Hacker News Reader

Comment by immibis | Hacker News Reader

The TPM allows Hollywood to verify that you're running an Approved(TM) operating system. It's also very useful for WEI, which is web DRM - it allows Google to verify that you're running an Approved(TM) operating system and browser.

Linux will never be approved, unless it's heavily locked down, by the way.

View on HN

For what it is worth google has fortunately abandonded the WEI proposal, a quote from the README of https://github.com/RupertBenWiser/Web-Environment-Integrity/

  NOTE: This proposal is no longer pursued.
  Thank you for all the constructive feedback and engagement on the topic. An Android-specific API that does not target the open web is being considered here.

The android specific proposal is only adding support for it to WebView, which developers actually could already by combining the WebView and play integrity APIs, so that as much as I don't love it that doesn't seem too terrible if it is just saving developers from writing some boilerplate code to connect the two. Here is the recent discussion about the WebView changes https://news.ycombinator.com/item?id=38118627

If it's that simple, can you point at a single example of Hollywood using the TPM for access control?

I forgot all new technologies spring out of the ground full-formed as soon as they are possible. They haven't done it yet. But look at Google's WEI.

You can also look at how any other DRM works. It's all based on hardware and software locks very similar to what TPMs do.

TPMs have been widely deployed for around a decade. Widevine doesn't use them - it makes use of the protected video path hardware built into the GPU or motherboard chipset.

As far as I know they only became mandatory with Windows 11, so give them a few years to become universal.

Windows 11 was the first release to enforce anything at the OS level, but Windows client sticker certification has required them since 8.1, released in 2013. As a result almost all Windows client systems in the wild have some form of TPM by default (in most cases running on the ME or the PSP)

Indeed, more systems than have the existing PlayReady 3000 GPU mechanisms.

But services still use that rather than a TPM, because a TPM is useless.

That's a lot of words to say "I don't know."

Reply on news.ycombinator.com