The TPM just sores keys. Intel's "Active Management Technology" (the OS in vPro) is a serious problem. Igor Skochinsky's talk[1] about this is very troubling.

The final piece of the puzzle is the new "Software Guard Extensions" in Intel's latest CPUs. This is clearly designed to protect SMM[2]. It is going to be a lot harder to "root" this stuff when the RAM is encrypted.

[1] http://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub https://www.youtube.com/watch?v=Y2_-VXz9E-w

[2]...and DRM in general. See this diagram of GlobalPlatform's "Trusted Execution Environment"; in particular, note how the "Rich OS" (windows, linux, etc) is allowed to run outside the chain of trust, with the DRM being protected by hardware. http://i.imgur.com/rjbzWyB.jpg

Some of the new extensions are also intended as yet another band aid against C style memory corruption.

You only need a memory manager for pointer protection. Intel states their intent for SGX on their website[1]. Some of the more important goals are:

    1. Allow application developers to protect sensitive data
       from unauthorized access or modification by rogue software
       running at higher privilege levels.

    ...

    5. Enable the development of trusted applications [...]

    6, Enable software vendors to deliver trusted applications and updates [...]

    ...

    8. Enable applications to define secure regions of code and data that
       maintain confidentiality even when an attacker has physical control
       of the platform and can conduct direct attacks on memory.

This isn't about buffer overflows. You don't need to create a system where software vendors can create regions of memory that are protected against a logic analyser or cold boot attack to fix C style pointer bugs. You do need this capability if you want to hide things from the owner of the computer.

It's not like they are hiding anything - "trusted applications" has been a dog whistle for DRM at least since "Palladium" (later called "Next-Generation Secure Computing Base"), part of Microsoft's "Trustworthy Computing" plans ~15 years ago.

[1] https://software.intel.com/en-us/blogs/2013/09/26/protecting...

Aren't there also legitimate use cases for these things? E.g. a password manager loading itself into a confidential memory region to prevent infiltration?

That may be, bit I'm absolutely confident it is perfect for malware and spyware too.

Many of us have laughed at Stallman at one point or another for his extreme paranoia. But this is something he saw coming miles ahead. Not so funny anymore.

I never understood that attitude.

Without his work GNU/Linux would never have happened, yet many that criticize him enjoy using GNU/Linux.

Back then it was not clear if *BSD would manage to win the court case from AT&T.

I'm all for healthy paranoia, but some things you mention don't seem to have changed really. Uefi is just as opaque as BIOS - why not mention both? TPM is just a tool. It can be used for DRM, it can be used for safer full disk encryption (keeping keys out of the readable memory). Firmware is just a cheaper and updatable version of original purpose-designed, or factory-programmed ROM chips - they have the same capabilities for messing with you (from the producer's point of view).

It really bothers me when people assign this to new technologies in general. Yes, some are actually new in desktops, like SMM. But most have been there for ages and just got an updated name or architecture.