Slashdot Mirror
TCPA Support in Linux
kempokaraterulz writes "Linux Journal is reporting that "The Trusted Computing Platform Alliance has published open specifications for a security chip and related software interfaces.". In the latest Gentoo Newsletter they talk about a possible 'Trusted Gentoo', and possible uses for hardware level security."
I mean - there are a lot of hardware security modules that can be used for building trusted systems right now.
Isn't the only purpose of pushing things like TCPA locking the platform down ?
-- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768
The only benefits I can see is increased security for encrypted communication or hard drive encryption. I am really trying to think hard of any other beneficial applications but can't come up with anything.
to hang myself.
Instruction: How to restrict your Linux box from yourself.
Life is not for the lazy.
Linus himself said DRM is ok, as long as it's used in the interests of the user. This is a good thing, think about it; EvilCorp(tm) wants to use DRM to cripple computers, but the PR guy will say "it's for the user". Of course their intent is nothing of the sort, but the Linux folks are the only ones who will actually implement something that *is* in the interest of the user. Then EvilCorp won't be able to lobby making Linux illegal, since Linux also uses DRM which does what EvilCorp claims it's doing "for the users". Well, hopefully.
"Backups are for wimps. Real men upload their data to an FTP site and have everyone else mirror it." -- Linus Torvalds
Better yet, lead 'em. It would be ridiculously funny if Trusted $FREENIX were released before Trusted Windows or Trusted MacOS.
Comment removed based on user account deletion
From a practical standpoint, TCPA is incompatible with the Linux philosophy of open-source modifications
IMO this is not exactly correct - is it against Linux philosophy of open-source modifications to secure my Linux box so nobody except me can make modifications to it?
TCPA used in such way (i.e. in interest of user, not supplier, not government, ...) is quite in line with Linux philosophy of "you're in control" :) .
But, as with all weapons, it has two edges. So, beware! :)
hany
And after the TCG accumulates enough bad PR, I guess they'll change the name again...
No...thats not it. I don't "oppose people having choice" or some crap like that. I oppose this becoming an industry standard that REMOVES my option of not having it. Once every computer has this, it won't be long before ISPs can say "we only want trusted machines on our network." It is the begining of the end for the computer cowboy; Trusting Computing is the first step to civilize the wild west called the internet. Sure for most users (those with tons of spyware on their computer, or with computers that their kids have loaded with enough illegal IP that a lawsuit might come any day in the mail) trusted computing might be seen as a good thing. But for someone who has taken these little multipurpose machines called computers and have used them as they wish despite lacking the blessings of the company's involved (such as me playing DVDs on my Linux box), Trusted Computing is a sign that the companies that have created this wild west are sick of not being obeyed.
This might help some company keep its local network in shape, which is great for them and a reason for its eventual success. But with that comes a future where my computer follows the law despite my wishes (or I lose Internet access), which would make it a very boring hunk of silicon and circutry indeed.
Open Source Sushi
Hmmm. And yet I don't seem to need any form of TCPA/TCG or DRM. In all the years I've run linux full-time, I have never ever had naughty code or naughty hackers get in. I can't say that about any of the windoze users I know. Beyond that, I certainly don't need any system that can be used as a DRM system.
Nope. Uh-uh. Not on my box. I'll copy my files and CDs as I feel the need and will not have anyone but me control when and how I go on to use such copies. This all looks like what it is, an attempt by corporations to gain control of the most important and useful aspects of your PERSONAL and private property computer. Screw TCPA/TCG (and DRM). Paint it all up with lipstick and rouge all you want but in the end it is about restricting what people are allowed to do with their own computers. Any benefits that come to the individual computer owner are accidental and peripheral to the actual designed and intended purpose.
In Bushworld, they struggle to keep church and state separate in Iraq as they increasingly merge the two in America.
What do you mean don't believe the FUD? What do you think your post is?
Give us one point where Ross Anderson's arguments don't hold. You will be rebutted. Go on.
In general...sure...TCPA could have some positive effects on the computing community. However, it also has great potential to be slipped in...and eventually, by law, it must be used to lock things down. Only a few things at first...but, eventually could mandate a great deal of limitations as to what you can legally do with a computer. As much as the corporate entities are beginning to use the govt. to legislate things...and they really don't like the fair use we do have...it is easily possible to forsee this as a means to that end.
Taken long enough...it could happen, which is why you need to take things like this slowly and with a great deal of skepticism early on.
I heard it said before that "What one generations tolerates....the next generation embraces"
Think of it this way...the article the other day on /. about how many US kids don't understand what the 1st amendment really means...they haven't been taught about it...and we're tolerating loss of freedoms. When they are grown and we're not around...they won't even know they existed in the old form...
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
You should read the TCPA FAQ if you have not already. It explains why this is a bad thing.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
As usual with slashdot, you hold strong opinions regarding tcpa with absolutely no idea what it is.
Tcpa lets you tell your machine to only run binaries signed by Microsoft. You can also tell it to only run binaries signed by IBM. Or you can tell it to only run binaries signed by debian. Or yourself. Or any combination. You tell it what you want it to do in this regard.
The only valid argument against it is the remote atestation issue, which (using digital signatures) can attest the identity of a client over the network. Think windows file sharing refusing to work with a Samba client, even if they open the protocol, because the samba client was not signed by Microsoft. Or worse, IIS only allowing IE to connect to it. Or most likely, a streaming media server only allowing windows media player.
Course, this has good and bad aspects as well. The technology exists, it has useful purposes, you cannot put the genie back in the bottle. If people use remote atestation irresponsibly as in the above scenerios, then it is not a technology problem, it is a people problem and should be dealt with accordingly. TCPA is just a logical next step to take with public key.
Finkployd
To have to burst your bubble of uninformed ostrich-head burying, there is no DRM method that both 1) functions and 2) permits the freedom not to use it.
DRM is based on the idea of interlocking hardware and software, where there are no loopholes simply because you don't have control of your computer (while it's in DRM mode). All software is cryptographically "trusted" if and only if it is signed by an "authority."
If you intend to use your computer to interact with the rest of the world, and the rest of the world is using DRM, you have no choice but to always use your computer in DRM mode.
(To clarify, yes, there are some DRM specs which permit centrally-signed software to interact with non-centrally-signed software -- but these specs are by definition pointless because the loophole automatically voids any "protection" the system gains from signing. The weakest link in a chain determines its maximum strength.)
Completely wrong. The owners of machines don't get the keys needed to sign things for their own hardware. Only the builders of the hardware have those keys, and they are contractually obligated by agreements to the MPAA and RIAA not to divulge those keys to anyone (except employees in the course of their work).
Wow, you just don't have a single clue about any of this do you? You can pop whatever keys you want into the hardware. If you want to create a system where only binaries signed by you can run, go for it. If you only want to run binaries signed by debian, redhat, or joe blow down the street, you can do that too. You can also turn off this checking and allow anything to run.
The scary part of this is the remote attestation piece. THIS is what the riaa and mpaa want. It basically allows streaming media servers and media files to only be opened by programs signed (and verified by the hardware) by those they trust, like microsoft. A scary vision of this is that windows file sharing could disallow samba clients to connect to it even if the open the protocol, because samba was not signed by Microsoft.
If the owners of the hardware were going to be the ones having the keys needed to run on that hardware, then I wouldn't have any problem with it.
You are not going to get Microsoft's signing key and be able to sign your binaries as them, but you will certainly get their public key to verify their binaries and put that in your hardware. You can also generate your own key to sign with and put that public key in the hardware too.
Do you honestly believe that anyone, anywhere would ever go for a system where all software running on Windows has to be signed by microsoft? They couldn't even do that with signing device drivers and such (although they tried, all it does is warn you). You think microsoft is going to stop selling visual studio and all their programming tools because nobody but them can create and sign binaries? Now take this a step further, do you think overseas PC makers are going to sell PCs that can only run windows? Even US companies would never do that.
Good God man, actually take some time and learn about this stuff before you spout uninformed drivel everywhere. There are some real legit complaints about TCPA, but you seem to not understand the most basic aspects of it.
Finkployd