Suppressing The Concerns Over HDCP Content Protection For Intel's Linux DRM Driver

[cybertraveler]

Yeah but the point isn't those who are unaware. The point is we who are aware, do we have the right to be a CPU without the secure processor or not? There is where some court should intervene.

More generally, you could ask the question: "do I have the right to use violence to force other human beings to make products that meet my needs purely by virtue of my existence?"

The reason I posed that particular question is because when people talk about having a "right to something", they are usually referring to that "right" being enforced by governments. People in governments "enforce" "rights" using... "force" (ie violence or threat of violence).

When I ask myself that question posed above I answer 'no'. The reason I answer 'no' is because in order for something to be a "right" it has to be a universal standard (IE it applies to everyone equally). In a business I owned or operated, I would not want customers/governments to use violence (or threats of violence) against me or my staff under a pretence that they have a "right" to a particular product made in a particular way from me. As such I will not demand or impose this particular "right" upon other people or businesses.

I do not like the Intel ME or the AMD PSP, but neither of those companies are mine to command and there is no deception/fraud going on. Intel and AMD are both very clear about their in-processor technology. They go so far as advertising it and proudly highlighting it on their packaging and websites as a feature. The exploits found for the ME are not concealed by Intel. Intel loudly announce them to the world when they are found. For many people, this ME/PSP technology is a desirable feature. Who am I to tell Intel, AMD or their customers that they cannot make or buy this technology.

I do acknowledge the problem though. I just look to peaceful solutions to the problem. Solutions which do not infringe upon other people's free will.

One such peaceful solution is using Intel Skylake or earlier processors with the wonderful me_cleaner software to disable the ME by stripping the firmware of the nasties. You can donate to this effort here to support it if you wish: https://github.com/corna/me_cleaner/wiki/Donation

Another peaceful solution is to buy products from companies like Raptor Engineering, ORWL, Minifree and Purism who are making incredible efforts to bring secure products to market that people like ourselves can purchase and rely upon.

When a company takes the risk of bringing a secure, open system to market, I think that this gives people like us a great opportunity to support that company financially by buying their products. This creates a signal to the market that there is a demand for this stuff and from that, more entrepreneurs and creative individuals are enticed into the market.

We can actually increase demand for this secure technology by spreading awareness to friends/family/co-workers of the personal and large-scale societal dangers of the likes of the Intel ME and AMD PSP.

[artivision]

More generally, you could ask the question: "do I have the right to use violence to force other human beings to make products that meet my needs purely by virtue of my existence?"

The reason I posed that particular question is because when people talk about having a "right to something", they are usually referring to that "right" being enforced by governments. People in governments "enforce" "rights" using... "force" (ie violence or threat of violence).

When I ask myself that question posed above I answer 'no'. The reason I answer 'no' is because in order for something to be a "right" it has to be a universal standard (IE it applies to everyone equally). In a business I owned or operated, I would not want customers/governments to use violence (or threats of violence) against me or my staff under a pretence that they have a "right" to a particular product made in a particular way from me. As such I will not demand or impose this particular "right" upon other people or businesses.

I do not like the Intel ME or the AMD PSP, but neither of those companies are mine to command and there is no deception/fraud going on. Intel and AMD are both very clear about their in-processor technology. They go so far as advertising it and proudly highlighting it on their packaging and websites as a feature. The exploits found for the ME are not concealed by Intel. Intel loudly announce them to the world when they are found. For many people, this ME/PSP technology is a desirable feature. Who am I to tell Intel, AMD or their customers that they cannot make or buy this technology.

I do acknowledge the problem though. I just look to peaceful solutions to the problem. Solutions which do not infringe upon other people's free will.

One such peaceful solution is using Intel Skylake or earlier processors with the wonderful me_cleaner software to disable the ME by stripping the firmware of the nasties. You can donate to this effort here to support it if you wish: https://github.com/corna/me_cleaner/wiki/Donation

Another peaceful solution is to buy products from companies like Raptor Engineering, ORWL, Minifree and Purism who are making incredible efforts to bring secure products to market that people like ourselves can purchase and rely upon.

When a company takes the risk of bringing a secure, open system to market, I think that this gives people like us a great opportunity to support that company financially by buying their products. This creates a signal to the market that there is a demand for this stuff and from that, more entrepreneurs and creative individuals are enticed into the market.

We can actually increase demand for this secure technology by spreading awareness to friends/family/co-workers of the personal and large-scale societal dangers of the likes of the Intel ME and AMD PSP.

The right to privacy it is a universal standard today (as you said) and should be enforced to corporations to. Enforced doesn't mean violence.

[cybertraveler]

The right to privacy it is a universal standard today (as you said) and should be enforced to corporations to. Enforced doesn't mean violence.

What does a "right to privacy" look like? If I make a multiplayer video game which by-design streams all game sessions (including chat) to anyone who wants to watch, am I violating this "right to privacy"? Should I be forced to change my game?

If a business ignores a privacy law which encodes this "right to privacy", what kind of non-violent enforcement would be done to them?

[Zan Lynx]

The right to privacy it is a universal standard today (as you said) and should be enforced to corporations to. Enforced doesn't mean violence.

Yes, "enforced" totally DOES mean violence.

So, you make a law and "enforce" privacy. Then someone makes a game that requires the use of a government ID to create an account and shows that ID to everyone else. Now what? You're going to tell the company they cannot sell their game? So now they sell it online via BitCoin. Are you going to fine their CEO? So he laughs at you, has all his assets in BitCoin and lives on his friend's couch. Now what? Generally at this point the government calls it "contempt of court" or something and uses VIOLENCE to throw someone in jail.

[starshipeleven]

Yes, "enforced" totally DOES mean violence.

It means the least amount of violence to get compliance, which is probably closer to what he actually meant.

While both "arresting after warnings" and "gunning down on sight" a suspect are violence, the former is the least amount of it.

So, you make a law and "enforce" privacy. Then someone makes a game that requires the use of a government ID to create an account and shows that ID to everyone else. Now what? You're going to tell the company they cannot sell their game?

In decent EU countries (privacy laws are kinda strict) they would just find and jail people involved in the decision to make this privacy violation (so probably CEO and board of directors), seizing assets (developer workstations and stuff for example).

How they distribute it is irrelevant, if you violate a law you get prosecuted because of your violation.

I don't know offhand if your example can be just sidestepped with a simple EULA or not, for the sake of the example I'm assuming something that is not permitted by law, like for example mining personal data in a non-anonymous way and then showing it to everyone.

[starshipeleven]

What does a "right to privacy" look like?

I know it might sound weird for third world countries like the USA, but here in EU we have laws for that. https://en.wikipedia.org/wiki/Data_Protection_Directive

Each member nation has laws following these directives to a good extent, for specific info you need to look up each country's own laws.

If a business ignores a privacy law which encodes this "right to privacy", what kind of non-violent enforcement would be done to them?

The usual stuff that is done to companies. Fines if relatively minor violation, theoretical chance of jailing CEO and other managers involved if the violation is big (I say theoretical because it's hard to jail a CEO or any wealthy individual in general).

[artivision]

I know it might sound weird for third world countries like the USA, but here in EU we have laws for that. https://en.wikipedia.org/wiki/Data_Protection_Directive

Each member nation has laws following these directives to a good extent, for specific info you need to look up each country's own laws.

The usual stuff that is done to companies. Fines if relatively minor violation, theoretical chance of jailing CEO and other managers involved if the violation is big (I say theoretical because it's hard to jail a CEO or any wealthy individual in general).

Well said. Also Intel and AMD support the demands of DRM and MAFIA corporations (third parties) inside products that we have paid (along with the development costs of the security processor). Here in EU this is fraud.

[cybertraveler]

The usual stuff that is done to companies. Fines if relatively minor violation, theoretical chance of jailing CEO and other managers involved if the violation is big (I say theoretical because it's hard to jail a CEO or any wealthy individual in general).

Do you think that there is no violence or threat of violence involved with fines? If so, I suggest you ask yourself what happens if you refuse to pay the fines? (I think you know). What happens when you refuse to let-in the men who come to collect the fines? (you know)

Are you also presenting "jailing" as an example of a non-violence enforcement mechanism? IE forcibly placing someone in a confined space, locked behind heavy doors and often surrounded by an abnormally high number of murderers and rapists.

If you are uncomfortable accepting the use of violence (or the threat of doing so) in the enforcement of these privacy laws, or if you feel the need to conceal the violence required to enforce the laws, then how can you honestly advocate for them?

If you think the use of violence for this purpose is ok, then why not say so openly? I'm comfortable with saying that violence is OK for use in self-defence (providing this use of force does not continue after you have successfully secured your safety). I am also comfortable advocating that people financially support companies and individuals which create secure and private computers and technology.

[Luke]

I don't have any problem with HDCP as long as it doesn't introduce new binaries. When you create content you should be also free to decide who has access to it.
There might be people who use illegal ways to get access but I just don't use it when I have a problem with the DRM.

BTW, I have a way bigger problem with these Facebook and Twitter buttons. Firstly, who uses Facebook, secondly I don't think it's a good idea to support Twitter either though there are people using it that are not bots. I'm usually very strict about social networks not existing in my life and I don't know whether I can use services that mention them next to every post.

You can and should block social media sharing buttons. The combination of NoScript with Ghostery(no longer open source) or Disconnect(open source) stops them cold. I think Adblock can shitcan them too but not sure about that as tracker blocking is my specialty in this.

[Luke]

More generally, you could ask the question: "do I have the right to use violence to force other human beings to make products that meet my needs purely by virtue of my existence?"

The reason I posed that particular question is because when people talk about having a "right to something", they are usually referring to that "right" being enforced by governments. People in governments "enforce" "rights" using... "force" (ie violence or threat of violence).

When I ask myself that question posed above I answer 'no'. The reason I answer 'no' is because in order for something to be a "right" it has to be a universal standard (IE it applies to everyone equally). In a business I owned or operated, I would not want customers/governments to use violence (or threats of violence) against me or my staff under a pretence that they have a "right" to a particular product made in a particular way from me. As such I will not demand or impose this particular "right" upon other people or businesses.

I do not like the Intel ME or the AMD PSP, but neither of those companies are mine to command and there is no deception/fraud going on. Intel and AMD are both very clear about their in-processor technology. They go so far as advertising it and proudly highlighting it on their packaging and websites as a feature. The exploits found for the ME are not concealed by Intel. Intel loudly announce them to the world when they are found. For many people, this ME/PSP technology is a desirable feature. Who am I to tell Intel, AMD or their customers that they cannot make or buy this technology.

I do acknowledge the problem though. I just look to peaceful solutions to the problem. Solutions which do not infringe upon other people's free will.

One such peaceful solution is using Intel Skylake or earlier processors with the wonderful me_cleaner software to disable the ME by stripping the firmware of the nasties. You can donate to this effort here to support it if you wish: https://github.com/corna/me_cleaner/wiki/Donation

Another peaceful solution is to buy products from companies like Raptor Engineering, ORWL, Minifree and Purism who are making incredible efforts to bring secure products to market that people like ourselves can purchase and rely upon.

When a company takes the risk of bringing a secure, open system to market, I think that this gives people like us a great opportunity to support that company financially by buying their products. This creates a signal to the market that there is a demand for this stuff and from that, more entrepreneurs and creative individuals are enticed into the market.

We can actually increase demand for this secure technology by spreading awareness to friends/family/co-workers of the personal and large-scale societal dangers of the likes of the Intel ME and AMD PSP.

Still another workaround is to stockpile the older stuff, or expect to buy it over Ebay and then use an external flasher to update the firmware (in case of interception in the mail and malicious firmware added). AMD is free of PSP through AM3+ (Bulldozer/Piledriver), while for Intel we are talking really old shit but me_cleaner is available for those chips. I just hope someone comes up with an AMD version of me_cleaner (PSP cleaner?) but I don't know if the AMD system is broken up into separate binaries or "partitions" as Intel's management engine firmware is. With AMD the part that would have to be kept is the portion that actually brings up the CPU itself. An exploit there would of course pwn the entire CPU. Since this is chipset stuff, a 3ed party chipset accomodating the AMD Ryzen series (maybe by FPGA?) might be the solution here.