thomas

Public Key

npub1jvr3uxxgs0wtdpp03huvx4hjkf5pusg6mprw9rkvhq3c3572jqesjzmx03

NIP-05 Address

Profile Code

nprofile1qqsfxpc7rryg8h9ksshcm7xr2mety6q7gydds3hz3mxtsgug609fqvcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsm00khj

Publishing to

nostr.mom

Author Public Key

npub1jvr3uxxgs0wtdpp03huvx4hjkf5pusg6mprw9rkvhq3c3572jqesjzmx03

Show more details

Last Notes

2026-05-10 16:43:06 UTC

- reply

So true! One little thing: This would also be bad if it weren't a bogus excuse. Because Remote Attestation in a device for the general public in itself is evil, and it will always be abused. The whole purpose of Remote Attestation is to enable a service to ban people from using arbitrary hardware and OSes. And in extension, to ban people from using arbitrary client apps for those services.

2025-05-25 14:44:15 UTC

- reply

No, that is not fine, that is exactly the point.
They do not trust their users. They hate user freedom. They want to provide their software for Anti-User DRM, they even try to get their OS signature key included by Google so their OS would work with play integrity and other DRM services.
Anyone else modifying and compiling Open Source GrapheneOS would then not be able to use it in the same way.
That is what GPLv3 forbids, @npub1zts…ccks [@j_j](https://muenchen.social/@j_j ) @npub1y2l…nuf9 @npub15nl…hcq3

2024-09-09 19:01:11 UTC

- reply

There are probably many apps that check for mock, but don't use the integrity API.
Each hobby OS project begging monopolists for inclusion can't be the solution.
Maybe remote attestation should be abolished altogether?
@npub1lfx…wnmg [@kkarhan](https://infosec.space/@kkarhan )

2024-08-01 06:34:18 UTC

[@kkarhan](https://infosec.space/@kkarhan )
And apps should not be allowed to restrict anything the user wants. Backups. Screenshots. Deny the app a location and spoof it, if the app doesn't accept this. Sound processing (DSP). Android Auto for non-Google-play apps. Scripting/automation. etc. Currently shady and insecure root hacks are needed for that. This should all be enabled and secured by an OS that sides with the user, not with the app developer or with google.
@npub1kwa…e0nj