Comment by charcircuit
3 months ago
Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.
3 months ago
Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.
Pray tell, how might you get them to trust your signing key? Do you just email Mr. Pichai and ask nicely, is that enough?
I would try reaching out to the Recaptcha team so you can create a legal contract around what guarantees and compensation are needed to get your key trusted.
But that would only be possible for large companies. If I'm just tinkering with my own Linux distribution for fun, Google won't even bother responding to my request.
The intention behind it doesn't matter at all. In the end, it just means that only a few major operating systems are allowed, and the market is divided up among the established manufacturers. Anyone new to the market faces a major problem right off the bat, and trying to build something yourself doesn't work either.
Not sure if you’re being deliberately obtuse, but a signing key means nothing by itself. What exactly do you think is being attested TO?
Thats right: that the user can’t do what they want with their own device. Obviously your key wouldn’t be trusted if they could.
There is no other conceivable purpose that attestation could serve.
> Not sure if you’re being deliberately obtuse
Yes, they are. If there's a thread on HN about user-hostile features, you can be pretty confident that they've written a comment defending it.
There are many changes that are possible which do not harm the integrity of applications.
>the user can’t do what they want with their own device
In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account. Once other people are in the picture you can't always have your way.
> Attestation isn't against being able to do whatever you want with your own device.
“Prison isn’t against being able to go wherever you want.”
> There are many changes that are possible which do not harm the integrity of applications.
“Well there’s a lot of places you can go in prison, you just can’t leave.”
Uh-huh.
> In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account.
This is completely incoherent. You and I both know that a bank refusing to give away someone else’s money has nothing to do with being able to run whatever code and operating systems we want to on our own devices.
Obviously the decision happens on some remote server which would require a username and password to authorize. It doesn’t matter one bit what piece of code sent it over.
2 replies →