Coreboot Blocked from Recent Thinkpads by Intel Boot Guard

If you mean a security administrator of a large company - it's their computer, not yours.

The hacker movement has been soft on this for a long time. Blind trust in university accounts is a good example. There's really no reason to believe that your university is less likely to snoop on your mail than Google is. There's in fact a lot more reason to believe that an actual human, with an interest in you specifically, may be doing so. Same with files or processes on a shared server. But hacker culture grew in a time where computing required a shared, large investment in a computer, and so there was no choice but to trust the university computer if you wanted to do any computing at all, and that became an accepted part of the culture.

We now live in an age where the personal computer is just about (but not quite) affordable for everyone. We need to shake the idea that you can achieve computing freedom on someone else's computer. Perhaps you can freely compute for them: if you're doing research for a university who's given you an account, or work for an employer who's given you a laptop, by all means, use their computer. The concept of freedom, then, applies to the university or the employer, and you are just their agent.

But if you're talking about personal computing, we need to get a personal computer in everyone's hands. We need to solve problems of affordability and accessibility, but people should no more be reliant on a company-issued laptop than on a university-issued shell account.

Historically, hackers have been very good at taking software that was meant to be secure, and breaking it. As you point out, the Windows kernel was never going to be unhackable. iOS (iPad/iPhone), which is arguably the state of the art in walled-garden verified boot with hardware support, has been reliably jailbroken.

Historically, hackers have been very bad at writing software that was meant to be secure, and keeping it secure.

I'm a lot more confident in our ability, as the hacker movement, to destroy any DRM scheme that wants to use a TPM than to successfully make a general-purpose OS that keeps someone's files secure. And that worries me. If these two were somehow a direct tradeoff (which they're not), I'm pretty sure I'd prefer a world where DRM worked but security breaches and malware weren't an everyday occurrence.

But when done sensibly and used in a system that's under the user's control (incl. that remote service), it's a security enhancing feature.

And people might not be as much in arms about it anymore because the landscape changed: The original Palladium proposal was made in an environment where the only threat model was "consumers 'steal' content".

Today, measured boot is also a legitimate security measure against criminal activity targetted at the user (eg boot kits, extortion ware), which didn't really enter the picture back then.

Secure Boot is a facility of UEFI, the firmware, to restrict which bootloaders and OSes can load, and prevent them from loading if a signature check fails. It makes sure that the firmware knows and trusts the OS.

"SRTM" is a facility of the TPM to inspect what firmware and bootloaders have already loaded and executed, and refuse to unlock an encryption key, attest to the network, etc. if the hashes don't match. It requires a TPM (Secure Boot does not), and crucially it cannot prevent anything from running. It can just refuse to do cryptographic operations depending on what has run. It makes sure that the OS knows and trusts the firmware.

They both have the effect of blocking boot sector malware (although from opposite directions), but the way that they work, the requirements for setting them up, the flexibility you get, and the other threats they defend against are rather different. And complementary, it's often a good plan to use them together to tie a nice knot.

("Boot Guard," the topic of this article, is something else entirely, where the hardware checks the signature on the firwmare. The firmware in turn can Secure Boot if it wants.)