The whole project isn't targeted at end-users. It's IoT, businesses, hospitals, government agencies, utility companies, etc.
We need to stop seeing us (as private end users) as the centre of the world and start to acknowledge that there's hundreds of millions of PC devices out there that don't serve private end users. It's the security needs of these organisations that are addressed by this technology, not yours, not mine.
The unfortunate truth is that Windows is still the backbone of many government agencies, power plants, hospital IT, businesses and so on.
It's also a fact that most of these machines are not well managed, lack updates , aren't hardened or secured in any way and are targeted by cyber criminals on a daily basis; sometimes with grim consequences. It gets even worse when you look at IoT and the mess that manufacturers get us into (default passwords, unsecured data transfer, ...).
I see this chip in the same area as Intel's vPro, TPM 2.0, AMDs ASP (in their Ryzen PRO line), and so on; not necessarily aimed at end users (aside from the occasional buzzword) and more aimed towards businesses and government users (as part of their Zero-Trust initiative).
> The whole project isn't targeted at end-users. It's IoT, businesses, hospitals, government agencies, utility companies, etc.
> It's the security needs of these organisations that are addressed by this technology, not yours, not mine.
It's perfectly fine to let a sysadmin lock down a computer to reduce what the end user can do.
None of these use cases or security benefits require taking power away from the sysadmin. And that's what the argument is about: not whether the end-user is losing control, but whether the sysadmin is losing control. With the obvious note that lots of home users are their own sysadmins.
> I see this chip in the same area as Intel's vPro, TPM 2.0, AMDs ASP (in their Ryzen PRO line), and so on; not necessarily aimed at end users (aside from the occasional buzzword) and more aimed towards businesses and government users (as part of their Zero-Trust initiative).
Those are basically fine, as long as they can be disabled when not needed.
But if I'm forced to give someone else special beyond-root access to my device for DRM purposes, that's not acceptable.
> None of these use cases or security benefits require taking power away from the sysadmin.
Yes, they do! That's the whole point of the product. Why would you even trust the sysadmin in the first place? The fact of the matter is that a lot of data leaks have been caused by insiders - either willingly or via social engineering.
This technology provides a method of closing this loophole and aims to enable users (not private people) to have a secure domain that not even someone with physical access to the system and all administrative privileges has access to.
Whether it works as advertised is another story of course, but the gist of it is that no one is to be trusted; especially not the sysadmin.
> With the obvious note that lots of home users are their own sysadmins.
Again - this is not primarily targeted at home users. Plus the vast majority of home users don't even know what administrating a system even means. And TBH - why should they? "It just works!" has been a very successful mantra for this one company what sells iPods and such...
This might be hard to grasp for some greybeards, but hardware security by design is worth more than security cameras, NDAs, background checks and good work ethics.
> But if I'm forced to give someone else special beyond-root access to my device for DRM purposes, that's not acceptable.
And that's fine and you are free to not use these products then because they're not made for you anyway. This is not consumer level hardware (at least not yet).
Its fine to say dont buy such hardware. The concern is what happens if thats all AMD, Intel and qualcomm sell to people. Apple already does this with the iPhones and tablets, and unless you find a bootrom exploit good luck running an other OS on the device.
You also start running into problems where more software and content may require such hardware.
> Apple already does this with the iPhones and tablets, and unless you find a bootrom exploit good luck running an other OS on the device.
These devices are not general computing devices (according to Apple), so in their mind that's fine. It also makes no difference to the customer since alternatives exist.
The fact that pretty much all other products in the smartphone and tablet market are inferior in terms of hardware, quality and software doesn't matter.
> You also start running into problems where more software and content may require such hardware.
So? If anything, this opens a market for software and hardware that doesn't require it, don't you think? For every Steam and Epic Game Store there's a Good Old Games [1] is what I'm saying. Just another great reason to support and use FOSS, no?
> These devices are not general computing devices (according to Apple), so in their mind that's fine. It also makes no difference to the customer since alternatives exist.
Yeah, well, if that's all it takes, then we'll probably not have any more "general computing devices" being sold in a few years. (Where did I hear that before?)
This argument of "trust no one, not even the sysadmin you employ" is actually "trust no one except me and this black box I'd like to sell you".
Even ignoring the externalities of this kind of push I don't really see the value.
> This technology provides a method of closing this loophole and aims to enable users (not private people) to have a secure domain that not even someone with physical access to the system and all administrative privileges has access to.
Whether it works as advertised is another story of course, but the gist of it is that no one is to be trusted; especially not the sysadmin.
Who exactly is the user in this scenario? Who exactly sets the rules that the pluton architecture should enforce here?
> And that's fine and you are free to not use these products then because they're not made for you anyway. This is not consumer level hardware (at least not yet).
I don't understand why you are so sure about this not being intended for consumer-level hardware. There are plenty of scenarios where locking consumers out of their own devices would be highly desireable from a business perspective - DRM being only one of them.
> Consoles are absolutely general computing devices.
Repeating a false statement doesn't make it true.
A general computation device is a device that manipulates data without detailed, step-by step control by human hand and is designed to be used for many different types of problems.
A gaming console is strictly not designed to be used for many different types problems. It's a piece of hardware designed to run a specific vendor-sanctioned class of video games and in some cases provide limited media playback capabilities.
It uses specially designed hardware for that purpose, which is different in many ways from general computer hardware (specialised SoCs, proprietary storage solutions, etc.).
Sure, it's perfectly possible to use a passenger jet as a demolition device for multi-storey buildings, but that doesn't mean that they're in same device class as demolition equipment. The type of a device derives from its intended use, not potential uses. That's why a nail gun isn't sold as a hunting weapon even though it ticks almost every box of being a firearm.
Without those pesky users computing wouldn't be as successful. Windows isn't secure enough to use it in government or IOT in my opinion, aside from office software for clerks.
But if it is not aimed at end users, I am sure a simple switch will help. Somehow I doubt we will see it.
Consoles aren't general computing devices, though.
Apple disagrees with your idea of ownership, too ;) and so do the customers who Pluton is targeted at - https://www.microsoft.com/en-us/windowsforbusiness/windows10...
The whole project isn't targeted at end-users. It's IoT, businesses, hospitals, government agencies, utility companies, etc.
We need to stop seeing us (as private end users) as the centre of the world and start to acknowledge that there's hundreds of millions of PC devices out there that don't serve private end users. It's the security needs of these organisations that are addressed by this technology, not yours, not mine.
The unfortunate truth is that Windows is still the backbone of many government agencies, power plants, hospital IT, businesses and so on.
It's also a fact that most of these machines are not well managed, lack updates , aren't hardened or secured in any way and are targeted by cyber criminals on a daily basis; sometimes with grim consequences. It gets even worse when you look at IoT and the mess that manufacturers get us into (default passwords, unsecured data transfer, ...).
I see this chip in the same area as Intel's vPro, TPM 2.0, AMDs ASP (in their Ryzen PRO line), and so on; not necessarily aimed at end users (aside from the occasional buzzword) and more aimed towards businesses and government users (as part of their Zero-Trust initiative).