alex7734

I don't think it is that much more secure, given that in this case "something you have" is bolted onto the machine you're attempting to protect and that a sufficiently long password provides enough space to make brute forcing impossible anyway.

In my opinion all the TPM achieves in this case is ensuring you lose your data if the machine dies (or if some OS update fucks up and doesn't properly ensure the TPM acknowledges the new version as valid).

That said it does help against the so called evil maid attacks, given that it would lock itself out if anyone modifies the OS, so if that's part of your threat model then it is useful, I guess.

If you're going to use a long password there is no point to using the TPM as the length of the password itself is enough brute force resistance.

"Please watch this 20 minute ad to continue using your EvilCorp Eye Replacement"

> Capcom notes that "mods that are not officially supported by the game are impossible to distinguish from cheat tools, implementation-wise." But Capcom then talks about the "reputational damage caused by malicious mods," which can be "detrimental to the company."

That's like saying that if I paint my Ferrari pink I'm damaging Ferrari's image. Which may be true, but fuck you, it's my Ferrari.

After I purchase a product it's mine to do as I wish. I don't see why software should be any different.

In a sane world this would have to be satire, but unfortunately I believe every single word of this

The company I work for recently had the beautiful experience of having Windows Defender delete our program from many of our customers computers during the weekend, with the consequent support calls the next day about "your program does not run and I'm losing money!" and the headache of having to find out why the exe is magically gone, since the antivirus going crazy is the last thing you think of.

"Thankfully" it seems they did a progressive rollout of whatever version of Defender that detects our software so we didn't get every customer angry at once, which would come pretty close to a business ending event.

So yeah malware seems an adequate word to me. Especially since there's no way to find out what heuristic we're tripping and no one to ask for help so there's no guarantee that this won't happen again in a few weeks.

> and letting purchasers decide to buy it or not with full knowledge

Consumers never have full knowledge of the quality level of whatever they're purchasing, much less in something like a house that is not standard and has to be adapted to the place it's built in.

At least with a law setting minimums, if you're lucky, you can sue if it doesn't meet them.

Well, yes, I explained myself horribly.

What I meant is that most people are way more sensitive to graphics than anything else. A lot of people will never play a game that is ugly but don't seem to mind laggy inputs.

There are a lot of games that, even without "real" input lag, have tons of animation dampening/inertia to the point that it makes them IMHO unresponsive, just to improve the "cinematic feel" and avoid characters instantly changing direction.

If you prefer responsiveness to having the player character spin be perfectly smooth, well, sucks to be you, because prettier games sell better.

Obviously this doesn't apply to fighting games or competitive shooters or anything like that where responsiveness is the point of the game.

> But if the input is laggy, I'll feel that the entire time I'm playing.

You've already bought the game at this point so most devs don't care.

> It's not like their ad model does better if users lose faith in their results.

Yes but not really: if the results are so bad that they're useless, yes, the users leave, but Google profits maximally when the results are only barely good enough that you don't leave but still filled with a ton of ad-bloated crap.

The problem here is not using propietary software but building your product/business on top of a contract that can be changed by Unity whenever they feel like squeezing you for more money.

Yandex:

https://yandex.com/search/?text=python+endswith

They're short of skilled people that want to work for free basically.

It wasn't that long ago when Microsoft got sued (in the US) for not allowing people to uninstall and replace Internet Explorer.

Something has changed since then that has made US anti-trust much "lazier".

> Oh, so first you print free money and dump it into inflating assets making the rich obscenely rich, and now Joe Schmoe will have to be taxed to pay for it?

> So that's how trickle down at works. Privatize the winnings, socialize the losses.

This has been going on for as long as I've been alive. I don't see how it could be possibly be solved with the system being as it is. If anything, with tech enabling increasingly draconian control over people, it will get worse.

> Why? Because telling a bot they've failed tells them that they should stop trying something that's not working

In my humble opinion if your bot is stuck in a CloudFlare loop for 10 minutes that's a pretty strong signal that something's not working...

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

"Obviously" is a very strong word for what is pretty much your opinion.

As the system was designed browsers are an agent of the user, not of the web servers or the ad businesses. If you want guaranteed ad impressions and control go make iPhone apps. Taking an open system such as the web and forcefully closing it up using overwhelming monopoly power like Google is doing is not only disgusting but also incredibly anti-competitive.

> At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional.

For now. "Entirely optional" can be stretched very far. If you were banned from AdSense revenue and from appearing in search unless you enforced this, it would still be "entirely optional" but also pretty much trash your site unless you complied.

I don't know how it works in the US but in the EU the working class pay a lot more tax, proportionally, than the rich:

In Spain if you work and you cost your company 26430 euros:

- The company pays 6430 for social security (calculated as a % of your salary, so this is effectively your tax even if on paper it's the company that pays it.)

- You pay 1270 for social security (on paper you pay it but the company gives it to the tax office directly)

- You pay 2338 for income tax (on paper you pay it but the company gives most of it to the tax office directly)

- You end up getting 16390 euros, or an effective tax rate of 38%.

This goes up if you pick a higher salary, obviously. If you work and you cost your company 67000 euros:

- The company pays 16300 for social security

- You pay 3101 for social security

- You pay 11582

- You end up getting 36016 euros, or an effective tax rate of 46%.

If you're a freelancer and you work for yourself it's more or less the same but there's also a fixed tax that while not being very high it's hard to deal with when you're earning 0 when starting out. In practice most people just risk it and don't report their activity at first for this reason.

But if you're truly rich, you don't work, you have assets that appreciate for you. Tax rate for capital gains is capped at 26% no matter how many millions you're earning.

This does not take into account that as a rich person you're going to be spending less of the money you earn than a poor person so you're paying less VAT (sales tax) as well.

> it could release highly toxic hydrogen sulfide gas.

How bad is it in real world conditions? Because from what I'm reading it's not the "it makes you sick" kind of toxic, but rather the "it kills you in seconds" kind of toxic.

> No matter what, there's always a way in. There's always a hack. The harder you make it to hack, the more motivated those crazy people at defcon will be to break it.

Absolutely, but I don't want to have to use 0days like a criminal or to open up a TPM chip in an $1M electron microscope just to have my PC render webpages the way I want it to (without ads that is).

> They have a history of killing projects

Yeah that's Google alright

TPM is not designed to prevent intrusion from hackers, it's designed to turn your general purpose computer into an appliance by preventing you, the owner, from modifying the OS in your computer as you see fit (and interact with third party services at the same time, thanks to remote attestation).

It means that instead of _just patching_ the software in your computer to customize it now you have to resort to using 0days to do it like a criminal which makes it considerably harder.

It does help against hackers, of course, and the same restrictions do secure you against some attacks (evil maid attacks) but that's not the intent.

The threat model TPM protects against is:

- You log in into Netflix (or whatever)

- Netflix sends your PC the movie so you can watch it.

- Your PC now has the movie in memory.

- You extract the movie from your PC's memory and you can now watch it forever without Netflix's permission.

What the "trusted" in Trusted Platform Module means is that with TPM they can trust your PC to not let you do that.

Sure, you can convince people to use Firefox and drop Chrome just like IE was dropped back in the day but back then there wasn't a strong incentive to websites to prefer one browser over another (other than convenience).

Here's what I think is gonna happen:

- First the feature is added to Chrome as it is now. As they described they add it with some kind of hold-back or limiting constraint to reduce the outrage until everything is ready.

- Then the media people (Netflix, Hulu, Disney, YouTube...), who have long been salivating for something like this, push the other browsers to implement this. You really only need to convince Safari, as Edge has such a low market share in comparison that they will be forced to fold or be irrelevant (and it's not like Microsoft hates this feature anyway). For reference, Chrome, Safari and Edge make up 89% of market share. Edge alone is only 4%.

- Once the browsers are on board it's time to get the sites onboard. Really most people tend to visit social media sites more than anything else, so as long as you get them onboard you don't need to do anything else, and WEI serves their interests as well (for example it would stop you from scraping Reddit).

- As for the rest of the sites you can just make Adsense not count views or clicks from untrusted users (after all that's the _stated goal_ of this project) and site owners _will_ find ways to get their users to switch to Chrome on their own. You can add a checkbox to Adsense to get it to block your site for untrusted users to make it extra easy if you're feeling lazy.

- The final strike will be Cloudflare. Right now they rely on CAPTCHA to block bots but now they can just use WEI instead. Since most of the web uses Cloudflare now you have a gateway between the user and most sites that will tell you to go away or eternally give you endless CAPTCHAS if you are using a "bad browser".

- At this point all that is left is getting Google to give Cloudflare an exemption to the hold-back feature "for the greater good" or just kill it off at this point because there's no need to play nice anymore.

I'm not optimistic. It was easy to install Firefox and remove the IE icon on your mom's computer back in the day. It's not that easy to tell her to stop watching Netflix, Disney, Reddit, Facebook, her favorite cooking recipe site...

The best that can happen is that the internet splits and the free portion of it stays large enough to be useful. (and it doesn't get DDOSed into the ground)

I find the blatant gaslighting regarding this topic baffling.

> Wisner insists that “WEI is not designed to single out browsers or extensions” and that it won’t block browsers that spoof their identity.

WEI's sole purpose in life is to detect browsers that do things that Google does not like. If it does not block browsers that spoof their identity then what the hell does it do?

Sure, sure, WEI won't block them: it will just tell the web server that you are not using an approved browser. It's not Google's fault if the web server then blocks you! How could they have known?

I would find it slightly more respectable if Google just came out and said the quiet part out loud: "Our profits and the industry's profits are more important than your freedom, so shut up and take it, since you can do nothing about it."

Sneaking around like this is just an insult to our intelligence.

> But as mentioned above, isn't doing so against Google's own self interest?

I don't see how it is against their interest, it would cement Google into power in a way that is very difficult to undo barring government intervention (which I doubt is going to happen).

> It seems like the project is explicitly stating their goal isn't to allow for websites to do this, and they are implementing it in a manner consistent with that.

If you drop a frog in a pot of boiling water, it will of course frantically try to clamber out. But if you place it gently in a pot of tepid water and turn the heat on low, it will float there quite placidly. As the water gradually heats up, the frog will sink into a tranquil stupor, exactly like one of us in a hot bath, and before long, with a smile on its face, it will unresistingly allow itself to be boiled to death.

> If I understand correctly Hulu cannot act unilaterally with the currently planned implementation of this.

Hulu will keep their attestation implementation ready to turn on at a moment's notice because it's patently obvious that the hold-back stuff will be gone when it's ready to go, and it's obvious because the currently described implementation (with the hold-back) does not really serve any real purpose.

The hold-back is only on the spec to keep people from revolting while the thing is built and tested.

At which point you use CAPTCHA.

The goal of WEI is not to get rid of bots, that's just a bonus, it is to remove user control and customization over his own experience.

> the only way WEI would prevent bots would be by preventing you from running the browser on an operating system without 3rd party software installed

Or by isolating the browser from third party software. Android does not let applications mess with each other. Windows already prevents non-elevated applications from touching elevated applications (i.e. running as administrator).

What makes you think that Windows won't add an "untouchable" mode to executables belonging to "approved" browsers? The kernel is already locked down so you won't be able to bypass it that easily.

I've seen people open up all of their users' "private" content to Googlebot IPs just to get rid of errors in Google's search/Adsense console "in case it helps revenue" (as in they didn't even know for sure if it would help, only that it shows up as an "error" in Google's console and red=bad)

All you need to do is to jingle some real, if small SEO/ad advantage and people will bend over themselves to lick Google's boots.

You have to be hopelessly naive to believe that the hold-back feature is going to be implemented as described, if at all, and not quietly removed when the outrage dies down.

And even if it stays as described, the percentage will be low enough that those that fail attestation can be safely barraged with captchas or simply told to go away. (You can try browsing the web with TOR to get a taste of how you will be treated)

The whole post can be summarized as "trust me bro"

They can play with semantics all they want but the point of WEI is so the server can tell apart modified and unmodified browsers at which point the server can tell modified browsers to go away.