[davidfiala]

Attestation of any type: A double edged sword, where you are guaranteed to lose freedom. Attestation entrenches, empowers, and enriches other entities that aren't you.

Ironic how this post got upvoted in parallel to polar opposite in the #1 slot: "John Deere owners will get the right to repair equipment under FTC settlement" https://news.ycombinator.com/item?id=48838876

Engineers may debate about what-about-isms of vulnerabilities and counterexamples of TPM failures, but that misses the point: We should be debating about where society will be when devices you paid for serve other masters.

Probably we should just write/vibe/demand better software. Otherwise we're going to end up with a law demanding TPMs that watch more than just your firmware...

[solenoid0937]

You don't understand the use case or audience of this article:

> If your infra consistently enforces mTLS

This is for mutual authentication in corporate infrastructure. Attestation is a critical security property for these environments.

[sfdlkj3jk342a]

> Attestation is a critical security property for these environments.

No it's not. Every corporate network to which I've connected worked just fine without it.

[fleventynine]

> Every corporate network to which I've connected worked just fine without it.

Just because it appears to be working fine doesn't mean you are in control of it. Without hardware attestation, how do you know the machines are running the software you think they are?

[darkwater]

My spouse's local Linux account on my laptop works fine with their password set as their username as well. Is it technically secure, though?