I would personally _love_ if we could get proprietary software to become illegal (or for there to be some sort of disincentive such as taxing proprietary software, or enforcing and extending warranties on proprietary software). But large proprietary software companies hold such sway in politics that hoping for that doesn't really help. It would be a much better idea to simply stop buying their crap, and helping others around you "break the shackles" (as it were). Digital Restrictions Management is something that I always mention when people talk about Netflix or other such streaming services -- because once you explain the issues with those kinds of services I find that most people are at least intrigued by alternatives (which usually have features that the DRM systems don't, because DRM has always been clunky as they're trying to accomplish something that is effectively not possible).

[1]: http://www.fsf.org/campaigns/drm.html

I do agree that making DRM is a losing battle, and they are transferring that cost to legitimate customers. Really though I don't have much other options for streaming. Amazon prime has the same setup, and CraveTV probably does too. Though Crave doesn't have much for content that I'm interested in.

Maybe taxing on the distribution of proprietary software would be more palatable? After all, software that is written can only become proprietary if you distribute it to other people under a non-free license. I personally think the warranty idea is much softer on companies (while still giving some more protection for end-users).

I don't think banks should be taxed for having propreitary systems. I do have a problem with SaaS[1] companies, and companies which make money of selling software which is proprietary -- because they are actively creating a monopoly on the expertise in and ability to support their particular software (known more politely as vendor lock-in). Not to mention that proprietary software developers incredibly often mistreat their users through a variety of schemes.

[1]: https://www.gnu.org/philosophy/who-does-that-server-really-s...

Really I think we just need better regulation around it all. So making sure that you are allowed to hack your own device if you wish. Able to extract your data. SaaS companies being required to give you data exports (unless unsafe to do so).

Taxing proprietary software distribution is a form of regulation. The ideas you propose are too piece-meal and won't actually solve the underlying problems -- namely that proprietary software is used as a tool to abuse its users. This is something that is inherent to the power dynamic between a developer and the users of proprietary software, regulation won't help.

"But what if the bank just hires their own staff to become experts at that open source software instead?" That could work, up until they need to make specific changes to the software for their business. So they fork the open source project and create their own variation of it.

Some of the banks profits now went into paying developers for the changes in the fork. Do you think the bank's executives will just want the money they put into the fork to potentially benefit all of their competitors by having them make a pull request to the original software? Probably not...and then you end up with proprietary software again. Only in this case it's worse than the proprietary software we started with, because every bank has their own fork of the original open project.

Given that that is how they can avoid having to maintain a fork indefinitely, and that that is the fair thing to do after you profited from the gift of others who did the same: Erm, yes, they absolutely should want that, and most likely it is in their own best interest.

The problem comes when rapacious companies decide it's a good idea to make people pay for the privilege of being the product, and use the law to restrict what people can do with the software, which is what DRM is really all about.

You appear to be confusing what "proprietary software" means[1]. DRM is an example of something that is only possible with proprietary software.

[1]: https://www.gnu.org/proprietary/proprietary.en.html

I have no problems with this as I don't want to use such 'services' anyway. I keep my own digital library, on my own server, using free software. I have no problems foregoing the latest H*llywood 'blockbuster' to keep a semblance of control over what I consider to be my private sphere.

Fortunately, we can still make that choice. I did the same. But sometimes I feel that we are so much a minority...

But as long as we still can do the things we want, I do not see it as a problem ... but well, yes, since we have to struggle hard to just controll our devices a bit, because the rest does not care and so they can allmost implement whatever spware they want - it is a problem .

let's say your friends are using WhatsApp, or Skype, via proprietary protocol, but you only use open sourced IM, then you are isolated from them.

Fortunately the evidence against just those actors - Facebook, Google and others - is getting more and more visible and palpable to all. Between Facebook's blatant censorship of content and Youtube 'demonitising' [1] 'controversial' videos and actors, it is getting hard to avoid noticing that they are flexing their opinion-influencing muscles. This should make it a bit easier to convince people to jump ship [2] but you won't get all of those people to forego on the delights of Spies'r'Us or CatVideoCentral. Still, once a few of them join you you'll no longer be out of the loop and that is what matters here.

[1] a good word in this context as it almost reads as 'demonising'

[1] ...and please tell them that moving from Facebook to VKontakte is not an effective move in this respect

If some pass laws that make my choice to go outside FBook, Google or whatever-Internet-monster, then I'm screwed.

That my current nightmare. But I have not the faintest idea if this is close to reality or not. EFF zealots would probably very close while the very existence of ubiquitous free software says the opposite. Dunno...

This is extremely user-hostile.

I can think of two relatively easy and probably-not-secure (you were asking for freedom, not security...) ways to not only detect but also bypass this:

- Hook certificate verification APIs to always return true.

- Scan for certificates embedded in the binary and overwrite them dynamically. This will work if the app decides to use its own crypto but standard certificate formats.

This is about control.

Do they ever go beyond that?

No excuses of course, and Microsoft can share the blame too.

As long as you consent to that, everything is fine I guess. The software is doing its job as an agent of its users.

Will not, as in you can theoretically get it to "say the right answers" if you have root? It seems like the best way to "crack" this protection would be something like virtualisation, where the binary is run in an environment that "looks good" to it. (This also reminds me of a lot of malware, which actively tries to determine if it's being run in a VM or otherwise being analysed.)

[1] https://developer.android.com/training/safetynet/attestation... (note the table under "Possible attestation results". This is what I meant by you are not allowed to own your device's own filesystem (root access).

But Google is moving towards reading hardware fuses, and has been working together with OEMs to use secure enclaves to securely attest the status of the system in the future.

By requiring the attestation results to be signed by a key burnt into the CPU, they also prevent virtualisation.

I'm not against, non-network, hardware-based security features. In fact, I think we need them. I would certainly desire a phone where someone can't simply access my private key with a soldering iron and flash programmer.

And I wouldn't mind a bootloader that is locked to prevent tampering with the device, as long as I can unlock it, and unlocking it wipes the device or something. I wouldn't mind using Android as intended without root access. But, I want control over the decision. I want to control the OS I run on my device. I want the freedom to increase its lifespan beyond whenever the manufacturer stops provided security updates. I want to have the ability to enable root to inspect my data on my device using my storage, without sacrificing my ability to watch movies on the $600 device I paid for that somehow has a better quality display than my monitor. And also, I want the ability to block ads that gulp down my expensive mobile data so that I can instead pay for a service like Netflix.

Yep, I had the same thought. Can't wait to see full-system Android emulators running on a phone :)

That should be "will fail", right?

> We're at the point where you don't even own your own filesystem anymore on a Linux device.

Is this really true? It seems to be of the form "if you decide to own your file system, then you are not given access to certain proprietary media resources or applications". That's a shame, and I'm not happy about it, but my access to Netflix is a convenience, not a fundamental right.

Yup. Sorry, typo, I can't edit it now. :(

With regard to your second comment, that was one perspective that I do consider. There are still plenty of media sources that do not use device attestation. But the trends are not showing in the right direction. Also, as you say, you could decide that maintaining root is more important than being able to consume movies or whatever other DRMd media on your device, but you are sacrificing some of the main features that were marketed to you during your purchase, while still paying full price.

Also, it's not just content-delivery apps that take advantage of the APIs, utility apps like Android Pay require their availability. Multiplayer mobile games are also beginning to implement them to "combat cheating" (correction: preserve the viability of microtransactions, but I'm just a cynic). I think the Android Pay case is a bit more understandable, but still, why not implement it as an optional feature a user can enable? If it is designed to save money from fraud, then why not give users a small financial incentive to enable it? Taking the choice away from the user is the enemy here.

Don't forget that the lockdown of software on mobile devices goes beyond these new attestation APIs. For 5+ years, phone manufacturers been shipping bootloaders that cannot be unlocked, devices that cannot be rooted, and firmware/OS that cannot be flashed. There is an attempt to ultimately control all the freedom a user has to install their own software. The technology to prevent user freedom is only going to get better and better, as exploits are covered up and manufacturers become smarter about code signing and secure hardware design.

So there is much more to the issue than I think is present at first glance. It affects everything, and it is only getting worse. Forget the closed-source firmware that can be delivered and installed at any time over the air and has unrestricted access to your device's unencrypted RAM... that's been going on forever. But now even Wi-Fi routers are being shipped with locked down bootloaders, killing any chance of upgrading or fixing security issues in your device once a manufacturer decides to stop supporting a device. Guess you'll just have to buy a one in two years. That new AC-2300! 802.11AC is going to be so much faster than that old measly AC-1900. Don't forget the crystal oscillators wear out over time, anyway. /s

Sorry to go on such a wild rant, but I'm pissed. I'll go on over to the AMD profits thread, and feel a little bit more optimistic about the future of freedom.

Not at all. You make a good point. I was reacting to your comment about Netflix as if that were the main issue, but your reply makes it clear that you meant it as just the easiest illustration of a fundamental shift in dynamic. Thank you for clarifying (civilly rather than angrily, despite your obvious passion on the subject!).