Sprucing up open source's GPL foundation

TalkBack 18 of 34:

Next »

« Previous

• Thread View
• Flat View

cryptographically signed STUPIDITY

To anyone who knows anything about encryption,
the concept of using Public Private key
technology based on asymmetric keys is weak in
the first place, and then by inserting the public
key into a billion peices of hardware (where you
can't change it when it is compromised) is about
as trustable as a guy selling watches from his
raincoat in a train station.

The problem here is that the people working on
this idea start with the predicate "well the
hardware has to have a key in it that will only
run our software which is signed", before then
thinking about "Trusted computing".

Keys MUST be DISCARDABLE to be trustable.
I came across this concept when working with
Lotus Notes, which uses an Asymmetric key
signature system with hierarchical organisational
certifiers and so on.
At one stage the company I worked for suspected
the Organisational root certifier was compromised
by a competitor.
You can only recreate trust by creating a new Org
root certifier and new versions of EVERY OTHER
KEY. This would have meant going around every
customer and recreating org to org trust
certificates. The management decided not to do it
since it was too big a job, and therefore had to
continue with a situation.

The problem was that too much Trust was placed in
certificates. Put these certificates in hardware
and you'd have to throw away the hardware to
regain trust.

CERTIFICATES MUST BE DISCARDABLE TO BE TRUSTABLE.
Therefore "Trusted Computing" will never be
Trustable in it's current envisioned form.



GNU Public Licence is the strongest licence (most
tried and tested, simplest and so on) to date.
It sounds like Richard Stallman is writing an
improved licence (added features). The article
sounds like he's writing a new one because the
existing one is weak. I don't think this is the
case at all. (Note software patents don't exist
in a large part of the world, and in the USA most
people think there should be massive USPTO
reform, therefore it's the USPTO that is weak,
not the GPL).

Posted by: hipparchus2000   Posted on: 12/24/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now