Microsoft Stalling TCG Best Practices Document?

It doesn't come easy writes "Bruce Schneier (of Counterpane Internet Security) suspects Microsoft doesn't want the recently Trusted Computing Group published best practices document: Design, Implementation, and Usage Principles for TPM-Based Platforms to apply to Vista. The reasons are mostly speculation at the moment but Bruce implies further investigation will be forthcoming..."

Comments

Fishy? No, deceptive and devious!

[garcia]

The same system that protects spyware from accessing your data files might also stop you from copying audio and video files. The same system that ensures that all the patches you download are legitimate might also prevent you from, well, doing pretty much anything.

At least someone that is talking to a larger group of those not-in-the-know gets it.

The only reason I can think of for all this Machiavellian maneuvering is that the TCG board of directors is making sure that the document doesn't apply to Vista. If the document isn't published until after Vista is released, then obviously it doesn't apply.

If only that were the case! Unfortunately it's something that's calculated, malicious, and devious.

From Best Practices Principles Document:

preserving privacy, backward compatibility, and owner control

This will accomplish NOTHING but promote an environment where people will continue to become accustomed to DRM being on their computers. It's not going to stop worms, spyware, viruses, and the like - they are going to continue to plague people's computers - it's all part of the desensitizing of DRM. Get people pissed off enough about spyware, etc, and they will be happy to accept DRM.

It's really sad that most people still don't know what spyware is or how to defeat it. When they do hear of it they see this "DRM" stuff in the future that will eliminate it. Instead of taking the 5 minutes daily to do routine maintenance that will keep their computers and themselves happy, they instead opt for having someone else do all the work for them at the loss of everything that was once great about computers.

No lasting effect.

[Trusty Penfold]

So it doesn't apply to Vista and the end result is that Vista turns out to be an bug-ridden, insecure operating system. What's new?

This will yet more incentive to move to a system which has been properly designed, from scratch, to be safe.

As has happened before, the other members of the group will go ahead with their design based off of a draft of the document - generation 1 has a few interoperability issues because each member interpreted the draft differently but at least there will be something out there which everyone, except MS, is trying their best to follow.

Re:No lasting effect.

[TemporalBeing]

"So it doesn't apply to Vista and the end result is that Vista turns out to be an bug-ridden, insecure operating system. What's new?" This is classic Microsoft Embrace and Extend. Since it doesn't apply to Vista, Microsoft will release it the way they want it in Vista, and everyone else will have to comply in order to be compatible. If Microsoft actually had to comply to someone else's standard, then there would actually be interoperability.

Re:No lasting effect.

[nacturation]

If Microsoft actually had to comply to someone else's standard, then there would actually be interoperability.

In this case, the standard defines how it should work and what it should do. Microsoft can *implement* this in any way that they choose. In no way does this imply that adhering to the standard will promote interoperability. Think of it this way: a security standard might say that "door locks should be of sufficient strength and complexity that it would withstand 500 pounds of force and take an experienced lockpick a minimum of 30 minutes to pick". Adhering to this standard doesn't mean that one vendor's keys will work with another, nor that the locks will even fit on your brand of door.

Re:No lasting effect.

[PepeGSay]

Nowhere in the article does he convince me that even if it was published before Vista was released that it *would* apply to Vista. Microsoft is going to delay or modify a major OS release because a *recommendation* outlining a mythical platform is released? This guy has a touch of paranoia.

Re:No lasting effect.

[wgaryhas]

You're thinking of the wrong type of standard. There are standards for how a browser should interpret HTML and CSS data, internet explorer doesn't follow these standards; websites have now been designed around how IE renders html instead of the standard so that anything following the standard can't render the page properly.

Re:No lasting effect.

[Reziac]

Personally, I think it would be better if TC/DRM *does* become a mess of incompatible "standards" with many points of failure -- if it's a PITA to the average person, TC has more chance of coming to the public notice as the negative thing it truly is.

Lets play fill in the blank.

[metallikop]

Microsoft Stalling __________ Best Practices. Old news.

Speculation & Implication...

[leather_helmet]

thats all we're getting served from /. nowdays... or crapple osx vs. beta windows

TCG Bashing?

[weilawei]

I'm not sure of the writer's bias, but it would seem that TCG is fairly "opt-in." Somewhat unlike the current /. tidal wave seems to indicate. TFA mentions "Controllability: Each owner should have effective choice and control over the use and operation of the TCG-enabled capabilities that belong to them; their participation must be opt-in. Subsequently, any user should be able to reliably disable the TCG functionality in a way that does not violate the owner's policy." Who and what is the owner's policy? If the owner's policy says I can't run what I want without TCG, then that statement is effectively meaningless. I can have a hunk of hardware. If the "owner's policy" is something I make up, then it seems fine. TFA also states "The use of coercion to effectively force the use of the TPM capabilities is not an appropriate use of the TCG technology." This is exactly counter to /.speek. So what is it? Is this marketing spin? Is it real?

Re:TCG Bashing?

[saintp]

Of course hardware and software companies won't use coercion to force people into TPM. They'll just stop selling everything else, citing "lack of demand." "There's just been no demand," Intel will say, "for a processor/mobo/whatever that doesn't support TPM, ever since Windows stopped supporting non-TPM platforms." Of course, months before, Bill Gates will have played the high morality card and announced that Windows would not longer run on non-TPM platforms; to allow that continue is to allow the continued spread of spyware and viruses, and Microsoft indignantly refuses to be any part of that!

See? It's not coercion. It's for security. It helps the economy. It thwarts terrorists. TPM gives flags to orphans if that's what it needs to do to get people on board.

Re:TCG Bashing?

[Josh Triplett]

...it would seem that TCG is fairly "opt-in."

Most of the TCG spec is optional and can be turned off, and thus is not particularly dangerous unless you don't control what your software does. It will make Windows Media DRM and similar proprietary systems stronger and harder to break (though still not impossible), but it won't affect people who run Free and Open Source Software. Some of these features may even be useful in a FOSS environment, such as by keeping your encryption keys safe even if your machine is remotely compromised.

The primary danger in the TCG spec is Remote Attestation. This allows your machine to non-forgeably attest that it is running a particular hardware/software configuration. While Remote Attestation is also opt-in, refusal to attest to your systems configuration will be treated the same as attesting to a disallowed configuration: no access. This would mean no "compatible but unsupported" clients, something that the FOSS community has been amazingly good at providing for many protocols.

Essentially, Remote Attestation would take away your ability to have your computer say things like "Uh, yeah, I'm running IE7 on Windows Vista, sure!", "Yeah, this is iTunes 42.9 requesting purchase of music file blah.m4p", "Of course I'm running the official IM client from AOL/MSN/etc, certainly not something unofficial like Gaim", and "Yes, of *course* I'm just going to stream this file and delete it after viewing, I certainly wouldn't want to download it to watch over something faster than my slow Internet connection".

Re:TCG Bashing?

[Malyven]

The problem is currently there are no controls on TCG. This document would attempt to make it opt-in.

That is why he believes that MS is trying to stall so that these rules don't apply to Vista.

Re:TCG Bashing?

[robertjw]

I'm not sure of the writer's bias

Bruce Schneier is a security expert with a practical perspective on security analysis. I subscribe to his newsletter, and near as I can tell, he's not particularly biased for or against Windows. He is very vocal about the balance needed between individual rights and security concerns. He also regularly points out security measures and implementations that are just for show.

I read the article and it doesn't seem like he's bashing TCG at all. Appears more like he has issues with Microsoft wanting to release VISTA as a approved TCG OS without actually following the best practices document.

Re:TCG Bashing?

[MobyDisk]

but it won't affect people who run Free and Open Source Software

Until they stop making free and open source hardware and lock out the software.

Re:TCG Bashing?

[zonker]

i don't believe schneier has any bias except towards making sure bad security and policy doesn't become commonplace. this means making clear the user's rights and the content owner's rights and making sure they don't overstep each others bounds.

have you ever read any of his stuff?

Re:TCG Bashing?

[Master of Transhuman]

Read the article again - in English.

Bruce makes it clear that the document is fairly good in that it comes down on the side of YOU - the owner of the PC (unless we're talking corporate PC here which is inapplicable since corps do what they want with a worker's PC anyway) - having control of the DRM and being able to disable any part of it that you deem necessary to do what you want.

Microsoft obviously is stalling this because Bill Gates wants to control what you do on behalf of his big customers like the music and movie industry.

The point is that the original TCM specifications said nothing about who would control all this. This document is laying out best practices and specifying that TCM SHOULD be under the control of the owner, not the designers and manufacturers.

This is good - if in fact it ends up being applied by said designers and manufacturers.

Microsoft obviously doesn't want it to apply to Vista because their agenda is NOT to apply the recommended best practices.

Re:TCG Bashing?

[Alsee]

Who and what is the owner's policy? If the owner's policy says I can't run what I want without TCG, then that statement is effectively meaningless. I can have a hunk of hardware. If the "owner's policy" is something I make up, then it seems fine.

Here's how it works... you try to instal some software and IT TELLS YOU what your "policy" must be. If you do not accept that policy then it is impossible to instal and run that software. If you try to read a media/data file IT TELLS YOU what your policy must be. If you do not accept that policy then it is impossible to read that file. If you try want to view a website IT TELLS YOU what your policy must be. If you do not accept that policy then you cannot see the website.

Under Trusted Network Connect, as documented on the Trusted Computing Group's website front page, your network provider gets to TELL YOU what your policy must be. If you do not accept that policy then you are denied internet access.

"The use of coercion to effectively force the use of the TPM capabilities is not an appropriate use of the TCG technology." This is exactly counter to /.speek. So what is it? Is this marketing spin? Is it real?

Well you decide. You are force to "opt-in" or none of the new software will instal. You are forced to "opt-in" or you get locked out of all of the new media files and data files and network protocals and the new e-Mail system Microsoft is working on. And once Trusted Network Connect becomes common... and Microsoft has issues a press release that they are implementing Trusted Network Connect under the name Network Access Protection... well at that point you are force to "opt-in" or be denied internet access.

But rememer they aren't doing anything wrong and they aren't trying to force anything on you. It is all opt-in and you always get to set the policy on your computer. It's just that nothing works any more unless you do opt-in and you do set your policy exactly they way they tell you to.

And of course you are always free to turn the Trust system off. Remember the item "any user should be able to reliably disable the TCG functionality in a way that does not violate the owner's policy"? Yep, you can turn it off... however the policy you had to opt-in to, the policy you had to choose to set... that policy had to be that you get locked out of your own files when you turn it off. The software you installed stops working, the various files on your computer are encrypted and MUST be impossible to read or restore, nothing works any more.

But it's all OK because, as they say over and over, the owner is always in control. It was the owner who decided that his computer would drop deat and lock him out of his own files if he turned the system off. It was the owner who "voluntarily" agreed to these FSCKING INSANE "policies", otherwise he's have been locked out of everything in the first place.

There... does that clarify why one side of the debate makes it sound seems harmless and optional while the other side of the debate seems to be making apparantly contradicting statements?

-

Re:TCG Bashing?

[KillShill]

Insidious Computing is not in any way optional and most assuredly not for the benefit of the public.

there is a simple test you can do to determine this for yourself.

ask them why they won't let the "owner" of the machine have access to the encyrption key(s)?

if it is truly for the protection of the owner, then having the key would certainly allow the owner to decide what is best for themselves.

the only reason to disallow access to your own property is for the enforcement of DRM and things like remote attestation.

i don't know if you've heard or not, but very soon, within 5-10 years you will NOT be able to access the internet without REMOTE ATTESTATION. and the only way to ensure that remote attestation is authentic is to prevent the legal and lawful owner of the machine from changing anything about what the system reports to servers.

there is NO benefit whatsoever from disallowing the OWNER from having the key to his/her machine.

this isn't a damn rental, you BOUGHT AND OWN the physical components as well as the right to use the software (aka encryption programs on the chips).

and also if you think this only applies to MS systems and software you are very naive. just wait until the software vendor you use (which is not MS) gets ahold of a "trusted" system... they can do all sorts of things to you, even if most or all of it is reprehensible. they will cite the EULA and enforce every single provision and add new ones without your knowledge. oh of course, it won't be a tidal wave. they know better than to make so many changes at one time. they will boil the frog more slowly...

Re:TCG Bashing?

[C0deM0nkey]

"Subsequently, any user should be able to reliably disable the TCG functionality in a way that does not violate the owner's policy."

Owner = copyright owner
User = computer owner

The way I believe the article should be read is: The owner of the computer is able to disable any DRM the copyright owner has allowed them to disable.

Basically, copyright owners will exert more control over their copyrighted works at the expense of your fair use rights; a technological enforcement that, when circumvented, will result in prosecution under the DMCA. Nice.

If this was not the case, copyrighted works would be released into the public domain or released under an appropriate public license (CC, GPL, LGPL, etc.) after a reasonable time and this technology would be irrelevant.

Re:TCG Bashing?

[fermion]

I would add that if one is not sure who Schnieir is or his biases, then one really has no basis to write an opinion on any computer security issue. He is one of the major players in the field. It is like programming and never having heard of Gamma or kernighan or stroustrup. One may not a agree with a particular player, but one should know who the players are.

In fact it has only been in past several years that Schneier has left the ivory tower and taken a stance on certain security situations, most notably in Beyond Fear. I find his thought process to be interesting and entertaining. For example his treatment of guns for airline pilots is classic.

Re:TCG Bashing?

[teslatug]

Not to mention all the hardware out there that can now be easily locked up. This has the potential to make hardware truly proprietary, Microsoft-only, Apple-only, etc. It will make reverse engineering drivers a hell of a lot harder if manufacturers start co-opting it for "protecting" their IP. That scares me a lot more than the stuff you mentioned. I can do without streaming, websites, AIM, etc, but I can't do without a video card, NIC, etc.

Re:TCG Bashing?

[Anonymous Coward]

Bruce makes it clear that the document is fairly good in that it comes down on the side of YOU - the owner of the PC (unless we're talking corporate PC here which is inapplicable since corps do what they want with a worker's PC anyway) - having control of the DRM and being able to disable any part of it that you deem necessary to do what you want.

It says nothing of the sort. It's marketing... it says a lot of reassuring things without actually committing any company to obeying anything. Microsoft attempts to delay it are PR... as it should be obvious, Microsoft isn't actually committed to anything -- the Trusted Hardware will allow them to do whatever the fuck they want, and you will never be able to tell since all the instructions and data will be encrypted. Best practises my arse... what good are best practises if there is no way to verify that they are being followed.

Re:TCG Bashing?

[alext]

Yes, the particular elision being made here is between a system that you can trust and one that they can trust.

The former does not require the latter but we can safely assume it will never appear that way.

Re:TCG Bashing?

[Anonymous Coward]

I'm really torn, because I have a libertarian streak that would rail against any important service being denied based on remote attestation (or failure to do so).

However, it occurred to me that it would be very nice to be able to generate (for example) a "live CD" and send it to a colocation facility to have a system booted for you that you could verify via remote attestation to not be subject to tampering, before you start putting your important data on it, crypto keys, certs, etc. Being able to verify the system I am renting seems like a very good technical measure to support the trust model inherent in such scenarios.

The social problem comes when vendors start seeing a user's computer as a colo facility. I would like to think market forces would win out, and that these vendors would lose their markets to competitors with more respectful consumer relationships.

Re:TCG Bashing?

[Master of Transhuman]

I said Bruce says the document says what it in fact does say.

Whether any company follows it is another matter - as I indicated.

The fact that Microsoft is stalling on accepting the best practices recommended in the document indicates that it does not want to follow those practices.

So you are correct in that respect - i.e., Microsoft.

You should note that the document is produced by a consortium that includes many other players besides Microsoft, including IBM. Whether any of them will apply the best practices may be open to question, but IBM has a stake in Linux and I doubt IBM will allow DRM to kill Linux. Many of the other players in the consortium have a stake in Linux as well, to some degree or another. Microsoft is the main one that clearly does not.

In any event, Bruce's point was that the document was good IF in fact the players follow the recommended practices.

Re:TCG Bashing?

[Anonymous Coward]

Spoken like a true English major.

For the last time, the people are less important than the ideas. The people are important insofar as they come up with interesting, insightful and informative ideas.

Now get off /. and find some hoes.

Link to actual blog entry

[Anonymous Coward]

Trusted Computing Best Practices.

PLEASE can we stop linking to the entire stupid hierarchy of news.com.com.com.com, zdnet, cnet and other stupid useless sites like that? Schneier is a big boy, he can handle /. - and if not, there's always coral.

Re:Link to actual blog entry

[That's Unpossible!]

PLEASE can we stop linking to the entire stupid hierarchy of news.com.com.com.com, zdnet, cnet and other stupid useless sites like that? Schneier is a big boy, he can handle /. - and if not, there's always coral.

I think we should link to both.

While unlikely (at CNET), it is possible that a news organization would present both sides of the story in an unbiased fashion, whereas if you just link to Schneier, you'll be getting only his take on it.

Re:Link to actual blog entry

[Master of Transhuman]

US, we'll stop caring about your (and Israel's) nuclear weapons when your government stops pledging to "make Israel safe by killing all Muslims." Mmm'kay?

Re:Link to actual blog entry

[That's Unpossible!]

"make Israel safe by killing all Muslims."

The difference between what I wrote and what you wrote is that one of them is based in reality.

Reality: For years the Foreign Ministry in Tehran was draped with a 40-foot banner proclaiming that "Israel must burn."

http://www.telegraph.co.uk/news/main.jhtml?xml=/ne ws/2005/08/12/wiran12.xml&sSheet=/portal/2005/08/1 2/ixportaltop.html

Reality: America has millions of peace-loving Muslims living in our country, many are citizens.

Reality: We have only used nuclear weapons twice, both in Japan, to end World War II.

Now try to present any facts to back up your point of view. You cannot do it, because your point of view is illogical. We are targeting insurgents and terrorists. Obviously many of them are Muslims. That does not mean we are targeting Muslims. To say we are is to use a logical fallacy.

Re:Link to actual blog entry

[schotter]

"Reality: We have only used nuclear weapons twice, both in Japan, to end World War II."

That's a very selective view of reality. Not to mention off-topic.

The USA has used nuclear weapons hundreds of times - around 480 I think. Nevada, Colorado, New Mexico, Mississippi, the Aleutian Islands, the Marshall Islands, Christmas Island, Johnston Atoll, and various places in the South Atlantic too. People have both died and been forcibly removed from their homelands as a result of those 'test' nukings, so they're surely significant enough to be remembered.

And historians are still divided about the motivations behind the USA nuking Hiroshima and Nagasaki -- there's a good argument that they were trying to scare the USSR with their shiny new weapons.

Re:Link to actual blog entry

[Agarax]

OOOH, gotta love the tinfoil hatters.

Everyone knows the nuclear bomb is a myth perported by the Free Masons and the Grey Aliens

The DRM factor.

[Lellor]

Microsoft can only push consumers so far. If their DRM technology is too anti-social they will find that their systems will be rejected on an ever increasing scale.

Consumers may be sheep, but even sheep can be pushed too far and become dangerous to the handler. Living in a rural area, I've seen that for myself. The same thing applies to people who Microsoft are attempting to push their DRM on. It can only go so far.

Re:The DRM factor.

[peragrin]

It already is being rejected. At as far as music is concerned. People have voted with their dollars (& pounds, euros, etc)

Apple's DRM is simple and consistant unlike MSFT's which change per song. Apple has sold over a half a billion dollars worth of songs. The rest combined barely equal a tenth of that.

If you have to have DRM it has to be consistant and easy to use, and actually have rights not just restrictions.

Re:The DRM factor.

[MrCopilot]

Consumers may be sheep, but even sheep can be pushed too far and become dangerous to the handler. Dangerous Sheep, Just what part of the sheep are you handling there, son?

Baaaaad Rancher.

Re:The DRM factor.

[DrEldarion]

... of course Apple is selling more music. The iPod is, by far, the most popular MP3 player available, and it doesn't support WMA files, rendering the other services useless for iPod owners.

Re:The DRM factor.

[Anonymous Coward]

Oh god. consumers will be pushed as far as they can be pushed, they wont' do shit. What WILL happen is that another company will see that the customers are unhappy, and steal the customers. That is the beauty of capitalism.

Re:The DRM factor.

[Prophet of Nixon]

I have actually been chased up a tree by an angry sheep.

Now, why I admit this randomly on the internet, I don't know... In any case, those things are mean.

Re:The DRM factor.

[youknowmewell]

Please, don't mention sheep.

It's a bit insenstive don't you think?

Probably is best not to make any comparisons between sheep and people...

Re:The DRM factor.

[mopslik]

People have voted with their dollars (& pounds, euros, etc). Apple's DRM is simple and consistant unlike MSFT's which change per song. Apple has sold over a half a billion dollars worth of songs. The rest combined barely equal a tenth of that.

I'd warrant that a backlash against Microsoft's DRM isn't what's fueling Apple sales. More likely:

1. The iPod is THE "wow" music player to have these days
2. Heavy marketing by Apple
3. Songs are cheap

I know a number of iPod owners, an DRM doesn't even cross their minds.

Re:The DRM factor.

[youknowmewell]

Gah, I linked to this before, not sure why it didn't work. http://en.wikinews.org/wiki/450_sheep_leap_to_thei r_deaths_in_Turkey

Re:The DRM factor.

[notdanielp]

Apple's DRM is simple and consistant unlike MSFT's which change per song. Apple has sold over a half a billion dollars worth of songs. The rest combined barely equal a tenth of that.

Consistent? Apple reserves the right to change their DRM on songs you've already bought. Wikipedia tracks some of the changes made to iTunes DRM since release:
          "With the introduction of iTunes 4.5, Apple raised the number of machines allowed to use purchased music from 3 to 5. They also cut the number of times a user can burn CDs of the same playlist from 10 to 7. This adjustment was the result of the renegotiation Apple had with major labels. In 4.7.1, users were further restricted: they were limited to sharing their songs with five computers within 24 hours, rather than the previous five at a time."

Re:The DRM factor.

[Duct Tape Jedi]

Consumers may be sheep, but even sheep can be pushed too far and become dangerous to the handler. Living in a rural area, I've seen that for myself. The same thing applies to people who Microsoft are attempting to push their DRM on. It can only go so far.

If you toss a frog into a pan of boiling water it will jump out.

If you put a frog in a pan of water and slowly turn up the heat you get frog soup.

Re:The DRM factor.

[shotfeel]

And when herding livestock, say onto a truck, you don't just put the truck in the middle of a field, pull down the ramp and start herding them on.

You slowly herd them into smaller and smaller confinements, and by the time they realize they're headed into a "dead end" its too late to turn back.

Re:The DRM factor.

[Deleriux]

This is completely true - Many online stores and local stores in my area blatantly put that there Media Device / Pc / Whatever is "DRM Compatible".

People dont know or dont really care what "DRM Compatible" actually is or means on the product they are buying, they just see it as yet another feature they get with the device.

Before people know what DRM is its probably going to be either too late to go back or too hard to find products that are non-drm.

Re:The DRM factor.

[Anonymous Coward]

"I know a number of iPod owners, an DRM doesn't even cross their minds."

Exactly. And if you are, say, 13 years old and getting your first iPod, you think this "normal" and just the way it is.

Just a guess

[Xerp]

Out of any software company, Microsoft has the worst security record in history. I wonder if this could have anything to do with it? Just a guess...

Re:Just a guess

[Skiron]

I would say out of 'any company' Microsoft have the worse security record. In other fields of business (finance, banking, stock market, health, manufacture, aviation etc. etc.) with a record like Microsofts' you wouldn't last in business.

V. I. S. T. A. (the real meaning)

[Anonymous Coward]

Viruses
Insecurities
Spyware
Trojans
Adware

Re:V. I. S. T. A. (the real meaning)

[Philip K Dickhead]

• Veracity
• Integrity
• Security
• Trust
• Accountability

Re:V. I. S. T. A. (the real meaning)

[Anonymous Coward]

Too bad that not a single one of those words can be applied to Microsoft's products or practices.

Re:V. I. S. T. A. (the real meaning)

[Anonymous Coward]

• Very
• Interesting
• Siamese
• Twins
• Aprhrodisiac

Re:V. I. S. T. A. (the real meaning)

[Anonymous Coward]

Really, your name says it all.

(BTW, CAPTCHA of the day: Recalls)

Re:V. I. S. T. A. (the real meaning)

[Epistax]

Virgins
Inpsired
Spew
Timely
Acronyms

Re:V. I. S. T. A. (the real meaning)

[Master of Transhuman]

Or to Bill Gates in general.

Or anybody else at Microsoft that speaks for Microsoft publicly.

Paid liars, the lot.

Re:V. I. S. T. A. (the real meaning)

[Anonymous Coward]

• Very
• Interesting,
• Said
• The
• Anonymous coward.

Re:V. I. S. T. A. (the real meaning)

[Anonymous Coward]

Thank you, Mr. Gates, for clarifying this.

Re:V. I. S. T. A. (the real meaning)

[Jugalator]

What does Linux stand for then...?

Laziness
Isolation
Nerds
Unibrows
Xenophobia

Hmm? ;-)

Re:V. I. S. T. A. (the real meaning)

[kronin]

Very
Insecure
System
That's
Appalling

Re:V. I. S. T. A. (the real meaning)

[the_olo]

And the new logo will be...

http://img236.imageshack.us/img236/6058/msvistalog o6yj.png

Standard MS's bahavior

[Anonymous Coward]

MS is well known for participating in standards committees, only to subvert the standards in ways to keep the competition at bay. Why should anyone expect things be different in this case?

Re:Standard MS's bahavior

[kris2112]

Bahavior?

Was that a sheep joke?

Re:Standard MS's bahavior

[thermal_noise]

I think that's a bit unfair.

Microsoft have been doing a lot of good hard
work in the Web Services standards related fields,
spending considerable amounts of resources coming
up with some pretty good stuff.

Give them credit where it's due, and scorn where it
is apt, and the critique becomes much stronger.

Re:Fishy? No, deceptive and devious!

[ciroknight]

Eh, it's all just signs of Microsoft cracking. Right now it's running around in so many directions, trying to do so many things that one side of Microsoft can't tell what the other's doing.

One section of Microsoft is trying to find a way to diversify into other fields (as it always has been). This means as soon as anything gets popular, instantly releasing that they will have a competitor to that product. See previous articles..

The next section of Microsoft is designing Vista. More or less, they're looking over at Apple and saying "hmm, now how do we do this for ourselves". Hey, if you're going to copy, make sure you copy from the best.

Next, Microsoft's patent team is doing everything they can to churn out as many patents for as many things as possible, no matter what relevance they have to anything. Patents are the new gold; having them makes you rich, no matter in what shape, color, or form.

Then you have the Microsoft gaming committee putting together the XBox 360.. Good luck with that xboxers.

And then you end up with the "future of technology" department; the one where they write all of these magnificent things, designing things like Palladium and giving them crazy names. The only problem is, while this section's doing the designing, all of the other sections of Microsoft are doing their own thing; it seems as if there isn't any communication in the entire process.

Microsoft is like a three hundred pound kid on a tricycle on a very big hill. They've got a lot of business henged on a small amount of products, and they've got to ensure that these products don't collaspe. And the best way of doing that is Advertising, the media, product placement, and the public (get the picture yet? good). The more of these documents coming out that don't mean anything at all, the more Microsoft looks like it's doing something.

Some notes

[Red Flayer]

A quick scan of the bullet points on the first page of the article may reveal why MS may not implement:

"Security: ...The reporting mechanism should be fully under the owner's control. "

"Privacy: ...designed and implemented with privacy in mind "

"Interoperability: ...should not introduce any new interoperability obstacles that are not for the purpose of security. "

"Controllability: Each owner should have effective choice and control... their participation must be opt-in. "

Why should MS rewrite all of their business practices based on what their competitors suggest?

I'm not saying that TGP is a bad idea... I'm saying that it is a bad idea for MS.

Re:Some notes

[KillShill]

when the Insidious Computing group denies the owner of the machine their encyrption key, that alone dissolves all the points you brought up.

when the real owner no longer has the key, then by definition, someone else does. and that someone else has an agenda that is anti-privacy, anti-freedom, anti-property rights.

they deny you and me, the owners of our respective machines, the key to enable full access to them.

that is all one really needs to know in order to figure out the destination.

just an aside, consoles (read: computers) also get away with this purely evil methodolgy. they deny the rightful owner of the machine full access to it. you bought the cpu, gfx chip, sound chip, storage mechanisms, but are NOT ALLOWED access to them. i don't know about other people, but i find that so outrageous and so reprehensible, that i cannot for the life of me figure out why they are still allowed to do business in the civilzed world.

i mean after all, people don't rent consoles... they purchase them outright... and what a business model it is: preventing the lawful use of property that is legally purchased.

something to think about.

Re:Some notes

[shotfeel]

"Security: ...The reporting mechanism should be fully under the owner's control. "

Exept the owner is the company you licensed the software from. The user is the person who bought the computer and software license.

"Privacy: ...designed and implemented with privacy in mind "

The user at the keyboard doesn't really need to know what's going on when "security" is reporting to the owner (see above). Especially since the user already agreed to let the owner do what they want as one of the conditions of "participation" (see below).

"Interoperability: ...should not introduce any new interoperability obstacles that are not for the purpose of security. "

Meaning if the owner (see above) needs to do it to secure their software and the files it works with from "attack" by the user, its OK.

Controllability: Each owner should have effective choice and control... their participation must be opt-in. "

Meaning if the user doesn't agree to everything the owner (see above) dictates (which may change at owner's discretion), the owner is free to lock the user out of their computer (or some resources therof).

Sounds exactly like what MS would want. I know I'm putting a dark spin on the definitions, but there's nothing to say my interpretation isn't (partially) correct.

Re:Some notes

[Red Flayer]

I think if you read the article, you'll see where these points shouldn't be construed the way you have.

A lot of the parts I left out are ones that refute your analysis.

Re:Some notes

[Anonymous Coward]

Because it spells out S.P.I.C?

Re:Some notes

[jez9999]

but are NOT ALLOWED access to them

Nonsense. They could force open the console and get physical access. Oh, did you mean access in the sense of functionality, or something? They don't have to perform any particular function outside of that which they were sold to do; with a console, they were sold to work as a complete system for the sole purpose of playing pre-approved games, and maybe playing pre-approved movies and music.

Why?

[imunfair]

I don't really see why Microsoft would want to stall it - assuming it would allow them to stop piracy of their operating system... Maybe piracy really isn't a big factor for them, and developing this technology would cost them more (plus delay the already late release of Vista)

That said, I'd applaud anyone who successfully fought/stalled/stopped the trusted computing initative - I don't really want someone monitoring me and telling me "No that's wrong, you can't run/do that" or "You can't connect to the internet because your computer/operating system doesn't support the 'trusted NICs'" (You know it will go there eventually...)

Re:Why?

[twiddlingbits]

TCI really doesn't concern your everyday user. It is for companies who have to protect highly sensitive information from disclosure by keeping the systems the data lives on secure. Systems handling finances, classified data, etc. all these can benefit from such an initiative. Just think ig TCI had been used a lot of the recent spate of ID thefts might have been prevented because the system would never have let itself be hacked. Of course, this CAN be taken too far. It's best applied in small doses where it can do the most good.

Re:Why?

[Anonymous Coward]

It's obvious why Microsoft wants to delay it but useless asswipes like you are too fucked in their vomit-filled head to stop sucking their own dick for the time required to wipe the cum from their eyes and read the fucking article.

Re:Why?

[jp10558]

This already exists in some situations. My cousin, who goes to LaSalle, was forced to uninstall NOD32 and Outpost firewall to access the net, because they were too "insecure" according to some cisco clean access program.

What did they require as a replacement? McAffee's security suite.

I am really glad I'm done with college networks. I think they need to let me decide what software I want to run (or not run) for security of my machine. Turn off the net if I'm spamming or broadcasting viruses, but not because I think NOD32 is a better AV solution than McAffee.

Re:Why?

[plasmacutter]

TCI can also be used to prevent whistleblowers from providing proof of federal crimes, massive environmental damage, wage law lapses, and other such "trade secrets". these companies are not people, they are things, and they are things which test positive on the DSM standards for psychopathy, so they deserve to be open and monitored as much as possible. We have trade secret laws, etc. We don't need a system which prevents people from reporting lapses in the laws by large corps.

Re:Why?

[Reziac]

I think in cases like what you cite, it would be really "interesting" to follow the money and learn exactly who is in bed with whom, beyond the obvious.

And I agree with you totally. So long as a given user's machine isn't spewing garbage, it's none of their damned business WHAT security apps they do or don't run.

Of course, TC will make it simple to enforce this: run the apps we say, or you won't be allowed to connect to the network. (Read posts by Alsee for what I believe is how things will wind up. http://slashdot.org/~Alsee

Re:Why?

[twiddlingbits]

Thats the HUMANs who are doing that, not the TCI software standards. I can just as easily say all the same things about ANY security mechanism on any operating system. Lets take HTTPS and IPSec for example, you probably use these secure standards every day for your benefit. Crooks like Enron and Worldcomm did to. It proves nothing. TCI is just a standard that can be used to enhance security, what you chose to secure, good or bad is a human decision

Re:Why?

[UnapprovedThought]

Thats the HUMANs who are doing that, not the TCI software standards

Too much power in the hands of any one human is a situation ripe for abuse.

You wouldn't hand a loaded gun to a small child, would you? It's a bad idea because the child doesn't even understand the implications of the power of the device. (Most C-levels are no better informed of what they're getting themselves into with TC, as they will happily admit if you ask them right now...) Even worse is to hand a nuke to someone who has already shown a lack of civilized restraint in the use of power. It's just not a wise idea. We can get along just fine without this technology.

TC as drafted is too powerful and too centralizing in nature in its fully deployed form to leave its control in the hands of a few conniving jokers, and they will ultimately use it to lock people in to the choices that run in their favor, and to lock people out of the choices that don't run in their favor. Left out in the cold from all of this will be consumers' natural choices. We (the consumers) don't need it, we didn't ask for it, it's against our interests, so -- I argue -- we shouldn't pay for it.

Re:Why?

[twiddlingbits]

I think we are between a rock and hard place here. We want our information to be secure and protected from the "bad guys" but we don't want to give the other type of "bad guys" all the tools they need to lock us out either where we can't do anything. In the hands of a few the standard could be burdensome, but I don't see the few here, it's an open standard anyone can comment on it and it doesn't specify an implementation. But I agree that it can be turned to evil just as guns can. Absolute power corrupts.

It's not mandatory, is it?

[NubKnacker]

Does it say anywhere in the document that the participants of the group absolutely have to implement its recommendations in their upcoming releases? No. So why would MS try to delay it's release?

They've proven it time and again that they can get away with doing what they want not giving two hoots about anyone else's opinion. What makes you think they can't do they same with this even after the document is released?

This story just reminds me of all that Masonry crap and the time I wasted watching documentaries and crap on them.(Because I was really really bored.) Conspiracy theories....pfft.

Re:It's not mandatory, is it?

[bhsx]

Do NOT talk about the Free Masons.
Ever!
(Yes, your IP is logged)

more to the point

[sum.zero]

just who is the 'owner' of your computer? are you a 'user' in this document? it's not very clear to me...

sum.zero

Huh?

[youknowmewell]

Microsoft stalling best practices? No...

Re:Huh?

[Zorque]

Sadly, yes. If anyone needs me, I'll be killing myself.

Re:Fishy? No, deceptive and devious!

[Anonymous Coward]

It's really sad that most people still don't know what spyware is or how to defeat it. When they do hear of it they see this "DRM" stuff in the future that will eliminate it. Instead of taking the 5 minutes daily to do routine maintenance that will keep their computers and themselves happy, they instead opt for having someone else do all the work for them at the loss of everything that was once great about computers.

"They who would give up an essential liberty for temporary security, deserve neither liberty or security," Ben Franklin. Sheesh, it's like Fascism for computers. "Please, take away our freedom! Give us safety and trust!" they cried, saluting their Fearless Leader. I guess that makes Bill Gates Hitler.

Total Subversion, Vista will have DRM

[Anonymous Coward]

This looks like a move to implement full DRM and coerce it on end users, directly in violation of the spirit of the TCG.

Microsoft might just be trying to tip-toe around it so they can implement full DRM by making their software-only implementation.

Who misread the title?

[Anonymous Coward]

I misread the title as "Microsoft Stealing". I guess those words just fit together well in my head.

File Protection

[nurb432]

Not only can it protect your files from being accessed by spyware, it can protect them from being accessed by you.

That is, when the 'key holders' decide that the information is forbidden. ( or just politically incorrect ).

And 'loss of everything great about computers? Remember, you are *just* a consumer, you should be happy with your 'media-device'.

Re:File Protection

[Anonymous Coward]

Well, i wont buy any of those DRM thingies... i rather stick with aging hardware than getting a PC that is basicly less useful than todays consoles. For all gaming needs i still can see me buying a next gen console and for serious pc stuff an old pc is more than enough anyway. And maybe some smaller companies will sell some not-that-great-but-working free systems. Maybe it will seem like a (not so?) small step back, but it will be a big step on if you see it on a larger scale.

Re:File Protection

[Jugalator]

And, unfortunately, using something else than Vista won't help here as long as there isn't some kind of global boycott (yeah, right!)

Using e.g. Linux instead of Vista to avoid these practices will give you content that may not even be playable at all, unless Linux supports the DRM mechanisms and hardware of course. So it's really a lose/lose situation, no matter how you look at it.

The implications of this is, of course, that you have nothing to lose on using Windows Vista, rather just things to gain on it. All non-DRM content on it will work just like before, and the rest will have strict rules applied to it. While on a OS that don't support this, you'll get the same thing, but instead of strict rules, you just won't be able to play it at all.

Just saying this, because NGSCB is often looked at as a major downside with Vista, when the real downside will instead come to each and every OS not even supporting the protection mechanisms. At least Vista users will be able to use the media/hardware if complying to the terms.

Re:File Protection

[87C751]

The implications of this is, of course, that you have nothing to lose on using Windows Vista, rather just things to gain on it. All non-DRM content on it will work just like before, and the rest will have strict rules applied to it.

Until SP2, when non-DRM content gets mysteriously broken due to a purportedly unrelated security fix. And there's precedent. Look at the way XP SP2 broke raw sockets completely. (of course, the saner solution of restricting them to privileged accounts wouldn't have worked too well, seeing as the majority of XP boxes run as admin all the time, anyway. but I digress.)

On the other hand, your glasses are a lovely shade of pink. Rose, one might call it.

Re:File Protection

[Reziac]

You say, "Not only can it protect your files from being accessed by spyware, it can protect them from being accessed by you. That is, when the 'key holders' decide that the information is forbidden. (or just politically incorrect)."

This brings to mind an ugly scenario, where the OS's TC component continually monitors your computer for disallowed content, which depending on the legal climate of the day, might be classed from "felonious" to merely "politically incorrect". And it might then report your transgression to the "appropriate authorities".

Even innocent use of the wrong "keyword" could become a risk.

I think I need my tinfoil hat refitted.

Re:File Protection

[SilverspurG]

This brings to mind an ugly scenario

I'm on board with another ugly scenario presented here.

Writers of malicious software are always several dozen steps ahead of the average consumer by nature. They will figure out how to circumvent the TC implementations and then use those very restrictions to prevent the users from diagnosing and removing them.

In a sick sort of way this may be economically profitable for companies who write security software. But the whole system is definitely not in the best interest of society.

Re:File Protection

[Reziac]

I think that's altogether too plausible -- that TC/Palladium will indeed become the "secure path" for rootkits and various other malware, and by its very nature the installed malware will be out of the user's reach.

That's yet another reason why once we're all stuck with it, and with no internet access except by a TC system -- my older computers, the ones that do my everyday work, will never interact with the TC machine. Not only will *I* be unable to trust said machine, it could easily be a hazard (out of my control) to my other systems.

Not to mention the potential for "whoops, TC chip or OS had a bug, and now all your files are irrevocably encrypted, cuz it thought you were trying to tamper with it. So sad."

Re:File Protection

[KwKSilver]

The TPM-loving media and hardware makers have my permission to shove their products where the sun doesn't shine and rotate. This is all about DRM and strangling whats's left of the competition amongst MS competitors on the Windows platform (e.g. Word Perfect, game software, Google, Yahoo, etc.)--for now, Linux and UNIX later. They could save themselves the expense, I wouldn't walk across the street for unlimited free copies of any or all MS, RIAA or MPAA products.

Re:File Protection

[Jaseoldboss]

Well, i wont buy any of those DRM thingies

That was my first reaction, but then you've got to look ahead to what to do when you can't watch any films, listen to music play games any more.

We're screwed if this gets adopted and the average Joe is going to hand our asses to them on a plate by rushing to buy the latest Hi-Def Vista PCs and Consoles when they start appearing.

Re:File Protection

[Anonymous Coward]

If Linux won't play/run it, I'm not buying it.

If someone cracks it, and a compatible version of the content is not made available for sale, Oh well, I'll have to download it from a Russian or European web site or usenet server.

So who ultimately loses? The corporations - well, the shareholders, really. Employees will still get their salaries, and the execs will continue to get their multi-million-dollar quarterly bonuses until shareholders FINALLY wise up (usually too late) and punt the execs.

Interestingly, the captcha for this post is "extort"

Re:File Protection

[jez9999]

A reasonable compromise might be to buy some kind of media centre (preferably not running Windows :-) machine for watching video and listening to music, leaving your PC un-DRMed for stuff like programming, Internet access, etc. That's what I plan to do if the DRM nuke goes off.

Re:File Protection

[Frank T. Lofaro Jr.]

Remember SSSCA/CBDTPA?

They'll finally pass it and now you'll be a felon.

Re:File Protection

[PlacidPundit]

A reasonable compromise might be to buy some kind of media centre (preferably not running Windows :-) machine for watching video and listening to music, leaving your PC un-DRMed for stuff like programming, Internet access, etc.

Yeah, but we already have that. We call them "computers" and "televisions." :-)

Seriously, all the media industry is trying to do is adopt digital tech without going to all the trouble of creating a new business model. They're trying to turn general purpose computers into black box media devices. And Microsoft is only too happy to help. They've been trying to branch into media for *ages*.

Recently what?

[Enigma_Man]

Editors?

-Jesse

Re:Recently what?

[Enigma_Man]

Nevermind, I see how the sentence can be, it's just extremely awkward.

-Jesse

Re:Recently what?

[jaavaaguru]

I had to read that 4 times for it to make sense. I think this looks a bit better, but still not perfect...

"Bruce Schneier (of Counterpane Internet Security) suspects Microsoft doesn't want the best practices document 'Design, Implementation, and Usage Principles for TPM-Based Platforms' (recently published by the Trusted Computing Group) to apply to Vista. The reasons are mostly speculation at the moment but Bruce implies further investigation will be forthcoming..."

Foggy...

[Spy der Mann]

It seems that the Windows (TM) are a little foggy and don't allow a very clear "Vista"(TM) (view) of the inner workings... we might need an XP(TM)-ert to clarify what's going in. If he can find the help of a "Search Assistant"(TM), the better. Just make sure his speech is not clippy(TM).

Re:Foggy...

[Anonymous Coward]

That was terrible, truly awful...

this is an old story, just new players

[Fox_1]

If you want to keep the standards from impacting your business join the committee that makes them and strangle it in delays and horsecrap. Welcome to big business 101. Kinda like Oil guys working with the EPA, or cigarette companies running Health studies.

Re:Fishy? No, deceptive and devious!

[Anonymous Coward]

You failed to mentioned their marketing arm, the apparent real key to their success.
(That and good luck)

The reason is obvious

[Anonymous Coward]

They are working on their own document, entitled "Trusted Computing Group - worst practices".

The IEEE P1667 open alternative

[IPAQ2000]

This makes so much more sense

Re:The IEEE P1667 open alternative

[Anonymous Coward]

microsoft is trying to get vista out ASAP. They even slashed their core features. They aren't going to want anything to compromise their release date... A public outcry about them not wanting to abide by industry standard "trusted computing" model is the last thing they need to cripple their launch.

Re:The IEEE P1667 open alternative

[Wesley Felter]

At first glance, that looks totally orthogonal to TCG.

Why would Microsoft care about a piece of paper?

[dpbsmith]

I don't get it.

It's like all the privacy notice boilerplate. There are stories almost every day about companies disclosing information they promised not to disclose.

It all reminds me of the scene in Dr. Strangelove where the President asks how a rogue SAC commander could have launched a nuclear strike, when only the President is supposed to have that authority. And an air force spokesperson clears his throat and says "It appears that General Ripper may have exceeded his authority."

Why wouldn't Microsoft just bull ahead? And when anyone complains, Buck Turgidson will say "It appears that Microsoft may not have followed best practices" and everyone will shrug it off, the way they always do.

Server licences & desktops as servers...

[Anonymous Coward]

Let's face it. There's not much difference between a 'server' and a 'desktop' as far as Windows goes. A little tuning and a slight difference in the bundled tools and apps...that's it.

If Vista were given any kind of elevated security status above Windows Server, MS would loose those sales.

Re:Server licences & desktops as servers...

[Anonymous Coward]

" Let's face it. There's not much difference between a 'server' and a 'desktop' as far as Windows goes."

I think there is. How many clients will a Home/Pro XP box let get connected to it at any one time? Microsoft's EULA says you are restricted to 10. But I can't say if it enforces that in their software or not. And if you buy their 2003 Server for ~$1000 bucks, it is restricted to 5 clients. So, yeah, for home, that's not a problem. But for a small/medium office, their desktop would make a lousy server for that reason.

TCG?

[Mortal-God]

I didn't know M$ was trying to get into the Trading Card industry. I see it now: "I tap my Bill Gates and send a monopolistic attack at you loose $2bil points." "Yeah well I summon a firewall to block your attack" "oh but my Bill Gates was equipped with Windows so it gets +50 attack points and destroys your firewall" "good, Windows opens you to attack so I send my WinWorm at you, it will take you 2 turns to clean up that mess"

Re:Fishy? No, deceptive and devious!

[Anonymous Coward]

Please, take away our freedom! Give us safety and trust!" they cried, saluting their Fearless Leader. I guess that makes Bill Gates Hitler.

No, it makes Gates a Republican's politician's wet dream.

Too Funny

[segedunum]

The ultimate Big Brother (let's face it, if they can, they will) experiment in the TCG (not that the technology cannot be used for security of course) being one-upped by Microsoft who want to use the technology for their own ends. It's the same thing all the time with Microsoft and bodies of this kind. They join, and perhaps even contribute, then they go away and make their own version that only applies to them.

this is just....

[KillShill]

refraining to boil the frog too quickly.

they don't want us jumping out before it's too late.

and by us, i mean the folks who haven't a clue as to how Insidious this whole thing is.

i am also partial to Sinister Computing; it has a nice ring to it.

Re:this is just....

[Anonymous Coward]

How about Digital Rights Molestation?

Re:Fishy? No, deceptive and devious!

[KillShill]

" Eh, it's all just signs of Microsoft cracking. Right now it's running around in so many directions, trying to do so many things that one side of Microsoft can't tell what the other's doing."

what a bunch of utter bu**sh**.

i've never bought into the absurd notion that a company or organization doing things that the other people in the said groups don't know about.

it's just a red herring. or another way to say it is "plausible deniability".

it's not hard to see that it's very effective... almost no one holds them accountable when their "PR" dept brings it up or an "astroturfer".

Balmer: bill, i think the public is catching on to what we're up to with our so-called "trusted computing"

Gates: then we'll just have to boil the frog more slowly.

they're not cracking up at all. they've probably been analyzing the situation and determined that the shi* they're forcing down our throats would be more easily accomplished if they do it in smaller amounts, with some chocolate along for the ride to cover up the smell/taste.

Aluminum Foil Beanie Mode

[sysadmn]

What if MS is stalling not because they don't want it to apply to Vista, but so that their competitors on the committee can't implement software only (TNC) solutions? HP, IBM, and Sun all have DoD certified (B2 compliant) versions of their proprietary operating systems. If MS confuses things so that TPC means (only) Intel's hardware and Microsoft's software, they've frozen out AIX, HP-UX, and Solaris until Vista catches up. (Yeah, I know there are B2 versions of NT - you just can't do much with it.).

Re:Aluminum Foil Beanie Mode

[sconeu]

No, there are no B2 versions of NT. There are C2 versions... on specific hardware, with no floppy drive or net connection.

Who is the "owner?"

[overshoot]

The TCG has resisted defining "owner" for purposes of their spec, despite several requests for clarification.

Think of it this way: most computer-related "stuff" now has a "licensed, not sold" tag attached. Ask yourself again, then, who has ultimate control unter TCG definitions.

Of course "opting in" will be mandatory for any..

[plasmacutter]

use of proprietary anything.. so the "option" to opt in evaporates for the average citizen and it's again to "forced in".

mod parent up.

[plasmacutter]

I rate the parent "insightful", and anyone else who sees the black chess pieces being put into place probably thinks the same.

and so it begins

[El_Muerte_TDS]

the downfall of "trusted" computing. The group doesn't even trust eachother. How can we even trust a group like that.

It's So Depressing

[brokenarmsgordon]

It's so depressing.

The sad thing is not that a lot of people don't know what spyware or DRM are, or why they're bad. The sad thing is that a lot of people do, yet nothing is really accomplished. The cnet article is good because it raises many important points about the nature of Vista and trusted computing. And it will sit on that server with no fanfare. This will not be an important story to anyone, newspapers will not pick it up and nor will computing magazines.

We will get nowhere beyond this article, which takes no stand; makes only polite suggestions and queries.

``Something is fishy here. Should we be concerned?" A shallow question with hollow convictions and the full-bodied echo of defeat.

Trusted Computing is not about security. We know what it's really about, it's about IP. You don't need an unjustified mess to be secure. Security is just the excuse. It's about patents and trademarks and copyrights. It's not about security, because security benefits people. Trusted Computing benefits companies. It's about money and control. It's about their control over our money.

The article will sit there and rot and no one will take it further, because no one wants to risk offending the advertisers. No one wants to risk slowing a cashflow.

These kinds of things are vital, important issues. They concern our very rights as citizens and as human beings. The important part of Intellectual Property is not the latter, it's the former, it's about control of the former. Companies -- inhuman, non-being concepts on paper and ink -- subvert the rights of living people to think and explore.

We can do nothing. How do you adhere to your morals and convictions and fight something that will adhere to nothing? We are powerless to affect change and every day more restraints and ludicrous laws are passed on us and our rights are signed away for profit. For the benefit of people already in life's favor.

But it's not a big deal, right? When you're allowed to read a book is a not a big deal. What you're not allowed to say is not a big deal. What you're allowed to even think is not a big deal.

It's so depressing.

Re:It's So Depressing

[Anonymous Coward]

We can do nothing.

Of course we can, we are consumers ! Just don't buy this stuff !

It's so depressing.

It's only depressing if you sit on your ass and passively accept it. If you don't like it, resist it !

Re:Fishy? No, deceptive and devious!

[shotfeel]

It's not going to stop worms, spyware, viruses, and the like - they are going to continue to plague people's computers

Don't be so pessimistic. Once you're in the "Trusted Enviornment" you're stuck there and can't touch anything else. So, knowing MS, this means worms, viruses and the like will only have access to trusted resources. Meaning MS Office will be wiped off the computer, but Open Office and my pr0n collection will be safe.

does any of this surprise anybody

[suezz]

does any of this really surprise anybody. it is microsoft pretending to be getting along with the industry open standards and then they will come along and make their own so they can lock people in and keep the revenue stream coming in.

now especially with IPTV and all the drm crap they are making with the MPAA/RIAA it is obvious where they are going along with apple. You are obviously going to have to have the platform THEY choose to view their movies/tv.

Umm, I wonder if it will stop with just movies and tv - you think I will be able to install linux on the new vista pcs.

The IPTV and the drm with music and movies is just the DVDCss all over again. You have to have a platform THEY choose for you and if you don't well tough - you can view or buy their content.

Boy who would of seen this coming.

It doesn't matter.

[missing_boy]

From the article:

But there's something fishy going on. Microsoft is doing its best to stall the document, and to ensure that it doesn't apply to Vista, Microsoft's next-generation operating system.

Interesting article, but I'm not quite sure that it's worth while the author's trouble to speculate on "fishy Microsoft-related news". The fact is that when Vista is released, it'll ship with every new desktop and every new laptop that's sold, basically anywhere around the world, and nobody will give a hoot about a speculative paper released before the OS was. Vista will most likely be much more secure than 2000 and XP, and that is plenty enough for Joe User.

Tired of Slashdot conspiracy theories

[Dangero]

Is anyone here actually a software developer??? Vista is in Beta 1 NOW, so of course they aren't going to implement any design that was not previously planned. Would any other software engineer expect them to? Of course not! I personally am working on a product that is in Beta and if someone comes to me and tells me that I need to add/change anything, I direct them to the specs for the next release. I mean, come on. An OS is just about as big and complex as software designs get. Do you think Microsoft is really worried about the industry trying to force them to accept this standard? No way! Maybe if the spec came out 4 years ago when they were just starting Longhorn. Not now. It's unrealistic for any OS writer, not just Microsoft.

Re:Tired of Slashdot conspiracy theories

[kpat154]

It's sad when only 1 of 107 comments is actually on target. Cudos Dangero - I couldn't have said it better myself.

Re:Tired of Slashdot conspiracy theories

[jimmyharris]

Are you forgetting "Mr WinSuperSite" who says "Too, I'd like to remind you that Windows Vista is only in Beta 1. Lots of things are going to change, and many, many features will be added by Beta 2 and beyond."

Or does that only apply to positive features yet to be added?

Re:Tired of Slashdot conspiracy theories

[Anonymous Coward]

Well, hey, that's what Sevice Packs are for. And with Windows being so buggy, you are pretty much forced to apply the Service Packs whether you want to or not.

Start our "Thank You" notes to GNU

[jackDuhRipper]

> it's all part of the desensitizing of DRM

Agreed that that's part of it. And, as we slip down that slope where there are hardware- and OS-level mechanisms determining what we can and cannot view, hear and run, let's please thank the heavens and stars for GNU, the FSF and the thousands of players who've given us the ability to circumvent these things.

I personally don't get too up in arms about "some DRM." I think, e.g., FairPlay is pretty fair for consumers. Currently.

I no longer hear (m)any rants about CPU IDs. It's not because it's no longer there - it's because - per the parent post - we're desensitized.

From my PoV, a little governing of our digital Freedoms is acceptable if it means there's incentive for entities to build and offer good services. I thank heavens for the eternal vigilance we're all provided by the likes of GNU and FSF because they're the ones who've made possible the tools that can help us decide for ourselves when others decide to clamp down too tightly (and that threshold will differ for diferent individuals).

Re:Start our "Thank You" notes to GNU

[Hurricane78]

> From my PoV, a little governing of our digital Freedoms is acceptable if it means there's incentive for entities to build and offer good services.

"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." - Benjamin Franklin (1759)

From my POV, this not only counts for safety, but for nearly everything, as I see freedom as the highest of all goods.
And I'm certanly not the only one who thinks that way if he actually *starts* thinking. (Wich is not a habit of what i call "the average citizen".)

Re:Start our "Thank You" notes to GNU

[Ph33r th3 g(O)at]

I personally don't get too up in arms about "some DRM." I think, e.g., FairPlay [extremetech.com] is pretty fair for consumers. Currently

But those that accepted FairPlay have cooperated with getting the Digital Restrictions Management nose underneath the camel's tent. Once DRM is accepted, it will all become more intrusive, because there will be an oligopoly or monopoly controlling the only game in town.

Short sighted

[hal9000(jr)]

Yah know, all you hens running around clucking about how the sky is falling when ever someone mentions anything about trusted computing should 1) stop, 2) breathe, 3) read the documents, 4) think about how humanity reacts (in the US, at least) to perceived threats to privacy and control, 5) then get a grip. The stated in intent of the TCG is to create a trusted platform that is tamper resistant to software attacks like worms, viruses, and trojans, will not interfere with any other operating software, and will be pretty much seamless.
Can the system be abused by those nefarious ner-do-wells trying to lock you into some software? Sure, but that is true for any system. Have a little faith. The purchasing American public won't willingly give up what they perceive is their right to control thier hardware and software. The backlash will keep the worst offending vendors at bay. Voting with your dollars is a very powerful weapon. Use it against any company regardless of the hardware or software they are selling.

Re:Short sighted

[kronin]

"The purchasing American public won't willingly give up what they perceive is their right to control thier hardware and software. The backlash will keep the worst offending vendors at bay."

Keep telling yourself that. That's what they want you to believe. Meanwhile I'm going to sit in my nuclear fallout shelter with my tin-foil hat on.

Re:Short sighted

[jez9999]

OK, but after sudden implementation of DRM by the backdoor, try finding a workable CPU/OS solution that's able to play media without DRM restrictions; for that matter, try finding (legal) media without DRM restrictions.

Re:Fishy? No, deceptive and devious!

[Anonymous Coward]

What's the difference?

Re:Fishy? No, deceptive and devious!

[Jason Earl]

i've never bought into the absurd notion that a company or organization doing things that the other people in the said groups don't know about.

Then you've never worked in an organization with more than 3 people in it. In a real business there are generally all sorts of politics going on. I have lost track of the amount of times I have seen Linux or BSD boxes put into production without approval up the corporate ladder. Heck, I have been involved several times with a project at the division level that was formed to fill the gap of a company wide software program that the division guys could see was doomed to failure. The division guys simply waited for a spectacular failure and then forwarded an skunkworks project that did more or less the same thing (but usually on a much less ambitious scale).

Microsoft is no different. There are thousands of ultra-competitive hackers there all trying to make their mark. In the business sector there are even teams that compete for essentially the same business. My personal guess is that Microsoft is stalling this paper because it knows that Windows is the only implementation of Trusted Computing that people actually care about. If Microsoft can force Apple, Sun, and the rest to wait for a paper before rolling out software then Microsoft will get the jump on them with Vista. That being the case there's almost certainly a wide ranging difference of opinion about Trusted Computing inside Microsoft.

Huh?

[sunwolf]

Did anyone else read that as "Trading Card Game"?

Consistant?

[bogie]

You mean like when Apple decides to rip out functionality in it's product and reduce consumers right with every version of Itunes that comes out?

Coming soon Itunes 8.0. 1 cd burn, no streaming, and no burning of paid music to cd.

If anything Apple is the posterboy of DRM run amok and a preview of the future where companies reduce your right with every "needed" upgrade. But fine, everyone should just keep posting how its great that Apple implements "consumer friendly" DRM.

"recently Trusted"?

[jd0g85]

the recently Trusted Computing Group published best practices document

The group is "recently Trusted"? You mean it wasn't trusted before? Oh, I get it. You meant "the TCG's recently published best practices document."

Sorry, bad grammar confuses me sometimes.

Lawful intercept.

[Anonymous Coward]

"Most of the TCG spec is optional and can be turned off"

Oh please. Don't get fooled. This is just sucker bait, and you're swallowing it.

If it is optional now, it won't be in the future. The way things have always worked is that "lawful intercept" occurs in the next generation of the products.

It's been this way with just about EVERY new technology of interest that has come along. First with the phone system, then with the internet, routers/switches, and they are currently trying to do it with VOIP.

Computers are just the next thing on this list.

I give it in place by 2010, max.

Bruce 100% on target as usual.

[WarmNoodles]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bruce, when you going to run for something I can help vote you in on?

My educated sentiments parallel Mr. Schneier's.

Not much more to say but thanks again Bruce.

Regards sir.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQxY/ET40OzQY/jmJEQJF+gCghwtbQ71nbU1lpC8J5J D6UVm3rjwAni4r
jPinOQbsxGaIKSJlAGKEPTrq
=e9ml
-----END PGP SIGNATURE-----

Am I the only one who thought....

[TechniMyoko]

Microsoft has a card game?

Re:Am I the only one who thought....

[hotdiggitydawg]

No.

Re:Fishy? No, deceptive and devious!

[CurlyG]

I could not agree more - the person you are replying to has no idea what they're talking about. Almost *every* company over a certain size I've ever worked for or dealt with as customer or client has the same problem.

Not only does the left hand rarely know what the right hand is doing, the pinky and thumb are usually working at cross-purposes as well, or at the very least in intense rivalry for the promotion to forefinger.

One-liner

[Anonymous Coward]

Perhaps there are perceived problems with "Design, Implementation, and Usage Principles for TPM-Based Platforms to apply to Vista" being one line long.

Solitare

[Martix]

the only game in town ;)

Re:Fishy? No, deceptive and devious!

[Anonymous Coward]

i've never bought into the absurd notion that a company or organization doing things that the other people in the said groups don't know about.

You should change your user name to SgtSchultz (877105). You know nothing.

When you work with (famous company XXXXX), you sign lots of NDAs. You aren't signing them to keep the secret stuff out of (famous company's well-known competitor YYYYY)'s hands. That comes later, when the product under development is approved for production. You sign them to keep the secret stuff away from rival groups at XXXXX who will knife the baby as soon as they learn it exists.

Large companies are invariably their own worst enemies.

TPC your friendly neigbour

[Jarth]

Well, to me, thanks but no thanks.

Unless i have ABSOLUTE certainty i'll be able to NOT use TPC-technology at choice i will start collecting non-TPC motherboards from this day forth as to build a FREE-technology computer system tomorrow.

I mean ... actually, what security ?
To privatise from whom ?
In wich war ?
A virus ?
A ... company ?
A governement ?
A nation ?
Unknowns ?

And at what cost ? Why not spend all that great money on making great software, better tools ... spending it on sponsorships people coding great software for the world for almost nothing ...

Knowledge is power, Control is power, this is a step too far ... Maybe microsoft started seeing some light ... as one should not cary guns if one is hoping to avoid armed conflict ...

gasp!

Mod parent up, please

[Slashcrap]

Because it's a particularly intelligent and well written comment. Not only does it have punctuation, but it's actually in the right places as well.

This makes it virtually unique in Slashdot history. Hang on, I've just realised that he used the word "affect" correctly. It is unique.

Glad I Run OS X

[mox358]

Articles like this remind me why I switched to Mac a few years ago... I didn't like the business practices of M$ forcing me to install IE with Win98, so I voted with my wallet and completely moved to Mac.

Now I admit to buying songs from iTunes which contain DRM, but they have never stood in the way of me using my music that I paid for. I wonder how many Windows users can say that about Windows Media products?