Boot Guard, evidently, doesn't require building a walled garden, either, according to this article. You can use it to securely attest to the signature on the firmware, and seal your hard drive's encryption key to that attestation. That way an unauthorized modification to the firmware won't result in your private data being stolen, but the computer remains usable with an intentional modification to the firmware, whether it's Coreboot or a manual binary patch or whatever.
Freedom and security shouldn't be a tradeoff. Security includes making sure authorized use of the system is permitted. Freedom involves making sure that my computer isn't acting against my interests. We need to stop portraying this as a tradeoff, and we should make it clear that we'll accept (and maybe even demand) security when it is done in the service of computing freedom.
(x86) Secure Boot was a big step forward here for both freedom and security: it lets me make sure that only an OS I choose runs on my machine, and that no nonfree OS, not even the one that came with the computer, will boot up unless I want it to. It also (obviously) played well into the security demands of the wider market. We should be demanding more things like Secure Boot, alongside fewer things like Boot Guard.
[1] https://www.gnu.org/philosophy/can-you-trust.html
[2] I don't mean fair use in a strictly legal sense, because I live in the US where the DMCA forbids breaking DRM even for what would otherwise be fair use under copyright law; but I think it should be fairly uncontroversial that doing so is moral.
Historically, hackers have been very good at taking software that was meant to be secure, and breaking it. As you point out, the Windows kernel was never going to be unhackable. iOS (iPad/iPhone), which is arguably the state of the art in walled-garden verified boot with hardware support, has been reliably jailbroken.
Historically, hackers have been very bad at writing software that was meant to be secure, and keeping it secure.
I'm a lot more confident in our ability, as the hacker movement, to destroy any DRM scheme that wants to use a TPM than to successfully make a general-purpose OS that keeps someone's files secure. And that worries me. If these two were somehow a direct tradeoff (which they're not), I'm pretty sure I'd prefer a world where DRM worked but security breaches and malware weren't an everyday occurrence.
Anyway, there are a few recent developments which make me feel somewhat anxious, which I guess means they're good. Among them are Rust and seL4.
Rust, which I'm quite enthusiastic about when not in a hacking mindset, could be one of a few languages that can get rid of the assumption that fast/small/light tools have to be written in C or C++ and thus memory unsafe. To name a particularly egregious case, it strikes me as ridiculous that OpenBSD's ntpd feels the need to include a privilege separation feature, despite being a low-thousands-of-lines implementation of a tiny protocol; I mean, there are probably no vulnerabilities in that particular codebase anyway, and given a danger, being paranoid is a good thing - but in the context of the complexity of something like NTP, we have so many CPU cycles to spare that programs simply should not be a typo away from magically turning malformed input into arbitrary code execution. (To be fair, high-level languages have their own vulnerability classes which might allow the same, but at least you're not constantly teetering on the edge of the cliff. Well, unless the language is bash :) And of course Rust is aimed at far more performance critical scenarios - they aim to build a whole browser which is competitive with existing ones performance-wise while being mostly safe code.
seL4 as a product is overhyped: the kernel they verified is tiny, and the proof enormous. It will be a long, long time before a significant fraction of the code running on a production system will be formally verified. However, whereas before there was always a hope of finding a critical bug in even the innermost low level bits of every system... well, now there is one system where that's theoretically impossible. That's a step. Perhaps, slowly but surely, there will be more steps, more places created where bugs (even logic errors, panics, and other types not caught by languages like Rust) cannot lurk. In the long run, that's certainly the type of software I want running my brain!
But every time I hear about it, people are disappointed by the language. So how is that going?
- For some reason, Rust posts constantly make the front page of HN. Either the Rust community includes a lot of HN users, or there are just a lot of people who like to hear about it.
- Rust is highly imperfect (as you would expect it to be). There's the constant breakage, which is supposed to end in like 2 or 3 months with 1.0; as a complex language it has more warts than, say, Go, and requires a deeper understanding to use well (i.e. you really benefit from experience with C++); the borrow checker takes some getting used to, I've heard, before you don't feel like you're fighting with it (haven't written enough code myself to get to that point); builds are slow; it doesn't have everyone's favorite pet feature; etc. Especially since people don't seem to feel the need to spend very much time getting to know Rust before writing blog posts and especially HN comments about it, that leads to a lot of complaints, which due to the previous point show up disproportionately on HN. (Actually, anecdotally I think most of the posts are positive, but every post about Rust is used to some extent as a "general Rust discussion" comment thread, just like every other topic. :)
- With all these complaints, the simple but critical point gets drowned out that the language works, pretty much - satisfies to a good extent if not perfectly its performance, safety, and readability goals. (For proof that it works in the large, consider that Servo is over 400k lines of Rust code and implements an already quite featureful HTML renderer[1].)
But I think there will be a good amount of positive hype once 1.0 gets out the door. Can't wait.
[1] http://kmcallister.github.io/papers/2015-servo-experience-re...
But when done sensibly and used in a system that's under the user's control (incl. that remote service), it's a security enhancing feature.
And people might not be as much in arms about it anymore because the landscape changed: The original Palladium proposal was made in an environment where the only threat model was "consumers 'steal' content".
Today, measured boot is also a legitimate security measure against criminal activity targetted at the user (eg boot kits, extortion ware), which didn't really enter the picture back then.
The hacker movement has been soft on this for a long time. Blind trust in university accounts is a good example. There's really no reason to believe that your university is less likely to snoop on your mail than Google is. There's in fact a lot more reason to believe that an actual human, with an interest in you specifically, may be doing so. Same with files or processes on a shared server. But hacker culture grew in a time where computing required a shared, large investment in a computer, and so there was no choice but to trust the university computer if you wanted to do any computing at all, and that became an accepted part of the culture.
We now live in an age where the personal computer is just about (but not quite) affordable for everyone. We need to shake the idea that you can achieve computing freedom on someone else's computer. Perhaps you can freely compute for them: if you're doing research for a university who's given you an account, or work for an employer who's given you a laptop, by all means, use their computer. The concept of freedom, then, applies to the university or the employer, and you are just their agent.
But if you're talking about personal computing, we need to get a personal computer in everyone's hands. We need to solve problems of affordability and accessibility, but people should no more be reliant on a company-issued laptop than on a university-issued shell account.
That's not true. They lack the ability to ensure their freedom, yes. But they don't necessarily lack computing freedom.
If you mean a security administrator of a large company - it's their computer, not yours.
https://www.youtube.com/watch?v=HUEvRyemKSg
The coming civil war over general purpose computing (2012):
That is true for very competent end users, but near impossible for the general masses.
We have come so far as to be able to install big Linux distributions like Fedora and Ubuntu without any hassle on Secure Boot systems. That only works though, because their bootloader, kernel and kernel modules were blessed (i.e. signed) by the distributor. Building your own kernel still requires you to disable Secure Boot (or far more difficult, add your own key to Secure Boot and sign everything yourself). Heck, even ZFS, which is otherwise as easy to install as adding a third party repository, is incompatible with secure boot, as it loads a custom kernel module.
Now, to visualize the real world difficulty of disabling secure boot imagine guiding your spouse or friend through this process over the phone: Reboot the system a few times until they found the text telling which key press during boot to enter EFI setup or guess correctly for their hardware manufacturer, let them read out aloud what they see - possibly in a language they don't speak well if the interface is not localized, navigate them through the menus, find out how to change the Secure Boot setting (one should think switching binary settings and moving stuff up and down in a list would be a solved UI problem nowadays… speaking from experience with my HP Probook UEFI interface, it is not, though), (if you are particularly unlucky: explain which keys of their keyboard layout map to the needed US keyboard layout), exit and safe the settings.
All in all I think for the average user (who doesn't even know what firmware is), signed images are a good thing.
The worst part is that the masses are going to think these anti-user measures are helping them, "because security". They'll see only the "prevents hackers" part being advertised and agree wholeheartedly, or even if they realise that it means they won't be able to choose the firmware they run, they'll shrug it off as "I'm basically never going to do that, so why should it matter to me?" The majority have spoken for security over freedom, and lead us down this path, where eventually almost no one will own the computers they use, or be allowed to do anything with them (including write software) except as permitted by the organisations that control them.
This is really, really scary. It's quite reminiscent of the dystopia in Stallman's "The Right to Read":
https://www.gnu.org/philosophy/right-to-read.html
It won't be easy to turn the situation around, but if anything I believe it will have to start with education - to reverse the brainwashing that companies and governments have propagated, and show people the power they can have when they control their computing devices. It is particularly hard when the majority are barely computer-literate, and there is vested interest in keeping them that way.
I don't think the situation has gotten to the point where it's necessary to stockpile older and freer computers, but that could be an option in the future. However, I'm certainly not going to be replacing my Thinkpad X60 with anything else for as long as possible.
I think this famous quote really needs to be made more aware of among those preparing to fight against the war on general-purpose computing: "Those who give up freedom for security deserve neither."