There must not be a way to backdoor user devices, under any circumstances.

Of course we should secure IoT, but the article is about one very particular kind of security: roots of trust. The idea is that devices shouldn't run unsigned software, so forget about custom firmwares, and generally owning the hardware.

There is a workaround, sometimes called "user override", where the owners can set their own root-of-trust so that they can install custom software. It may involves some physical action, like pushing a switch, so that it cannot be done remotely by a hacker. But the article doesn't mention that, in fact, it especially mentions that the manufacturer (not the user) is to be trusted and an appropriate response is to reset the device, making it completely unusable for the user. Note that such behavior is considered unacceptable by GPLv3.

There are some cases where it is appropriate, GPLv3 makes a distinction between hardware sold to businesses and "User Products", and I think that's fair. You probably don't want people to tinker with things like credit card terminals. But the article makes no such distinction, even implying that consumer goods are to be included.

Talk about the worst corporate doublespeak - 'trusted computing'.

It also goes by DRM, or rental hardware, or you never actually own it cause someone else retains permanent digital control.

There is NO trust here, only control and power in never actually selling anything.

And since we're talking of IoT, this goes hand in hand with proprietary corporate clouds, anti-FLOSS like Home Assistant, rental in the form of sales, forced firmware upgrades that remove previous features to gatekeep and resell what you promised.

I don't even need to read further. Anybody, and I do mean anybody, who uses the moniker 'Trusted Computing', should be ignored, blackballed, and relegated to the bin of computing.

More than a decade ago I was hired as an intern at Colgate-Palmolive as a software developer. Turns out they were(are?) one of the largest SAP deployments in the US. The entire company revolved around SAP. Due to lack of college graduates knowing SAP, they took great pains to treat me extremely well and train me (a CS major) in ABAP using SAP Netweaver.

My project was more ambitious than the rest of the group because I had enough courage and bravado to be assigned a project like that. In fact I made it a point to be 'brave' and make myself look really good in front of the upper level managers. I tried to know everyones name, even in other departments and to be super polite and humble around any sort of manager there. When I finally got some tasks to do, I was so miserable that I finished multiple days without getting anything done. I felt so depressed thinking that I slogged through four years of CS for this?

In the end I managed to finish last in the cohort and Colgate took the rare(at the time)decision to not extend me a full time offer. I felt like a complete failure because I didn't put in 100% and I felt like I let my mentor down.

At the same time I know that I truly hated it. To this day seeing pictures of SAP GUI gives me anxiety and makes my stomach turn. How do you overcome something like that and push on? It does not always seem like a sure thing. I sometimes think what if I had pushed through and gotten the offer? I'd probably still be at Colgate like my mentor was.

With the benefit of hindsight I have learned to be super appreciative and thankful for them treating me so well but im glad circumstances led me to not ending up there. But really who knows if it would have been better in the long run? Whenever I see Colgate it actually evokes positive memories of that time. But the biggest thing I learned was to not bite off more than you can chew and if you don't truly love what you are doing there is another path out there.