Hans-Christoph Steiner @eighthave@librem.one

A practical way to break #Android #hardware #attestation https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

The "trusted device" debate reminds me of the late 90s debate whether its possible to #trust the #network. Its now clear that good security requires not trusting the network.

From where I sit, the "trusted device" debate is the same. Big companies are lazy and pretend the device can be trusted while companies pushing #DRM and other anti-democratic, anti-user functionality want #finance and #government as allies

"Should we #OpenSource something that has the ability to kill humanity?"

That is the wrong question, akin to saying: "Should we allow the most powerful #tech to be democratically controlled?". Humans have invented means to #kill #humanity before: #nuclear and biological weapons, and they were used. They are so horrific, basically all countries work to ban them. If #AI leaders believe it also has this power, shouldn't they also be working on non-proliferation?

https://www.bbc.com/news/articles/cz97ljy91zxo

@stf a couple decades ago, I ran some really long ethernet. I think the slower speeds have longer ranges. I think I did 10mbit at 100m. At the PoE injection point, add a powered switch as a repeater to get another 100m of range.

@daniel Oh this is interesting. Does that mean that Google thinks that their LLM scraping might not count as "fair use"? Is there any reporting on this?

@alsutton @postmarketOS sounds like you are proposing some kind of government ID check, then, albeit via the domain name registrar. Also, there is no natural link between a domain name and an app, that has to be invented.

@mro if the signing key is the root of trust in the developer, then it is important to know that the developer understands that and takes it seriously, and doesn't just give away the keys to the root of trust.

@alsutton @postmarketOS This would specifically link the app and the domain name. That would give the app signer's pseudonym a website/email link, building a more complete pseudonym profile. But I can't see how that would change anything for when the user wants some method of verifying the developer. Linking to someone's government identity does make it easier to track down the actual people who are involved.

@mro I agree, highlighting the role of the signing key seems key. An app signing key is in effect a pseudonym. The hard part is that there is that there is no concrete way for users to verify what the key management practices of the developer are. Judging that from the outside means looking for any signs that the signing key was misused. If a dev wants to hide misuse of their signing key, that is pretty easy to do. For example, they could sign malware and only ship that to targeted users

@jexner your formulation seems like its going the right direction. On one hand, in the world of financial accountability, "know your customer" and showing government ID is normal. Borrowing an established practice makes sense when it works, but it doesn't feel right to apply that to developing software. I don't think the requirements are the same between finance and software, although sometimes similar. I haven't found a good breakdown though that maps that out.

@jexner Can the human be anonymous while the "dev" is public? Clearly, we want the apps we use to be maintained by entities that we can trust. Are given names required for that? I think clearly not. For example, non-profits. People trust #EFF as an entity, even without knowing who everyone works there is, and whether the staff changes. So the entity can be trusted separately from human participants. I think developers are similar. Many trusted FOSS contributors operate under pseudonyms

@rene_mobile @marcprux @fdroidorg @GrapheneOS @lehtimaeki @ottok @grote

You are all people who have specifically thought about this kind of stuff in relation to software distribution, what do you think?