I like the approach of Chromebooks. Safe and secure in its default state. Can switch to "dev mode" which gives you a less secure but much more open system. And then can open the case, remove the write-protect screw, and have a fully open system. If any problems develop, or you simply want to go back to a locked-down secure state, you can very easily reset the machine to it's original configuration.

My personal approach to the problem is multiple devices. Linux laptop and Windows desktop for my open systems. iPhone and Chromebook for when I don't want to worry.

Chromebooks are close but one should be able to keep their changes and reactivate the security screw so no further changes maybe made. Simply, manual switches to protect UEFI/BIOS and TPM changes are better move then none or all approach the Chromebooks take.

>So what can one do? How to approach it? Is there even a way to create a computer that both respects the end-user as its rightful owner and can be safely used to conduct business and pleasure on-line?

Take a look at Qubes. It virtualizes almost everything that is done on the system and it had a very solid security model. An example: your banking VM can be clearly marked and distinct from the (potentially one-time) VM you used to pen that dodgy-looking email attachment.

The problem is that “end-user” means two very different things. Most hackers still think of “end-user” as you and me (note the answers you’re getting), and this is why Free Software is losing battles left and right, particularly in mobile. Stallman’s comments re: iPhone, for example, demonstrate that as an industry and advocacy group we still don’t really understand this.

We have to accept that those who need rigid, inflexible computing to protect them far outnumber us. People don’t care if they can rewrite Notepad or read its source code, they care that Facebook works and that they don’t get viruses or added to a botnet. The only way to develop a healthy advocacy here is to understand that the hacker ideals and customizability that we expect of a computing system really make us a vanishing minority and acknowledging that for the now-average user, those ideals make less and less sense as time goes on. We had our run, then everybody else found computers. Times change. It’s not bad.

Is there a way to create your computer? For us, probably. For them, I’m increasingly believing it isn’t. This isn’t a knock against anyone, just an acknowledgment that there are almost certainly two answers to this question and Free Software ideals and beliefs aren’t equipped to handle the much, much larger answer. Proprietary operating systems, walled gardens, Internet centralization, it plays toward all of the ideals Free Software has been holding dear for decades. We have to evolve our thinking, I’m afraid. The less we acknowledge that perhaps Free Software is wrong for the average user, the less we will have a voice at the table; eventually, nobody will listen at all.

Hell, many cars don’t even allow you to work on them any more. Look at Teslas, higher-end Audis, etc. I offered to change my neighbor’s oil in his Audi and he got scared about his warranty.

Heh.

It's good you brought up cars, as they're a perfect example of conflicting needs. Cars are now computers on wheels, and while I'd love to drive a car I personally modded at firmware level, I would also be against allowing such cars on public roads. One, hackers make mistakes, and two, malicious actors would trick regular people into modding their cars to further their malicious goals. Both reasons create public hazard. Which is obvious in case of cars, but less obvious with computers connected to the Internet.

At this point I fear we might need to fork computing entirely - let the regular users live in "hell" of propertiary, locked down services they don't actually own, while ourselves, we get the "heaven" of free software... that's pretty much not allowed to interact with regular users. I don't see how to keep the two worlds as one, because all features meant for hackers can also be used by malicious actors to pwn people.

Consider e.g. dev console in a web browser. All is cool, because regular users don't know what F12 does and wouldn't even think of pressing it. But then Facebook and others have to put Self-XSS measures into place, because a malicious actor can tell a regular user what F12 does, and how it "can" let them see who viewed their Facebook profile...

I hate the idea of split world. It means I won't be able to e.g. automate my banking or pizza delivery, because those things will have to go through "dumb" computing, to avoid self-pwnage risks. It means that eventually I won't be able to even get a general-purpose computer, because the nature of niche markets is that they generally don't get served with good stuff at accessible prices - they either get served at exorbitant prices, or don't get served at all.

So I don't want that split world. I want an alternative to fight for. But as I previously wrote, I can't see any.

I am of two minds of such a split world, as all too often it means that when a geek is called on to fix something for the rest of us, they invariably can't because they can't get the right access.

Never mind that i fear that the black hats of the world will always find a way to break the sandbox of the "safe" computers, and thus we are effectively fucked. Because now they have access on a level the rest of us do not, and thus can't counter their actions.

BTW, i do believe Cory Doctorow has done a couple of speaking tours on this under the titles "The coming war on general purpose computing" and "The coming civil war on general purpose computing".

The first being about government demands for a computer that do everything but some naughty action, and the second about well meaning geeks locking down computers to make them "safer".

We already do split the world, if you think about it. Despite looking and behaving alike, servers and workstations/phones/etc. diverge quite dramatically. You manage them differently, interact with them differently, use them for different purposes, and so on. Every hacker can relate to this: "don't use root for day-to-day work." Well, do I need root on my workstation? Maybe not. Do I need root on my server? Yes.

I think split world is livable if that divergence is embraced. Running a Xeon server as a workstation is something a lot of developers do. As clients get more locked down, it's probably the direction we'll have to go, and really differentiating what makes a "server" from a "client".

> have to accept that those who need rigid, inflexible computing to protect them far outnumber us. People don’t care if they can rewrite Notepad or read its source code, they care that Facebook works and that they don’t get viruses or added to a botnet

And yet the epsilon between "Facebook" and "malware" continues to shrink. I'd personally rather have my phone ownt by an impersonal botnet that's just going to send out some "growth hacking" spam or look for bank passwords, than a person-targetting adversarial application that is designed for the purpose of creating a long term surveillance profile on me. But of course everyone is free to choose their own kinks!

What we have to accept is that "people" actually have no fucking clue what they want. Advertising tells them, and social proof reinforces it. What the Free Software Foundation doesn't "get" is money, as in enough money to carpet bomb their own popularity into public consciousness. While promoting end-user freedom creates massive economic wealth, capturing that wealth predictably is inherently impossible.

Having said that, the surveillance industrial complex will certainly continue catering to this mythical "average user", as they gain when people self-identify into this group and thus resign themselves to sharecropping. But it's foolish to buy into their disempowering least-common-denominator-database-row uniformity paradigm, any more than we need to pretend to do so to eat. The only reason the Free world actually needs to care about the next generation of GoogAppAzon middlemanning is that economics force us to piggyback onto their hardware.

I’m sorry, no. If the FSF had a billion dollar budget, you’d still lose people immediately at the first instruction to open a terminal and become root. Your comment actually illustrates the exact point I’m making: the epsilon between us and them is widening, because the loudest voices want people to look at computing the same way our heroes of the ‘70s and ‘80s did and don’t realize this is unproductive. Freedom is too often equated with the way we have done things before.

You or I buy a phone and look for a terminal. They buy a phone and go straight to the App Store to install Facebook. And yes, people know what they want. They are on Facebook because that’s what they want. Look at pictures of my newborn, group of friends. Oh, all my friends are on Facebook and it lets me do that. What’s that, GNU Social? I need to figure out what? I need a server? Mail is decentralized. How many average people don’t use a central service like Gmail? People are choosing the things Free Software doesn’t like because for them it is better. Full stop.

Free Software has no competitive answer for anything the big names are doing for the average user. Not one thing. There’s enough people interested in it that competitive answers could be developed and find a market. The problem is unrealistic ideals (decentralization, often; how much of global SMTP traffic is spam, again?) placing unrealistic requirements upon a project and focusing all of its resources on things the average user doesn’t care about. What if I wrote a Facebook that cared about privacy and, somehow, miraculously got billion MAU traction? You’d be right back banging the same drum making you irrelevant about surveillance state apparatus because it’s centralized. Except the whole point of Facebook is network effect. So.

You’re deluding yourself if you think billions of people are clueless and Free Software has all the answers, if only there were a little more budget. Just look at the worldview evident in your comment. That sort of talk will make most anybody glaze over, and you immediately lose your chance to pull them to a better way of doing things. “Only use things to which you can read source code.” What’s source code? Nobody cares about the ideals. Adapt accordingly if you want to effect meaningful change. That’s my point.

There’s literally decades of proof based on what’s successful that we don’t have a firm grasp of how to adapt software freedom to Joe Random. You and I both know it’s better. Now figure out how to tell them and design systems that are palatable to the average user.

That’s my other point: I don’t think a customizable system with Free Software ideals in mind can sufficiently protect and be useful for the average user. I want to be proven wrong.

If the FSF had a billion dollar budget, they could copy the UI and infrastructure of Faceboot, include hooks that allowed people to run their own code/servers/etc, and then pump the resulting product LA^h^hSV-style until it caught on. There would be no need to criticize it for being somewhat centralized, because the option to run your own part would exist. And rather than powerlessly complaining about unilateral corporate decisions, even normal users could share software fixes instead.

The FSF itself might specifically not be capable of this (due to an aesthetic formed from decades of waging trench war), but a generic Free software organization certainly would be. What's missing is the billion dollars to develop, refine, and endlessly promote this idea, because there is no scalable profit in actual Free software!

I don't think we're actually disagreeing on the above lead-in topic - we're just coming at this from wildly different paradigms. My comments are not trying to convince "billions" of people - I'm resigned to the fact that people will tend to choose the shiny promoted thing, even when the shininess itself is paid for by the harm being done to them!

But that does not mean that people who should know better (eg programmers) should find justification, or even escape scorn, for creating such things. Eroding users' ultimate control over their devices goes past the paternalism of protecting careless/ignorant users, and into the territory of malfeasance. Such things are against any basic sense of professional ethics - the same type of principle-agent violation as a sysadmin who creates a backdoor for their future self.

To bring this back to something concrete, look at the paradigm of control promulgated by contemporary bootloaders. Verifying running code is a worthwhile goal, but there is no reason this requires trust rooted in manufacturer-kept keys. Rooting the trust in symmetrical algorithms or user-loaded signing keys would accomplish the same exact goal while still preserving user freedom. And then the default scheme of only trusting code signed by the manufacturer would be implemented on top of that. But doing so would require a little more implementation complexity (giving up control inherently makes things harder), and be less profitable.

> There's literally decades of proof based on what's successful that we don’t have a firm grasp of how to adapt software freedom to Joe Random

My above points are essentially refuting your point here. The lack of mass-appeal Free software does not imply we don't know how to make it, as it can also be explained by simply not knowing how to fund it!

There are plenty of things in life that have rough edges and "average users" have ultimately learned to "not do that". Software is at an analogous stage to people putting water in the engine oil because of "one simple trick", but this does not justify welding the hood shut on all new cars!

I think what we want can be built on capability security. https://sandstorm.io/how-it-works is a more recent start on this sort of thing which saw a proof of concept in CapDesk back around the turn of the century.

A hardware switch would do nicely.

How is hardware switch going to let me (and software I write) do whatever I want with the machine while preventing software from the Internet from doing the same?

The switch alternates between "Do anything && disconnect power to network interfaces" and "Lock state && enable power to network interfaces"

You're suggesting a hardware switch capable of turning a general-purpose computer into a completely locked down computer, with a trusted chain all the way from physical switch to the code doing "computing mode" transition?

Sounds interesting, though I fear that at that point, companies won't even bother providing the "general-purpose" mode anymore.

Effectively what a Chromebook already is.

the first ones were released with a physical switch behind the removable (shock horror) battery. Later ones have a magic key press that do the same thing (though one variant that Google sold directly had a flaw where the state was stored in volatile memory).

This is how people install things like Crouton and whole Linux distros.

Note btw that by default a Chromebook updates silently in the background (in a fashion that Android gained with 8.0).

It has two partitions, one is active one is dormant.

when a update is released, it gets applied to the dormant one. And on the next boot, the two a flipped. If the newly updated partition fails to boot, the system will switch them back on next reboot. And if it succeeds, it will become the active one while the older version goes dormant until another update is released.

Keep in mind that little if any state is stored locally.

And frankly, if Mozilla wants to get back in the game they should consider producing a similar system that also offer a set of backend services (or collaboration with others that can offers said services) and the means of bootstrapping such services independently.

Because right now while Chromebooks are being adopted rapidly in USA and Canada, European nations a weary thanks to the question of where the data is stored and who can potentially access them.

What’s so weird about that? This is nothing new. Before wireless that hardware switch was the Ethernet cable.

It is weird, because we're not talking about a switch to turn networking off, we're talking about switch to turn general-purpose computation off, making your computer a completely locked down sandbox. This is unprecedented (aside Chromebooks, it would seem).