news at 11. [LWN.net]

news at 11.

Posted Apr 24, 2003 14:43 UTC (Thu) by coriordan (guest, #7544)
Parent article: Linus on digital rights management

I don't see why Linus made such a big deal about this announcment. From reading the thread on lkml.org, it seems like the linux-hackers don't really care. I'm guessing this was brought up by talk of Treacherous Computing but I don't think kernel-signing is the same thing.

There are three reasons for it's non-importance:
1) signed-kernels (and other pieces of software) can be a good thing. Wouldn't you like to be sure that the server you log into to check your mail isn't secretly monitoring you? check the signatures of the shell/kernel/mta/mua/etc/etc/... (this could be moot due to reason 2:)

2) A work around is possible. The users only needs to have a copy of a signed kernel on their system, they *don't* have to be running it.

3) The only threat to the user is that certain apps will be programmed to only run if the users system is running a kernel from a particular vendor. This can not possibly ever be a problem to people who use only Free Software.

anyway: people don't care on lkml, I don't see the deal at all.

Ciaran O'Riordan

(Log in to post comments)

news at 11.

Posted Apr 24, 2003 14:58 UTC (Thu) by corbet (editor, #1) [Link]

The thing I think you're missing is that people can make hardware that will only run signed kernels. At that point you can wire any sort of DRM into the kernel you want - and make source available - and users still won't be able to change it. So it will be possible to make an Xbox-like system with a Linux kernel.

news:

Posted Apr 24, 2003 16:23 UTC (Thu) by coriordan (guest, #7544) [Link]

> The thing I think you're missing is that people can make hardware that
> will only run signed kernels

I was missing that. Hmmm.

Well, I hope the GPLv3 address this sort of practice. Even if Linus asks developers not to use it, other projects should be protected from this sneaky kind of freedom-circumvention tactic.

I also hope consumers don't support/buy this kind of crippled hardware.

Ciaran O'Riordan

news:

Posted Apr 24, 2003 17:25 UTC (Thu) by dlang (subscriber, #313) [Link]

if GPL v3 attempts to regulate this then there will be interesting fireworks. Linus has the kernel licensed under the GPLv2, NOT GPLv2 or later and so we could get into a mess where a kernel hacker submits something under GPLv3 and Linus rejects it unless they change it to GPLv2 (and if GPLv2 and GPLv3 code is combined which version is the result under)

news:

Posted Apr 24, 2003 18:18 UTC (Thu) by coriordan (guest, #7544) [Link]

This isn't that big a deal. Linux is only one project, if Linus doesn't like v3 he can use v2. Another option is that he can dual license the kernel under both versions, he already accepts dual licensed code so long as one of the licenses is the GPLv2.

This dual licensing situation wouldn't sovle the signed-kernels-only hardware problem but it would allow kernel hackers to use v3 if they want.

Ignoring Linux, I'd like to see v3 address this issue becuase I release software under the GPL, and I wouldn't like it to be used in a way that doesn't give users Freedom.

RMS's comments on this issue would of course be interesting but this situation really isn't that important. The problem of cripling hardware to remove users freedom has already been thought of, and Linus's thoughts on the matter are irrelevant.

Ciaran O'Riordan
...actually, Bruce Perens's comments would be interesting?
(Until now, RMS has been the only person who will publicly disagree with Linus.)

news at 11.

Posted Apr 24, 2003 16:32 UTC (Thu) by dthurston (subscriber, #4603) [Link]

Umm, you do know that Tivo already does this, right? The FSF has stated that they are fine with the practice (or at least that it doesn't violate the GPL).

FSF not OK with bootloaders that only load *signed* GPL'd kernels

Posted Apr 24, 2003 17:00 UTC (Thu) by emk (subscriber, #1128) [Link]

The FSF is not fine with this practice, as far as I can tell--they really fear things like the next generation XBox, which is apparently targetted to take the place of home computers, but (allegedly) will only run signed software. Once you have DRM, you can see your GPL'd programs, but you may not be able to run modified versions.

However, the FSF does not believe that such sneakiness violates GPLv2, as written. GPLv3 may or may not address this issue.

news at 11.

Posted Apr 25, 2003 6:46 UTC (Fri) by ekj (subscriber, #1524) [Link]

Yes, you can make hardware that will only run signed binaries, and thus close that hardware to tinkering. Infact, making such hardware has already been attempted, it's called a console.

In essence, the bootloader of such hardware does the equivalent of:

if (valid_signature(kernel))
boot(kernel)
else
complain_and_stop();

This is nasty, if you are running on such hardware, than the ability to change the kernel in any way you like brings you nothing: if you change anything, even something completely trivial, the signature will no longer be valid, and your new changed kernel will not boot.

Linus is rigth though, this is clearly allowed under the GPL. And furthermore, it very likely CANNOT be forbidden even if we would want to.

A Signature is (or atleast it can be) a separate document saying the equivalent of: "I, Bill Gates, testify to the fact that the kernel with sha1sum=b7a7bf03dcafd4d48001d6a2a6fd2ceaefa4cc1e is trustworthy and can be booted. signed(bill_g)"

There is no way for the GPL, or any other legal document to forbid the above document from existing. The signature above is clearly not a derived work of the kernel, but rather a commentary upon it. (namely a commentary on the trustworthiness) The only info derived from the kernel is the sha1sum, but the only function of this is to make it clear which kernel you are talking about. (much like mentioning the ISBN-number of a book you are reviewing)

Furthermore, there is also no way you would be able to forbid hardware from acting on the existence (or absence) of such a signature. Afterall there is no law saying that "hardware *must* boot all code."

Now, what *would* be nasty would be new laws *requiring* hardware to implement signature-checking. Such laws would essentially make it forbidden to make user-modifiable computers. The way the US is moving at the moment, I would not be too surprised if such a law is introduced and passed in the next few years.

news at 11.

Posted Apr 25, 2003 13:45 UTC (Fri) by Wol (guest, #4433) [Link]

But new laws *requiring* it would kill the computer industry stone dead! Either you make it well-nigh impossible to get hold of signing keys, which would destroy all the little programming shops (and don't forget, that includes most businesses that use computers as *computers* rather than glorified typewriters), or you end up with loads of keys out there that are forever leaking.

RedHat certainly, and probably other major distributors such as SuSE, would almost certainly publish a signing key for general use.

Have no fear. Such a law would be either unenforceable, or nuke-style destructive. However, given the number of laws recently *passed* which ban the Internet infrastructure in various US states (the so-called super-DMCA bills), unfortunately I can see such laws getting passed...

Cheers,
Wol

Distinguish development workstations from Aunt Tillie's iMac

Posted May 2, 2003 9:31 UTC (Fri) by bgilbert (subscriber, #4738) [Link]

Not necessarily. Consider professional media production houses and copy protection mechanisms like MacroVision. Professional equipment can trivially defeat MacroVision, and anyone who wants to buy an N-thousand-dollar professional deck and TBC can do it. The point of MacroVision is to discourage casual copiers, not professional pirates.

So, require standard home and business computers to execute only signed code. Sell a separate class of hardware -- "development machines" -- which costs $50k/box and will run anything you throw at it. Combine that with a TCPA-like system in which most signed software won't trust a system that can run unsigned code. Then, vigorously prosecute people who "misuse" their code-signing keys* -- and since companies with deep pockets are more likely to have code-signing keys in the first place, this will be effective. The end result is that you've concentrated development on a relatively small number of dedicated, single-purpose, trackable and auditable machines, and motivated everyone with a key to protect it from use by others.

Will this shut down open-source development entirely? Of course not. But it raises the bar; if the average user's workstation can't run the output of its own compiler, it's much harder for people to casually tinker with the code. The trick is to raise the bar too high for Joe Programmer, while still letting small software houses get through.

* What happens if code must meet certain requirements in order to be legally signed (either through outright legislation, federal regulation, or contract with the provider of the signing key)? Through the miracle of selective enforcement, this can leave free software developers with legitimately-obtained signing keys open to fairly significant legal action. That'll be a deterrent as well.