At CES this week, Lenovo announced that their new Z-series laptops would ship with AMD processors that incorporate Microsoft’s Pluton security chip. There’s a fair degree of cynicism around whether Microsoft have the interests of the industry as a whole at heart or not, so unsurprisingly people have voiced concerns about Pluton allowing for platform lock-in and future devices no longer booting non-Windows operating systems. Based on what we currently know, I think those concerns are understandable but misplaced.
As usual, Matthew Garrett does an excellent job explaining complex topics like this.
To summarize; if you’re not running Windows (and want to run FreeBSD or Linux or Haiku or…) it’s time to buy lube in bulk; because your ability to update firmware will be gone, and if (e.g.) a government seizes your computer for any reason then Microsoft will happily assist by extracting encryption keys in a way that no disk encryption scheme can prevent.
Installing alternative OS on Chromebooks aren`t so trivial also. And making dual-boot, IIRC, made it possible to destroy alternative OS to be destroyed by pressing space.
I’ve hard all this kind of nonsense from corporations and media puffery before. I’m sorry but I have a very high degree of circumspection about this. The whole impetus has been a cross between boiling frogs and being sucked into quicksand. I’d rather come straight out with it and call them liars and go from there.
I have a real problem with men in the tech world and it is a man problem. Cognitively men take far too many shortcuts and have a different sense of risk to women. When men especially start saying “trust me” yet arein an appalling hurry to direct and distract examination as well as gishgallop past slow and careful rounded scrutiny which takes in context and history I get jittery. In fact this whole Pluton scheme and Lenovo jumping on it so fast smack of fait accompli. No. I think regulators need to take a very hard look at this – the patterns, and trends, and reasons and if it means banning this product from sale or import so be it.
Myself I don’t think Matthew Garret is remotely qualified to discuss the security aspects of this topic and I don’t just mean technical but the whole kaboodle including human rights and governance and redress. His enthusiasms may play well in the US economy which is an entirely different thing all of its own and with the novelty hungry tech industry but I suspect EU lawyers would make mincemeat of this.
As for his handwaving in the last paragraph about an alleged edge case and he “doesn’t think”. Exactly. Rigorous philosopher he is not.
3/10. Must try harder.
HollyB,
You may disagree with him and there’s certainly room for debate on microsoft’s motives and governance. But Matthew Garret is one of the most qualified individuals on the subject. It’s largely thanks to his work that we can run linux on UEFI secure boot machines. He is exceptionally qualified to discuss the security aspects of this topic and team linux is lucky to have guys like him.
It doesn’t mean he knows everything about security. You’re just being your usual obstinate self. Take a look at whole of the problem not one niche tech-head area and do some reading around the subject for once in your lazy life. I’m not doing it for you.
Pot, meet kettle.
HollyB,
He has more credibility than you do.
You’re being quite a hypocrite.
I for one am more than happy to talk about security technology with anyone would like to do so in an intelligent way, but you only seem to be interested in berating others.
Alfman? I’ve told you politely before to take a hike and this time I am not doing it politely. Sod off. You’re making big assumptions about what I know or don’t know, you ignore what you are told, and go straight into a big obstructive sulk behind your office politics. You do this every single time. It’s a standard attack pattern with you. There is no consent and I do not find your abuse of male privilege in a male dominated forum amusing.
I’m also not forgetting when you used a typo as an excuse to slip into sexually harassing language Mr Octopus.
As for the drive-by wiseguys I have even less interest in your contributions.
HollyB,
No, this is my community too. I have shown you a great deal more respect than you’ve shown me so I don’t think I’m the problem here. If you have a specific problem then let me know and I’ll try to be reasonable, but I will not be silenced.
Not at all, I don’t assume anything about what you know. If anything asking you questions about what you know is the logical opposite of assuming.
Specifically what attacks though? I don’t know if you noticed but I actually agree with you about Pluton. I responded to your canned criticisms of Matthew Garrett because I don’t think they were fair.
This is a public forum, nobody needs your consent to be here. It’s true that technology is male dominated but I’ve seen little evidence of sexist attacks against you on osnews. If there were I would call on osnews staff to put a stop to it. I really do want to encourage the participation of women in tech, however this does not excuse your own stream of broadly sexist attacks against males.
Mr Octopus? Haha where did that come from? It’s really not my intention to offend you. However asking you questions for more information about what you’re saying is not a good reason to be offended.
No, he lost his credibility when he started shilling for Microsoft and their spyware designed to take control away from things we own.
Carewolf,
I haven’t seen it myself, can you clarify where he does that?
I’d say that disqualifies him from making unbiased statements honestly.
Because he has a vested interest in that ecosystem, and its subsequent further encroachments, as someone that was part of embracing it.
cb88,
But there’s a difference between bias/disagreement/debating things and calling someone unqualified to discuss the topic. There are times I disagree with people like Linus Torvalds, Lennart Poettering, Theo de Raadt, etc. but I don’t accuse them of being unqualified for it. We will always need to keep an eye out for bias whether people are qualified or not,
Edit: just to make the point, flat earth people routinely disqualify astronauts and scientists because their qualifications are sources of bias about the earth being a globe.
Perhaps, however would you consider say Eduard Pernkopf to be a qualified doctor… he arguably made some of the most valuable contributions to anatomical drawings in history, however the means of producing them where horrific and wholly unethical.
Basically you can disqualify someone on an ethical basis just as much as a lack of skill or other qualifications… in spite of exceptional qualifications otherwise and arguably standing up in defense of a platform monitoring “solution” that provides ZERO benefits for the end user is unethical.
Also saying its in the eye of the beholder is a cop out and avoiding the serious issues at hand.
cb88,
Agree with everything here.
He can and should be judged for the things he’s done to harm others, but whether we like it or not he still would be qualified to talk on the subject of his expertise. Say Albert Einstein had been completely immoral, that doesn’t mean we could or should erase his theory of special relativity. His insight into the topic was not contingent upon his morality, rather his qualifications stemmed from his acute understanding of the subject matter.
I get why you might detest a person so much that you’d want to ignore their qualifications on the subject, but in this specific instance I think it’s hard to make that case against Matthew Garrett in good faith.
Am I not covering the serious issues?
Can you go a single post without spewing hate filled misandry? Why you’re still allowed to even comment here is beyond me. You never add anything of value and only bring the conversation down with your nonsense.
Just ignore her. She thrives on stirring shit and being an insufferable human. She posts such vile drivel to rile people up and start an argument.
With HollyB, the only way you can win is by not rising up to her.
It’s difficult though on mobile. It’s hard enough to scroll through the comments and every time she posts one of these deliberately incendiary comments it becomes a big thread.
Thom, could you add a ‘block user’ feature?
I miss the OSnews features of old. To vote down and block user’s comments that don’t try to contribute to the debate, but instead make personal attacks would be invaluable right now.
Yet another reason to hold on to those perfectly usable 4th gen and older Intel machines, and 2012 and older Thinkpad T- and X-series in particular. I have no love for Lenovo given their past misdeeds, but a Thinkpad X230 with OpenBSD or Linux is about as close to portable computing nirvana as it gets, at least for me.
On the other side of things, ARM64 and RISC-V both hold massive potential in HPC and portable/embedded spaces respectively. The amazing work being done by the Asahi Linux team on the Apple M1 has led to some great advances in Linux on ARM in general, and is bound to push ARM64 Linux and BSD support forward. Regardless of how one feels about Apple hardware, this is a good thing.
Well said. I think this way too, and have a storage closet of older components and a bunch of old hardware running a variety of operating systems. Part of it is just the enthusiasm of pursuing a hobby. But it is also partly done in recognition that hardware has been growing more and more user hostile as time goes on. If the trend continues, future generations will either succumb to the pressure, or else they will need better solutions than ancient hardware. This is one reason why the free hardware movement is so compelling and important. There may come a time when this hardware is the only answer to ensuring that my computer works for me alone, and that I am not being spied upon at the hardware level.
It’s an interesting move putting their Xbox security chip into consumer PCs. While their program to pay them $25~ to run your own code on Xbox’s has kept the crackers away, putting it in every PC will likely get it cracked, and thus Xbox security cracked.
I don’t think the pay wall keeps them away, it’s the effort needed to circumvent the locks is just getting So difficult that it needs dedicated expertise and lots of time (money). There just isn’t the demand for it like there was back in the day. For £10 a month I get all the games with no effort. Back in the day of the PS1 you soldered in a little chip then had to find the images or buy CD from disreputable sources. This was quite common then, but just isn’t anymore.
It’s the same reason people don’t pirate DVD or MP3 on the same scale anymore. It’s not worth the effort compared to the ease and cost of doing it legitimately with Netflix/Spotify.
The problem with that theory is that PS4 has had exploits for some time now. They still appear to be doing the $2,500 per a dev kit route as well as getting devs into signed partnership agreements with strict requirements. Meanwhile, it’s just $25 to turn your own standard xbox into a dev kit. It’s definitely the price, and not the difficulty. You would think the real motivation to not do it anymore would be the fact the hardware is barely different from a standard PC now, but there will always be those people trying crack these things just because they want to.
We seem to have a double standard when it comes to Microsoft.
Apple have been doing this for years with its security chip and mobile device companies like Samsung have equivalents like Knox in its mobile devices.
And yet, if that mobile device had a keyboard and a Microsoft OS, it’s vilified for introducing a similar feature to its competitors. Why is it we view this differently? Is it simply because of Linux support (which Lenovo don’t claim anyway for this laptop so multiple components might not have drivers anyway)? Is it because of previous bias (from the IBM PC era)? Or is it simply a need to have a goodie and a baddie and Microsoft have been cast in that role?
Adurbe,
I would not call this a double standard. If the chip was on Surface devices, or the Xbox then it would be okay. It is *their* hardware.
However when I buy a pre-made PC, even if has Windows by default, I expect a general purpose machine. If I buy an AMD chip from retail, I expect to be fully able to utilize it. This is a clear downgrade in the platform freedom compared to what we had before.
(And Apple is criticized heavily for their lock in).
sukru,
I was going to say this too. Many of us have been very critical of apple too. In fact I think the risk increases when our leading tech companies do it together. The danger to our rights will be highest when the market is trapped by restrictions on all sides.
I don’t trust the motives of either company, they are both positioning the reigns around computers and tightening them. I think the threats to open computing are real and I will do my part to vote with my feet as much as possible. But I’m also aware that if apple and microsoft succeed in locking down computing for the masses, the walled garden network effects will be very harmful to everyone. The changes are happening gradually, but my fear is that we end up having no choice but to go groveling to microsoft and apple just in order to get their permission to distribute our software to our customers.
Alfman,
Yes, the gradual changes are very reasonable, individually. But looking back at the long track a lot of features have been eroded.
As computers get more capable, we are losing more ground. Almost every week there is a news article about more restrictions.
Today, it would be difficult to remember CPUs not having OOB “management engines”, GPUs coming with datasheets and programming manuals, monitors not needing HDCP, phones not needing cloud for backups, applications being able to install by just copying, and 100 other small cuts that happened slowly over time.
“Top of the line” computers were open. Now we are restricted to “hobby” systems like Raspberry Pi.
Interestingly, AMD’s and Intel both publish the ISA specifications for their graphics hardware and the official drivers from both companies are opensource, while the RPi uses a binary blob GPU drivers.
FWIW Raptor’s Talos and Talos II workstations are open, top to bottom, with no binary blobs or closed firmware. Those are pretty close to Top-of-the-Line
Drumhellar,
Thanks for introducing Raptor. I had no information about them before.
Of course, they look nice, but are out of my budget:
https://www.raptorcs.com/TALOSII/
(Even the heatsink price is comparable to full Intel CPUs).
And don’t perform too bad compared to Xeon server CPUs:
https://www.phoronix.com/scan.php?page=article&item=power9-epyc-xeon&num=3
Part of those have evolved because so has the usage. Mostly side loading apps is discouraged (but generally possible with extra steps) due to viruses or similar. Back on my Nokia 8310, having a virus was an irritatation. Now my phone stores my credit cards, family photos/videos and plenty more besides. I’m litterly in the process of helping a friend consolidate their photos into a cloud service after a disk fail almost lost a decade of memories
I suppose this is part of where I am coming from. Lenovo are not selling you a general purpose machine. That is a featureset that is being projected, but not offered. They are selling you a pre-configured device and setup which they have assured themselves they can support and honor the warrenty for. To my mind this Lenovo is “theirs” as much as a Mac is Apples or a Surface Microsoft’s. They are all just a collection of components from multiple manufacturers to make a product
However, I completely agree that if you buy off the shelf components, (or a pre-made PC that advertises itself as general purpose) you should be able to fully utilise them for their intended purpose.
You’re just about on the mark. Historically, Apple was allowed more leeway on vendor lock-in issues precisely because people could always fall back on IBM compatibles as the perennial open platform. That’s why 386BSD and Linux happened in the first place, and why PCs remained the default target for all alternative OS developments from the 90s and onward. Decommodifying PC hardware is therefore distinct from building a closed ecosystem like a new Mac, new Amiga, or any game console. It’s an attack on that public good, because it removes expected consumer choice.
Equivalently, because IBM handed Microsoft the MS-DOS monopoly, Windows itself must bear the burden of being a common carrier platform, and therefore cannot do things like force Internet Explorer and Edge on its users, even though e.g. Safari had virtually no competition on iOS for years and years.
On a related note, I think the ruse of “it’s for your own security” in TPM chip marketing would get a lot further if they could resist naming their products blatantly hostile things like “Pluton.” The word may denote a cold, remote, and inaccessible location, but it evokes images of hideously greedy Roman senators counting gold coins.
Headecima,
Yes, people did give apple a lot of leeway in anticompetitive restrictions. I think in the long term more of them will come to realize that was a mistake. It’s ironic that apple used to market themselves as the opposite of IBM and yet apple turned into IBM when they got to the top. Their insatiable greed has put them at the forefront of the corporate effort to strip owner control and lobby against right to repair.
TPM chips have good use cases for enterprises in particular. Enterprises have been able to buy TPM computers for many years. However I don’t think that requiring TPM (or pluton) is justified for end user systems, I don’t have any evidence, but microsoft’s motives are very suspect and I think it will probably come down to enforcing more restrictions against owners in the future.
It’s not good that the two dominant platforms are heading this way.
Alfman,
I would not say “greed”, but success changes companies. At some point they become large and important, and want to use their influence, instead of inventions to get more value.
I saw Apple like an appliance manufacturer, and probably this was a common theme back in the day. Their computers were used by publishing houses, designers, and college professors. It was okay for them to do whatever they wanted. Today, they are one of the largest computer manufacturers. There was a threshold in between. A grey area.
We could liken this Sony’s PlayStation. In PS2 era, nobody cared how the system worked — except game developers. But then they promoted the Cell chips on the PS3 as “super computers”, yet removed an advertised feature (Linux compatibility) with an update, they crossed a threshold.
Unfortunately, like other anti-trust actions, they received what could be called a “slap on the wrist”. (I would have been much happier if they were forced to bring the feature back).
And, I agree, TPM as a concept is very useful. Especially if you care about data privacy.
Second paragraph:
> But first it’s helpful to know what Pluton actually is, and that’s hard because Microsoft haven’t actually provided much in the way of technical detail. The best I’ve found is a discussion of Pluton in the context of Azure Sphere, Microsoft’s IoT security platform. This, in association with the block diagrams on page 12 and 13 of this slidedeck, suggest that Pluton is a general purpose security processor in a similar vein to Google’s Titan chip.
So… how can anyone draw any solid conclusions based on that?
dimlev,
You’re right, I think it’s an open question. If there are nefarious bits in there, its unlikely they’ll be covered in microsoft’s press release designed to put it in a good light.
Also as is often the case with security features, it’s not just the feature itself that’s controversial but also the way it’s used. A feature may be sold initially as promoting owner security but may get twisted into being used to restrict owners. Unfortunately for us as consumers, corporate interests are represented at the drawing board but consumer/owner interests are not and so that shapes the features that we get.
I feel that while pluton has legit use cases, most of them seem to be redundant with TPM’s use cases. MJG’s reporting suggests that pluton does not act like a hypervisor and won’t do anything unless it’s called on. If true pluton shouldn’t be able to interfere with system bootup, but that could change with new firmware or secure boot kernels. My guess is that pluton’s primary use case for microsoft in practice will be hardware enforced DRM and denying non-microsoft authorized modifications at the CPU level. Microsoft’s document suggests pluton software reports to azure cloud, but it’s unclear to me if pluton chips are vendor neutral (such that we can replace it with open source firmware), or if microsoft provisioned services & firmware will be effectively hard coded in practice.
Given Microsoft’s history, human nature and a brief review of history, we can draw at least one solid conclusion: that the vagueness itself is cause for concern. We should be well past the point of giving multinational corporations or governments the benefit of the doubt.
If this actually turns out to be a general-purpose, self-service, opt-in security platform that can be deactivated or isolated, it would not be much of a threat. Organizations could probably put it to good use, and that is fine.
But apologies would not be in order. It is fair to suspect, in the absence of information, that this is another brick in the very visible wall being built in recent history: to increase the sense of security enjoyed by multinational corporations, governments and cowards against me and at my expense. It is up to Microsoft to prove that this is not the case.
We will no see this crap in government machines. Thus it is a HUGE red flag. If it is safe, why does governments refuse it?
Security is often multi-layered and it’s really really expensive to do that properly. It involves multi-domain expertise. It’s never just about the tech but also governance and civil society. Yes, you can read that in published public policy documents and published military strategies. I know because I have read them.
But back to the single technical issue… The more simple something is the less there is to go wrong or exploit and no system is ever 100% secure ever. No that the 100% secure OS which was touted in here is not secure. It’s just not. Nor is the UEFI Garret is peddling and creating a UEFI does not make you an expert in security. We’ve had this argument here before and some people tiresomely refuse to get this.
The systems with this stuff disabled or not present are very likely high value targets and/or behind layers of security including site security, personnel vetting, and lots of network protection systems and active monitoring your average big business or random person does not have access to. Yes you can buy turnkey systems and pay money to third parties but it’s all mickey mouse level. They have something to sell and more interested in that than really solving anything and that’s the real problem. There’s also the issue of sovereignty and data sovereignty. Those secure open systems someone mentioned a number of comments ago? You can buy one and it costs a lot but it’s not secure on its own. The workstation will cost you £10,000 but you’re going to be paying ten to 100 times that for the site and personnel and security surrounding it. Most of the £10,000 isn’t really going on security it’s going on it being a modular industrial system which is why you will find it in tough workplace environments with fire control systems or isolated sites such as on board warships. Most of you missed all that.
There’s no big conspiracy here. All of this is known knowns. The problems as always are mostly human nature – power tripping and greed and the need to appear to be “dah man”.
Pluton is a loss of sovereignty, yet another corporation pushing a proprietary system, yet another brick in the wall by a corporation and individuals and industry sector with a proven history of lies and bad habits and customer hostile practices, as the frog gently boils away.
Your best security is to vote in a decent social democratic government which invests in human rights and civil society and sound regulation and consumer rights and so on. Eat well, sleep well, go for a walk when you need one. Stop listening to GB News or Fox News. Get your head out of that plastic slab. I’m old enough to remember the world before Thatcher and Reagan got their hands on it and what the world was like before the internet. I wouldn’t throw away the progress made on social and other issues but not everything today is as great as its made out to be. I think we can do better.