in reply to Re^2: Future of Perl on Win32?
in thread Future of Perl on Win32?

If any code signing mechanism that MS implement either

  1. Only allows code signed off by MS to run.
  2. Doesn't allow retro-active signing of existing code by existing code authors/owners/licence holders.
  3. Doesn't permit machine owners to decide what code they can allow to run on their machines.

the software containing that mechanism will be deservedly still born.

As somebody else pointed out, whatever you think of MS, they aren't totally stupid.


Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.

Replies are listed 'Best First'.
Re^4: Future of Perl on Win32?
by Anonymous Monk on Apr 26, 2006 at 19:15 UTC
    If any code signing mechanism that MS implement either snip 3. Doesn't permit machine owners to decide what code they can allow to run on their machines. the software containing that mechanism will be deservedly still born

    I'm not convinced of that; all it takes is marketing to create consumer acceptance, and Microsoft is a world leader in marketing.

    Consider the average game console: they manufactuerer has certainly tried very hard to prevent anyone from running "unauthorized" software on those systems, and to a large degree, they've been successful.

    The only reasons why the same sort of approach wouldn't work for a computer branded as a "workstation" rather than a "game console" are social rather than technical. If people can accept that game consoles only take software written by the manufactuer, they can probably be made to accept a similar idea for PCs as well.

    Remember, Microsoft didn't make a fortune by being great at technology. They made a fortune, in part, by being great at marketing (and lots of other shady business practices, including antitrust violations). They've always been very good at manipulating social perceptions; their marketing for Windows 95 was so good that people who didn't even have computers were calling up the helplines asking how to use this great new product they'ld just purchased.

    I'm not saying that Microsoft could pull it off; but if anyone can, it's them. Those guys could sell MS-Sand in the middle of a desert, and people would be lining up for miles around to buy it.

    --
    Ytrew

      What convinces me that it wouldn't fly is that the main source of revenue for OSs are corporate customers. Corporates are mostly very conservative. If MS tell them that in order to upgrade their 1000s of workstations, they will also have to re-write every application they use; or apply in writing to MS (or any 3rd party body), to have their existing in-house and 3rd party applications 'signed off', the impact of the upgrade would just be too costly and too risky to contemplate.

      Can you imagine every bank, government dept. etc., having to supply the source code of their proprietary and commercially sensitive applications to MS or some 3rd party clearing house organisation before they can run them? I'm very convinced that any such requirement would be death to the OS.

      IMO, there would *have* to be some 'self-sign certification' option. Indeed, I would welcome a process that prevented an executable from running on my system until I had explicitly, manually, (with-no-possibility-for-programmable-override), authorised it. A minor inconvenience during the development cycle, but it would prevent the vast majority of viruses, trojans and spyware.

      I essentially do this now for applications that attempt socket communications via my firewall. If it extended to all executables, that would be a good thing in my opinion--but only if *I* control what is allowed to run. And what not.

      I agree that there are some worrying precedents for people accepting the diminution of there rights in consumer products--iPod is the latest, greatest, most worrying example--but I think that corporates are unlikely to surrender their rights quite so easily.

      My take on DRM and similar technologies, and anything that purports to sell me something but then curtails my rights to use it as I see fit, is that I simply do not buy them. If everybody followed suit, they simply wouldn't get off the ground, but that is a forlorn hope in many areas of consumer products--game consoles, mp3 players, DVD players, mobile phones, ISP connections etc.


      Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
      Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?
      "Science is about questioning the status quo. Questioning authority".
      In the absence of evidence, opinion is indistinguishable from prejudice.
        What convinces me that it wouldn't fly is that the main source of revenue for OSs are corporate customers.
        Yes. But don't forget that there are going to be 5 versions of Vista. I'd expect the restrictions (if any) would start at the low end (home entertainment, etc.), and if successful, start encroaching on the business and enterprise versions in later releases (2011?).

        If MS tell them that in order to upgrade their 1000s of workstations, they will also have to re-write every application they use; or apply in writing to MS (or any 3rd party body), to have their existing in-house and 3rd party applications 'signed off', the impact of the upgrade would just be too costly and too risky to contemplate.

        Can you imagine every bank, government dept. etc., having to supply the source code of their proprietary and commercially sensitive applications to MS or some 3rd party clearing house organisation before they can run them?

        You've got to think like a salesman. Present it as an opportunity. Now the IS department can finally enforce all of its regulations on which software is officially approved for use. No more worries about viruses/trojans. No more employees goofing off playing computer games. And it won't be any more of a burden to implement this, than it currently is to negotiate their site license. Banks and governments are the first customers who would sign up for this feature. Rogue bank employees won't be able to sell internal/sensitive documents, because they'll only be decryptable on authorized bank computers. Government beauracrats will be less able to leak stuff to the press. And MS won't go to the bother of trying to certify that the custom programs you want signed are reliable. They'll just have a rubber stamp approval for any binary you submit. Of course, you'll get to pay for the priveledge. And they'll be running as second class citizens, without full access to every part of the system, otherwise you could possibly compromise the whole scheme. But it'll mostly work.
        Can you imagine every bank, government dept. etc., having to supply the source code of their proprietary and commercially sensitive applications to MS or some 3rd party clearing house organisation before they can run them?

        How many banks run propritary and commerical sensitive applications under windows? How many government agencies do? In my experience with government, they run Excell, Word, a few major non-microsoft programs (which would quickly be certified by the manufacturers), and little else. For banking, everything I've heard indicates that the heavy lifting is *still* done by COBOL on mainframes. The majority of third party developers would quickly get their old apps certified; and the fringe developers simply don't matter that much.

        MS gets to tax all the other developers a small amount to certify their apps; and to the rest of the world, it then looks like a typical upgrade risk ; just one that's more profitable for Microsoft.

        anything that purports to sell me something but then curtails my rights to use it as I see fit, is that I simply do not buy them.

        That battle was lost years ago, dating at least back to when the Berne Convention was signed. Patents, trademarks, and copyrights have existed for centuries. DRM law is just an extention of existing legal principles, which purport to increase innovation by making sure only right-holders can do it (and thereby, have a profit motive as an "incentive").

        People have been boycotting over these issues for as long as there have been monopoly rights; and sadly, it doesn't really work. There are too many monied interests and too much public apathy for the freedom to innovate to ever really prosper. Twenty years ago, as a young and naive boy, I really thought the laws would get reformed, and change for the better. Twenty years later, all I see is change for the worse; and the public at large doesn't even seem to notice, let alone care. Maybe they just all want different rights than you and I do.
        --
        Ytrew

      Consider the average game console: they manufactuerer has certainly tried very hard to prevent anyone from running "unauthorized" software on those systems, and to a large degree, they've been successful.

      I've never worked in a company that only ran "authorized" software on every machine. That is, every company I've ever worked for as an employee or a consultant has had at least one necessary application written by a third-party.