Hacker News Reader

Comment by jmclnx | Hacker News Reader

I did not view the video, but I believe "General Purpose Computing" is coming to an end. With everyone moving to Cell Phones plus the boot lockdown (Secure Boot) and things like Intel ME, TPM, future is not looking too bright. And I heard Microsoft is requiring some new addition to Chips that Windows will need which seems to be a kind of backdoor (I forgot what it is called).

I am sure many people here have seen this, looks to me this is the direction society is slowly heading towards:

www.gnu.org/philosophy/right-to-read.en.html

View on HN

> And I heard Microsoft is requiring some new addition to Chips that Windows will need which seems to be a kind of backdoor (I forgot what it is called).

It's called Pluton, and (scarily) there is not much public technical information about it.

Intel should be figuring how to fix sleep on their chipset, the company is managed by idiots and we just injected them with billions of tax payer dollars so they can continue this b.s.

I heard this before, with another name... around the 00s so "back in the day" some 20 years ago

I think that ended up as some sort of trusted computing project; we were worried back then that linux was gonna be impossible to run in our PCs... well then PCs turned into smart-phones and even though they run linux (or iOS), we ain't choosing what they run

the name was something with a P? like palladium or something that has no P but sounds somewhat like that?... I'm saying I don't remember.

You are correct in the name, Palladium. https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...

Just some links for the lazy:

https://learn.microsoft.com/en-us/windows/security/informati...

https://www.howtogeek.com/779095/what-is-microsofts-pluton-s...

Note that none of this is technical information; it's just broad descriptions of the sort that you could've written in 2005. It's not clear in your links, but I think Pluton updates work like microcode updates.

There's a nice quotation from the end of the How-To Geek article:

> As long as these measures don’t prevent us from running software we actually want to use, Pluton is a welcome development.

Yeah, I wasn't trying to editorialize on this. I honestly didn't know about Pluton, so I just included a couple of links to newcomers like myself.

Indeed, Pluton could be beneficial, assuming you are on the side of fully trusting the Microsoft ecosystem front-to-back. Or scary if you don't trust the old 'Softy.

That being said, Apple's M1 architecture has a similar security chip installed as well. Some people legitimately want these walled gardens. We here at HN are probably more on the fringe side than the majority.

Very few people outside Microsoft want these walled gardens. They want the guarantees that the walled gardens can give them.

It's an eternal trade-off explored in much fiction. The Browncoats v Alliance in Firefly or the Rebel Alliance v the Empire in Star Wars, or the Vickies v anarchists in The Diamond Age, and many more. We want both the stability and humanity and safety of a cultured, controlled civilization, and the creative, exuberant culture that can be born out of periods of chaos. On a personal level, this implies we all want to live on the right side of the tracks, but have the option to party on the wrong side of the tracks.

I think the rebels have to do better, to wit, they (we?) have to work smarter to make software that's just as functional but with far less code, so that it can be audited by an actual human being. Software engineers take a blase attitude about dependency bloat, but that must change. We also need to be ready to run on open hardware when it is released. Last but not least, we need to invent a way for the best hackers and geeks to sift through the software we run, people we trust to find flaws and exploits and not use them. I, for one, would gladly pay for this service, and I think thousands of others would, too.

and (scarily) there is not much public technical information about it

What little there is, and even articles that are occasionally posted here about the dystopia it'll bring, seem to have vanished and/or be taken over by corporate mouthpieces spreading FUD in the comments. I can only see that as being the industry trying very, very hard to stop any dissent.

That doesn't sound too good. Last time some project was called Pluto it was a continuously radiation spewing nuclear ramjet.

> looks to me this is the direction society is slowly heading towards

It's not, notice how easily it was circumvented in the story. In reality, it would not be possible to lend Lissa the computer with books, because there would be continuous FaceID checking who is the real person staring at the screen.

Also, in the story, "ten percent of those fees went to the researchers who wrote the papers", that would be a great upgrade for the current world.

General purpose computing was never really what the general public wanted. We might go back to general purpose computing for hobbyists.

It is in our best interest to make the general public want general purpose computing (and make general purpose computing useful for them).

You're going to fight an uphill battle on that one.

In my experience the general public's notion of "general purpose computing" is "Well, my phone can do everything I need, isn't that general purpose computing?"

> "Well, my phone can do everything I need (...)"

Is something that's being said only in advertisements, or by people conditioned by modern mass market tech to feel helpless, and define their needs as subset of what they know how to do on their device. In my meatspace circles, the people who say "oh my phone does everything that I need" tend to regularly ask me to help them with stuff they need, but their phone (or their knowledge of it) is, in fact, insufficient for.

"Sick of being forced to watch pesky ads instead of the video you actually want to see? General purpose computing is the reason you can."

I think it is the contrary. All our industry relies on general purpose computing. I don't believe the walled gardens will ever grow beyond the most trivial usages of these devices. I believe that a lot of people won't interact with computing aside from their smartphones.

Lots of people i think would happily accept a global authoritarian regime as long as it told the right stories about how it was Making The World Better For Everyone <3

And another population that would accept such a regime as long as it was making the world a worse place for the sort of people they don’t like.

I'm not convinced these are distinct populations.

More details can be had in The Digital Imprimatur (from 2003): https://www.fourmilab.ch/documents/digital-imprimatur/

I oddly disagree. I mean the trend is definitely there, but last time I checked unRaid can deal with TPM ( so clearly there is an interest from motivated individuals to defeat that trend ), cell phones are actually even more interesting as they were kinda locked in to begin with and we are slowly seeing competition from non-duopology sources ( purism, pine ) and degoogled OSs..

The war is there, but it seems not all is lost just yet.

TPM and secure boot will certainly create a caste system of devices. You will only be able to run your banking app on approved devices, just like we can see on smartphone.

There are defensible arguments for secure boot, but they all thoroughly miss the larger picture in my opinion.

That said, I do believe that Windows will loose some endusers finally. Not the masses perhaps, but as long as there is an alternative, I am happy. If some apps forces me to use a specific machine or OS, I will not use it.

I think it’s important to understand why these trends are happening if you want any hope of reversing them. It’s not just some incipient evil spreading its shadow over computing that we need to address. These technologies represent an advancement in the field, but the control of them is out of our hands.

The components you are referring to confer a clear and important benefit to devices – a secure boot chain. This is the most foolproof way we know to prevent tampering or hacking a device.

The problem is that some of these secure boot chains don’t allow being overridden by users. Many do – the Pixel series of phones, the M-series of Apple laptops, and Windows S devices all allow “turning off” or “hijacking” their secure boot chains. The further problem if you can turn off secure boot is that these pieces of hardware often can’t then be turned back on with a different secure boot chain – say, one based on open source software. Debian and NixOS and other OSes already have zero-trust ways of verifying the integrity of their software using reproducible builds, but they can’t go the step further and have the hardware it is installed on do the same verification with some sort of signature.

GrapheneOS has figured out how to do this, and it leverages the secure boot chain of the Pixel device. It is very cool and I think a nice symbiosis between the hardware and open source software: https://grapheneos.org/build#generating-release-signing-keys

The next and more problematic part of what these technologies provide is integrity, which is the guarantee that on top of the boot being secure, the software being run is from the manufacturer and it behaves as the manufacturer intends. A lot of functionality currently relies on this guarantee of integrity: anti-cheat software, DRM software (Widevine, HDCP), transit cards, credit cards, driver’s licenses, etc. The technology manufacturers aren’t building this software because they want to, but because they have to. The Original Sin for the iPhone was carriers: at the time in 2008 they were really worried about unlocking and tethering, and the prank of the day was to put a flashlight app into the App Store that allowed tethering via a proxy. Rights holders, carriers, game manufacturers, etc all pressure tech companies to use integrity to solve their problems.

Many of these solutions have alternatives that don’t require OS integrity: if the government issues signed digital IDs, for example, then it wouldn’t matter what software is running on the phone. Some are tough and don’t have alternatives, like anti-cheat and DRM. DRM in particular is a complex US legal issue: anti-circumvention is straight up breaking the law. No solution would be comprehensive without changing the law.

Progress has been made, though! The fact that we have figured out ways of unlocking boot chains in a way that is acceptable to all of the large companies is awesome. Apple does it by being able to guarantee other secure boot chains on the device remain intact, and Google does it by ensuring the device is wiped. This took real engineering effort to do.

It’s important to push these companies to go further. An M1 iPad is almost identical to an M1 MacBook in hardware, and yet Apple only allows the latter to run Linux.

The comment is already a blog post, but another big problem is that these tools are great for anti-competitive purposes… which the government is increasingly taking a look at.

> I think it’s important to understand why these trends are happening if you want any hope of reversing them.

Why? Because we let it happen. We keep buying these things that have this function as a feature. The answer is simple but it demands dedication and resilience.

Simply stop buying them and using them. Yes, a boycott. There is no other answer because they are making ton of money doing things this way and the one;y way they will stop is if we stop making it profitable for them.

You need across-the-board regulation, things like right-to-inspect-and-repair rules written into law, enforceable by independent parties via civil lawsuits in law courts - and that's because the entities involved have monopoly/monopsony power in the markets.

At some point, it's like telling people who don't want to drink dirty water that they should boycott their one and only water provider.

Boycotting doesn't work. It never does, it never did. Neither in tech nor anywhere else.

Maybe there would've been a chance if it was easy to prove that for every TPM chip they have to manufacture, they need to kill a small kitten. Or, if computing hardware was a commodity like a laundry detergent, so you could just choose an alternative that has near-identical specs, near-identical design and near-identical price, but comes without that one feature you don't want.

The companies don't care what you think, because this is a supplier-driven market. As a consumer, you can only choose out of what's available on the market. There's only so many players; barriers to entry are high, and they corrupt those who scale them[0]. They're going to keep making money and keep telling you what to buy, because they know you have no other choice.

----

[0] - You need a lot of up-front capital to start a hardware or software business. You're not going to pay for it out of your own pocket. The kind of people that will happily lend you money? They're the ones that will make sure your product fucks end-users over in every way possible, because they want to maximize returns on their investment. So even if you started wanting to do good, you're unlikely to be still doing it if you succeed.

Boycotting is not a practical solution for so many reasons for so much of the technology we use every day.

It represents a black-and-white way of thinking about the problem when the entire point I am trying to make is that everything is gray and if you work in technology you need to understand the different shades of gray better.

> The further problem if you can turn off secure boot is that these pieces of hardware often can’t then be turned back on with a different secure boot chain – say, one based on open source software.

Is your statement meant to be inclusive of, say, all laptops? I was under the impression that one can setup a machine to boot using personal keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/

I don't consider UEFI Secure Boot to be on the same level as these other secure boot technologies because it doesn't help in the face of physical access to the machine.

The process of being able to use your own keys is certainly cool, but it is less impressive if anyone with physical access to the machine can also do that

A QA friend of mine remarked that he was amazed that the loss of general purpose computing capability would be accomplished simply by a change in form factor.

Smartphone OSes have propogated their own curated walled-garden app stores, and then the desktop OS vendors follow suit. Soon it will simply not be possible to install unsigned, uncertified software on your computer, and that will be the end of GPC.

> Soon it will simply not be possible to install unsigned, uncertified software on your computer,

Microsoft Windows has had that for a while. It's called "Windows S".[1] Only software from the Microsoft store can be installed.

The lowest price laptops from Walmart run Windows S.

[1] https://support.microsoft.com/en-us/windows/windows-10-and-w...

Afaik you can switch out of S mode. You just can’t switch it back on again.

https://support.microsoft.com/en-us/windows/switching-out-of...

> Afaik you can switch out of S mode.

Sometimes. For now. Machines in enterprise and school environments often have that option locked out.

Those by definition aren’t your computers.

for now!

And yet with the EU taking a first stab at (smartphone) OS lockdowns, it’s guaranteed most of the top comments here on HN are just buckets of vitriol being poured on it. As happened with the EU forcing a universal charging standard. Or privacy protections.

It such regulation comes, it will be taking away freedom to take away freedom from the free market. Interesting concept, and interesting mental gymnastics will be done.

Case in point.

I cannot fathom how Americans can point at the EU successfully forcing phone manufacturers to switch from 40 different types of proprietary chargers (we used to have different chargers for different models within a phone series ffs) to 1 and say “wow fuck the EU for taking away the freedom that obligated me to have a dedicated charging drawer”. That is the true mental gymnastics.

Same with privacy. What sane human thinks “yes please, farm, process and store into perpetuity all the intimate data points of my life”..

The issue is we were already down to 3 different plugs - micro-usb, usb-c and lightning. Most android phones are already usb-c, so it's a pretty blatantly targeted measure.

I'm mostly concerned about it locking out the development of new standards that aren't USB, even if that was an unlikely development anyway.

> Most android phones are already usb-c, so it's a pretty blatantly targeted measure.

That's because, not in spite of the measures taken by the EU, which happened quite a long time ago.

Which is why I desperately want someone to build a board using a Yosys/nextpnr-supported FPGA and having loads of RAM. Half a gig is a typical maximum for such boards - with access to more generous amount of RAM building an entirely self-hosting RISC-V based computer becomes plausible. OK it won't be fast, but it will be Free. (Of course that might not help much if the wider internet - or particular critical services - starts to require remote attestation...)

I think such solution is not needed now -- even if all the vendors started selling only locked-down computers tomorrow (realistically I think the fastest transition may take 10 years, you not only need to implement this at motherboard/CPU vendors, but also within all these corporations that have their own servers and thus depend on running custom OSes), you still have loads of current hardware that you can use until it breaks, let's say another 10 years. Should the problem arise in 2035, you will have completely different FPGA/ASIC possibilities available by then, and current FPGAs are no longer manufactured.

I hope it's never needed - but I'm also alarmed by how quickly certain transitions are happening (perhaps I'm just feeling especially pessimistic about the rate at which we're sleepwalking into a tech dystopia because a fortnight after the local supermarket installed a bunch of self-checkout terminals, HSBC announced the closure of over 100 UK branches, including the one I use!) We already have Pluton-equipped laptops with the 3rd-party signing key disabled by default - it's not a huge step further to remove it entirely. So yeah, I hope it's never needed, but "hope for the best, prepare for the worst", and all that!

I would love to see that come true in the future but sadly nowadays the best way to have a fully free system is to use older hardware and stock up in spare parts to keep it running until an alternative pops up. Or one of those workstations with an IBM POWER CPU, but the price point is out of reach for most consumers.

We thought Apple was unlocking the smartphone’s potential, not locking the computer’s.

We can still build our own computers and software from scratch if necessary.

The problem is that you will need software/services that only run on the "trusted" platform. An early example of this are services that require "apps" that require Google Services on Android, detect rooting or even require remote attestation.

I do not believe it is possible to watch high resolution content from Netflix on Linux.

Last I checked it was still possible to get up to 1080p through a FireFox addon; but you're right that anything higher (or officially supported) is locked to Windows.

Amazon has the same meassures. I should really cancel my substribtions just because of this crap...

In that case we would need to use services (assuming they are actually needed) that respect freedom, or create them or find alternative ways to meet the same need.

> In that case we would need to use services (assuming they are actually needed)

We're talking about things like banking. Yes, some of this already affects services that are needed in practical sense to function in modern society, and it'll affect more of them over time.

> or create them [services that respect freedom]

Impossible, because the market is highly competitive, so services respecting freedom have no chance to survive for long, which also means almost no one is willing to try making them - and more importantly - funding them.

> or find alternative ways to meet the same need.

Increasingly close to impossible in a practical sense. Observe how many things are increasingly becoming mobile-first or mobile-only.

Banks, again, are a litmus test: there are plenty of new ones that don't have a web interface or physical presence, and the more traditional ones all strongly push users towards being dependent on the phone app (even if used only as an auth tool, it's still a hard dependency), which of course will happily use hardware and remote attestation to ensure you're not using a device that isn't a pristine, unmodded version of what the corporate world wants you to use.

It may be difficult, for example it may require starting a new bank, or outright impossible, when most people you need to communicate with (e.g. for business, or hobbies - but of course you can go living in the woods) are on some proprietary communication platform (think of WhatsApp/Facebook). Other times it may be "just" wildly inconvenient, e.g. when all taxi services, bikesharing and public transport in a given city will be available only through an "app". As another anecdote from real life, the 2022 AMS meeting (https://annual.ametsoc.org/index.cfm/2022/about-the-meeting/...) required "daily health survey" through a "CLEAR app" to attend.

Therein lies the whole point.

Last time I checked, we couldn't even fab something approaching the complexity of a 4004 or 6502. Until we can do that, we are not truly independent as hobbyists.

Why do you care if other people are using cell phones? You can still build your own general purpose computer, and even if Wintel no longer suits your needs, there are many other options.

Reply on news.ycombinator.com