Folks, we need Palladium and other security enhancements in this internet age. How else do we expect Microsoft to fix situations like this SQL Server bug that is rampaging through the internet???
Before we have any Knee Jerk reactions...
on
Palladium Changes Name
·
· Score: 3, Insightful
Honestly, people... Next-Generation-Secure-Computing-Base is not DRM. This is only a tool that will allow computer users more security over important documents. Just because Pallad...Next-Generation-Computing...can be used to build DRM does not mean that it should be lumped in with it. Save the knee jerk reactions for IBM and TCPA.
Yes, TCPA and Palladium are rival versions of the same thing. They contain differences this is true, but they also contain _many_ similarities... and one of which is enabling DRM. Intel has admitted this. IBM has admitted this.
Jim Ward of IBM (one of the main people involved with the TCPA spec):
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
No, I can see where that would be useful to a small subset of users. The majority do not need this. It is useful to business. It is useful to government. It is useful to anyone who wishes to lock up documents/data and this includes the RIAA and big media. It is also particularly useful to members of the TCPA who are selling this to big media as a DRM solution.
Now you've almost got it;) The answer is not to just 'buy no DRM controlled content'... the answer is refuse to buy any DRM platform. That is also my choice (as long as the industry consortium does not force this into every computer).
I am opposed to DRM because it represents another case of the large corporations trampling all over the rights of citizens. I do not deserve to be treated like a thief and I do not deserve to be presumed a thief because I want to exercise my rights to live in a free world and a free society. I am opposed to DRM because the large corporations are lying and cheating and have no problem with selling this as a 'security' feature that is 'a bad implementation of DRM' only to turn around and backstab customers and sell this as DRM to big media.
I have been to the Brian LaMachia's talk on Pd at MIT. I also know from Brian that TCPA and Palladium are rival implementation of the same sort of thing. TCPA might be a milder version of Pd and it might have some useful purposes, but this does not change the fact that TCPA could (and probably will) be used by IBM to power some sort of DRM system. IBM officials have already said as much:
From an interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
Hey, I know that it is GPL. I also know that it is a reference and *you* know exactly what I am talking about. IBM wants to present DRM solutions and TCPA is a part of this.
From an interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
I have read enough about TCPA and Palladium to know that these are DRM enabling technologies. I also know that members of the TCPA and BSA are very interested in providing DRM. This is obvious and if you'd read around you would see the same thing.
An interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
No, I do not mean 'normal users of windows'. The majority of people who use computers do not need TCPA/Pd/Palladium. I do not see why you would take offense to the fact that the majority run windows. This should be common knowledge. Just because you and I use linux and _might_ have some use for this chip other than DRM does not mean that everyone else will. Do not forget that IBM is interested in DRM and is a member of the Business Software Alliance... a group which has been falling over itself to come up with DRM)
All of those things have been solved with normal computer hardware. Secure e-commerce is all over the place. I find it funny that IBM et al, would trot out 'secure e-commerce' as a justification for DRM. I will grant that TCPA has some legitimate use cases, but not for the vast majority. That is why this should be an add-on card and not installed/enabled on mom and dad's computer.
I can already authenticate with SSL and secure encryption. TCPA will not change this. TCPA will not prevent trojans/virus. Read the FAQ. As for whom do you trust I am far from the only person who has a problem with TCPA/Pd/DRM:
Because it is *my* data and if I want to move it from system to system or do a backup I should be able to and not *trust* that my system will be available. The hardware will not always do what the end user wants because the hardware is controlled by the software (which is controlled by large corporations for the majority of computer users) and because the hardware can fail.
You are right that the chip could be used for these purposes. I have no problem with that. I don't want to see it automatically installed on end users machines because the majority will not be using it for ssh-keygen. The only reason for this on regular machines (not business users or power users) is for DRM. Intel has admitted this is why they are involved with TCPA. IBM is also interested in DRM. TCPA will be a part of this. If power users and business users want TCPA then it should be an add-on card and not ubiquitous. Normal users do not need it.
And you need to wake up and smell the bacon. Microsoft, Sony, IBM are falling over themselves trying to come up with DRM that will please big media. They have banded together at times (the recent agreement to disprove of government mandaged DRM in favor of proprietary $$ solutions) and fought like caged animals at other times (Sony and Microsoft in patent fight over DRM). Microsoft already has DRM features in WMP.
Ok, fair enough. You admit that TCPA can (IMO will) be used for DRM.
What other benefit does TCPA give to the end user. I have not seen one. Sure, I can buy that it will be good for some corporations that want to control employees access and delivery of sensitive documents. Sure, I can buy that TCPA will be sold as a solution for private companies. But, why oh why would joe computer user need this on his computer? The answer is because IBM, TCPA members want to sell this to big media as a first generation DRM. I know that it won't be perfect DRM (this is impossible IMHO) but it surely can be used to severly restrict the rights of the majority of computer users. That is what I and others have a problem with.
No, not at all. Care to answer what you will be using TCPA for? Have you bought into this hype for TCPA as security? How pray tell will normal computer users benefit from TCPA?
The end user will not be able to access his/her data without knowledge of the private key. If the end user does not know his/her private key then he has to trust that his hardware does. The only way for the end user to communicate with the hardware is through the software. Perhaps, this can be defeated by hardware hacks, but the normal end user will not be sophisticated enough to do this.
From Bruce Schneier, " 1. A "trusted" computer does not mean a computer that is trustworthy." and "2. When you think about a secure computer, the first question you should ask is: "Secure for whom?"
http://www.counterpane.com/crypto-gram-0208.html
While the aforementioned is dealing with Pd and not TCPA they are both implementations of 'Trusted Computing' which is a dishonest term. Basically, the major use case for TCPA is DRM. This fact is readily apparent if you ask yourself a simple question: will the end user have access to his/her private key. The answer with TCPA (as with Pd) is a definitive no!
Also see:
MIT: http://www.technologyreview.com/articles/wo_weinbe rger102502.asp?p=0 EFF: http://www.eff.org/Legal/active_legal.html Ross Anderson: http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
I read that white paper and it does not change a thing. The availability of GPL drivers does not change the fact that this is an enabling technology for DRM and not much else.
NO. TCPA is bad because the *primary* use for this technology will be DRM. That is the purpose and reason for the 'Trusted Computing Alliance' and for TCPA. Claims to the contrary are dishonest. While David Safford might use TCPA to 'encrypt senstive data' the major business case for this product is DRM. The average consumer of a PC does not encrypt anything and this is unlikely to change with DRM. The fact that the end user is not allowed to know his/her private keys should clue you in!
Slashdot Mirror
Folks, we need Palladium and other security enhancements in this internet age. How else do we expect Microsoft to fix situations like this SQL Server bug that is rampaging through the internet???
Honestly, people ... Next-Generation-Secure-Computing-Base is not DRM. This is only a tool that will allow computer users more security over important documents. Just because Pallad...Next-Generation-Computing...can be used to build DRM does not mean that it should be lumped in with it. Save the knee jerk reactions for IBM and TCPA.
Yes, TCPA and Palladium are rival versions of the same thing. They contain differences this is true, but they also contain _many_ similarities ... and one of which is enabling DRM. Intel has admitted this. IBM has admitted this.
Jim Ward of IBM (one of the main people involved with the TCPA spec):
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
No, I can see where that would be useful to a small subset of users. The majority do not need this. It is useful to business. It is useful to government. It is useful to anyone who wishes to lock up documents/data and this includes the RIAA and big media. It is also particularly useful to members of the TCPA who are selling this to big media as a DRM solution.
Now you've almost got it ;) The answer is not to just 'buy no DRM controlled content' ... the answer is refuse to buy any DRM platform. That is also my choice (as long as the industry consortium does not force this into every computer).
I am opposed to DRM because it represents another case of the large corporations trampling all over the rights of citizens. I do not deserve to be treated like a thief and I do not deserve to be presumed a thief because I want to exercise my rights to live in a free world and a free society. I am opposed to DRM because the large corporations are lying and cheating and have no problem with selling this as a 'security' feature that is 'a bad implementation of DRM' only to turn around and backstab customers and sell this as DRM to big media.
Have a look at this article and specifically the comments from Jim Ward (one of the main guys working on TCPA)
l sI D=150
http://www.entmag.com/news/article.asp?Editoria
I have been to the Brian LaMachia's talk on Pd at MIT. I also know from Brian that TCPA and Palladium are rival implementation of the same sort of thing. TCPA might be a milder version of Pd and it might have some useful purposes, but this does not change the fact that TCPA could (and probably will) be used by IBM to power some sort of DRM system. IBM officials have already said as much:
From an interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
Hey, I know that it is GPL. I also know that it is a reference and *you* know exactly what I am talking about. IBM wants to present DRM solutions and TCPA is a part of this.
From an interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
I have read enough about TCPA and Palladium to know that these are DRM enabling technologies. I also know that members of the TCPA and BSA are very interested in providing DRM. This is obvious and if you'd read around you would see the same thing.
An interview with Jim Ward of IBM (one of the authors of the TCPA spec)
"The TCPA specifications center on two main areas: trusted reporting and public key infrastructure (PKI). The TCPA reporting guidelines create profiles of a machine's security settings as the machine boots. Ward says content providers such as Bloomberg or Hoover's may take advantage of this feature to ensure users do not redistribute content."
No, I do not mean 'normal users of windows'. The majority of people who use computers do not need TCPA/Pd/Palladium. I do not see why you would take offense to the fact that the majority run windows. This should be common knowledge. Just because you and I use linux and _might_ have some use for this chip other than DRM does not mean that everyone else will. Do not forget that IBM is interested in DRM and is a member of the Business Software Alliance ... a group which has been falling over itself to come up with DRM)
All of those things have been solved with normal computer hardware. Secure e-commerce is all over the place. I find it funny that IBM et al, would trot out 'secure e-commerce' as a justification for DRM. I will grant that TCPA has some legitimate use cases, but not for the vast majority. That is why this should be an add-on card and not installed/enabled on mom and dad's computer.
I can already authenticate with SSL and secure encryption. TCPA will not change this. TCPA will not prevent trojans/virus. Read the FAQ. As for whom do you trust I am far from the only person who has a problem with TCPA/Pd/DRM:
l
http://www.counterpane.com/crypto-gram-0208.htm
http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
Because it is *my* data and if I want to move it from system to system or do a backup I should be able to and not *trust* that my system will be available. The hardware will not always do what the end user wants because the hardware is controlled by the software (which is controlled by large corporations for the majority of computer users) and because the hardware can fail.
You are right that the chip could be used for these purposes. I have no problem with that. I don't want to see it automatically installed on end users machines because the majority will not be using it for ssh-keygen. The only reason for this on regular machines (not business users or power users) is for DRM. Intel has admitted this is why they are involved with TCPA. IBM is also interested in DRM. TCPA will be a part of this. If power users and business users want TCPA then it should be an add-on card and not ubiquitous. Normal users do not need it.
And you need to wake up and smell the bacon. Microsoft, Sony, IBM are falling over themselves trying to come up with DRM that will please big media. They have banded together at times (the recent agreement to disprove of government mandaged DRM in favor of proprietary $$ solutions) and fought like caged animals at other times (Sony and Microsoft in patent fight over DRM). Microsoft already has DRM features in WMP.
And others have explained quite well why TCPA is hand in hand with Palladium/DRM:
1 55 181
http://slashdot.org/comments.pl?sid=51812&cid=5
Ok, fair enough. You admit that TCPA can (IMO will) be used for DRM.
What other benefit does TCPA give to the end user. I have not seen one. Sure, I can buy that it will be good for some corporations that want to control employees access and delivery of sensitive documents. Sure, I can buy that TCPA will be sold as a solution for private companies. But, why oh why would joe computer user need this on his computer? The answer is because IBM, TCPA members want to sell this to big media as a first generation DRM. I know that it won't be perfect DRM (this is impossible IMHO) but it surely can be used to severly restrict the rights of the majority of computer users. That is what I and others have a problem with.
No, not at all. Care to answer what you will be using TCPA for? Have you bought into this hype for TCPA as security? How pray tell will normal computer users benefit from TCPA?
Sure, they are participating in every major trade group involved with DRM. TCPA, Business Software Alliance, ...
/ usa/about/members/
http://www.againsttcpa.com/
http://www.bsa.org
The end user will not be able to access his/her data without knowledge of the private key. If the end user does not know his/her private key then he has to trust that his hardware does. The only way for the end user to communicate with the hardware is through the software. Perhaps, this can be defeated by hardware hacks, but the normal end user will not be sophisticated enough to do this.
Sure, no problem:
l
e rger102502.asp?p=0
From Bruce Schneier, " 1. A "trusted" computer does not mean a computer that is trustworthy." and "2. When you think about a secure computer, the first question you should ask is: "Secure for whom?"
http://www.counterpane.com/crypto-gram-0208.htm
While the aforementioned is dealing with Pd and not TCPA they are both implementations of 'Trusted Computing' which is a dishonest term. Basically, the major use case for TCPA is DRM. This fact is readily apparent if you ask yourself a simple question: will the end user have access to his/her private key. The answer with TCPA (as with Pd) is a definitive no!
Also see:
MIT: http://www.technologyreview.com/articles/wo_weinb
EFF: http://www.eff.org/Legal/active_legal.html
Ross Anderson: http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
I read that white paper and it does not change a thing. The availability of GPL drivers does not change the fact that this is an enabling technology for DRM and not much else.
NO. TCPA is bad because the *primary* use for this technology will be DRM. That is the purpose and reason for the 'Trusted Computing Alliance' and for TCPA. Claims to the contrary are dishonest. While David Safford might use TCPA to 'encrypt senstive data' the major business case for this product is DRM. The average consumer of a PC does not encrypt anything and this is unlikely to change with DRM. The fact that the end user is not allowed to know his/her private keys should clue you in!
Exactly. Without access to the actual key pair then the end user does not have control over his own computer. This facilitates DRM and not much else.