Intel TDX For Confidential VMs Causing Concern Among Fedora & Open-Source Advocates

[phoronix]

Phoronix: Intel TDX For Confidential VMs Causing Concern Among Fedora & Open-Source Advocates

One of the capabilities of newer Intel Xeon Scalable processors is support for Trust Domain Extensions (TDX) as a way of providing for confidential virtual machines. Intel TDX allows for "isolation, confidentiality, and integrity at the VM level" which is good from the security perspective but the dependence on signed binaries is causing mixed feelings within the Fedora camp at the broader open-source community...

https://www.phoronix.com/news/Intel-TDX-Fedora-OSS-Concerns

[Ironmask]

What the hell? What is this? Intel trying to gain market share with vendor lock-in?
I don't even get the point of this, does this do anything a regular kernel hypervisor doesn't? Or is this Intel's way of saying "okay we gave up trying to not break that with speculative execution exploits, just use this new thing we made instead"

[timofonic]

Treacherous Computing, that is. Intel and security? That's a funny joke!

[Danny3]

Fuck this shit, who approved such garbage?

[c117152]

If the build is reproducible then they can just separate the signature from the executable and have the install script use the linker to put the two together client-side. That is, have the build use a dummy signature (a string of zeros), then have the binary package provide executable.ld + executable.ld.signature and finally when copying to /usr/foobar, have the script doing the copying overwrite the dummy signature with the intel provided signature.

[sophisticles]

This is what the open source community worries about?

There are two major wars going on with no end in sight, the global economy is a mess, unemployment is sky high, crime is rampant, we are going to hell in a hand basket and the open source community is wringing their hands over some trivial minutiae based sophomoric bull session.

I think it's time for the open source community to grow up if they care at all about the rest of the computing public taking GPL'd software seriously.

[panikal]

This is what the open source community worries about?

There are two major wars going on with no end in sight, the global economy is a mess, unemployment is sky high, crime is rampant, we are going to hell in a hand basket and the open source community is wringing their hands over some trivial minutiae based sophomoric bull session.

Yes! The more global problems that go on, the less we should worry about things like vendor lock in and requiring vendors to sign our binaries to run VMs. Until there is less war and less murder we should stop caring about the spirit of open source.

I think it's time for the open source community to grow up if they care at all about the rest of the computing public taking GPL'd software seriously.

You do understand that GPL and the open source community are actually taking this seriously on behalf of the rest of the computing public? Otherwise why don't I just run Windows or MacOS?

I really don't understand the point you're trying to make other than people care about things you think are stupid?

[Ironmask]

This is what the open source community worries about?

There are two major wars going on with no end in sight, the global economy is a mess, unemployment is sky high, crime is rampant, we are going to hell in a hand basket and the open source community is wringing their hands over some trivial minutiae based sophomoric bull session.

I think it's time for the open source community to grow up if they care at all about the rest of the computing public taking GPL'd software seriously.

Sir this is a forum about software

[edxposed]

TDX's target user base isn't going to consider using bureaucratic crap like Fedora, they're just asking for trouble.

[ehansin]

Sir this is a forum about software

And to be fair, hardware as well