Comment by mariusor
12 hours ago
Where does this resigned opinion that open source can not do attestation come from? Do you really think it's impossible to build the attestation mechanisms inside open source OSs?
12 hours ago
Where does this resigned opinion that open source can not do attestation come from? Do you really think it's impossible to build the attestation mechanisms inside open source OSs?
Checking what software a user is running can be done with open source software, but actually doing so takes away the user's right to run modified copies of software. The fact that it basically needs hardware-backed DRM also doesn't help.
I see, it makes sense. But I feel like it is a worth while compromise.
Attestation as I understand it is to allow third parties to trust a user's computing device for purposes of handling their sensitive data (both from the user's and the third party's point of view) in a way that doesn't rely strictly on the user's savvy for keeping everything leak proof.
Even if this data belongs to me - as said user - I still think that the existence of open source attested software is a net benefit in the bigger picture because the future looks more and more dependent on secure computation.