You of course can make modifications to your machine. The chip doesn't disable modification. It's OFF BY DEFAULT, for crying out loud.
Should you choose to enable it, you can convince others that you have an unmodified machine if and only if you actually have an unmodified machine. That's all.
Whether or not a modified machine will be useful is a different question, and totally dependent on what you consider useful. I believe almost nobody except entertainment providers will require remote attestation. Thus, a modified machine will be useless if you want to talk to them, and useful otherwise. But other people have more scary visions, and what do I know?
that can be compiled into binary You're making things up, don't you? It is written where exactly?
The "signed" source, if modified, does not make a usable binary Of course it does. You can sign it, run it, sell it, bake it, drink it, do whatever you want with it. What you can't do is convincingly misrepresent it to be something else than it is. Guess what, no one ever promised you such an ability, now or in the future.
There's no guarantee anywhere that you shall be actually able to use what you get in any way whatsoever. It's even printed IN BIG CAPITAL LETTERS THAT THERE IS NO SUCH GUARANTEE. All you have is some source code, and a promise of the copyright holder not to sue you if you abide by his terms. Got it?
Remote attestation means that I can reliably know what software you run. NOT that you can convince me that YOU know what software you run. The latter is nearly useless (you might be intentionally running malicious software, but I have no way of knowing it) and can be achieved without any special hardware anyway.
The chip is designed to enable remote attestation.
on
TCPA Support in Linux
·
· Score: 1
If you can extract the keys, there's no remote attestation anymore and no reason for the chip to exist.
OK, so every new PC mobo in existence will have a TPM. Do you know that there are lots more things connected to the Internet? Like, um, your DSL router and your IP-enabled webcam? In the future there will be only more. It is impossible to require that all this is replaced, even by residential users, and it is impossible to certify all software that these things run.
What's more, there are tens of millions of old computers everywhere around the world that their owners can't afford to replace. You in the US may have enough disposable income, but that's not necessarily true elsewhere.
Your pres's advisor is full of shit. You can Secure The National Information Infrastucture against viruses and against Terrorist Attack, but that will require sealing your virtual borders. Suddenly, e.g. US universities will not be able to talk to their counterparts in India and Russia and Brasil. Like it's going to happen.
Fortunately it's not really feasible. Cisco is unable to attest every DSL router/modem, every toaster, every webcam, every fridge, every... you get the idea. And when they don't, and most of these little appliances stop working, there will be an outcry.
ISPs don't necessarily want to buy more stuff. Besides, as I said elsewhere, this will cut the USA off much of the rest of the world. The world is not eager to be pwned by Cisco, even if the U.S. of A. is.
It will only connect to other applications approved by the same people who signed your own app.
That's OK, I only want to connect to BitTorrent clients signed by Red Hat and Gentoo, and maybe a couple of others. No problem with that.
no representative of the RIAA will install it
Why the fuck would I care? If a representative of the RIAA would install a client that purports to be a genuine BT client but in fact logs trafic and spoofs content, then I would be concerned. Thankfully, with a TCG platform I can ignore such destructive clients.
Why exactly would a "bad-guy" knowingly and willingly execute software that does your will?
If he wants me to connect to his computer, that's his only choice. I he doesn't, he may run what he damn pleases.
Things that are endorsed by the USA government are not necessarily things that are viewed in a positive light elsewhere. This will probably cut off USA from the rest of the world, because the rest of the world doesn't necessarily want foreign corporations to effectively own their networks.
The CRTM may measure itself to PCR[0] and must measure to PCR[0] any portion of the POST BIOS, including Manufacturer Controlled Embedded Option ROMs, firmware, etc. that are provided as part of the Motherboard.
They can do something like that now if they want, sort of. It's not like they can't implement a closed proprietary protocol and force everyone to use it. You of course can hack their implementation, but how many people would do that?
It's not exactly the same, but you get the idea.
Besides, I have no idea why any ISP would want to do that. What does it brings them, except the need to replace lots of hardware and software?
Without hacking hardware at any rate. The TPM verifies BIOS before it starts booting and only enables itself if the BIOS is OK. It won't enable itself *after* the boot sequence, only before. You need to whip up your soldering iron to convince the TPM to do what you want, and even then it's not easy.
Probably an easier way is to have a hacked memory module that lets you change the contents with some kind of hardware interface.
If the memory and all buses in the computer are encrypted, then you're out of luck, but this is not currently in the spec.
You still can modify the source, redistribute the changes etc. You cannot make executables with certain properties, but GPL doesn't guarantee that anyway.
Think windows file sharing refusing to work with a Samba client, even if they open the protocol, because the samba client was not signed by Microsoft. Or worse, IIS only allowing IE to connect to it. Or most likely, a streaming media server only allowing windows media player.
Or a CounterStrike server only working with genuine CounterStrike clients (no cheats). Or an anonymous remailer/onion router only working with identical copies of itself (no logs saved anywhere in the chain). Or a BitTorrent... well, you get the idea.
In this scheme there's no single central authority. Everybody decides for himself what software/hardware he trusts. It's pretty hard to enact a law that makes it illegal to trust e.g. anyone but Microsoft. Such move would meet some opposition, especially in countries other than USA.
OK then. You can see from the chemical formula that Zyklon-B CAN kill people. TCPA simply can't be used for the nefarious purposes people ascribe to it. I don't see the potential in the spec at any rate. Maybe I'm blind, who knows? You can read the damn spec and judge for yourself. It's free and open.
By the way, I'm a Jew and I find your comment offensive. Don't ask me why, I barely could bring myself to answering this one, OK?
Making a source-based distro work in this setting. I think it's possible.
You start with a signed binary compiler. If the source is signed, the compiler then signs the binary. This includes the compiler's source, so you have a kind of chain of trust. Unfortunately you can't modify pretty much anything (compiler, kernel, drivers...) without breaking the chain, but at least you can adjust your precious USE flags and say -O418 -funroll-all-bloody-loops-right-now to your heart's content.
Slashdot Mirror
You of course can make modifications to your machine. The chip doesn't disable modification. It's OFF BY DEFAULT, for crying out loud.
Should you choose to enable it, you can convince others that you have an unmodified machine if and only if you actually have an unmodified machine. That's all.
Whether or not a modified machine will be useful is a different question, and totally dependent on what you consider useful. I believe almost nobody except entertainment providers will require remote attestation. Thus, a modified machine will be useless if you want to talk to them, and useful otherwise. But other people have more scary visions, and what do I know?
However I believe thay are totally impossible, for variety of reasons.
that can be compiled into binary
You're making things up, don't you? It is written where exactly?
The "signed" source, if modified, does not make a usable binary
Of course it does. You can sign it, run it, sell it, bake it, drink it, do whatever you want with it. What you can't do is convincingly misrepresent it to be something else than it is. Guess what, no one ever promised you such an ability, now or in the future.
It will most certainly be plugged in the next revision, but it's nice to know anyway.
There's no guarantee anywhere that you shall be actually able to use what you get in any way whatsoever. It's even printed IN BIG CAPITAL LETTERS THAT THERE IS NO SUCH GUARANTEE. All you have is some source code, and a promise of the copyright holder not to sue you if you abide by his terms. Got it?
Remote attestation means that I can reliably know what software you run. NOT that you can convince me that YOU know what software you run. The latter is nearly useless (you might be intentionally running malicious software, but I have no way of knowing it) and can be achieved without any special hardware anyway.
If you can extract the keys, there's no remote attestation anymore and no reason for the chip to exist.
OK, so every new PC mobo in existence will have a TPM. Do you know that there are lots more things connected to the Internet? Like, um, your DSL router and your IP-enabled webcam? In the future there will be only more. It is impossible to require that all this is replaced, even by residential users, and it is impossible to certify all software that these things run.
What's more, there are tens of millions of old computers everywhere around the world that their owners can't afford to replace. You in the US may have enough disposable income, but that's not necessarily true elsewhere.
Your pres's advisor is full of shit. You can Secure The National Information Infrastucture against viruses and against Terrorist Attack, but that will require sealing your virtual borders. Suddenly, e.g. US universities will not be able to talk to their counterparts in India and Russia and Brasil. Like it's going to happen.
Fortunately it's not really feasible. Cisco is unable to attest every DSL router/modem, every toaster, every webcam, every fridge, every... you get the idea. And when they don't, and most of these little appliances stop working, there will be an outcry.
ISPs don't necessarily want to buy more stuff. Besides, as I said elsewhere, this will cut the USA off much of the rest of the world. The world is not eager to be pwned by Cisco, even if the U.S. of A. is.
That's OK, I only want to connect to BitTorrent clients signed by Red Hat and Gentoo, and maybe a couple of others. No problem with that.
no representative of the RIAA will install it Why the fuck would I care? If a representative of the RIAA would install a client that purports to be a genuine BT client but in fact logs trafic and spoofs content, then I would be concerned. Thankfully, with a TCG platform I can ignore such destructive clients.
Why exactly would a "bad-guy" knowingly and willingly execute software that does your will?
If he wants me to connect to his computer, that's his only choice. I he doesn't, he may run what he damn pleases.
Things that are endorsed by the USA government are not necessarily things that are viewed in a positive light elsewhere. This will probably cut off USA from the rest of the world, because the rest of the world doesn't necessarily want foreign corporations to effectively own their networks.
No one prmised you an ability though.
It's not exactly the same, but you get the idea.
Besides, I have no idea why any ISP would want to do that. What does it brings them, except the need to replace lots of hardware and software?
Along with a host of other things. I'm talking about the "kill everything but Microsoft" kind of things.
Probably an easier way is to have a hacked memory module that lets you change the contents with some kind of hardware interface.
If the memory and all buses in the computer are encrypted, then you're out of luck, but this is not currently in the spec.
You still can modify the source, redistribute the changes etc. You cannot make executables with certain properties, but GPL doesn't guarantee that anyway.
Where did you get this idea about Longhorn? Just curious. I tried to google and found nothing.
Think windows file sharing refusing to work with a Samba client, even if they open the protocol, because the samba client was not signed by Microsoft. Or worse, IIS only allowing IE to connect to it. Or most likely, a streaming media server only allowing windows media player. Or a CounterStrike server only working with genuine CounterStrike clients (no cheats). Or an anonymous remailer/onion router only working with identical copies of itself (no logs saved anywhere in the chain). Or a BitTorrent... well, you get the idea.
In this scheme there's no single central authority. Everybody decides for himself what software/hardware he trusts. It's pretty hard to enact a law that makes it illegal to trust e.g. anyone but Microsoft. Such move would meet some opposition, especially in countries other than USA.
I was ready to start writing pretty much the same thing, now I don't have to (and I hate composing essays more than three sentences long.)
By the way, I'm a Jew and I find your comment offensive. Don't ask me why, I barely could bring myself to answering this one, OK?
And they're not pretty.
You start with a signed binary compiler. If the source is signed, the compiler then signs the binary. This includes the compiler's source, so you have a kind of chain of trust. Unfortunately you can't modify pretty much anything (compiler, kernel, drivers...) without breaking the chain, but at least you can adjust your precious USE flags and say -O418 -funroll-all-bloody-loops-right-now to your heart's content.