[flagged]
Yubikey equivalents that are fully open source still have to be shredded rather than recycled, if properly secured. Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing.
I have nothing against reusable computing, but I’m tired of seeing “open” and “right to repair” erroneously held up as meaningful solutions to reusable–repurposeable computing. Focusing on the core issue at hand – that you feel we should have the right to repurpose hardware in our possession without impediment – would go a long ways towards starting the correct and necessary conversations about “security” and “anti-theft” that, today, will simply not happen productively under the open/repair banners that the reuse/repurpose movement is trying to ride under.
Is the first part even true? It does seem to me that there are a class of tasks, the most obvious being competitive video games, that do require that the user not have complete control over the hardware and software they're using.
Whether this system is implemented as closed source or as open source is wholly irrelevant to secure attestation, which could be done exactly as it is today even if the complete source code were available. The difficulty is that, for anti-cheat, someone other than the user must have signed the key inside the HSM, or else it can’t be trusted to be unmodified.
This is why Secure Boot with Attestation, and the entire objection to Microsoft Proton, turns out to be about repurposeability — people want the right to repurpose hardware without a third-party services, such as anti-cheating checks, being able to exclude them based on their modifications. That’s not about open source at all. That debate is not about open source, and with the advent of widespread secure attestation computing, it’s overdue for serious conversations.
Is that wrong?
Third-party services are temporary. Hardware lasts forever. If hardware attestation comes at the cost of ephemerally-usable hardware, it's not worth it. It's certainly not worth forcing it onto devices that would otherwise be usable, but instead become landfill because their previous IT team went insolvent.
People can (and should) get mad at this, and doing so with the Open Source community is not a mistake. Open Source represents leverage (AKA "Freedom") against corporations that would otherwise harm you for profit. You can excuse this behavior with all sorts of DRM and anticheat, but you'll never win until the kernel stops processing digital input and output. It's a snipe chase, and it's not worth pretending it's not a power grab.
Note, however, that as Apple takes back all products they’ve ever produced for electronics recycling, in each case where an Apple product does reach a landfill, that could have been avoided. If, as in your example, an IT department refuses to recycle Apple electronics responsibly, then that’s not sufficient to declare repurposeability a landfill-prevention measure. So I worry greatly when I see such arguments refer to Apple and landfills, because they’re easily undercut, and that’s then used as an excuse to ignore the repurposeability debate I that I consider most important here.
People want to hold Apple (the world's richest company) accountable. Why shouldn't they?
Using this “Apple products in landfill” sensational headline to make the regulatory case is easily defeated by Apple PR, however, so find an argument that holds more water. For example: what’s the recycling story for Microsoft, Samsung, Google, and Lenovo handheld and laptop products? Do they all take back any of their mobile computing products for recycling? If not, using whichever of them refuse to recycle as an example will go a lot further towards making a case for regulation than using the one of them that takes back absolutely everything.
If you want Microsoft’s online gaming services to trust your computing environment in ranked competitive play, then you may find that booting with a self-signed certificate in your HSM isn’t sufficient for them to allow you into ranked play; they might choose to require a Pluton HSM. That has nothing to do with “open source”, though; the signing keys stored in an HSM’s secure vault are not part of its schematic or software source code, any more than the SSL certificate for a Wordpress blog hosted on Linux is part of the Wordpress or Linux source code.