Talk:Next-Generation Secure Computing Base/Archive 1

message: There are a number of uses for Palladium which will empower end users at the expense of centralized bureaucracies.  Recently several researchers pointed out that Palladlium could increase the security of P2P file sharing networks, making it harder for copyright owners to inspect the data flowing through the network and attack it.
:Instead, the copyright owners can apply for a court order to have the network shutdown completely, and Palladium makes this technically possible (this is not currently the case with most P2P systems). Furthermore, public sharing of illicit or copyright material will be no more secure under Palladium than is presently possible.
:The present method by which illegal filesharers on P2P systems (in this case I'm using Gnutella as an example, but this works similarly on other systems) are caught and taken to court is as follows:
::1) The IP holder or their representative connects to the P2P system and searches for filenames which are likely to contain infringing material. For example, the IP holder of "Motion" by Front 242 might search for "front 242 motion".
::2) Upon receiving results, the IP holder starts a download of any infringing files and observes the IP address of the servent carrying the file.
::3) The IP holder checks the downloaded file to ensure it contains infringing material, and, in the case that it does, traces the IP address of the servent to their ISP, requests the physical address of the servent and issues a lawsuit or cease and desist notice.
:Possible guards against this include:
::1) Restricting file listings and downloads to users that you know and trust. This is technically feasable today through public/private key encryption, and also will be feasable using Palladium technology. This has the effect of reducing the number of users on the network dramatically and thereby decreasing the number of files shared. 
::2) Renaming files so that they cannot be found by IP enforcers. This has the effect that genuine users cannot find the files, either.
:Users who download files from P2P networks are currently less vulnerable than users who offer files for upload. However, it is possible for downloaders to be caught in the event that an IP enforcer or informer has access to a machine through which their network traffic travels between the server and client. This is easily protected against today using public key encryption, and again this will not change under Palladium.
:Additionally, Palladium will offer one further step to the IP holder in the above description of how infringers are caught:
::4) The IP holder uploads the infringing file to a central blacklist, as a result of which copies of the file found on any Palladium enabled machine will be deleted automatically the next time they connect to the Internet. This is the only net change that will occur to file sharing networks as a result of Palladium.
:::It is a falsehood that Palladium includes a central blacklist of files to be deleted.  Please provide a reference for this claim. MKWilliams
:Therefore, this example is bogus. Palladium will not offer any increased security to users sharing illegal files over P2P networks.
:Lezek 01:58, 17 Nov 2003 (UTC)
thread_title: Empowering

message: Microsoft plans to release the Palladium micro-kernel, known as the Nexus or the Nub, in source code form.  This will allow people to confirm that Palladium works as claimed, and use the "many eyes" principle to improve the security and reliability of the Palladium system.
:This has no practical meaning, because in order to use the micro-kernel, it must be signed by a certifying authority. Therefore, the source code is useless to anybody who does not have the authority to sign it or the money to pay for someone else to do this. Since it's unlikely that Microsoft will allow anyone to sell modified versions of their micro-kernel (in order to cover their costs getting it signed), in practice nobody will be able to use the source code. Lezek
::It is a falsehood that the Palladium micro-kernel or any other code must be signed by a certifying authority.  Please provide a reference for this claim. MKWilliams
:::I'm no computer geek in any way, but I'm trying to understand all this Palladium stuff. So I would like to ask: if no "certifying authority" signs the code as trusted,  who does it? The user? The one who wrote the code? Who can then guarantee that viruses are not given "trusted" status (voluntarily or not), and is able to cause havoc in all non-trusted programs? As I understand it, once trusted it is not possible to modify (delete?) the virus code in the protected area, so if infested, will it be possible to get rid of it?
:::And another thing (which maybe is not directly related): In commercials at swedish radio, it is claimed that the new 64bit processors (in particular the AMD's) are "safe" against all computer viruses (has a built in virus protection which should render antivirus software obsolete) - exactly how much truth lies in that claim? Thanks in advance, \Mikez 07:34, 9 Dec 2004 (UTC)
thread_title: Open

message: I propose to remove the lengthy discussion under "Functionality of TCPA/NGSCB" on the main page which describes a mistaken understanding of how Palladium would work, involving only loading a signed OS, etc.  Also I propose to remove the response to this under "Criticism" which is no longer relevant since that description was mistaken.  I will leave the accurate Functionality description (the first part of that section) as it is correct.  Any objections? MKWilliams 20:29, 4 Dec 2003 (UTC)
replies: text: If that's not correct, then go ahead. CHz 04:50, 6 Dec 2003 (UTC)
thread_title: Proposal to remove incorrect Functionality and Criticism text

message: Clearly there is a lot of difference in opinion over what exactly Palladium/TCPA/NGSCB (hereinafter abbreviated to PTN) will do, which seems to fit into two camps:
#PTN requires a signed OS be booted, which will only run signed programs and connect to PTN websites only, and will stop the user copying protected content or opening it with anything other than a designated program.  Microsoft will be the core authority for signing things, but may delegate to other companies to avoid any anticompetitive grief, though these would be beholden to Microsoft.
#PTN can load a signed OS or not, but only a signed OS would be able to access protected content and connect to PTN-only websites.  Also each program does not have to be signed, but can be.  It can also use the cryptographic functions of PTN at will, though whether this required a program to be signed or not is unclear.  Signing is done by anyone, as anyone can generate their own public/private key pair within whatever encryption scheme PTN uses.
Perhaps someone can provide a list of what PTN actually does, so that a) the article can be amended and b) this functionality can be examined and, if necessary, criticised.
Daveryan 14:22, 4 Jan 2004 (UTC)
thread_title: What is Palladium?

message: As the article correctly states, the NG-SCB was previously known as Palladium - so shouldn't it be moved to Next Generation Secure Computing Base. It's a pain to type, but we can have any number of redirects. Given that I don't have time to read through the whole debate on this page and get involved in any other way, I won't just do it, but I thought I'd bring it up anyway. - IMSoP 15:40, 11 May 2004 (UTC)
thread_title: Shouldn't this page be renamed?