The Dangers of Microsoft Pluton | Hacker News Reader

The Dangers of Microsoft Pluton

gabrielsieben.tech

733 pointsgjsman-1000533 comments

This is not a good article. At a technical level it's confused about a whole bunch of things:

* SMM has been part of x86 for decades. The Secured Core requirements around SMM actually reduce its power.

* The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not)

* Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore.

* System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good)

* Existing TPM-based remote attestation already includes the secure boot state

The short version: everything that the article is worried about being enabled by Pluton is already possible, and has been for years.

But there's a meaningful point here. Remote attestation can certainly be used to restrict access to resources in ways that are incompatible with general purpose computing, or which reduce user choice. Remote attestation can also be used to give end users confidence that their machine is in a good state without constraining what they do with it. As a technology, remote attestation can be used in both good and bad ways. We do need to keep track of whether anyone is threatening to use it in bad ways and react appropriately.

(But tbh remote attestation as an attack on general purpose computing isn't the really scary thing about widespread remote attestation. Remote attestation ties back to the TPM's endorsement key, an immutable cryptographic key certified by the TPM vendor at manufacturing time. The straightforward implementation of allowing arbitrary remote sites to trigger remote attestation would tie all of these accesses back to a single piece of hardware, and would be a privacy nightmare.)

Arguing about the technicalities DOES NOT MATTER one bit about what the final outcome will be, and in fact appears to be a carefully calculated means of distraction.

everything that the article is worried about being enabled by Pluton is already possible, and has been for years.

There's a HUGE difference between "possible" and "very easy to deploy". https://news.ycombinator.com/item?id=29859106

There's literally zero difference in how easy it is to deploy using Pluton and using existing TPMs.

This is partly true but its not quite. Think a little long-term here. Windows 10 ends support in just three years, in 2025. Windows 11 requires TPM 2.0, which was a big headache when Windows 11 was announced.

That means in three years, every supported PC will have TPM 2.0. Within ~1 year, assuming that Intel and AMD fulfill what they've implied in the launch announcement, every new PC will also come with Pluton.

That's a lot easier to deploy to compared to having some PCs with TPM, others without, some out-of-date on TPM 1.1, some with unpatched firmware (like the 2017 Infineon bug), so forth.

Now... some say, what about non-Windows systems, like macOS and Chrome? Think bigger for a second - Cisco (as an example) is in the Trusted Computing Group that designed a lot of this stuff, and Cisco Meraki is deployed in so many businesses for Wi-Fi security its incredible. All Cisco Meraki has to do (for example, maybe its not Cisco) is make a connection app that uses Pluton/TPM on Windows, Secure Enclave/T2 on macOS/iOS with Apple DeviceCheck, and SafetyNet on ChromeOS/Android. And you are all done - you've successfully made sure every new system is almost certainly untampered with. You've locked the door. For any system that can't be verified, no problems sending them to the IT Help Desk to be manually registered with a private key and sign a disclaimer.

It wasn't possible before, but five years from now, it will be much easier. Every Windows PC will be on the same page, and all major systems will have consistent assertion frameworks. Now, is Pluton wholly responsible? No. Windows 11 plays a role. Pluton just makes it broader and stronger, and Pluton also provides a long-term strengthening as eventually the TPM 2.0-only level will be able to be cut off for just Pluton.

You are incorrect yourself in several ways here.

> The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not)

Pluton is de-facto a Secured Core PC implementation, and Secure Core PCs are also making this change. Thus it effects both Pluton and Secured Core, but the new requirement does not effect non-Pluton and non-Secure-Core systems. Because Secured-Core PCs are currently niche and will no longer exist once Pluton is broadly adopted, Pluton will be the first appearance of this change for the vast majority of users.

If I'm selling a 12th Gen Intel system right now, I can keep the 3rd-party UEFI certificate enabled. If I am selling a 12th Gen Secure Core PC, then this year I must disable that certificate, but my non-Secured-Core PCs can again keep it open. When Pluton arrives, that door must be shut.

You can verify this with Microsoft's Secured Core PC documentation:

https://docs.microsoft.com/en-us/windows-hardware/design/dev...

> Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore.

To an extent. The original TPM is very finicky as documented by the comments on this post and elsewhere - even changing a RAM stick could invalidate the TPM's assertion. For this reason, the TPM was very unideal for DRM due to it's all-or-nothing approach, which Microsoft Pluton does not make the mistake of repeating, allowing for much more granular security that makes it much more easily applied. The second reason why Pluton is much more dangerous is that the TPM could be easily virtualized or hacked over the bus rendering DRM use-cases quite broken, whereas Pluton supports neither weakness, making its DRM potential (again) much more potent. Finally, using DICE, unlike a TPM, the Pluton is explicitly designed to give a computer a permanent identity that can never be erased, which (again) TPM does not guarantee.

Useful HN comment explaining: https://news.ycombinator.com/item?id=25193346

That's actually the big reason why the Remote Assertion is an important point here. The TPM version of it was almost unusable outside of very niche business applications and BitLocker, while with DICE, the Pluton is far more potent. (After all, if TPM worked fine on it's own, why does DICE even exist?)

I think the last point to further back this view I will also add is these comments from a Microsoft employee on the subject.

https://lobste.rs/s/fdguww/dangers_microsoft_pluton#c_tdlo1r

> System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good)

Microsoft themselves states in Pluton's announcement that Pluton will hardware-integrate with Windows Update for various system firmware, through their "chip-to-cloud" security initiative. To quote them:

"One of the other major security problems solved by Pluton is keeping the system firmware up to date across the entire PC ecosystem. Today customers receive updates to their security firmware from a variety of different sources than can be difficult to manage, resulting in widespread patching issues. Pluton provides a flexible, updateable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. Pluton for Windows computers will be integrated with the Windows Update process in the same way that the Azure Sphere Security Service connects to IoT devices."

This is a little frustratingly vague and thus part of the reason why Pluton requires some speculation. Judging by the reference to "different sources that are difficult to manage", it appears you don't update Pluton, Pluton updates you. Pluton has an active role in your system's security, whereas TPM was only passive.

> Pluton is de-facto a Secured Core PC implementation

No, it's not. You can deploy Pluton without having to implement the Secured Core PC spec.

> Microsoft Pluton does not make the mistake of repeating,

No, seriously, the only remote attestation supported by Pluton on x86 at present is literally this TPM-based remote attestation. There's no meaningful fragility here - remote attestation means you can look at the individual log events rather than just looking at the composite PCR values, and that lets you ignore the noise created by things like hardware configuration changes. I have helped build and deploy infrastructure that makes use of remote attestation to validate secure boot state.

> the TPM could be easily virtualized

No, because the EK certificate won't chain back to a trusted CA>

> hacked over the bus

True in some cases, but already mitigated on all systems that are using fTPMs (ie, most Windows 11 systems).

> the Pluton is explicitly designed to give a computer a permanent identity that can never be erased, which (again) TPM does not guarantee.

TPM does, in fact, guarantee that. The endorsement key is static over the lifetime of the TPM.

> why does DICE even exist

DICE provides a set of features that don't require the functionality of a full TPM. This allows you to implement things like device identity attestation in a standardised way that works for both hardware with a full TPM and also IoT devices where a TPM would be too expensive.

> Today customers receive updates to their security firmware from a variety of different sources

Look at the diagram immediately above that quote. They're talking about the firmware that runs on Pluton, not the firmware executed by the main CPU.

Again, you're raising a legitimate issue (remote attestation can be used for bad things), but you're burying it under a bunch of misconceptions and just flat out inaccuracies. I agree that we should be worried about widespread use of remote attestation, both from a "War on general purpose computing" perspective and a privacy perspective. But literally everything you're legitimately worried about happening could happen right now. Framing this as something that's tied to Pluton risks giving people the impression that they can avoid it by just not buying anything with Pluton, and that's simply untrue.

> No, it's not. You can deploy Pluton without having to implement the Secured Core PC spec.

I may update the article to reflect this, I will look into that further. So far the few Pluton systems available all seem to also implement Secured Core, however, as more systems become available perhaps that will change...? I am OK with being wrong here and openly admit that there may be inaccuracies and speculation due to the limited public information and limited number of systems and configurations with Pluton so far.

I'm not quite at the point of agreement yet, mainly because your argument leaves Pluton's addition and functionality almost redundant and inexplicable. From your perspective, almost everything the Pluton is capable of is also possible with a TPM. However, this does not make sense to me, as why implement the Pluton if an fTPM is fully capable of everything the Pluton can do? Why can't an fTPM just be updated with CPU microcode which Windows Update already can handle? What is the point of SHACK then if TPM is fully capable of handling keys already? Why would Microsoft make a grand announcement about how this allows for "chip-to-cloud" security with Project Cerberus and all that, if nothing actually changes almost at all?

Also, can you explain how this checks out with Microsoft RIoT?

TPMs were often separate chips so you could just eavesdrop on a few pins and with that you could pretend that you are running an OS you are not.

I'm completely missing how his example of a Word document that can only be opened by approved users on approved hardware within the corporation is supposed to be a bad thing.

Honestly, that sounds pretty fantastic. I've been using 3rd party tools/extensions to do this sort of thing in corporate and government environments for years, but having the attestation go all the way down to the hardware level is a big value-add, especially with so much ransomware/spyware/extortion/espionage going on these days.

Can someone please explain to me how the author might see this level of security as a bad thing?

The capacity for abuse is huge, way beyong the potential benefits.

From the USA, we get news of banned book in some states. When I read that, my head goes back to my european history, and I reach the Godwin point very quickly.

Those kind of people will abuse such system to prevent things to be shared.

It will be used for putting DRM on everything and create a more and more closed web.

It will be used by corporations and govs to prevent wisthleblowers and journalists to do their job. Or to prevent employees to get evidences of mistreatments in case they need to sue.

Because if you look at it, it's basically just a system for information control. And bad actors love that.

And of course it will be "for security reasons".

Trusting people with a terrible track record to not abuse a massive power in the future, espacially one that can be scaled up with the push of a button once the infrastructure is in place, is not a good bet.

> From the USA, we get news of banned book in some states. When I read that, my head goes back to my european history, and I reach the Godwin point very quickly.

Books are not banned, just not used in the classroom anymore. While the reasons for it may be wrong, it's something that happens constantly all over the world. No one prevents children or adults to read those books at home. Banning books could mean that owning them is illegal and that just hasn't happened.

Banning their use in classrooms is lesser but still a step on that path, and the same Republicans trying to do that are not going to stop at schools after they win but will rather see that as an invigorating first step in a long campaign. For example, book sellers in Virginia are currently fighting a lawsuit against an attempt which would ban private sales:

https://www.virginiamercury.com/2022/07/06/free-speech-group...

> Banning books could mean that owning them is illegal and that just hasn't happened.

Just within the last century it was illegal to send a copy of Ulyesses or The Canturbury Tales through US mail.

Books are just information. Information gets banned all the time. Old-timers will remember this:

https://en.wikipedia.org/wiki/Free_Speech_Flag

If you want to use the OS to ban a book or program or whatever, you don't need fancy hardware features, just a database of hashes pushed down via a software update. Apple wanted to do a version of this for CSAM images, it only didn't happen because they chose to tell users about it and got massive backlash. The implication that governments need more powerful DRM features to do something similar just obscures the fact that they could do it tomorrow if the US government gave up their free speech stances.

But at least you could load your own OS.

Chip manufacturers could even decide that nothing good happens on open source operating systems, so you're now only allowed to run Mac or Windows operating systems.

The point is really that they're taking full ownership of the chips from you.

The EU just mandated chats to be scanned for content. Of course just for CSAM just as the meta data collection is only used for terrorism. Problem is that the latter is also used for parking tickets. They really try to hit the definition of a totalitarian state by the letter.

I think it may have also been problematic legally for Apple. The US laws for CSAM are very strict and Apple wanted to do some sort of confirmation that the images are indeed CSAM which would have meant moving the images from the device to Apple servers.

Ron DeSantis doesn't need hardware-level DRM to ban math books.

https://www.baynews9.com/fl/tampa/news/2022/05/06/florida-ba...

If you're worried about book bannings in states like Florida, DeSantis is up for reelection in just over 3 months. Go volunteer or donate money to his opponent (probably Charlie Crist).

Did they actually ban the books, or did they merely ban their usage in K-12 instruction with the news outlet rounding that up to a book ban for dramaturgical reasons? Not that a ban in school instruction is necessarily good (though, I would guess, not nearly as rare), but the actual full-fledged ban that DRM could aid in enforcing, which would prevent you as an individual from reading a book you want to read in _any_ plausible context, is on a different level.

Deciding which textbooks that are going to be used in public schools isn't banning books. If you don't want the government to decide which books are used to teach your children then homeschooling or private schooling are what you should be focused on.

Technologists often have such tunnel vision that limits their concerns to tyranny driven by technology when there's plenty of low tech attacks on open society all the time.

It reminds me of the good old "my password takes 2 billion years to crack, but my kneecaps only take a few seconds" metaphor about people in tech forgetting that physical coercion is, in fact, a possible attack vector for your IT security.

> Ron DeSantis doesn't need hardware-level DRM to ban math books.

Enforcement is a different issue.

And we don't need guns to do a genocide. We managed to kill a good chunk of the american natives with mostly blades.

Yet, you probably don't want to give willingly a nuke to a dictator.

In the same way, giving this kind of power to people that have shown in the past to abuse information control is like banking on the wolf to behave in the hen this time.

> Go volunteer or donate money to his opponent (probably Charlie Crist).

I'm not in the US. I just read those crazy news, compare it to my grandfather stories, and worry.

Have you read the books being banned?

Mein Kampf is a banned book which I don't think many would disagree with. There are many other such books filled with propaganda that are rightly banned. I don't see why other propaganda-filled books that are being pushed on unsuspecting children shouldn't be banned too, unless the only reason is that you dislike the direction of the propaganda.

In the UK movie screening used to be and probably still is decided at the smallest municipal level of town councils, see The Life of Brian.

District councils (so the second 'lowest' of the possible tiers) but yes. In practice, they've all deferred to the judgement of the British Board of Film Classification (née ...Film Censorship) for nearly every film since it was set up.

The same things that make it good in a corporate environment can make it abusive in a personal machine.

By forcing the kernel to be untamperable, Microsoft can arbitrarily enforce ANY policy they choose on your PC. They could spy on every single piece of network communication. They could ban any given software from being able to run on Windows - maybe Chrome, maybe Steam, any competitor at all. They actually could easily enforce laws on banned content too - any given website, book, audio or video could be impossible to consume, and an attempt to try could be reported to Microsoft. They could stream the contents of your display and mic and camera at any time to anyone they choose. There is literally nothing they cannot do with complete control over the kernel. And since the kernel and Windows itself is closed source, there are ways to hide all of it so you would never even know.

Security is great but it also goes hand-in-hand with control and surveillance. Every capability to increase security also increases the amount of control those providing the security have.

> They actually could easily enforce laws on banned content too

Exactly this. As soon as governments (or lobbyists) discover that this level of control is available to them, they will introduce whatever remaining laws they need, banning E2E encrypted chat apps, or Tor, or bittorrent clients.

I suspect that, like civil asset forfeiture, or running commands on botnet-infected devices[0], these actions will have only the thinnest veneer of "due process" applied to them. After all, if your computer is running "illegal" software, why should the government wait for your permission before deleting that software, or even tell you that it had done it after the fact?

[0] https://uk.pcmag.com/security/139675/us-disrupts-cyclops-bli...

Microsoft doesn't need an "untamperable" kernel to force spying on users. Windows 10/11 has horrible invasive telemetry that can't be disabled, but no one has figured out how to modify the OS and strip it out, all the "solutions" involve temporarily disabling services or blocking network traffic. Is there actually some new capability here that points to future surveillance and censorship, or are you just fitting everything Microsoft does into a narrative where these things are just around the corner and waiting for the right technology? In my opinion the technology has been there for many years, it's just waiting for the US to go insane enough to implement massive censorship.

But you can install your own OS. You can't disable this tool via another OS.

Particularly now that heterogeneous computing is making it big, video decoding can easily just be made not to work unless this tech stack okays it--regardless of the OS.

This chip could all out disable other operating systems if they don't provide the spyware telemetry that Microsoft requires.

If I'm not mistaken, "no one has figured out" is factually incorrect. https://ameliorated.info/ blocks nearly all OS network requests (and hopefully all OS telemetry) by physically removing the relevant files from the system (though this breaks UWP apps, .appx, and such), and disables Windows Update to prevent telemetry components from being reinstalled. I use it on a near-daily basis, and it works quite well in most cases, although having a separate admin account by default, not being able to create new accounts (they show black screens), and missing features (Action Center and notifications) do sting, and I'm worried about the lack of security updates. If you do choose to use it, https://git.ameliorated.info/Joe/amecs is important for configuring the system.

> They could ban any given software from being able to run on Windows - maybe Chrome, maybe Steam, any competitor at all.

IIRC, this was the reason Valve created SteamOS: they feared Microsoft would use their control over Windows so that the only viable software store on PCs would be Microsoft's own store.

Like the App Store.

Hopefully we get the digital markets act over here for similar protections

What you can install on YOUR pc will be at the sole mercy of microsoft/or maybe someone else.... That's the cusp of it. Not that it can be used for good, but that it sets the way for heavy misuse by large corporations.

Wait a few years. Smaller companies won't even be allowed to order high end cpu's. You'll be at 100% mercy of these corporations.

If after 2 years they decide to brick your pc, they'll just do it. You think government will help you out here? Lol...

Secure chips like this are already in all devices but PCs. And in none of these areas has any of that happened. Quite the opposite, Apple got a fine when they slowed down older devices to save battery (at least what they said).

So the government will clearly help out here. And none of these companies has an incentives to stop sales to smaller companies, they make a lot of money with those.

> Secure chips like this are already in all devices but PCs. And in none of these areas has any of that happened.

Ah, that must be why we all have root access and can freely modify or install anything we want on every device we own! Oh, wait, we don't have those things and our non-PC systems are increasingly locked down and routinely do things against the wishes of the people who own them.

Try to install a BitTorrent client on your iphone, or a game emulator, a sexually explicit game or even a browser with a different engine.

All this has already happened since 2008 when the app store came out.

> Quite the opposite, Apple got a fine when they slowed down older devices to save battery

But the devices were actually slowed down, so the danger is real.

> So the government will clearly help out here.

The government is probably part of the driving factor in building this system.

The government probably doesn't want Wikileaks type material to be rendered. There are _so_ many ways the government likely wants to abuse this.

still waiting on the secure boot lockdown everyone has insisted is coming for the better part of two decades...

This smacks of fear mongering. The scenario you've outlined is just absurd. Many manufactures have pledged to turn this off by default and be an opt-in model. I'm not disagreeing that laptops given out by corporations for to you to use for work won't be heavily locked down and could be bricked remotely. But most laptops today already come this way from IT.

So if I'm understanding this correctly, you'd prefer to live in the world where the Collateral Murder Wikileaks video of journalists being murdered in cold blood was never released because it was hardware locked to the original military system it was found on? Or maybe some large viral video which triggers a social uprising simply won't play. You are seriously so focused on pointless corporate secrets that you would actually consider giving the people in charge of the control over your information stream the ability to decide that something just shouldn't be shown? Because what? It might make discovery for a lawsuit more difficult? It'll make it easier to hide malfeasance? This seems particularly useful if you are trying to pretend that May 35th never happened, for instance. Terrifying, and rather icky.

The way I see it: Whatever happens, the system will get abused, and so, I weigh the potential abuses along with the potential benefits. With remote attestation, you put a lot of control in the hands whoever controls the "remote", making the situation very asymmetrical, and so, ripe for centralized abuse. For example, with centralized trust systems, a leak of the signing keys are devastating for the system. For an example, see the DVD key leak:

https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...

Because that doesn't work. 2h before someone complains to IT that he cannot write/read/delete said Word document. Then management says X indeed needs access. Now you have created a maintenance nightmare sourced in rather weird security requirements.

Could as well gouge out the eyes of everyone not having a read permission on said document. There are 1001 solution to solve such problems. And as a gigantic bonus it doesn't have to be bound to hardware! User permission management is much easier.

Sure it's fantastic in a corporate environment. Not so fantastic for personal devices. Basically this: https://youtu.be/XgFbqSYdNK4

Well, don't put that on a personal device.

It's like your company giving you serious protecting gear to wear while doing your work on a nuclear reactor is a good thing. But having to wear such gear at home is not a popular choice, and should not be required.

How do you choose what you put in your CPU? What when Windows forces you to have that kind of hardware?

You can choose not to wear that gear, but choosing to not use Windows is much more complicated, at least for most people.

I can see a situation where "the authorities" decide that, say, the list of people who flew on Epstein's "Lolita express" is "evidence in a pending trial" or "confidential" in the name of "national security," and simply flip a switch to prevent our computers from being able to access any file with particular hashes that they've identified as containing the information.

Also, thank God for the Internet Archive.

Likewise. I see only potential for enormous hassle reduction if my employer (a bank, currently) can treat its entire compute infrastructure as a honking big cryptographically assured parallel universe.

It doesn't protect from malicious document leakage: you can still take screenshots or photographs or use a plain txt file. For unintentional leakage, MSIP already does what you are saying this just bakes into hardware where patching/fixes are harder than the cloud

The difference between ransomware/spyware/extortion/espionage and whistleblowing/free sharing of information is just one of perspective.

Remember when Snowden and Manning leaked huge troves of secret information about the crimes of the State? Remember when a bunch of journos got their hands on the so-called "Panama papers"?

Basically, this will make transparency even harder than it already is. That's a terrible danger for democracy at large. Stalin's wet dream.

Yep that’s why we should ban passwords.

It's a big value add for you, as a corporate IT deployer.

Outside of corporate IT, what if Microsoft uses this remote attestation to enforce binding non-corporate PCs to a Microsoft account. Some don't have a problem exposing everything to Microsoft's cloud, but Pluto sounds like it could be used to enforce this on a hardware level.

If computing devices without bondage to a cloud service are impossible, Windows has no more value proposition for me for personal computing. I'm going to stick with Apple, because at least Apple allows me to turn it all off, off seems to mean off on at least Apple iPhones/iPads (I don't have to check hundreds of weirdly named services, policy settings, scheduled tasks that are all on for some reason), and settings don't seem to randomly sneak on between updates.

Author has a bias against Microsoft. So do hacker news readers.

News of Pluton and its security goals have been readily available since 2020 from reputable hardware sites like Anandtech, or directly from Microsoft themselves. There's nothing new or hidden or surprising about it unless you live to dream up Microsoft conspiracy theories.

Many other hardware manufacturers have similar security offerings including Intel and Apple. Microsoft is arguably late to the game here, given their only recent interest in PC hardware. OS integration isn't even new. Macs have been shipping with T1 and T2 chips for over five years. Has the sky fallen on that ecosystem?

And that's why Microsoft needs to include such a chip. If we move to a world where security is enforced more and more by hardware, you'll need a device that can participate.

A lot of this rant reminds me of the justification for crypto. The techno-anarchists are terrified of authority they can’t hack around. The fact that some governments abuse their power implies no authority should ever have any power. If we can’t break the rules then the world will end. It’s a slippery slope from content providers getting paid to complete big brother 1984.

What tools are you using today to realize this scenario? Thanks!

The plugin my current employer uses is so well integrated that I don't even know its name. (I suspect it may be developed internally)

At a past job, we used Entrust [0] and I'm aware of Virtru [1] as well.

Edit: I forgot about Sharepoint, which also sort-of fills the ACL document-sharing niche. (though I'm less certain about whether it uses encryption to enforce its access policies)

[0] https://www.entrust.com/ [1] https://www.virtru.com/

Yeah I totally would like all "doomsday scenarios" in my company, non ironically.

what's stopping someone from taking photos of your precious document and posting them on 4chan?

nothing. there's nothing you can do to stop that.

I can discretely copy GBs of email messages and word docs in a reasonable amount of time, but I couldn't discretely take cell phone pictures of every page of every one of those messages and documents if I had years to do it. You don't always have to prevent something 100% of the time in every possible situation to have a devastating effect on people who want to do that thing.

I've just provided the easiest example of bypassing any boomer security nonmeasures. give a dedicated and competent attacker 15 minutes alone with your highly secure machine and highly sensitive documents, and if your entire security model depends on DRM rather than actually effective methods, they will figure out how to exfiltrate it all.

In corporate and government environments, I imagine that they'll ban employees / civil servants from bringing camera(phone)s to work, and necessarily forbid them working from home.

The only question is whether they will trust metal detectors to prevent whistleblowers from bringing in these devices, or if they will rely on strip searches and CCTV.

Try to scan banknotes with a scanner and you will see.

Linux/BSD will do it fine.

if you mean there are scanners that prevent you from scanning of a banknote, that's another great example of wasting time, money and resources to accomplish nothing

The thing I fear the most with this is "proof that secure boot has never been disabled". This is just a way to brick your device from accessing services.

What if you government's tax service requires such proof? Or bank? I cannot count how many machines I booted on Linux to rescue a hard drive, or image it, or wipe it, or just to install linux on them. All those devices, boom, paperweight for regular personal use.

I hate it so much that Microsoft is alone in this. It's not because it's M$, it's because they're alone on it.

This is already a problem with SafetyNet hardware attestation on Android. Because it's so easy to implement on the app side, everything from banking apps to games is verifying the device is running a blessed system image with a locked bootloader and no root access (read: no access to general-purpose computing).

As a developer of a banking app, I do my best to avoid implementing this user-hostile crap, but not all developers are empowered to say "no" to this requirement and not all care. There is zero benefit to the user to block them from using your services, and I would argue the net benefit is negative to the service. Users aren't hacked via privilege escalation exploits, they are hacked by phishing, and they can be phished on a SafetyNet-compliant device just fine.

I never knew SafetyNet was a thing, and wow, what a bullcrap thing for the basic consumer.

Thank you for being a smart banking app developer. There is so much bullshit in most of those apps that I consider them as "worst apps on my phone", but due to management incompetence rather than developer incompetence.

I really appreciate knowing some devs are out there defending us from the banking app madness. I'd encourage you, given your position, to write a blog post about why device ownership is important and your experiences on how others should consider operating.

You get two devices.

And more e-waste? Thanks but no thanks, I already have enough paperweights.

I remember when Microsoft introduced driver signing, i remember articles in Slashdot and TheRegister going wild about how Microsoft was about block side-loading third party software, and only allow software which they specifically authorized to run on Windows or that they would charge large % fees to allow 3rd party software to be installed.

When those these restrictive practices were introduced with iOS and to a much lesser extent various Android distributions (not just phone, but other types of appliances), i was genuinely surprised about how quiet the same type of people are, who I thought protested out of principal.

Its the same pattern, like poltics, where people are just basically trying to sell or advocate for you to buy into or sell another product.

Yep. People have been banging the drum on TPMs and similar security chips being the end of personal computing for about 18 years now. Still waiting.

Atom Bay Trail tablets were often locked to running Windows only.......

"This water is only 90 degrees, you're fucking crazy, the pot's notgoing to boil."

Ew. Why are all the chip manufacturers going along with this stupid plan? I want to buy a processor and then own it and have it work in my best interests, not consume electricity and generatie heat enforcing draconian 3rd party DRM policies.

The market (software/system builders) say that locked down platforms like the iPhone are fabulously profitable. Sorry.

And that's why the road to a better software ecosystem is not some hackers smart trick to defeat the system for the moment but very clear rules of what is allowed to be done in the name of security and what isn't

A legislative piece of paper (or many pieces of paper) have the power to reign in corporations far far beyond any technical solution or workaround.

And yes, that requires limiting (intellectual) property rights and regulating what certain contracts can enforce. Sometimes it's needed if you ask me

In my experience this sentiment is rejected primarily by many technical people because it feels like adding the human factor to a pristine world of logic. In reality it's humans all the way down and there is no reason to believe that Microsoft/Apple is a better steward than an elected body of representatives acting according to the rule of law

Lol, cargo-cult chip fabbing. What's next? I can't even fathom.. maybe this inability on my part is a blessing in disguise.

So is war. Don't reproduce.

The conspiratorial answers here are emotionally satisfying, but ultimately wrong. The reason chip makers and OS vendors are adding this is customer demand, by which I mean enterprises. Companies want remote attestation and guaranteed-immutable OS images on their networks, and I honestly can't say I blame them. In a perfect world they could have it and we could somehow firewall it away from the consumer space entirely, but that's not going to happen.

On-premise, open-source, customer-owned remote attestation servers are possible. Avoid outsourcing integrity verification to 3rd-party clouds.

I don't really care for the reason, why can't we as consumers opt out if it's consumer oriented then? For me it's not even about the egregious security and privacy implications -- I just simply want the (illusion of) choice w/r/t silicon rootkit 'features' that I'll never use.

Good, if companies want those features, then they can be the ones to pay the price in privacy. Otherwise, let me set an OTP bit to disable all Management Engine kinds of functionality on the CPU permanently.

Haven’t looked at the Intel space, but doesn’t AMD have an “PRO” tier available for OEM only? Ryzen Pro, Threadripper Pro… Or Nvidia and their segmented RTX/GTX vs Quadro. These hardware companies love segmentation, let them have it, do that for PRO enterprise only, leave my personal use, no remote attestation, immutable OS needed PC alone.

Enterprises can put whatever they like on their devices. Not mine. So this argument falls apart.

It's tragic (especially if you care about general-purpose computing and the future of open platforms), and a sign that Microsoft's Palladium project was never really canceled. Boil the frog...

Of course, Microsoft would say it's not about DRM (at least right now), it's for "security." Which... its secure as Microsoft's servers are, to be sure.

Next-Generation Secure Computing my ass.

Because owning your device is a nice bedtime story we've been told for quite some time now since the iPhone became the norm.

Because China and Russia might be hacking your hardware.

Don't people listen when a guy like Pompeo speaks he has pretty much outlined the plan with his Clean Network Initiative, I wouldn't be surprised that within a decade CloudFlare and other US cloud services will be used as the great firewall of the western sphere.

Are there proofs for the easterners? Because for the westerners they are plenty.

Intel started putting ME in their cpus 12 years ago.

and yet, without any evidence, huawei is being blamed for "spying".... smh

It's not mutually excusive. I think risks from hostile powers need to be called out, and I think we also need to be calling out this bad behavior on our side too.

> Ew. Why are all the chip manufacturers going along with this stupid plan?

Because if they don't add whatever garbage Microsoft orders them to include in their chips then Microsoft can simply require that shit for the next version of their OS to boot. They could even force an update on existing PCs to check for it. Nobody is going to buy a chip if having it means they can't run the OS that 99% of computers on the plant are using. If Intel dared to say no, MS could pretty much run them out of business.

This works both ways however. No one is going to buy the OS that can't even run on their latest chip. Microsoft can make all the demands they want, but the chip manufacturers still have the power to refuse to implement it; if Microsoft wants to brick their own OS, that's not their problem.

> No one is going to buy the OS that can't even run on their latest chip.

Unless that latest chip is vastly superior to what we have today, almost nobody is going to care. Most people couldn't tell you which chip is in their computer right now. They don't even care what a processor is. They just want to be able to click on the little picture that makes facebook happen and they don't want to have to learn anything new to make that happen.

If every chip manufacturer refused, you're right that we'd be pretty safe, but the moment they can get just one chip manufacturer on board every OEM will buy those chips or go out of business. Intel was "evil inside" decades ago for a reason, so we knew how this was going to play out.

> Why are all the chip manufacturers going along with this stupid plan?

Because the music/movie industry benefits from DRM and made agreements with the software and hardware industry.

Also NSA and the military complex benefit enormously from having control over hardware around the world.

It sounds like you can still do that. Other people will get to decide if you can use their services with your device, but (unlike an iPhone, for example) it's still your device to do as you please with.

Alphabet soup, probably, along with iphone profitability.

Because Apple

HVCI is truly revolutionary, you can no longer just dump lsass and get credentials if it is enabled among other use cases.

But to me, this all looks like MS building a house of cards again. If I am writing a rootkit or other malware why can I not use this to make sure only the compromised devices secure processor can read the contents of memory or does defender get a pass?! A defender/analyst won't also be able to dump ram with volatility or a custom driver to analyze the malware/implant? No microsoft solution would prevent a user from downloading and running an executable entirely so malicious code would run, but can it now hide from security solutions? What part of HVCI am I missing?

As far as the rest of it, it will break legitimate use cases for users so I don't expect it to be a default anytime soon. I hate the remote attestation stuff but my hope is it will either fizzle out or regulations will be put in place for enabling user control of the secure computing private key for personally owned devices because code you can't introspect or keys you can't manage should not exist on a device you own (not license).

For now (and I haven't seen an annoucement of a coming change about it), only trustlets signed by Microsoft can be executed in the VSM (Virtual Secure Mode), so you won't be able to write a malware or a rootkit that leverages it to hide the execution flow.

Thanks for clarifying. With drivers they get around that by using vulnerable drivers, but this isn't regular kernel mode code execution, and MS will probably revoke certs for future vulnerable trustlets? (Or not, since that can cause outages). Sounds like a whole new area of research.

I'm not hyped about most of the DRM stuff (and yeah, frog boiling is definitely a worry, though I don't know how we could ever end up with devices that can't boot alternative OSes just cuz of how servers are set up).

But I am personally glad to see hardware-level key stores show up on all CPUs. Maybe this is already a thing and I'm being duped by Apple for thinking it's good, but it feels good to me.

I'm not really worried myself that alternative Operating Systems will be locked out. However, I am concerned that the functionality of alternative Operating Systems will be locked out. If you see the (speculative but grounded) area near the end of the article - imagine if assertion becomes popular for things such as games or digital movies or the school WiFi. Your Linux PC will never be able to do that, and WINE (probably) won't be able to help. Won't stop you from hosting a server, but it will make it much harder to enjoy a Linux desktop. That's an issue.

> imagine if assertion becomes popular for things such as [...] digital movies

You don't need that. Streaming is already crippled on Linux. Hell, Netflix won't even stream full quality on Chrome!

> https://help.netflix.com/en/node/13444

    4K Ultra HD on a computer

    Netflix is available in Ultra HD on Windows and Mac computers with:

      Microsoft Edge for Windows

      Windows app for Windows 10 and Windows 11

      Safari for MacOS 11.0 or later

Fun fact, that app hasn't been updated in years. It's super buggy.

It's a nice demonstration how vendors won't bother to improve if the user has no choice.

... and this is why piracy will always continue to be a viable alternative.

I have netflix, but also a usenet server account and many TB of disk. I might cancel the first, if the added value becomes too small.

This is about money. This is about having to upgrade your CPU to get updates to your OS. The Android/iPhone business model.

nowadays 98% of things implying "security" are actually unwanted products, protections for "the other side" or trivial distortions of reality where, conveyed by "security" itself, the user himself becomes the product

- no, I don't need protections for the side channel, I never asked for them

- no, I don't need a unique identifier, who is the demented person who asked you for it

- no, I am not going to glitch the power supply, and even if I did it means I am interested in doing it and wish it worked instead I was prevented from doing it

- no, I don't care at all about having a hw store for certificates, which are ephemeral and dropped from above anyway so what am I supposed to trust?

- and so on

"not secure by design" nowadays comes close to being a coveted feature

Absolutely. Security is just a PR term for these, like how "think of the children" narrative is pushed when pushing for certain legislations.

Well stated.

Security has degraded to snake oil on a lot of topics. Boot infection are really rare and the whole TPM module isn't really needed in my opinion and I don't want it either for my systems. There are edge cases and sensible applications, but I don't want to see it as standard.

The concern with boot infections aren't for standard every-day malware, which is perfectly happy to just mine crypto on your machine in a sandbox[0] or read out your browser cookiejar for login tokens at normal user privilege. The kinds of people dealing in boot infections these days are three-letter agencies looking to make very difficult-to-detect malware that they can attack other countries' infrastructure with. Likewise the companies that run said infrastructure would rather buy servers and client machines that will defend against such attacks.

Before you say, "well, they're the government, why don't they just compromise the secure boot CA"; the problem is that cryptographic signatures create evidence. If someone finds your boot sector malware you don't want it to be attributable - but signatures from an already-trusted entity create exactly the kind of paper trail you'd rather avoid. If Microsoft signs a boot sector virus, then it's obviously a US government cyberweapon, and any companies that find it in their systems will start suing. In this particular context, secure boot is a policy of "no execution without attribution".

[0] Which nowadays can even be done in a browser. Modern browsers actually have to have throttling and CPU usage limits because of this.

> Boot infection are really rare

Gee I wonder why. /s Such statements are tedious to say the least, preventions have been implemented, obviously it curtails such abuse, obviously that reduces frequency.

> the whole TPM module isn't really needed in my opinion

It's nice that you have no key material that would need to be kept strictly on the device, but a lot of users actually do. We don't want people's Webauthn tokens carried away, we don't want Bitlocker keys stolen, most certainly we do not want biometric authentication data stolen. Maybe you have reduced that risk to near zero, but that's not the case for the vast majority of users.

> Gee I wonder why

The frequency dropped even before TPM was deployed on most machines and I guess most systems still haven't it enabled today. Reason for that is that there are simply more direct and profitable ways to get system access, see most applications of ransomware for example.

> It's nice that you have no key material

You can use many different types of authenticators. If you use Windows Hello you need TPM and they try to hinder you adding alternative means without TPM being activated. But that is a different story and solely on Microsoft. No need to falsely or passive aggressively suggest that a system would be insecure without these specific means.

no, I don't need a unique identifier

People fought against that and actually won, 23 years ago: https://news.ycombinator.com/item?id=10106870

Unfortunately, that may have been the only victory, as they slowly started introducing a lot of other stuff silently under the guise of "security".

"not secure by design" nowadays comes close to being a coveted feature

Absolutely. As the saying goes, "insecurity is freedom".

Hum... Looks like you didn't notice we losing.

At that same time, Microsoft started using your HDD serial as an identifier. Nowadays there are unique identifiers in most of your hardware, including the north bridge of your motherboard and the TPM that windows now requires.

Also, mobile devices got all kinds of unique identifiers from day 0.

No, I sure did notice --- that's why I said "the only victory". All the other battles seem to either have been lost or surrendered without a fight.

Yes ... I certainly look for chips WITHOUT certain "security features" when I'm building a system - makes it more difficult for the "bad guys" (really, just the greedy guys) to force me to do things the way they want.

What chips are left? When they've got Intel and AMD that's the vast majority right there. We really need some kind of open and transparent chip manufacturer who is unwilling to infest their product with user hostile code at Microsoft's demand.

Hmmm, yes. The Core-X seem helpfully lacking in undesirable features, but the standard range is certainly heavily encumbered. If I can get a half descent RISC-V chip and motherboard, that might be the go...

> no, I am not going to glitch the power supply, and even if I did it means I am interested in doing it and wish it worked instead I was prevented from doing it

Are you talking about brown-out detection circuits, or is there something else?

The first xbox was hacked using an attack via the power supply I believe. It caused some instructions in the boot sequence to be skipped i think. It’s a really cool story, wish i had a link.

It’s worth distinguishing between security against software attacks and security against physical “attacks”.

I absolutely don’t want my internet connected pet cam to be accessed remotely (outside the set of companies i’ve decided to trust, namely the manufacturer.)

Protection against hardware tempering is less good and probably mostly anti-consumer. The most legitimate cases I’ve heard:

- Protection from (some) supply chain attacks

- Leasing models. Where you acquire the item for less than it’s hardware cost and pay over time.

But honestly I’m not convinced of either.

Disclosure: I worked on Azure Sphere, the first place Pluton was developed outside Xbox.

Edit: I’ve read the whole article now. These scenarios are really bad and really realistic. Pluton is bad.

Could not agree more. Security only means control. I don't want security. I don't even want safety. I have never cared about either, and I'm now too old to die young, so I'm not afraid.

> "not secure by design" nowadays comes close to being a coveted feature

That's a huge market opportunity. I would buy "insecure" products over secure ones every time.

Ah, but it won't work on the internet once ISPs are forced to use remote attestation to prove you're using a government approved device.

> - no, I am not going to glitch the power supply, and even if I did it means I am interested in doing it and wish it worked instead I was prevented from doing it

This one makes no sense. Wouldn't 99.9% of power supply glitches be some sort of accident, and something that the end user probably doesn't want?

Security can be used to create both a safe, and a jail. Remember that.

---

I think Microsoft feels threatened at this point about Linux becoming more popular on PCs; what with hardware like the Steam Deck. Can't have Linux dominate the PC platform if you forcefully bind all hardware to the Windows ecosystem. Imagine if back in the day Microsoft used their dominance to block out all competing software on PCs but their own.

---

I can see a dystopian future where Government can enforce code/file signing with technologies like this (DRM), so that you can never again have an open computing platform; you could only ever use code or view files approved by the State, and if you try to write code or create content, it won't work period unless it is first approved by the State. (such as with an AI scanning tool to detect and block "wrong-think" or "dangerous functionality" (i.e. dissent or otherwise that threatens the powers that be))

Don't worry. Linux will always run on server hardware. We will just learn how to build rack-mounted gaming PCs.

This made me laugh.

I also look forward to the potential of open technologies like what RISC-V appears to enable. It's not all bad for sure.

I think the fear mongering is spot-on and there's no way back. The only positive way forward would be a non-profit org taking over the role of key manager. No for-profit org and no government should be in the position to control computing. So instead of blocking the technology that inevitably will come (or is already there), let's focus on legislation that prevents corporate entities from controlling computation.

Privacy and user empowerment stopped around 2007 and most technological advances suit the capital and political classes for their benefit, hegemony and ability to control us. It’s time to stop buying new hardware and to be content using older hardware to halt the erosion of our privacy and maintain what little independence we have.

Interesting naming. "Microsoft Hell God".

Pluto (Greek: Πλούτων Plouton, "giver of wealth", Pluton in French and German) the most common name for the classical ruler of the underworld. Plouton was one of several euphemistic names for Hades, described in the Iliad as the god most hateful to mortals. https://en.wikipedia.org/wiki/Pluto_(mythology)

Well, they already use Kerberos, his dog.

But they also have winsock trumpet. They need to pick a lane, I can't deal with the oscillation between goofy and evil.

Dude, that was 28 years ago.

Trumpet was an acquisition, so not orginally theirs

MIT named that.

Pluton is also a geological term, referring to magma domes that have solidified and since eroded to yield granite structures like Half Dome.

The spouse of Kali Linux? After all they seem to be on the same page politically despite their seeming differences.

maybe its because pluto is the "king of the underworld", the underworld being the root of trust?

> the underworld being the root of trust

Pun intended?

And the processor etc are under the operating system.

Hey, did I tell you I use Doric Arch? No MS here!

This is exactly what big corporations ask for. In the pharmaceutical industry stakes are very high and directed attacks are common. It is just the next step securing your IT.

However, for private users these are dark capabilities.

I've always thought that at some point the only "stomachable" version of windows is going to be some hacked offering, by god-knows-who or from where, but it'll still end up being preferable to what MS is requiring.

Isn't that the way it's been for several versions now with scripts to disable all the telemetry and shovelware?

As far as I know there are no scripts that are capable of disabling all of the telemetry and nothing that can't be undone the instant the computer has an internet connection and connects to windows update.

Yes, you'll likely have to keep re-doing it.

As far as scripts for it, this thread has some sage advice:

https://www.reddit.com/r/privacy/comments/n3v0s5/disable_win...

The tools to disable telemetry and bloat:

https://github.com/irmatade/sharpapp https://www.oo-software.com/fr/shutup10 https://github.com/Sycnex/Windows10Debloater

MSFT doc on what all telemetry is gathered, and what is considered "required" telemetry (although they give you enough info to block it at the router):

https://docs.microsoft.com/en-us/windows/privacy/configure-w...

I do like Win10 as an OS. On the whole I'd say the Satya era of MSFT is a mixed bag, but better on the whole than it was before.

Reminds of of Palladium:

https://www.zdnet.com/article/microsofts-palladium-what-the-... https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...

Very impressive analysis and understandable breakdown. And the author is only 20. Or maybe that’s a normal age for this kind of work and I’m just getting old.

Can you trust your computer? by Richard Stallman

https://www.gnu.org/philosophy/can-you-trust.en.html

Is Pluton IP open? All hardware vendors embracing this is not the right path for security / computing.

Why can't hardware vendors embrace standards-based open platforms like Global Platform [1].

[Edit] Google is also pushing Android Ready SE Alliance [2].

[1] https://globalplatform.org/

[2] https://security.googleblog.com/2021/03/announcing-android-r...

"""Microsoft believes they need to exercise more control over PC Security than previously"""

This has little to to with security. It's about having more control over the user.

When I clicked the link, I expected to see media security DRM functionality or something along those lines. However, from what I can tell, this is all critical security stuff; the security community has been begging for features like these for ages.

Kind of feels like Microsoft can’t win here. Everything is free and unprotected and their OS is a security joke, or they harden and get accused of DRM and monopolizing.

Can RISC-V save us here? Or is it time to start hoarding CPUs?

Might be a blessing in disguise?

The libre computing movement got lazy. We got used to care about free software and just accept free-riding on non-free hardware because "hardware too hard" and frankly we got it easy with x86 CPU and PC manufacturers being generally friendly, actively or passively, to free software and actually benefiting from industry concentration. The less attractive proprietary CPUs and other chips get, the greater chance a small but lively open ecosystem develops?

It's time to start rejecting such corporations. Nothing else would work.

I would assume chinese made RISC-V have their own special sauce.

That's a big assumption.

...if the schematics and tapeouts are entirely public.

Otherwise you can be assured that there will be backdoors.

i think this is simply Microsoft noticing Nike's embrace of Taking a Stance for the Bottom Line.

microsoft is smart enough to realize that NSA tinfoil types already do not trust them, and likely will never trust them (which, if you are that worried about security, why are you on windows anyway? NSAKEY?)

the predominant share of windows machines are sold to businesses and enterprises who DO want to lock down at a hardware level.

it's way too easy to steal a windows machine and wipe it clean. you can't do that with DEP-enrolled macs because of the TPM they already have, which is a strange misalignment when Windows' core market (enterprise) really cares about this kind of security.

apple has every reason to care about DRM more than microsoft, but the TPM advent on mac was mostly a welcomed one as I recall. perhaps that is because apple has taken a strong and public stance towards user privacy. but they have to: it is consumers who are buying their devices, and consumers rightly want a device that works for them.

microsoft is not in that position, or at least, is not with windows, from an economic standpoint. similarly, they are mostly selling to enterprises and business and governments for this product line, and those customers rightly want a device that is verifiably secure.

if you're worried about security for your personal use, buy a mac, because they've made their bottom line and your privacy intertwined. or, buy a linux box and purity check it down to the circuits. you have already decided against convenience in your trade-off equation by your a priori decision to care about this in the first place.

I would like a free as in freedom Libre Linux PC with open non bloated boot loader. Open hardware and open specs.

What I do not want in my next PC is more DRM and adtech spying on us.

This is basically a form of collusion and monopoly between Microsoft and CPU manufacturers.

Microsoft has already tried to monopolize the PC consumer market before. And back then the risks were tiny compared to what is at stake now.

https://www.justice.gov/atr/us-v-microsoft-courts-findings-f...

While I disagree with the author's opinion, it was very informative for me.

Not mentioned in the article - but it begs the question, could this have something to do with Microsoft's insistence that everyone, even Pro users in the next update, use a Microsoft Account with Windows 11? If Pluton (or Pluton 2, someday) could be tied to a Microsoft Account, wouldn't that be something.

Imagine a future where everyone requires an online account to use a computer, where every computer can only run software approved by the few large corporations that issue those accounts, and where a government or governments have those corporations on speed dial, to periodically "suggest" to them which software and which users should be allowed to transact and communicate online.

If you can imagine that, then imagine that every human is given a number which is equivalent to (or even more significant than) their name, and that name/number appears in certificates which are signed by the name/number of a certificate authority's key. By accepting the signature, you have to accept an EULA that takes an hour to read, so no one does, and it changes every month anyway, with future changes automatically binding you.

Does that sound like a world where people are free?

It's I think a general desire for end to end traceability and therefore accountability, which both managers and developers tend to like, albeit for different reasons.

Is it okay to talk about language as a meta-topic? I try not to stray too far into that, since it’s usually boring for readers. But one thing I was surprised to learn is that “begs the question” is only correct when you’re describing a chain of circular logic. “Raises the question” is apparently the right term for the general case. I felt a little duped, since I’d been using “begs the question” for years without looking into its origins.

But of course, that begs the question of whether language is defined by how people use it. :)

I purposefully "misuse" the phrase "begging the question" to mean the same thing as the grandparent, because I want to do my part to change what this phrase means.

Using "begging the question" to mean something as obscure and unintuitive (as in, it's basically an idiom that must be explained first) as "your question originates from circular logic" is a waste of prime dictionary space.

This term should mean "there is a question that is so blindingly obvious regarding the situation at hand, that it simply begs to be asked" - so, more or less what everyone who didn't have the term explained to them, thinks it's supposed to mean.

Reminder from the future:

Don't throw away your current hardware when you "upgrade". You, or others, may need it or parts of it in the future.

What this needs is a (write only) way of physically updating the keys inside pluton. Doing that will practically do a factory reset of the entire device. Then we can have our cake and eat it too.

Just to be clear, is this a case where you can't dual boot windows and another OS, or you can't boot another OS at all (in either case, the other OS being non Microsoft authorised)? Or something else entirely? Would it be possible to disable this at all, even that means you can't boot Windows?

You cannot boot the other OS at all if secure boot is enabled and Microsoft drops support for the 3rd party UEFI CA list. The machine will refuse to boot any kernel that has not been signed by the CAs already included in the machine. This is typically only Microsoft and sometimes the OEM like Lenovo or Dell.

This matched my guess: it's about MS extracting a $x per machine tax on all non-MS OSs to stay on their certificate list. Same playbook they've used on Android.

Can't wait for EU antitrust and the courts to punish this attempt

Could this be disabled by the user? Presumably doing so would mean you cannot boot Windows, but if thats a trade off Microsoft is forcing me to make, I'll accept it.

If you can't, it goes without saying that that is unacceptable

You can disable it for now. But there is no guarantee that you will always be able to.

Personally I think its very likely MS will eventually push to strongarm OEMs into locking secure boot to be enabled. All it will take is another round of "security improvements" and the public eats it up. The market would then fragment into laptops that can only run Windows and maybe more expensive laptops that allow you to disable secure boot. If the number of people who actually care enough to vote with spending a few extra hundred $ remains as low as it always has, over a decade it will drive open laptops to become wildly overpriced and eventually cease to exist.

Yes, you can disable secure boot.

What this article warns as the Apocalypse some suits that make computer use decisions for large organizations will see as features they want implemented.

"For all the nations have drunk of the wine of the wrath of her fornication, the kings of the earth have committed fornication with her, and the merchants of the earth have become rich through the abundance of her luxury."

It's a very rare Bible quote to get a thumbs up from me. Well done.

Every story about Microsoft--every time--ends with "...and then Microsoft fucked people over". After decades of watching the shitshow that is Microsoft, and the moral equivocating around defending them, I always return to this.

Authoritarian tech has two problems: the obvious one, and the fact that good hackers don’t want to work on such things, so it’s all built by consultants and stooges and is probably 10x clunkier than the clunkiest Bluetooth - X.25 gateway.

This is the problem, when normal people stop buying PCs, only gamers and enterprise customers remain. So they will sell what their customers want.

I'd say that stage has already come, there's huge amounts of people where their main or only computing device is a phone or tablet. I've dealt with recruitment in a non-technical field and their phone is the online nexus point for them for any emails, documents, or website interactions. Even for gaming I'd argue PC is going into enthusiast territory and the GPU pricing situation hasn't helped that, consoles and phone gaming is strong and streaming has developed a niche.

And now the gamers want mostly online competitive games and their makers want the strongest DRM and kernel-level inspection all in the name of anti-cheat. We shouldn't be surprised if online games are one of the first spaces to require Pluton-enabled systems or no boot game.

All sounds good for enterprise IT admins - who are the target for these features.

These paranoid delusions never get old. If Microsoft accidentally changes their license agreement to lorem ipsum, bloggers like this will surely be trying to decipher exactly how it steals their freedom. The fatal flaw in these posts is, as it always is, the blind assumption that Microsoft can just do whatever they want, unimpeded. If Microsoft declared, as an april 1st joke, that app PCs henceforth must be painted sky blue, these bloggers would take it seriously. They act as though Microsoft is the high priesthood of computers, and they can declare literally anything with the stroke of a pen. They act like Mac doesn't exist, cheap Linux computers don't exist, RISC-V (which doesn't even run Windows) doesn't exist. Non-Windows-compatible ARM devices don't exist. PC vendors are mindless drones that do whatever Microsoft tells them (even if it means losing billions of dollars to Apple) and they certainly aren't selling (Dell: https://news.ycombinator.com/item?id=4847720) linux (HP: https://news.ycombinator.com/item?id=31617198) laptops (Lenovo: https://news.ycombinator.com/item?id=28186204) right now (and don't even think about installing Linux on your Google Chromebook, it won't work! https://support.google.com/pixelbook/answer/9031351?hl=en ).

The usual rebuttal is "Well, yeah, things are fine NOW, but they're moving the chess pieces into place to do these things LATER". Yawn. I have heard this for 20+ years. See you in another 20...

I will definitely not buy CPU with built-in MS core. If Intel will add it too, guess it's time to get 12700 and use it for looong time.

Problem is that the consoles market is very lucrative for CPU vendors because it is a guaranteed turnover of specific models. Intel, AMD and Qualcomm will implement them. You can disable it though. It would suck if it were enable by default, at least lenovo said they will disable it at first.

Hardware-based attestation of the running software is an important security feature, especially in a world where data leaks and identity theft are rampant.

Let's say I'm a healthcare provider, and I'm about to send your medical data to a third party vendor. Wouldn't you prefer that your data only be able to be decrypted by a computer can prove to the world it booted a clean OS image with all the latest security patches installed?

If the vendor wants to install some self-built OS that they trust on their computer and not update it for 5 years, that's their business, but I may not want to trust their computer to have access to my data.

Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines (or even their own machines that may have been compromised). This is useful for more than just DRM.

The slowly rising "consolization" of PC, as my friend put it, is unnerving to watch.

> The road to hell is paved with good intentions.

If there were only dystopic uses of this technology, its development wouldn't be able to go on internally. They are specifically taking this path so they always have plenty of good reasons to pursue their agenda.

I don't see how this Babel tower of acronyms will not fail in a spectacular fashion, such as producing malware which is run upon receipt, cannot be by any action removed from your PC and installs crypto miner and ransomware on it.

This is definitely a big risk to commodity hardware being used for Linux :(

Especially when attestation can be used by websites etc. We'll need to have another computer at the side for accessing them.

Obligatory link to the talk from MS where they covered the origins of Pluton on the Xbox: https://www.youtube.com/watch?v=U7VwtOrwceo

The video does a good job of the original threat model for this technology and how it works on Xbox.

That's it, no more Windows Laptops for me

might as well drop apple laptops, as well, since Pluton is pretty much Secure Enclave for PC.

ohwait, that means no more computers at all.

well shit, time to switch careers.

It's not open...well...at least not to you.

Anyone who calls something secure without publishing the spec is just selling you a bridge.

Is this the part where they extinguish Linux (except for where they've embraced it with WSL)?

No. MSFT has bet the business on Cloud and while the virtualization stack they use is Hyper-V, they have a TON of products running Linux under the hood in the cloud.

A big chunk (I don't know the real number, but it's closer to 50% than 10%) of customer vm's on Azure are running Linux.

All this to say, MSFT is highly invested in the Linux ecosystem. They would be shooting themselves in the foot to try and kill it off at this point.

I think author meant Linux desktop Andy client facing Linux is, like the SteamOS.

I don't think Microsoft feels threatened by desktop Linux. If it catches on, it will be because manufacturers start shipping it, not because it's easier to install.

Manufacturers sell Linux workstations designed for power users and developers. UEFI/TPM, and now Pluton won't be a stumbling block for that as it hasn't been so far.

Dell is the biggest seller of pre-installed Linux desktop machines, and they are all billed as Workstations for power users or developers. Their home machines only have as an option Windows or ChromeOS. (Count that as Linux if you like, but I wouldn't...)

Why? Being more price competitive by bundling a free or cheap OS is not worth it in scaling up their support for a new OS. That's your stumbling block to better Linux desktop adoption, in my opinion.

Causing issues with remote attestation are probably more a side effect of just not caring about other OS's, rather than some sinister plot to sink Linux on the desktop.

We've been hearing this story for a real long time...

The larger rationale for this is likely due to them losing very important share to macOS because of things like the secure enclave.

Sounds like the anti-trust case (heh) can be started as soon as the first locked-in computer rolls off the line.

> It may contain inaccuracies or speculation...

This means to take anything written in that article with a grain of salt.

I'm all for it, just let me delete the Microsoft keys and start the trust chain with my own

"Companies will be able to control their network" doesn't sound like a problem to me, more like a solution.

"DRM will be unusable outside Windows" is already the case.

"Documents can only be opened by authorised users" sounds like a dream come true.

"You can't boot Linux by default" is annoying, but hardly a deal breaker. Statistically, almost nobody runs Linux on their devices. Valve could make a change in the Linux landscape if they actually get SteamOS off the ground (third time's the charm, right?) but so far SteamOS 3 is only meant to be used by their own hardware.

It's been decades since I last heard about powerful Windows rootkits because you can't just swap out the bootloader anymore. You could try it and risk a non booting victim system, but you're not extracting data or injecting ads into the kernel that way. Malware hasn't gone away (partially because Microsoft doesn't want to break old, signed, vulnerable device drivers that are used to bypass signature requirements and gain kernel access) but it's harder to gain good persistence now.

I get it, I want to run Linux on these devices as well. All of this stuff should be easy enough to disable if you're the owner of the device. However, your freedom to use your device however you want doesn't imply that others have to put up with your choices. If I choose to only accept Microsoft Panopticon Validated Devices onto my network, that's my business, no matter how foolish it might be. Distributing my software as a .exe isn't some kind of violation of your constitutional right to run OpenBSD, it's a business choice.

Personally, I'd love to see a similar system provide a hardware root of trust for Linux as well. Qubes being able to verify every single step of the boot process and securely loading the system's (several) security keys would be a great security benefit. Hell, I'd even like to see the option to only run signed software on my machine to ensure the executables haven't been tampered with, either signed by the distro maintainers or by myself during the install process, but Linux doesn't have such features or configuration accessible.

As long as it's possible to disable this stuff or to configure it for your own, personal key set, I'm all for this stuff. I want the freedom to secure my (Linux or Windows) system in hardware, as long as you have the freedom to turn it all off if you disagree. I don't buy Microsoft hardware specifically because I can't disable or configure that crap, despite their excellent pen support and fancy designs, and I think others should do the same. That's my personal choice, though.

Practically speaking, outside Intel and AMD, what CPUs are left to use?

RISC-V.

However, RISC-V is not x86. So, if you want to use the x86 instruction set, then will you need emulation? The modern x86 are too complicated anyways (in many ways; Pluton is just one of them but not only one, also the instructions is too complicated), but I think the old 8088 is reasonably not too complicated.

Hopefully EU bans this.

and all that crap will get eventually pwned anyways

Pluton first debuted in the Xbox One. It's possibly the first home console that went it's entire lifespan without being hacked. That should tell you everything about the threat we are facing.

That may be true, though the problem with releasing such a high profile exploit is that it's patched quickly. So IMO anyone with access to hardware / talent required to crack the xbox is probably sitting on that knowledge and extracting as much value as possible from it, instead of taking it public.

What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network?

Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Stallman was.

It's so true, but I'm trying to imagine a normie's reaction to reading this, and all I'm coming up with is, "This guy is a paranoid schizo, back to TikTok for me...", and so unfortunately, I don't see us steering away from this fate anytime soon.

These people won't respect you until you start taking their money. Become one of their techno-corporate overloads. Demonstrate how you're controlling/profiting off them, why it's bad. Maybe then they'll start listening. Or not. At least you'll have made a nice profit.

You can take their money and still they won't care.

Think about how many devices in a typical users home are incompatible for business reasons - for example that Chromecast that refuses to play Amazon prime movies. Or the iPhone charger cable that won't fit into an android. Users just live with it.

"My weird laptop doesn't support the school WiFi" is the same.

An economic niche supports one or two overlords, not a bunch of them. You and I aren't overlords. We need a different strategy.

People have become aware and angry that tech monopolies are exploitative. The winning strategy will involve focusing this fuzzy, ambient anger at a concrete target.

Once Pluton outs itself as an exercise in naked monopolistic power covered by a fig leaf of security -- and it will, as all hustles must eventually involve monetization -- the bad optics will be our opportunity to act. Any strategy on our side that involves putting down TikTok is doomed to failure, but if we put the bad optics in front of people, make the connection, and get them to briefly agree "yeeah, f** the monopolies! F** Pluton!" then a political solution becomes possible. Not easy, but possible.

It's a pity that this dialog has to be so reactive and simplistic, but communication at scale cannot function any other way.

> It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Stallman was.

I think it’s also worth asking why he didn’t have more impact despite pretty clearly seeing this problem. Part of the answer has to be resource disparities but I don’t think it’s just that - Linux didn’t really capitalize at all on Microsoft’s lost decade, and much of the innovation in security has happened on other platforms. I think there’s also some kind of blind spot in the open source community where a lot of people see this as something other people need, not them personally.

The reason the OSS community has had no impact is that it's never managed to produce software that regular non-tech-geeks want to use. The reason it's never managed to do that is lack of an economic model to finance the incredible amount of work required to make software usable by normal people.

I've been saying this ad nauseum forever and I'm not the only one.

A related problem is that the OSS world is mostly tech enthusiasts. It's like having car people design cars. They'd be full of special switches and options and stuff that car people want. Car people don't understand that most people hate cars. What they like is mobility. Same goes for computers. Most people hate computers. They just like what computers let them do: communication, making content, getting their work done, etc.

Consider that the one whose comment is currently at the top is pro-cancel-Stallman, and he also works on "free" software related to secure boot --- not as in breaking, but instead aiding its adoption.

The FSF was strongly against secure boot, then inexplicably started seeming to be in favour of it.

Connect the dots yourself.

Windows security models and policies are the enemy, not remote attestation (RA).

RA is a technology that has its fair use, and can be desired for other systems, like in Linux. With a pure RA system your services can decide to trust or not those devices on your network that can be compromised, and report to other devices that there is something suspicious.

As anything, this can be used properly to increase the security of your edge architecture, or wrongly to limit the users actions.

Let me put another example. With RA I should be able to authorize validated systems in my R&D VPN. If you are using your own laptop with the company certificate, and the verifier tag the systems as "unknown" or "unhealthy", it will not allow the access to the internal network, but sure you can still use your laptop for anything else. This, IMHO, is a fair use of this technology.

Yes, lots of Linux devices apply it like that today: You can't use your banking app or consume DRM crippled media on your Android phone if you have root or run a open source Android distribution.

Is it possible to realize this with Linux systems / networks today? Do you have any good project / description / URL? Thanks!

Same with TPM and why it had so many critics. Some people still seem adamant to say that boot viruses are the greatest threat in the 21st century, but the economic interest are far more dangerous for general computing in my opinion. And it isn't even close.

So basically, Cory Doctorow's "The Upcoming War Against General Computation"?

https://boingboing.net/2011/12/27/the-coming-war-on-general-...

https://github.com/jwise/28c3-doctorow/blob/master/transcrip...

Don't know enough about the subject to tell if his "attempts to control general computation will converge on rootkits" prediction has held up.

> "attempts to control general computation will converge on rootkits" prediction has held up.

If you play video games, you probably have a couple of neat kernel rootkits installed as "anti cheat".

A lot of remote proctoring stuff for exams are looking a lot like rootkits too.

EDR/XDR is also just rootkits. For security. The only thing that can stop a bad guy with a rootkit is a good guy with a rootkit, after all.

To this talk, there exists a less well-known sequel:

DEF CON 23 - Cory Doctorow - Fighting Back in the War on General Purpose Computers

https://www.youtube.com/watch?v=pT6itfUUsoQ

Can you explain what is the issue with TPM?

I get the issue with Pluton but TPM is only a dedicated and certified secure key and random number generator that does a better job than CPUs doing it in software, and it's also a secure enclave for storing your encryption keys. Would you rather store the keys in memory where they can be easily grabbed by malicious apps like Mimikatz? Macs had the same feature for years in the T2 chip.

It's the exact system that enables wireless payment and other strong security features on your phone.

So having TPM on PCs and using it for its interested purpose is a boon for everyone's security so I don't see the issue, just FUD.

Among that, the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration. Simplifying the description of the process a bit - at every bootup it checks the checksum of all programs loaded at every boot stage (UEFI, kernel, userspace) with respect to one that is known to be approved - process called "attestation".

So in worst case, if your attestation server is very strict, any new binary installed on your machine will prevent it from booting or satisfying the attestation. This is the main concern that TPM enables.

TPM is part of the system that means I can't my phone for wireless payment or use all sorts of other apps if I also want to do something outlandish like record phone calls, change the theme or delete Facebook... and everything it achieves can be done by other means anyway, making the device's owner a 2nd class citizen is a lazy solution.

TPM has features like remote attestation and is in general a mechanism to bind data to hardware, which is interesting for DRM purposes.

Sure, there are theoretical attacks on memory, but they are far less relevant for security than the penalties I have to accept with TPM being widely established.

Not that there aren't different means, but TPM also creates unique hashes of your system which only reinforces the problems around fingerprinting.

> It's the exact system that enables wireless payment and other strong security features on your phone.

Phones suck as computing devices on every conceivable metric and are heavily locked down devices. And it is not true that you need a TPM chip to create secure transfers. I constantly do business transaction on my PC just fine.

2013: German Federal Government Warns on the Security Dangers of Windows 8 https://www.infosecurity-magazine.com/news/german-federal-go...

2015: Governments recognize the importance of TPM 2.0 through ISO adoption https://www.microsoft.com/security/blog/2015/06/29/governmen...

2022: Microsoft Can Kiss My A* | Do You Own Your PC? [Smart App Control] https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s

The Trojan Platform Module (TPM)

The common component here is Microsoft, not the TPM.

Agreed. For proof, just look at how so much anti virus software can be considered malware in their own right.

Damn, now I'm nostalgic for the older days of hacker news where RMS was quoted every other post. The community is forgetting it's roots.

As someone who was here from day two, this is not how old HN was. It was many things to many people, and it’s very difficult to break out of the illusion that rose-tintedness tends to give us. (Guilty of it myself.)

HN has been consistently contrarian. That’s about all that you can say without quickly becoming mistaken.

But it's still the case... Stallman is quoted every day around here: https://hn.algolia.com/?dateRange=all&query=Stallman&sort=by...

What fascinates me is that for many here software and tech is their livelihood. You should be able to take care of access and ensure future generations still have the same opportunities.

Sure, you can sell yourself and make good money with software on some proprietary app store with proprietary tools. You are a freelance employee of the company providing that infrastructure at that point.

It is short-sighted, lazy and stupid in my opinion. There is merit for such security mechanism, especially for cloud applications, but it should be crystal clear that there are secondary motivations here. And that the security argument often falls short if you take a good look at current threats.

The community has long forgotten those roots the day they started pushing for anti-GPL licenses.

> Damn, now I'm nostalgic for the older days of hacker news where RMS was quoted every other post. The community is forgetting it's roots.

Keep in mind that now many of the people who post on HN earn a lot of money by working a company for which it is part of the business model to track users and collect data about them (officially for advertisement purposes).

Top-voted comments are linking directly to Right to Read and The Coming War on General-Purpose Computing, so I don't think the community has forgotten its roots.

You really wanna be scared? Go look at the multiple comments on the EU DMA announcement complaining that having a sideloading option is just a ploy for malware vendors to get into their iPhones. Or that someone else being able to sideload or jailbreak somehow hurts their security. These are coming from actual HN users!

That sounds more like /. than HN.

> Remote attestation is the true enemy of your freedom.

Technology is a tool. What is true however is that under the current way how the economy is structured remote attestation weakens freedoms of individuals mostly.

If Facebook was under remote attestation that private information was only used in limited and specific ways and even the NSA can not get to them without breaking the remote attestation, that would be a good thing. If firmware was under remote attestation we would have to worry a lot less about backdoors and the Diesel scandal would have never happened.

> If firmware was under remote attestation ... the Diesel scandal would have never happened.

Remote attestation would prevent a firmware written by first party and passed certification processes WHAT?

It is a tool, just like nuclear weapons are a weapon.

I'm definitely not on the "ban all crypto" side, but I see why the governments are in support of that, and for the longest time, strong crypto was (and still is?) classified as a munition; it's very powerful.

Well, I think governments are mostly concerned with people having secrets. Who would need secrets who isn't a terrorist? That it was classified as munition is probably more due to old war hawks and how they saw encryption employed.

But it'd make a lot of whistleblowing impossible too

This is almost the entire thesis of Zero Trust Networking principles. Somehow, the user AND the device need to attest to validity during the authorization process.

"Validity" for a device can mean many things (latest patches, is running anti-virus software, among other things).

A general user probably doesn't need to attest to these things. I would argue that anyone trying to access a corporate or some other organization's network SHOULD be required to attest to these things given the cyber threat landscape. The caveat: those same entities should provide or heavily subsidize the platforms they require (work computers). It's their IP at risk. I'm not so naive to think they would actually do this with BYOD initiatives, unfortunately.

For personal users on personal devices, I agree this might go too far (but some principles like MFA are best practices).

Stallman was right again.

This was the case at my university. In order to use the dorm network, you had to download a software package that validated your setup. It would then add your computer (I assume MAC) to an allow-list.

In order to deal with it, I had to create a subnet with a router, use an old laptop to do the verification, and then the whole subnet was added to the allow-list.

...and before Stallman, Hayek. Hayek couldn't have seen the technological means, but he did see the "self-regulated monopolies" shaping up from anti-competition moves on the part of government (most of which are driven by lobbying).

Engineers could leverage their economic might via collective action; don’t open your wfh laptop today.

Updating the Upton Sinclair quote without the gender bias; it’s difficult getting a person to understand something when their investment portfolio valuation depends on them not understanding it.

Who are they if they’re not what they are now?

When you all stop posting on corporate forums and working their jobs, shopping their stores, I’ll take you all sincerely and seriously.

The NSA and other three-letter US agencies will be all inside this chip, or have side-channels to the firmware update mechanism, obviously.

A secure operating system means nothing if the hardware itself cannot be secured, and the case for a new, trusted, transparent manufacturer of Intel-compatible CPUs and hardware in general grows stronger.

It's not out of the question.

Though I get the feeling we're missing the forest in the trees. Smartphones with proprietary basebands have been here for more than a decade or so. It's not only Intel-compatible we need, it would really take legislation to turn all these things more transparent or controllable.

Obviously

Regardless, I think that the pc platform deserves a good anti cheat solution.

Separating the groups of those who have a good anti cheat system enabled (such as this) and those who don’t is a good compromise for everybody. I think more reasonable companies such as Valve will go that way.

Anything that prevents me from modding or cheating in my single player games is anathema to me. And companies like Activision, Ubisoft and Rockstar would love a hardware-based system that takes control away from gamers.

Who needs to cheat in a Ubisoft game? Just point to the marker, walk, then hit R1 a few times, rinse repeat for 30 hours.

I didn’t say anything about single player games.

You didn't, but if the tech is there, it will be used.

Good anti-cheat solution is server side AI. Anything client side is malware.

Louder for the Cheeto-dust-covered people in the back.

I know that this is a popular take here, which is why I proposed that there should be a mechanism to opt out. But that would mean that you would have to play against those who opted out as well.

I would like to have an anti-cheat mechanism (that works), not a god damned security-nightmare rootkit that scans and uploads my private files to god knows where.

Microsoft are trying to enforce a monopoly on hardware, where is the https://www.sec.gov/ on this?

This. M$ is literally trying to wall off the PC.

That is "exactly" what they are trying to do, I find it sad that people are prepared to accept this as business as usual, considering the efforts made to make Linux available to everyone.

Just catching up where IBM failed.

Regardless of all the FUD against Pluton, it has a great feature, it is yet another CPU with hardware memory tagging, as the last resort against C flaws and derived languages.

FUD is no longer FUD when it becomes a realistic danger.

Given that remote attestation already had deleterious effects for user freedoms on smartphones and tablets (meaning, choose between banking apps and any deviation from the factory ROM), Pluton should be seen as a danger.

Smartphones and tablets are electronic gadgets.

If you want a general purpose computer get a laptop.

Most likely one sold by Linux OEMs, like Tuxedo and System76.

That's an invalid argument for multiple reasons, not the least of which is that some people can afford just one device.

That device is likely to be a smartphone because everything is slowly moving in the direction of requiring one.

If I need to spend extra money to get an additional "freedom device" and can't afford it, I just won't have one and will miss out on the good stuff.

Librem 5 and Pinephone smartphones are general-purpose computers.

In a landscape where security and privacy is imminent Pluton will sold as a saviour.

And I am pretty sure it's a darn good idea and well thought off and executed.

I cannot see why this is a bad idea besides the usual cargo cults claiming corporate distrust.

Heck we trusted Intel for decades and no one asked what Apple put in their silicon, because its Apple and Steve was so trustworthy.

After PRISM and xkeyscore, you don't get to doubt it's going to be abused for the worse.

Not anymore.

Reply on news.ycombinator.com