2026-10-29T01:42:53Z https://nostr.now thomas https://nostr.now/npub1jvr3uxxgs0wtdpp03huvx4hjkf5pusg6mprw9rkvhq3c3572jqesjzmx03 https://nostr.now/nevent1qqsw2du9p5jev2huc0sl23kceyekzd5kzgpjcqcqlmqrgv2skr2x2wczyzfsw8scezpaed5y97xl3s6k72exs8jprtvydc5wejuz8zxne2grxemhthh In reply to <a href='/nevent1qqsx3vst8g8zu7w07jnucn3fagy5pplwqfmyzljfje4pkgq8m0348zqszk755'>nevent1q…k755</a><br/>_________________________<br/><br/>So true! One little thing: This would also be bad if it weren&#39;t a bogus excuse. Because Remote Attestation in a device for the general public in itself is evil, and it will always be abused. The whole purpose of Remote Attestation is to enable a service to ban people from using arbitrary hardware and OSes. And in extension, to ban people from using arbitrary client apps for those services. 2026-05-10T16:43:06Z https://nostr.now/nevent1qqsznzf5lkktn3qsdy8ruu7d0ck8gaxszuzkrwt4ypex4tnflyn3ppczyzfsw8scezpaed5y97xl3s6k72exs8jprtvydc5wejuz8zxne2grx0jsrad In reply to <a href='/nevent1qqsdmkqumcdthey88x27prknrj995qgksqf6u5368qegspe3xdp9j3g8y7r0p'>nevent1q…7r0p</a><br/>_________________________<br/><br/>No, that is not fine, that is exactly the point. <br/>They do not trust their users. They hate user freedom. They want to provide their software for Anti-User DRM, they even try to get their OS signature key included by Google so their OS would work with play integrity and other DRM services.<br/>Anyone else modifying and compiling Open Source GrapheneOS would then not be able to use it in the same way.<br/>That is what GPLv3 forbids, <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ztsuz6kz4z6x70zze0naeqs4jy7u9l75anwe8q0dmnfrtsczf3wsk8ccks" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>divVerent</span> (<span class="italic">npub1zts…ccks</span>)</a></span> [@j_j](<a href="https://muenchen.social/@j_j">https://muenchen.social/@j_j</a> ) <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1y2l9en3y09nprm9yxt2e5edya7r6v6vzkq9xrh02cgj8srnf8cwq3znuf9" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Lars Marowsky-Brée 😷</span> (<span class="italic">npub1y2l…nuf9</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub15nl4wr4q9nw292wk9aa0q862us5xaa7y52lkmakyw6j52fj7ua2s00hcq3" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Moritz Poldrack :arch:</span> (<span class="italic">npub15nl…hcq3</span>)</a></span> 2025-05-25T14:44:15Z https://nostr.now/nevent1qqspjc3a8y2rhwmslgwskn4uhp2tswe2t9sxj8vr5ghyh5ux2u8c8fqzyzfsw8scezpaed5y97xl3s6k72exs8jprtvydc5wejuz8zxne2grxups3n3 In reply to <a href='/nevent1qqsrap4z0hecpsmdmzsv3lw2kgnllwrgxnm9y3mu8rt495xj50jetkgq2rh50'>nevent1q…rh50</a><br/>_________________________<br/><br/>There are probably many apps that check for mock, but don&#39;t use the integrity API.<br/>Each hobby OS project begging monopolists for inclusion can&#39;t be the solution.<br/>Maybe remote attestation should be abolished altogether? <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1lfxngj5mhk2af7f2vdvaqt2y8q4rxfe8w35us2md3vxxgrvzpslq02wnmg" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Wilfried Klaebe</span> (<span class="italic">npub1lfx…wnmg</span>)</a></span> [@kkarhan](<a href="https://infosec.space/@kkarhan">https://infosec.space/@kkarhan</a> ) 2024-09-09T19:01:11Z https://nostr.now/nevent1qqspjx0tl0ksg4yr2c6cv0rh8vucpg89qg6qp974fqd33pdsyac0laqzyzfsw8scezpaed5y97xl3s6k72exs8jprtvydc5wejuz8zxne2grx2ha26z [@kkarhan](<a href="https://infosec.space/@kkarhan">https://infosec.space/@kkarhan</a> )<br/>And apps should not be allowed to restrict anything the user wants. Backups. Screenshots. Deny the app a location and spoof it, if the app doesn&#39;t accept this. Sound processing (DSP). Android Auto for non-Google-play apps. Scripting/automation. etc. Currently shady and insecure root hacks are needed for that. This should all be enabled and secured by an OS that sides with the user, not with the app developer or with google. <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>GrapheneOS</span> (<span class="italic">npub1kwa…e0nj</span>)</a></span> 2024-08-01T06:34:18Z