Edit:
Further reading here:
I'm 100% convinced this is Microsoft's actual goal, and it's going to succeed very quickly at least on the desktop. Then one day, when a good number of apps will conveniently require WSL to run properly, or to run at all, MS could build their own Linux distribution containing licensed parts of Windows (drivers for closed hardware, graphics libraries, etc.) de facto displacing the original Linux from every other field of application including embedded, automotive, industrial, etc.
They don't care about the technology if they make money from it.
They used to sell an UNIX OS called Xenix.
I find this to be a pretty weak strawman, and one that not many people would consider to be part of their threat model (and if they are, they'd just purchase the part from a brick-and-mortar store so that, if there is malware, it's non-targeted).
Microsoft is mostly doing this for their endpoint security enterprise customers. The objectives aren't exactly hidden, either:
- Don't want anyone to be able to get data off of a bitlocker-encrypted drive[0]
- Don't allow things like O365 login credentials (including temporary auth tokens) to be pulled off a drive[1]
- Prevent thunderbolt 3 DMA (eg. from a rogue usb on the back of the computer)[2]
And yes, they probably also don't want people to keep hacking online video games, which is why Riot uses TPM attestation as an additional security measure to preventing people banned for hacking from evading bans in Valorant[3].
0: https://www.microsoft.com/security/blog/2020/11/17/meet-the-....
1: https://docs.microsoft.com/en-us/windows/security/threat-pro...
2: https://docs.microsoft.com/en-us/windows/security/informatio...
3: https://www.pcgamer.com/valorant-leads-the-charge-on-enforci...
on most of my gaming boards you buy the TPM and plug it into the board like you would a USB connector
total cost: ~$15 (ignoring currently craziness)
if I'm a wallhacker/aimbotter how would this stop me?
the hardware TPM is considerably harder to tamper with than the software "fTPM" that come built-in with the CPU
though I suppose once it gets cracked that may turn out to be a blessing for software freedom
There's quite literally only one potential exploit that would work for the purposes of ban-evasion: extracting the private key. Since every CPU is signed by Intel/AMD's CA, the Riot servers require your CPU attest by signing a secret message, so you'd need a surefire way to extract the private key from other machines to then spoof TPM responses using your existing hardware - that, or you have an active worker agent on other PCs proxying the attestation process.
And, if you were actually able to find a way to extract the private key on TSMC's newest process nodes, there are much more profitable ways to use that knowledge.. ie. selling it to zerodium or nation state actors that are eager to decrypt iPhones.
Preventing a piece of hardware, regardless who is using it, and not preventing the cheater on any other hardware.
It's a completely invalid idea and should not be defended or excused.
So no, it's not a completely invalid idea. At some iteration, it will make the anticheats even better, and they already work pretty well (regardless of players' oversized perception of cheaters running unpunished). A proper chain of trust + hardware signing of mouse input + kernel hardening + hardware fingerprinting will make most cheats irrelevant (including the ML-based ones). You'd have to mod your hardware to be even able to run cheats; which is also preventable, just ask console manufacturers.
The only downside is, this would turn your computing device into an appliance remotely controlled by several companies. And the gamers will be perfectly happy to have it at that, because everybody hates cheaters, and even talking about that is stigmatized.
No. Say no to TPM. It is worse than useless. Imagine Netflix or your bank participating in this nonsense. Would you buy a used computer?
(and BTW my bank already does that, requiring non-rooted stock firmware for its app on mobile. With Samsung for example, rooting amounts to warranty loss; maybe in EU it's different, but I'm not in EU)
Whether you or me say yes or no to TPM is not hugely important. Most people are absolutely happy to trade freedom for convenience, and it aligns with Microsoft's incentive to lock everyone into using their products. This isn't new at all, I've seen loss of PC modularity and openness discussed since late 90s.
However, there are several counterbalances for that incentive.
1. Platform fragmentation, the major one. This alone can delay the inevitable for any amount of time.
2. Backwards compatibility.
3. PCs being used for many purposes, not just as an appliance. This is a minor but noticeable one.
4. Some groups advocating for the platform openness. This one is of little relevance in practice.
Expecting the x86/MS platform to stay open forever is not realistic, because the incentives are biased towards locking down. How much time it'll take to get to that state is a different question, though. It haven't happened yet is all that can be said.
> Expecting the x86/MS platform to stay open forever is not realistic, because the incentives are biased towards locking down.
It's only unrealistic when these fatalist certainties are pushed as inevitable. Free, live free is more than the name of a novella, it's an act to be performed, to fight for.
So yes, say no to the TPM and other such measures such as SafetyNet, which are worse than useless to the most important endgame, to live free.
If there is no way to deal with cheating at games other than relinquishing ownership, disposition, and functionality of my own hardware, that is not my problem, and, it's not true anyway.
Consoles are just the easy way not the only way.
It is if you want to use someone else’s software that requires it; you can’t have something on your terms just because the cost of using it is paid in something other than fiat currency.
My Dell made Arch lappie runs up attested via a TPM 2.0. I boot UEFI, Secure boot to kernel and initrd.
On a Windows machine I’d prefer to use Azure cloud shell than WSL.
These things may be required by the security department. So WSL is a nice carrot there for them. Management through Windows and Linux on top of it. I worked in endpoint management so I can see the appeal.
However personally I really like the way Linux is free of corporate influence. In fact I switched to FreeBSD for that reason as I feel that big IT is getting too involved with Linux.
Last time I set up a startup, our developers all worked in the same environment as our servers.
They're bleeding users to MacOS, Linux desktop installs is a rounding error.
The only developers jumping ship are the ones that only care about POSIX, no matter where it is available.
But then they do things like Windows 11. Seriously has me considering Mac or Linux as a daily driver.
It's not going to happen. The Windows NT kernel is one of Microsoft's greatest assets; in fact it's better designed than Linux on many axes. Until recently it had better support for async I/O (and the developer experience of io_uring may still not measure up to IOCP under Windows), it was designed for multithreading, and it has a more advanced security model. It also has a more advanced driver model, which is to say it has a driver model at all. The fact that there's a standard ABI for drivers means hardware Just Works under Windows and is still incredibly fiddly under Linux. Microsoft essentially has stewardship over the entire PC platform because they play very nicely with OEMs and make hardware easy for Windows to support.
They are not going to give that up. It'd be the OS-kernel equivalent of giving up Alpha for Itanium.
If anything, the future of Linux is to be a guest under Windows NT. How many Hackernews have I heard repeat the mantra that the best Linux desktop environment is WSL?
> Microsoft essentially has stewardship over the entire PC platform
[citation needed]
https://docs.microsoft.com/en-us/windows-hardware/design/com...
https://docs.microsoft.com/en-us/windows-hardware/test/hlk/
There are no other standards for what a PC is. All of the open OSes, including Linux, just piggyback on Microsoft's standard. (And if anyone believes that the various giants building custom ARM processors aren't hoping that they can get dominance based on their own spec so that they can displace Microsoft and wield the same power, think again.)
ARM already has their own spec for that, the SBSA. So the one wielding power will most probably be ARM itself, not one of the "various giants building custom ARM processors".
Otherwise we would have the same level of fragmentation in x86 hardware space that we have in Linux software or that we see in ARM space. Much less compatibility.
- 2021: Windows Subsystem for Linux that can run pretty much any Linux program
- 2024: Custom proprietary extensions in WSL, hidden "incentives" to make sure some important software runs only on WSL
- 2027: Nobody uses Linux without WSL anymore
- 2030: WSL now costs $200 per year.
Been predicting it for years.
That should tell you how much relevance it has to anyone besides Intel.
As for the relevance for microkernels, they are doing alright outside desktop computers.
- 2024: dual support for native Linux & Windows 13 apps
- 2027: Linux & Windows 15 interop support
- 2030: run legacy Windows apps on Windows L (Linux)