The whole article rests on this: "It is a building block of extremely restrictive DRM systems, as it allows a third party to police what the user can or can't run on a device that is (at least supposed to be) theirs."
Except remote attestation is obviously not implemented only for consumer computing platforms, e.g., confidential computing
"Your anti-feature is not a feature" is a line I hold dear, but in this case I think it's pretty clearly demonstrated that this particular feature denies people use of their devices, denies people access, that it winnows and narrows what is possible. It's a clear and gross violation of RFC 8890 The Internet Is For End Users. It let's the far off big powers in the world set terms that we may or may not want to give them, that may or may not serve us. There's no win here to remote attestation.
jauntywundrkind•52m ago
https://news.ycombinator.com/item?id=50061290 https://news.ycombinator.com/item?id=50108196 https://news.ycombinator.com/item?id=50088935 https://news.ycombinator.com/item?id=50048312
I'm less convinced than I had been (it felt like absolute ruin at the time), but EME allowing encrypted to play on the web, but turning the web browser into a cop that polices the user and what they can do was a huge turning point, is the one other clear precedent here for the web. TBL stepped in and just said: it is so, we are doing this, after much protest. I sort of am ok with it now but it felt terrible.
It feels much different when merely having an account might be tied to having a vendor approved browser running on a vendor approved computer. That sure seems like the stakes. Google Play Integratity is that prenicious threat against humanity, the anti-personal against the personal computer, and it's largely won against humanity, seized the power away from humanity. It sure feels like the stakes are severe as they come, for what relationships society is allowed to maintain with computing, whether we're allowed any access.