←back to thread

Apple already shipped attestation on the web, and we barely noticed

(httptoolkit.com)
596 points pimterry | 3 comments | 25 Jul 23 14:10 UTC | HN request time: 0.001s | source
Show context
tempodox ◴[25 Jul 23 14:44 UTC] No.36863027[source]▶
> limiting access to features or entire sites based on whether the client is approved by a trusted issuer. In practice, that will mean Apple, Microsoft & Google.

Wait, does that mean they decide what websites I can visit? That doesn't sound dystopic at all.

replies(2): >>36863056 #>>36865925 #
kevincox ◴[25 Jul 23 17:24 UTC] No.36865925[source]▶
No, it is the other way around. The website decides if your software stack is allowed to view them.

1. Windows to old? Blocked.

2. Running FreeBSD? Blocked.

3. Patched your version of Chrome? Nope.

4. Your Linux distribution isn't approved? Blocked.

5. You want to use some obscure Chromium derivative? Absolutely not.

6. Running a RISC-V machine? LOL get lost.

Basically the user-agent is no longer the agent of the user. Instead the website can select which hardware and software stack can be used to access the website.

The inevitable outcome is that a huge number of sites will only allow OSes from Microsoft, Apple and Google running official browsers by the same three megacorps. Everything else will be blocked.

replies(1): >>36868830 #
1. hellojesus ◴[25 Jul 23 20:24 UTC] No.36868830[source]▶
We then devolve into an arms race of kernel 0days in order to access services while running FreeBSD?
replies(1): >>36869056 #
2. kevincox ◴[25 Jul 23 20:37 UTC] No.36869056[source]▶
It is true that there is a large software stack that needs to be "perfect" for this to work flawlessly. But look at iOS. It does appear that highly motivated corporations can keep a fairly secure stack of this size. iOS jailbreaks are few and far between. They do regularly occur, but not often enough for this to be a convenient solution.
replies(1): >>36869159 #
3. hellojesus ◴[25 Jul 23 20:43 UTC] No.36869159[source]▶
Plus it seems that attlestation could easily fix the patching laziness of humans by refusing to work with versions of software that have known 0days. So any published 0day would likely ruin the exploit for the discoverer. Plebs like myself would therefore never have a hope at escape, and would have to exist in the lowsec web. Which I'm okay with, for the record. Just wanted verification of where I would have to live.