There's a fair amount of lockdown with cloud providers as well. Not DRM related, but there nonetheless. Egress charges make it unsavory to move some apps out. And proprietary api setups make it more difficult to move as well...things like Google's cloud spanner, or AWS native features.

The big cloud providers will also, over time, shape what's available in hardware in a way that won't benefit on-premise customers.

I'd point at the SaaS model to be the death blow. Instead of running computation on our data, we put our data in third party control so that they can run their computation on what's now really their data. Chromebooks & stuff is just an extension of that in a world where SaaS is the dominant model of regular user's interaction with computers.

No, we never had a chance. If you consider these embedded "secure" CPU controllers in the news lately, we also have lost control of PC's as well. With baseband firmware, which was never ours in the first place, we have lost mobile.

Offline general purpose computing remains.

When the network becomes free, all will be lost.

Just like in the present we have mystery embedded CPU's all over in our computers, so in the future we will have mystery embedded modems siphoning our data all over in our computers. Offline will not be realistically achievable much longer.

That's what I'm guessing anyway.

Well, the locked-down nature of iOS and Chrome OS are what make them markedly more secure than a general purpose computer in the face of real-world threats. Just this week, my Mom's Chromebook kept her safe from what appears to have been a targeted attack (someone sent her an email with a link to a malicious .ru domain and my name in the From header). That locked-down design is also why I'm writing this response on a Chromebook.

It's for good reason that Tech Solidarity and other security-conscious organizations recommend using iOS and Chromebooks where possible: https://techsolidarity.org/resources/basic_security.htm

Of course, we must fight tooth and nail against any regulations that would restrict access to general-purpose computing, or put limits on connecting a general-purpose computer to the Internet. But it's important to remember that there are absolutely legitimate reasons to use and recommend locked-down machines, and that the most technically adept of us will use a combination of both categories of computing device in our lives.

You not getting p0wnd is an example of the shareholders of the owner of the machine, and the interests of the data input substrate (you), being aligned.

You get this security in exchange for all your personal data being uploaded to their servers (for advertising to try and change your behavior for their clients, and for storage for your government, and perhaps others), and Google getting to decide which apps you can run, and which apps developers can publish in the store.

As long as you stay aligned with the interests of the shareholders of the ad-surveillance company (and the government) it's a great deal.

I've wanted a locked down computer ever since every program that I installed in 1995 wanted to put a useless icon in my tray and take over every file type association. General purpose computers are great when I'm writing the program, but awful when running someone else's poorly written program that wants to take control over my computer.

I like to think of a general purpose computer like a giant truck: great if you like that kind of thing, but not for everyone.

What about a thriving Free Software ecosystem where the code can be audited and modified, and where the best apps (i.e. the ones that follow what users generally accept to be a standard of "respect" to your machine and its user, as well as doing their job) bubble up to the top?

Using various Ubuntu-based distros and Free Software apps over the last 8 years, I have never felt like any program was overstepping the boundaries.

You want a curated software store/repo. The computer itself doesn't need to be locked down to get the benefits you're talking about.

So, which curated software store/repo do you prefer?

http://download.com? Now owned by CNET, and full of sketchiness.

Or maybe you like http://freeware.com? Oh, snap, it's down and parked by a squatter now.

Or maybe an open source site? How about https://sourceforge.net? How'd that work out?

Could start by installing Java, let's see, oracle.com, click, ah, what's this? It's installing the Yahoo! browser toolbar by default??!!!

Yeah. Curated.

And even if you do manage to get a curated software store without lockdown that has a business model, it's not clear to me how you solve the problem of people sharing passwords with sketchy family members and friends who then install hidden software that secretly, behind their back, stalks them without so much as an informational prompt or opt-in.

No, I think there are good reasons for having devices somewhat locked down, especially when it's being done for the sake of the end user.

Ubuntu, Debian, Fedora, Arch; many Linux distributions provide excellent curated software repositories that just work for general purpose software. Have done so for well over a decade. All without locking the user out of his own computer.

And of course Steam, GoG, and the HumbleStore provide curated repositories for proprietary games on many platforms.

Steam is far less curated these days than 2-3 years ago

Linux official distro package repositories. Free open source software has had currated software repositories for many years and since hosting is quite cheap not much of a "business" model is required.

Don't want to deal with the official repository you can easily host your own and provide a package that adds your own repo and serves the latest and greatest version of your software. Want a solution that targets multiple distros and bundles deps there is no snappy.

Preventing untrusted users from installing software is also a solved problem. Require the root password or simply don't let them use sudo.

If you give morons and bad people physical access your machine AND permission to install software it seems to me that you have put you in a bad place where no amount of lockdown can render you safe.

Rather than make the futile effort to render your situation tenable when we know it wont how about we continue to improve actually feasible use cases?

> sharing passwords with sketchy family members and friends who then install hidden software

I guess that's a fair use case for locking down the OS.

But when it comes to various sites giving you bad software, how is locking the device and not giving the user control supposed to help? Any security measures like sandboxing could exist on a device without taking control from the user. And while installing zero programs is pretty secure, the user could make that choice without a lockdown.

> So, which curated software store/repo do you prefer?

Ninite is quite good. Other comments already pointed out various linux repos that do a very good job. Also look at the iOS store for something that has pretty aggressive quality control, even if the rules aren't perfect. (While iOS is locked down, the store would work the same if it wasn't.)

You sound like you've been living under a rock for twenty years! Choose pretty much any Linux distribution and you'll get an excellent package manager that plugs into curated lists of software, AKA repositories.

You basically want everyone's machine to be locked down to protect people like yourself with bad taste in applications.

Counterpoint: hundreds of millions of Windows 7 holdouts even after forced upgrades to Windows 10.

a distressingly large number of programmers are welcoming it in windows world with the encroachment of windows store lockdown. its really depressing.

Can you elaborate? (I'm not familiar with the Windows Store, though I guess it is similar to the Apple and Play Stores.) What do you mean by your statement?

Your point holds true for Windows 10 S, but why do you consider Chromebooks to be locked down? You can enable developer mode, install your own OS on them, or even re-use the Chrome OS kernel for other desktop environments through crouton.

You're also not forced to use Google's Chrome Web Store (except on Windows with the official distribution of Chrome).

Well, you can do all that until you cannot anymore. The systems are designed in such a way that Google only has to flip a switch, and all Chromebook securely turn into bricks (presumably only the ones that haven't had developer mode enabled).

On top of that, Chromebooks are mostly used in an education environment where they are in fact locked down to Chrome OS for specific email address domains. Then the domain administrator can conveniently switch it into a brick.

Google for (oh the irony) "Widevine" and how it interacts with it. So it has the same sort of problems that Microsoft palladium had : things like Netflix and the like simply won't work as soon as you have the developer switch enabled.

General purpose computing is dependent on 2 things : ability to run your own programs AND the ability to lie about that fact to the network. Without the second the first is useless.

Google understands this subtle point, but it appears most people do not. So Google is exploiting our ignorance here.

I'm pretty sure Netflix works fine with developer mode switched on. I can confirm at the moment (away from Chrome OS devices right now) that Widevine works fine with Netflix on desktop Linux; I'm pretty sure I remember Widevine working on my Chromebook with developer mode enabled.

that mode still completely changes the universe. nobody can make a living selling chromebook software without consent of and payment to google.

The point is that with this configuration you can use or buy software that normally runs on Ubuntu.

Sort of a side note here, but I think this is a big misunderstanding about Apple. Sounds crazy, I know, but hear me out before judging.

I think with Apple it's more about allowing the end user (the real end user, not the end user's boyfriend/girlfriend/wife/husband, child/sibling/parent, boss/teacher/roommate etc.) to have control over their own information.

In order to enforce this end user control, Apple needs to lock out rogue programs. It can't do so 100%, but it tries to get as close as reasonably possible. They try even harder with mobile devices, because mobile devices tend to be so personal and capture so much private information of one individual.

Apple has a lot to gain from controlling user experience, preventing malware, and protecting their 30% cut of software costs. Its not merely that they don't have much to gain from protecting users from snooping girlfriends. In almost every other instance they actually stand to gain from helping the other side.

Apple has every reason to help your mom/dad/boss/school ensure that you don't misuse THEIR property.

Your perspective seems to be mostly unfounded speculation that doesn't hold water.

Also because users are used to their phones being able to do less than a laptop. "The appstore doesn't have it" is a legitimate reason to not be able to use a program on a phone but not a Windows machine (for example)

Chromebooks are more open than nearly any other commercially available x86 and ARM laptop, they are in many ways more open than nearly any other commercially available x86 or ARM laptop since PC 5150. Yes, they have a verified boot process, but once you're admin on one you can just swap it to developer mode. It's clearly a feature, not a bug.

I can't tell if you're trolling by stating deliberately untrue statements or you have some insane thought process where this statement makes sense to you. The chromebook is deliberately and consciously a closed platform. You can't write or run arbitrary code on it, you can't swap the OS, you can't even SEE the OS.

That's the primary selling point. "We got this, don't look under the hood" Getting your own boot rom on there is a huge pain (I had to remove a screw off the main board) there were like ten steps I would never tell a non expert to attempt.

GP is right, in a sense. Chromebooks (the Intel ones, anyway) typically ship with Coreboot, and Google developers regularly contribute to upstream Coreboot.[0]

While you're correct that it's a pretty closed platform out of the box, you ultimately have more control over the platform than a typical x86 PC, if you go through the hoops of flashing your own Coreboot payload. The fact that it's hardware with official Coreboot support is notable, IMO.

[0] https://github.com/coreboot/coreboot/search?o=desc&q=google....

> You can't write or run arbitrary code on it, you can't swap the OS, you can't even SEE the OS.

You can write and run arbitrary code on it, you can swap the OS, and you can even rebuild the firmware from source and flash it yourself (though at that point you will void the warranty since the firmware is in a position to cause hardware damage, but not for any of the other things). There is a local terminal emulator, and when you turn on developer mode you can have a local unix shell with mount and write access to removable disks, so you can image install media for an operating system. The boot firmware comes with SeaBIOS by default for the reason that Google (for whatever reason) wants you to be perfectly able to install bios-based operating systems as long as they're compatible with the hardware. If it's Linux, then any downstream hardware drivers involved are packaged in google's public kernel repositories, and if it's a userspace component, it's in the ChromiumOS repositories, where you can pull and build the entire operating system (aside from the pepper plugins for digital restrictions management and flash).

Seriously, try doing many of these things with a typical off-the-shelf Windows or Apple laptop and get back to me. On Windows laptops you need to jump through hoops to disable firmware features which prevent you from installing new operating systems, on Chromebooks it's well documented and has no effect on warranty or your ability to roll back the changes. Most (all?) windows laptops have no vendor-provided open source firmware, and most of them don't have even a third party one which works. To write an install disk on Windows, you need to install a third-party image burning application, and there's no guarantee that the firmware will even let you boot it. Many windows laptop manufacturers will either inconvenience or flat-out deny warranty claimants who have replaced the operating system on their laptop. Microsoft does not publish the source code of the NT kernel. Most Windows laptops contain at least one piece of hardware which is not adequately documented such that somebody could write a driver for it without reverse engineering.

Apple laptops are in some ways better, in some ways worse here. On the one hand, the firmware does not explicitly prevent you from booting third-party images, on the other hand, the firmware and hardware have undocumented behaviour which makes it exceedingly difficult to get most new operating systems to reliably boot and install on it. Usually even if yo u do manage to install and boot something, some important piece of hardware (the wireless chip, the display output multiplexer, the webcam, the touchpad) is either slightly or completely different from a documented counterpart, and takes months or years to be supported by anything except OS X and the first-party drivers on Windows. Darwin releases are usually eventually open source, Apple's compilers are partially open source, but also include several proprietary components. Most of the operating system libraries which weren't already available when they started are proprietary. Though on the plus side, you don't really need anything extra to write a boot disk for a third-party operating system. On the down, there is no provided firmware source code, and the system is sufficiently underdocumented that it's unlikely anyone will ever write an alternative firmware image for your given Apple laptop model.