...and the moon.

That'd be too bad. Sometimes, I feel like the general public doesn't deserve general purpose computing.

I might be behind on the latest counter-counter-counter-measures, but I know some of the leading AC solutions are already using IOMMU to wedge a firewall between passive DMA sniffers and the game processes memory.

e.g. https://support.faceit.com/hc/en-us/articles/19590307650588-...

And once you remove the friction for requiring cryptographic verification of each component, all it takes is one well-resourced lobby to pass a law either banning user-controlled signing keys outright or relegating them to second-class status. All governments share broadly similar tendencies; the EU and UK govts have always coveted central control over user devices.

Doesn't have to be. While I'm not a fan of systemd (my comment history is there), I want to start from a neutral PoV, and see what it does.

I have my reservations, ideas, and what it's supposed to do, but this is not a place to make speculations and to break spirits.

I'll put my criticism out politely when it's time.

None of the consumer mobile devices give you all the keys. There are many reasons for that, but 99.9% of them are monetary reasons.

There are genuine positive applications for remote attestation. E.g., if you maintain a set of servers, you can verify that it runs the software it should be running (the software is not compromised). Or if you are running something similar to Apple's Private Compute Cloud to run models, users can verify that it is running the privacy-preserving image that it is claiming to be running.

There are also bad forms of remote attestation (like Google's variant that helps them let banks block you if you are running an alt-os). Those suck and should be rejected.

Edit: bri3d described what I mean better here: https://news.ycombinator.com/item?id=46785123

> Remote attestation is literally a form of DRM

Let's say I accept this statement.

What makes you think trusted boot == remote attestation?

> Secure boot and attestation both generally require a form of DRM.

They literally don't.

For a decade, I worked on secure boot & attestation for a device that was both:

- firmware updatable - had zero concept or hardware that connected it to anything that could remotely be called a network

No, it's not "all applications of cryptography". It's only remote attestation.

Buddy, if I want encryption of my own I've got secure boot, LUKS, GPG, etc. With all of those, why would I need or even want remote attestation? The purpose of that is to assure corporations that their code is running on my computer without me being able to modify it. It's for DRM.