]

To bad that trusted computed as described here would kill Google's ability to cache pages.

The term "trusted" is accurate for this.

[AtariAmarok]

You have the wrong definition of "trust" in mind.

You need to look further down on the list of definitions "trust" to find the appropriate one:

"A combination of firms or corporations for the purpose of reducing competition and controlling prices throughout a business or an industry."

Trusted Computing

[michiel.h]

an enhanced HW and OS based trusted computing platform that implements trust into client, server, networking, and communication platforms.

Hahahahahahahahaha

Hm, what?
Oh... so you mean... you mean you're not joking?

Lessig said it first

[Minna Kirai]

The article's (which is already slashdotted) main idea is that it will be possible for a cooperation of government and corporate interests to change the internet from the freewheeling, content-neutral common carrier we know and love into a strict disciplinarian.

That was the thesis of Lawrence Lessig's 5 year old book, "Code and Other Laws of Cyberspace". The internet is artificial. It's not a force of nature. Human effort built it, and human laws can change it. With sufficient financial motivation, laws will change it.

Tired quotations like "The internet treats censorship as damage, and routes around it" are at best observations of recent behavior, not guarantees that truely effective internet censorship won't happen in the future.

Those who care about freedom cannot just sit back and assume that because the net is fairly free now, it always will be. Eternal vigiliance is the price.

Re:Lessig said it first

[Bookwyrm]

They would need to have control of my connection at the packet level.

You think they don't already? Or rather, can't?

If your packet goes over someone else's wire, that person can do *anything* to that packet they want to. There is you, on one of the wire, sending electrical signals out that represent data -- there is nothing at all that mandates the electrical signals they send back have to be what you want them to be.

Honestly, if you would not believe this:

# traceroute my.server.com
Tracing route to 64.64.64.64
1. 15 ms 16 ms 19 ms my.router.net
2. 35 ms 42 ms 53 ms relay.babylon5.earth.gov
3. 55 ms 90 ms 85 ms comnet.core.ncc1701-e.starfleet.ufp
4. 120 ms 130 ms 115 ms my.server.com

Why in the world would you trust:

# traceroute my.server.com
Tracing route to 64.64.64.64
1. 15 ms 16 ms 19 ms my.router.net
2. 35 ms 42 ms 53 ms rtr1.router.net
3. 55 ms 90 ms 85 ms mae-east.gateway.server.com
4. 120 ms 130 ms 115 ms my.server.com

The person at the other end of your wire has total control over what he/she chooses to send you, be it garbage, data, or 10,000 volts. Once your packet reaches the other end of the wire, they can drop it, mangle it, copy it, etc. (Note that encryption and the like might stop them from decoding it or altering it *in a useful way*, but this doesn't stop them from *trying*)

You have no control over your packets once they leave your own wires, except what you may have contractually negotiated with the owner(s) of the other wire(s). (And any proof of contractually failure is going to be distressingly hard to show, as without hard evidence, the ephemeral/forgeable nature of the electronic medium makes proof tricky. You: "My ISP was forwarding packets to the NSA!" Them: "The paranoid guy forged those logs by manually typing up those files. Here are our logs that show otherwise.")

Other people already have control over your packets. You, at best, can attempt some minimal control over your data via encryption and digital signing, but not a lot beyond that.

Re:Lessig said it first

[Minna Kirai]

Now there are a few technical reasons why the internet CANNOT be retrofitted into pay-as-you-go content restricted affair.

I think that Walker's article does a good job at refuting those supposed technical reasons. If you can point out specifically how he's mistaken, please do so. The question of whether or not something is "techincally impossible" is always a difficult one, and the pattern throughout history is that something deemed "impossible" by one generation is achieved by the next.

The cost of metering the internet would be greater than the cost of providing it, free, to the world at large.

They don't have to do so much. Authoritarian control can be exercised without needing to meter each and every little packet. A government could simply declare that use of any encrypted protocol is illegal (the old "Clipper chip" proposal did something like this, good thing it died). Then randomly sniff packets, just 0.001% of them, until catching something that their automated systems cannot decode. The ISP points out the perpetrator, who is arrested while technicians comb over his PC for the offending code, and any other guilty evidence.

The Chilling Effect could be so strong that propagation of encryption could be effectively suppressed.

Finally restricting access to the internet would be like restricting access to our highway system.

That's using the "force of nature" argument. Restricting access to roads would be prohibitively difficult, because roadways are part of our physical world. The topology is determined by the 2-dimensional lay of the land. The internet, as an entirely artificial virtual world, obeys only rules invented by humans. What man built, man can unbuild.

I personally just mutter under my breath and pay it, but my wife actually routes around the toll roads useing back roads.

(Following is a pessimistic response. It might not happen, but it COULD)
Within 5 years, to pay a toll, you'll need to have a radio-transponder installed in your car. Sure, you can still pay cash to an attendant, but it'll be $5 instead of $0.50. And eventually that attendant will be fired, and replaced with police cruisers to arrest nonpayers on the highway. 5 years after that, the toll points will be taken down and replaced with an automatic system that uses GPS to tell when you entered the "premium" roadway. One year later, speeding tickets will be automatically mailed if that GPS clocks you at going over 65 mph.

Two years after that, a politician will decide that the fairest way to allocate highway-maintenance taxes is based on actual road usage, and every mile you drive will be tolled.

Just a guess

[CGP314]

Some of the prognostications and conclusions reached may not be palatable to Slashdot readers.

So I'm guessing that it has positive things to say about trusted computing :)

Remember...

[SoIosoft]

This is just one person's opinion on trusted computing. Nobody really knows where it's going, but there's a lot of people trying to push their various interests into it.

My feeling is the idea of trusted computing isn't in itself bad. As a matter of fact, there's probably a lot of very good uses for it to go along with a larger system of security. Some of the ideas in Palladium, if used correctly, really could enhance and improve security. It, in itself, may not provide security, but as part of a larger system with other security geatures, it may well be useful.

The problem is not trusted computing, but some of these rogue interests. The government, Microsoft, the recording industry, the motion picture industry, and just about everyone else wants a say in where it's going. Hopefully, between the various interests will cancel each other out and we'll end up with the good that comes from trusted computing, but without most of the bad.

Groups fighting against trusted computing shouldn't fight the technology, in my opinion, but some of the uses of it. This means they should fight some of the DRM aspects of it, not the technology in general. Remember, an extra layer of security isn't a bad thing to have.

Imminent Death Of The Net Predicted

[Alex Belits]

Explanation is here -- people were making those predictions for at least 20 years already, though with different reasons to support it.

He Fails on the History of Technology

[an_art]

I have yet to encounter an Internet Prognosticator who gets it right about the history of worldwide communication, and the formation of worldwide communities. Ham Radio operators communicated around the world, drove technological advances and formed virtual communities based upon radio communication, throughout much of the 20th century. In addition there were numerous folks who merely "surfed" the shortwave bands with receivers only, partaking of the worldwide shortwave radio "content." My point here is merely that these prognosticators should spend less time trying to prove that the Internet was the first medium to enable these activities, and spend more time on the Internet issues at hand. Art

Freedom without repsonsibility

[i_r_sensitive]

Those who care about freedom cannot just sit back and assume that because the net is fairly free now, it always will be. Eternal vigiliance is the price.

There is an additional price though, responsiblity.

Unlimited freedom without repsonsibility is equivalent to anarchy, and the net is as close to a functional implementation of anarchy that the world has seen. However, this does not imply that what we have is an ideal. Far from it in fact.

Spam is one immediately obvious result of this freedom. Give yourself a couple minutes and you can think of several other less than desirable outcomes of all this freedom.

By tempering freedoms with responsibility, we can have the free flow of ideas we all have come to expect from the web, but without propogating all those nuisance aspect of the beast.

Unfortunately that means regulation. But regulation is not feasible in the traditional sense. The internet is a global phenomenon, and while some corners of the world act to supress portions of the traffic, by and large the web is a building block of a truly global society.

But a society must have laws to function and sustain itself. In ten short years my own usage patterns have drastically changed, as well as the usages patterns of many of my peers.

Remember the good old days? I remember not having multiple email accounts, or any of a number of other measures I routinely undertake to weed out various garbage I don't want as part of my on-line experience. We've all had to take these measures, to some degree or another.

My question is, is that the way it should be? Is spam and it's unsavoury tribe really an acceptable cost for the freedoms entailed? Most, if not all of us have extreme antipathy to spam. It's the old adage about a right is such only until it infringes on the rights of others. I feel that spam has truly infringed on my web experience, most of us should feel the same way. Even if the measures to avoid it personally are trivial, should the majority who don't want spam have to make such changes to allow safeguard the freedoms of a few individuals who refuse to honor our freedoms?

Regulation is probably inevitable, and in fact is being attempted by governments today. I think this is the bigger concern. If the web is to be regulated, such regulation needs to come from within. The danger is that the regulation will be forced from outside. The reason this will occur is because we have subjugated responsibilites to freedoms. As long as this continues to be the case there will be an increasing impetus to force such regulation on the web. The problem is that the source of such change will be the very people we don't want to make the changes happen. Big business and government.

And it makes sense, why spend money and time and effort dealing with the effects of this (relatively) unabridged freedom with virus scanners, and spam blocking services Et. Al. when the same time and monies and effort can be used to eliminate the problem. For a multinational corporation, it is a relatively trivial exercise to lobby for the legislative changes required. Once that legal environment exists, it becomes easier to implement the rest of your solution. If you can get a couple of your peers to play ball...

I leave the hardest issue for the reader, how do we encourage those who threaten our freedoms with their irresponsible behaviours to behave responsibly?

Gloom, Doom, and Reality

[Lendrick]

Wow, that's quite a scary picture. And while it's admittedly possible that things could turn that way, I'll go out on a limb and say that it's fairly unlikely.

Take Digital Rights Management, for instance. People put up with it for a little while, until they try to listen to their songs on something other than their own computer -- then they suddenly realize that DRM in fact sucks donkey ass.

Buying a Palladium-enabled computer will be like buying a car with a top speed of 65 miles per hour. The fact is, everyone bends the law a little bit from time to time ... and a reasonable police officer won't pull you over for doing 68 in a 65. It's just not that big of a deal. Likewise, if someone (God forbid!) decides to install the same copy of Word on two different computers in their house, it's not likely that the FBI will come knocking on their door for a license violation.

When Joe User runs into stupid problems like "Error! This computer sucks and therefore refuses to play this music file" or "Error! This computer sucks and refuses to allow you to install this program", he'll start getting pissy. He'll tell his friends not to buy any of these "trusted" computers, and pretty soon, everyone's buying computers and software that don't have this sort of crap built in.

This of course won't stop big companies and big government from trying to restrict things, but the chance that they'll succeed is actually fairly small. I don't see DRM ever completely dissappearing from the radar, but I'm gussing that it'll remain what it is right now -- an annoyance.

what's the big hangup here anyway? well...lots....

[jdvernon1976]

To be perfectly honest, I'm not worried about Trusted Computing, "The Theory"

I buy most/all of my software (okay...maybe not M$ Office, but I buy all my games), I don't write viruses, and it should make spam a trivial non-issue.

Blah, blah, blah

However, I am in TOTAL agreement with everyone here that TC is a bad idea in "The Implementation", especially in the (over?) paranoid forecasts in its use.

My computer won't run unsigned software - no more viruses

My computer won't run unsigned software - any publisher can create subscriptions (overpriced ones, at that) and revoke the license 10 times a year

My computer won't open unsigned documents - the macros in the spreadsheet won't crash my computer

My computer won't open unsigned documents - this person has written op-ed columns against BigBadCorporation Inc, and they've revoked that person's software certificate so they can't send anything else

We could all go on and on - however, he says in the top of the article that he's not for it! What he says is basically a "Watch out for these kinds of words and messages from your legistators! These are the words with which they will woo you into consent!"

There is no problem that has a magic bullet. Every decision has good and bad, and I'm firmly convinced that the bad with DRM and TC has little to do with the proposed concept, but with a very foreseeable result and that it grossly outweighs the good.

Information used to be passed word-of-mouth, and evolved to cave paintings, the written text, the printing press, etc. etc. etc. and now the Internet as we know it. There is money to be made in keeping the spread of information in a one-to-many structure - scads and scads of cash - and with that as the primary (if not single!) motivation for those implementing DRM, as well as the politicians they influence, we the consumers will fall into the backdrop as a minor inconvenience.

Re:Trusted?

[ShieldW0lf]

Technically, it boils down to

"You're just going to have to trust me"

Except there is no constitutonal right to privacy

[AtariAmarok]

Except there is no Constitutional right to privacy. Penumbrae, vapors, and cumulo-nimbus can be inferred through imagination based on existing parts of the document to imply one, but it just does not exist: one can just as easily make up "implied" parts that negate a "Right to Privacy".