I would like to offer up what is probably a bit more provocative than I want it to be but here goes.
We should totally endorse secure boot for "webiances." I have to invent a word here because we haven't coined one yet, but its a device you use to surf the web, read email, chat on facebook, edit our resumes, Etc. It is something hobbiests and experimenters never ever need to write code for. Its the thing our grandparents use and we don't have to worry that Rico from Brazil is going to clean out their accounts with. It is an information telephone/tv/typewriter, it is an appliance.
Few people complain that you cannot boot unsigned code on the computer in your BMW, that is a good thing, you want to trust your car.
That said, there should always be (and no doubt will be) computers that engineers, hobbiests, and others use which are completely programmable. Those will be distinguished as being "General Purpose" computers as opposed to "Task specific" computers. They may even share the same instruction set architecture with their counterparts, but it should be perfectly Ok for a task specific device to refuse to run any code that hasn't been verified though some system of trust.
The comments about unlocking phone bootloaders, or the iPad, are quite relevant here. Those devices, when locked, aren't general purpose computers. Locked they can be task specific and reasonably safe [1]. Without such barriers they put their users at unnecessary risk and for users who have neither the ability nor the time to understand the risks that is a good thing.
[1] "reasonably safe" - This discussion will often jump to 'nothing is 100% secure' which is true of course and not the point. Planes fall out of the sky and kill people, but they are 'reasonably safe' which means that the risk of them killing us is acceptable given the benefit returned. Similarly with cars. Computers these days are not 'reasonably safe'. Huge swaths of non-technically literate people are harmed every year by the inability to create a reasonably safe environment for them to use.
I disagree strongly with this type of argument, nobody starts out a "computer professional", we all get there by experimenting on commodity hardware. With this type of proposal you essentially make it impossible for a user of a regular device to ever advance beyond the walled garden.
You seem to toss out the history of computers. I owned my first computer when I was in high school, I soldered it together from a kit (it was based on a Z80). Today I can do the same thing with an ARM chip (in fact I've been playing with the ST micro STM324F 'butterfly' which is a Cortex-M4 architecture.
You also toss out with the bathwater virtual machines. You can boot a virtual machine where the hypervisor is 'signed' on a machine which gives you 100% access to your virtual machine that can do most anything you might want, from talking to the network, to displaying graphics, to running the latest fizzbuzz contender.
My guess is that wmf's is correct, the relatively low volume of 'general purpose' computers will cause the cost to rise but I doubt it will ever be impossible to put one together.
You're very lucky. My first computer was an old Dell that my parents were planning to throw away (as it was slow) but which I rescued and, whilst looking for ways to speed it up, stumbled across Ubuntu. That's how, aged 13, I first got into Linux. If we had been using computers with secure boot, I assume I would still have gotten involved with computers, but quite possibly at a much later stage and I highly doubt I would be at the same level I am now.
Plus, it's hard enough to get people to switch to Linux now as it is - telling people they need to buy new computers, that'll reserve Linux purely for geeks at a time when it is starting to appeal more and more to consumers (though admittedly, not quite there yet).
>You seem to toss out the history of computers. I owned my first computer when I was in high school, I soldered it together from a kit (it was based on a Z80). Today I can do the same thing with an ARM chip (in fact I've been playing with the ST micro STM324F 'butterfly' which is a Cortex-M4 architecture.
My point being, I doubt that this was your first encounter with programming a computer, and even if it was, you are in the extreme minority, even on HN.
>You also toss out with the bathwater virtual machines. You can boot a virtual machine where the hypervisor is 'signed' on a machine which gives you 100% access to your virtual machine that can do most anything you might want, from talking to the network, to displaying graphics, to running the latest fizzbuzz contender.
Ah, where is this VM i can run on an unrooted ipad?
My first experience programming a computer was running FOCAL8 on a PDP8 that an engineer that was working with my Mom let me use because I was so bored waiting for her to be done with work and to give me a ride home from school. The second computer I programmed was running BASIC programs that I typed in on an ASR33 Teletype that was connected to a mainframe at the school district headquarters.
I don't doubt for a minute that my kids, should they choose to, could use a terminal application on a securely booted appliance device to access a computer 'instance' somewhere in the cloud (an EC2 instance perhaps). No need to root my iPad.
If you look at the Beagle board, or the RPi, or the Pandaboard or any number of 'kit' computers, they are still out there in numbers, and there will always be a market for them. And, depending on your level of sophistication you may start with a webiance and remove or simply access its internal compute engine with some other bit of code. Nothing UEFI can do, cannot be undone with a JTAG loader and new firmware. But it won't be useful for running those standard applications any more. Just like the TV I hacked into so that I could display video directly that was generated by my Z80 system ever tuned in TV shows again after that.
So I guess the standard counterargument is that if these "webiances" are allowed to be sold (oops, too late) then they will take 99% of the market and PCs will increase in price to the $2,000-$5,000 range and then all innovation will stop.
Look at what you call "innovation" today, what is it? Nothing about having locked down computers will prevent random folks from creating another Instagram. Look at the demo day for YC, how many of those demos require that the people install new program code on their "customer's" computer?
But a fully general purpose piece of hardware, could become much more expensive in the future.
I don't know, maybe 20 years ago average young computer hobbyists were writing small OSes, but today, people write websites and mobile apps. 20 years ago everything was simpler. You could learn about ins and outs of 8086 in a week, and it was "practical" to have such low-level access to hardware. Today, the landscape has changed. We should change too.
It is an interesting question, in 1977 the closest analog would be a 'locked down' color TV versus the Heathkit build your own color TV kit.
The other weird thing about this discussion is that none of the hobbiests in 1977 were concerned with the fact that you couldn't root an IBM S/370. They didn't need too, they just built their own computers. That said, anyone could get complete access to an IBM S/370 (one of my summer jobs at IBM gave me full control over one, right down to what microcode we were going to load that day) so the tools to 'create applications' will no doubt continue to exist.
What will change is that there will be a device that people use to communicate and play games and stuff which you can't just buy, install your own ROM image, have it do that other stuff and the stuff you want too. Not that scary.
The problem with your argument is that smartphones and tablets are sold as general purpose computers. They are sold as platforms. The tasks they perform are open ended by design. You can't just take that back.
None of the security and simplicity arguments hold any water because no one asks platform/device vendors to provide support to someone who decided to replace the OS or guarantee their security.
Lets look at that for a moment, your first claim is, if I understand it correctly, that someone selling a "platform" is bilaterally equivalent to "general purpose computer."
I'd claim that people selling a platform have established the set of things such a platform can support. So a Ruby 'platform' only supports Ruby programs, a 'Facebook' platform only supports Facebook Applications, an Android 'platform' only supports Android applications. In contrast a general purpose computer can host any platform, even multiple platforms simultaneously.
Smartphones and tablets are sold as a way of running any program that can run within the constraints of that platform.
General purpose computers are sold able to run any program you can think up.
I'd claim that 'General purpose computer' is a superset of the concept of 'Platform' and that nothing in the secure boot scenario prevents platform conformant applications from running on a platform (no 'taking it back') It does however give additional tools of platform limit enforcement.
That sounds pretty contrived to me, even tautological. Technically these tablet computers are as general purpose as it gets. That's why it takes extra effort on the part of vendors to limit what you can "naturally" do with them. But we're talking about what they are sold as. So here's an example:
"[...] there's no limit to what iPad can do for your business."
That's what platform means. A basis for doing anything without a limit, not just some pre-specified set of tasks. They are expressly different than feature phones or kitchen appliances or automobiles.
We should totally endorse secure boot for "webiances." I have to invent a word here because we haven't coined one yet, but its a device you use to surf the web, read email, chat on facebook, edit our resumes, Etc. It is something hobbiests and experimenters never ever need to write code for. Its the thing our grandparents use and we don't have to worry that Rico from Brazil is going to clean out their accounts with. It is an information telephone/tv/typewriter, it is an appliance.
Few people complain that you cannot boot unsigned code on the computer in your BMW, that is a good thing, you want to trust your car.
That said, there should always be (and no doubt will be) computers that engineers, hobbiests, and others use which are completely programmable. Those will be distinguished as being "General Purpose" computers as opposed to "Task specific" computers. They may even share the same instruction set architecture with their counterparts, but it should be perfectly Ok for a task specific device to refuse to run any code that hasn't been verified though some system of trust.
The comments about unlocking phone bootloaders, or the iPad, are quite relevant here. Those devices, when locked, aren't general purpose computers. Locked they can be task specific and reasonably safe [1]. Without such barriers they put their users at unnecessary risk and for users who have neither the ability nor the time to understand the risks that is a good thing.
[1] "reasonably safe" - This discussion will often jump to 'nothing is 100% secure' which is true of course and not the point. Planes fall out of the sky and kill people, but they are 'reasonably safe' which means that the risk of them killing us is acceptable given the benefit returned. Similarly with cars. Computers these days are not 'reasonably safe'. Huge swaths of non-technically literate people are harmed every year by the inability to create a reasonably safe environment for them to use.