Brave New Trusted Boot World
21–30 of 178 posts
Re: Brave New Trusted Boot World
#22There is something ironic about the FOSS projects these days embracing attestation rather than standing up for user rights by vehemently rejecting it.
I know my reasons for feeling worried about it but I wonder why you also dislike the idea of end user operating systems making it trivial for applications to take advantage of remote attestation?
Because it is the end of electronic personal property, and permanent removal of the ability to opt out of whatever ToC MS or Google decide you must sign to participate in society?
Re: Brave New Trusted Boot World
#23As somone who never really viewed systemd as a problem I'm starting to think the systemd "haters" were actually right, at least somewhat...
Viewing Poettering as some kind malicious entity undermining projects sounds like a conspiracy theory. But now with him working for Microsoft his actions do look like a lot like the "embrace, extend, and extinguish" pattern to me. Yes, yes "Microsoft And now I am supposed to cheer for the groundwork for the creation of an allmighty authority with the ability to "sanction" some (parts of) operating systems, but not others?
Re: Brave New Trusted Boot World
#24I'm OK with making sure the software I'm running is the software I thought I was running. But because trusted boot runs so deep, and is intentionally hard to get around, it's vital that the implementation is trustworthy. I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork. I wish this work were being done by just about any other…
> I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork.
They have been developing software, that enough people have deemed useful to include it in their distributions. Some have disagreed, and have made other choices. No one was forced to do anything, there have been no "foisting" and the "need" for Devuan is a subjective opinion.
There is really no need to transform purely technical arguments into personal attacks. This just discourages participating into free software development.
Re: Brave New Trusted Boot World
#25There is something ironic about the FOSS projects these days embracing attestation rather than standing up for user rights by vehemently rejecting it.
If you were responsible for the security of your enterprise network, would you vehemently fight for your user's rights to run the ransomware executable they just get sent over email?
[deleted]
Re: Brave New Trusted Boot World
#26Can I turn it off? Tbh this TPM thingy doesn't solve any problem for me.
Re: Brave New Trusted Boot World
#27>System ready for easy remote attestation, to prove validity of booted OS, configuration and local identity >“Democratize” use of PCR policies by defining PCR register meanings, and making binding to them robust against updates, so that external projects can safely and securely bind their own data to them (or use them for remote attestation) without risking breakage whenever the OS is updated. In what world is this a…
It's all about who has the power over the keys.
1. If the user can supply private keys that are treated as first class citizens, then yay!
2. If the user can't supply private keys, or the user's private key is treated as a second class citizen, then boo.
Given who is driving TPM usage right now (ie: Microsoft), my intuition says situation 2 is far more likely. I'm continually surprised by the number of people who think this is an unreasonable and/or paranoid.
Re: Brave New Trusted Boot World
#28Earlier quoted context omitted.
I know my reasons for feeling worried about it but I wonder why you also dislike the idea of end user operating systems making it trivial for applications to take advantage of remote attestation?
What are, if any, "advantages of remote attestation" besides enforcing DRMs and preventing sideloading/jailbreaking? Preventing those who need access to proprietary systems from using any distro except 1-2 certified ones?
So that you can be confident that your software hosted with a random cloud provider has been faithfully launched? This is why Intel is keeping SGX in their Xeon processors despite killing it off in consumer oriented series--servers benefit greatly from the ability to prove to clients that they are well behaved
Re: Brave New Trusted Boot World
#29Earlier quoted context omitted.
>This isn't about your own private machine. This is about corporation-owned machines in an enterprise network and as we see with nearly biweekly news articles about large-scale ransomware attacks, private data leaks and compromised employee machines, I would argue that the currently employed solutions clearly don't work. The fundamental issue is that you can't have one without the other, and that's bothering me. It's…
> you can't have one without the other, AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel. In some machines that's not be the case due to contracts with Microsoft, but those already can't run Linux in the first place, so you probably won't buy them for the purpose of running Linux. The suggestions in the original post do not change anything about this.
> AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel.
For now.
Re: Brave New Trusted Boot World
#30There is something ironic about the FOSS projects these days embracing attestation rather than standing up for user rights by vehemently rejecting it.
Why is attestation against user rights?
In addition to replies to my original comment, see [1] and [2] for the perils that attestation poses against user rights.