Slashdot Log In
Researchers Looking at Alternatives to Palladium
Posted by
CowboyNeal
on Thu Jun 05, 2003 05:06 PM
from the trust-and-distrust dept.
from the trust-and-distrust dept.
An anonymous reader writes "Some folks at Stanford have been looking at an alternative architecture for doing trusted computing (ala Palladium) based on using Virtual Machines. They presented a brief paper describing their work a couple weeks ago at the USENIX Workshop on Hot Topics in Operating Systems . In their paper they also discuss a bunch of non-DRM applications of Trusted Computing such as distributed firewalls, improving P2P security, preventing DDOS, and even strengthening civil liberty protections."
This discussion has been archived.
No new comments can be posted.
Researchers Looking at Alternatives to Palladium
|
Log In/Create an Account
| Top
| 221 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Well for a start. (Score:1, Funny)
There's nobody stoping... (Score:5, Insightful)
The fact is DRM takes away the PEOPLES' rights to choose who to trust.
Re:There's nobody stoping... (Score:4, Insightful)
DRM lets you send stuff to people you don't trust, because you trust that the software will prevent the people you do not trust from taking actions you wish to prevent.
It has nothing to do with defining who YOU trust.
Re:There's nobody stoping... (Score:4, Insightful)
(http://paperlined.org/)
Re:There's nobody stoping... (Score:5, Insightful)
(http://www.zenzen.org/)
For instance, a book publisher can not sell you a book you're not allowed to resell. They also can not forbid you from reading a book more than once or reading the book to your child.
DRM enables copyright holders to completely eliminate used sales and move the entire world to a pay-per-view world. Even more, it allows the copyright holders to have a perpetual copyright; one that will never expire for as long as the work is encrypted.
You will not "own" anything. Sure technically you own your DRM'ed digital music downloads, but just try to resell them.
The "value" of DRM'ed goods is significantly less than physical goods, but people won't realize that until laws get put in place forcing retailers to mark these goods as such.
Re:There's nobody stoping... (Score:5, Interesting)
(http://www.geocities.com/theLICC)
I saw an ad for a DVD that said "Own [some movie] today on DVD". It did not say, "License [some movie]".
Therefore, they are selling me a copy of that movie. By the doctrine of First Sale, it is mine to do with as I wish, including cracking the CSS or region coding, folding, spindling, or mutilating, reselling to someone else.
The only thing that I may not do is reproduce it for other people, since I don't hold the copyright.
MPAA refuses my money (Score:5, Insightful)
Not only that, but the MPAA commonly encourages piracy.
Let's say I want to see "The Two Towers". It is no longer in theatres, can't go there. It is a LONG time before they sell a DVD; so I can't pay them that way by buying a DVD. The only alternative is to obtain somehow a pirated DVD copy of "The Two Towers".
No way should they whine about money-loss to piracy when they aren't selling it in the first place! There is a demand for their product, and in this example, they refuse to meet it in any way.
Re:MPAA refuses my money (Score:4, Insightful)
So if someone won't sell you something you want, it's ok to steal it? For God's sake, grow up! Learn to wait a couple of months for the dvd to come out.
DRM != Trusted Computing (Score:4, Insightful)
(Last Journal: Sunday September 16, @04:44AM)
The problem is that the trusted layer *must* be small so that it can be completely verified. Applications can't be so easily verified and it would still be possible to compromise Outlook, for example to send unwanted EMail. All the signature does is to say that the software hasn't been modified, but we know that applications don't need bad code to misbehave, they only need the right kind of bad data. Once the code has been signed, it must be signed again verey time it is patched. A far from simple logistical problem.
OTOH, smaller code may be more easily verified - so a driver for a Smart Card reader could be protected, as could SSL. However a programmer can still make a mistake and allow the code to be compromised.
DRM is not automatically bad! (Score:3, Interesting)
a Good Thing (Score:5, Insightful)
(http://transmissionerr.dyndns.org/)
Re:a Good Thing (Score:5, Insightful)
Microsoft does have the power to do whatever they want with their operating system. Yet, for some reason that does not matter to me. I am not forced to use it, see? As long as there are some alternatives (and there are right now if you are willing to learn), I will be fine. More people need to be made aware of the alternatives, is all.
And to everyone who says, but what if Microsoft and some media companies get together to make some kind of system that ensures that content distributed in this system could only be used in extravagantly restrictive ways?
Well, darn, I guess I will not buy that content. I suppose I will just continue consuming media in all the other ways it is available to me that are easier and cheaper.
Some guy asked a better 'what if' recently in another discussion on Palladium. What if systems using this technology are required to access the Internet?
Oh, Microsoft controls the Internet now?
This is just another silly copy protection scheme, nothing more. As are any alternative silly copy protection schemes. Take the tinfoil hats off, folks.
Too bad... (Score:5, Insightful)
(Last Journal: Sunday July 06 2003, @09:07PM)
Guess which one is going to matter?
Re:Too bad... (Score:4, Insightful)
"One is proposed by some folks in Stanford, the other is proposed by Microsoft and Intel.
Guess which one is going to matter?"
Neither.
Re:Too bad... (Score:4, Insightful)
Vulgar Slang (Score:4, Interesting)
1) A safeguard, especially one viewed as a guarantee of the integrity of social institutions: the Bill of Rights, palladium of American civil liberties.
2) A sacred object that was believed to have the power to preserve a city or state possessing it.
I believe that city is called Microsoft.
"Bill of Rights"... whaaaahahaha.
---
At any rate, I have only one more word to say about Palladium. You can read all about that word here [reference.com]
Faking out Palladium? (Score:5, Interesting)
(http://slashdot.org/~Asprin | Last Journal: Wednesday November 05 2003, @03:24PM)
Moreso, would it be possible to fake out Palladium-dependent software by running it in an emulator that simulates the undelying Palladium subsystem?
What does a program REALLY KNOW about where it lives?
Wow, This is JUST like "The Matrix".
Trusted Computing good, DRM bad. (Score:3)
(http://autopr0n.com/ | Last Journal: Saturday August 06 2005, @01:30AM)
Virtual Machines? (Score:2)
(http://www.intelligentblogger.com/ | Last Journal: Monday August 27, @11:47AM)
We have that today. It's called JAVA. (Trolls, take a hike. Even Kreskin doesn't know when Java's dying.)
Other uses.. (Score:2, Interesting)
Viva la Alternatives (Score:3, Interesting)
Personally, I don't think they can pull it off. But with Stanford looking into an alternative now, this means we'll at least have choices down the line. And I'm sure that both sides will look at what each other does and rip off the good ideas.
Security is important and a verifiable identity is as well. Not just for e-commerce applications, either. Even such simple issues as banning some nimrod that wants to post stupidity on your board can be solved by a solid identity model.
Hopefully, one of em will pull it off.
Palladium,DRM = no trust or rights (Score:5, Insightful)
How can DRM "protect rights" when it denies basic rights of fair use?
Re:Palladium,DRM = no trust or rights (Score:5, Informative)
How can DRM "protect rights" when it denies basic rights of fair use?
Ah, but there's the rub. It's not about protecting YOUR rights, it's about protecting the rights of the big corporations. Well not so much their rights as the "rights" they want - i.e. control over your computer and everything you use it for.
Which would you choose. (Score:5, Insightful)
From these guys we get Trusted Computing where trusted means trusted by the guys building the network.
So, which would you choose?
Real meaning of trusted computing! (Score:5, Insightful)
The problem is we are looking at the wrong definition of trust. Most of us have in mind the primary definition: "Firm reliance on the integrity, ability, or character of a person or thing" or "Custody; care"
You have to look down the list to find the definition of "trust" that fits perfectly with Microsoft, RIAA/MPAA and the Palladium idea:
"A combination of firms or corporations for the purpose of reducing competition and controlling prices throughout a business or an industry."
Might as well called it "monopolized computing". Means the same thing.
The problem with Chemistry.... (Score:2)
(http://www.gotsheep.com/ | Last Journal: Wednesday August 13 2003, @11:49PM)
Such is life... technology is conspiring to take away my rights to protect me from myself.
Call my a pessimist, but... (Score:3, Interesting)
(Last Journal: Sunday August 24 2003, @05:04PM)
I find this branch of research and publication somewhat disturbing. As legitimate, morally appealing, uses for this technology appear, the opposition should become less vehemently opposed to the technology. It's the rational reaction for rational people. If you still oppose it, you're probably irrational.
We're capitalists, however. Civil liberties have not been terribly profitable products in the past. The old-world investors will not invest in end-point civil liberties protection technologies, and will continue to put on blinders to the true value in information networks--their end-points.
However, perhaps one or two capitalists out there has realized that (1) networks have no inherent value or use on their own, and (2) people are terrified of being ruled by any network. There's a fucking market for civil liberty weapons: tools to defend end-points, tools to protect individual's rights to connect and communicate with any other end-points, tools to insure security and authenticity between any two or more individuals. Justin Frankel's "Waste" is a beautiful start.
On a related, but off-topic tangent, I've got a new buzz-word: Intellectual Macro-Economics, a way to increase the value of the US dollar.
Here's how it works, in magic-bullet glory: Article 1, Section 8, of the US Constitution provides Congress with the power to increase the artists and scientific wealth of the US, providing a mechanism for doing so (limited terms). The concept is to increase the unlimited common wealth of the US (and probably Humanity), by encouraging the creation of new works. For the last 20 years our cultural wealth has been depleted by private interests, looting the cultural commons, robbing us of the creative wealth to build with. In this, the copyright law is our asset which has been mis-managed, and stopped delivering our wealth. To increase our national cultural wealth, require the creation of new works, and consequently increase foreign confidence in the US dollar, increasing its exchange value, we must repair copyright, patent, and trademark law so that the commons will resume growing, and an immediate idea-influx (through a retro-active term truncation) would have massive midterm-longterm beneficial effects.
Another aside. One side of the IP arguement sees the limited terms as the promotion of progress. The other side (ours, and the one that wrote the damned Constitution) sees the progress as the effect of limited terms: an increase in common intellectual wealth, with a "necessary evil" to promote the production of those works. Bleh. Communications barriers. And you thought it was so fucking obvious, didn't you?
Alan Cox (Score:2)
(http://www.jacco2.dds.nl/)
(What are the chances of two Alan Coxes in this field of business!? Bummer for the other Alan Cox. Probably often mistaken as Linus' lieutenant...)
One posible alternative is ... (Score:4, Interesting)
(http://www.ngranek.com/)
VMs executing signed code? (Score:2)
Why a VM ? (Score:1)
if you need to trust the VM binary, why not trust the very programs you want to trust directly ? because you put the VM in rom ? (or something in ROM is trusting the VM ? but, there, why not verify other programs, even downloaded ?)
Other remark, I though palladium was evil, but not TCPA ?
It's been said before... (Score:1)
(http://durin42.com/)
Boneh and Rosenblum (Score:2)
Drawbacks vs Benefits (Score:2)
(http://netdial.caribe.net/~adrian2/)
Trust is a good thing (Score:2, Interesting)
(Last Journal: Friday August 22 2003, @03:03PM)
So they build their network apps, we build our network apps. Ours are more fun and now can't be spammed, DDOSed, or any of the other nasty things they try.
Not any scarier, just more polarized.
p2p (Score:2)
Wouldn't it be nice if there was a P2P application [earthstation5.com] that had support for SSL, Proxy's and sets tunneling to prevent ISP's from blocking it?
well thats what the link is. It is still in beta and only available for windows so lets E-mail them [earthstation5.com] about porting it. Or maybe one of you sharp coders is looking for a project. I only know perl so I'm out hehe
Security through overworking crackers (Score:2, Interesting)
Security through obscurity-and-a-bunch-of-hard-work-to-break-it. Basically, the first time anyone skilled figures out the algorithms for the hardware, they can help someone make an emulator.
Then, all you need is the key any "trusted" computer uses. So, you brute force crack your own computer's key by having it encrypt or sign some communique to some "trusted" server out there. Then, you intercept the communique. Since you know the algorithms, you try encrypting or signing the communique with different keys until you find a key that results in a match.
Once you have your key and your emulator, you can look at what any program on your computer is doing, change whatever the hell you want, and cause whatever "mischief" you want. Want a DRMed MP3 unDRMed so that everyone on the Internet can have a copy ? Go right ahead. You could probably make a program to automate the process. Want to change something a "trusted" program is sending to a server ? Go right ahead.
OK, So Let Me Get This Straight (Score:2, Insightful)
(Last Journal: Thursday April 18 2002, @07:50PM)
OK, So Let Me Get This Straight... When MS does it, it's Pure Evil (TM). When Stanford does it, it's Happy Fluffy Bunnies. I'm glad we're all clear on that.
Trusted means... (Score:2)
Is that so horrible? If you can't stand the thought of running a program without screwing with it, then don't try to tell other people that that's what you're going to do.
All trusted computing means is that you tell other people that you'll run the software cleanly, and they can trust you to tell them the truth. If you can't stand this level of honesty then maybe you better take a good hard look at yourself.
Suits Me ... (Score:1)
(http://charlieharvey.org.uk/)
Corporate Cops (Score:1)
There is no theft (Score:1, Informative)
Knock off the word abuse. There is no theft involved in duplication.
"Some of us have to make a living, you know"
You forgot a BIG part of computer history (Score:5, Interesting)
No, they started out controlled by men in white coats in clean rooms.
The microcomputer and PC revolution changed all this.
The regressive trend back to "Master Control" started with Scott McNelly of Sun Microsystems. I remember when he first laid out his grand vision of returning everything to central control via the Internet. Java was part of this. Microsoft copied the rhetoric, announcing a time when your Word app and even your Word docs would all be on Microsoft's central servers.
Re:Fuck you crack smokin mods, fuck you in your as (Score:1, Offtopic)
Re:trusted solaris (Score:1)
what's YOUR problem? (Score:2)
(http://www.ecis.com/~alizard)