Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brave New Trusted Boot World

0pointer.net

Post reply on HN
Print view View original

121–130 of 178 posts

Re: Brave New Trusted Boot World

#121

Post by account42 »

Arch-TK wrote: post #59
TeMPOraL wrote: post #57

Earlier quoted context omitted.

To preempt the "but slippery slope!" counters, where we're currently at is "you may not use your bank's mobile app on a phone that isn't running genuine, unmodded, unrooted version of the hardware and OS it came with". This is the reality of modern Android devices. And it's not worse only because, like with any API, adoption of new-and-improved Safenet / Play $forgot-the-name APIs takes time. The slippery slope is no…

At least so far my bank hasn't prevented me from using my web browser on linux to access the banking website. But I am certain they will once Windows 11 gets enough traction in a few years.

Can you use your web browser for all functions of the banking app?

E.g. for my bank the app is the only 2FA option that doesn't come with additional costs.

Re: Brave New Trusted Boot World

#122

Post by fweimer »

growse wrote: post #75
AshamedCaptain wrote: post #68

Earlier quoted context omitted.

This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.

I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?

The Microsoft policies are unclear. I was around when Fedora came up with its current Secure Boot policies and may even have contributed to a somewhat maximalist interpretation. Fedora and others operate under the assumption that Secure Boot needs to prevent the execution of unsigned code in ring 0 (or the Arm equivalent), but is this actually required for a signature from Microsoft? Unclear. Plenty of distributions had their shims signed without kernel module signing implemented in the distribution.

I think the current policy is here:

https://techcommunity.microsoft.com/t5/hardware-dev-center/u...

It doesn't mention kernel mode. The focus on kernel mode may not even be appropriate because many bad things can happen without kernel mode (wiping local disks, operating the hardware beyond safe parameters).

Re: Brave New Trusted Boot World

#123

Post by ranger207 »

nonrandomstring wrote: post #118
ranger207 wrote: post #109

Earlier quoted context omitted.

> Make then not defenceless. This, simply put, doesn't work in an enterprise context. I'd argue that relying on people for security doesn't work in any context, and that it's about as effective as relying on programmers to not code memory leaks, but in companies where there's people whose _only_ use of a desktop computer is at work, as is increasingly common nowadays, it's simply not possible to get half the people o…

It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt". Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and sh…

I don't want my users to be clueless. I want them to better understand the technical systems they use every day so they can employ them more effectively. But they and I have a job as well. When I was in tech support, I spent hours some weeks with one particular user working on her software and teaching her more effective use of her computer. But I could only do that during slow weeks: I didn't have enough time to do that every week, and I certainly couldn't do it for everyone in the building. If we'd wanted to teach the whole building how to use computers, we would've needed probably a good quarter of the employees teaching other employees, during which time those employees under training wouldn't've been able to perform the work they were hired to do. We tried making documentation for users to read, but while you can lead a horse to water, you can't make him drink.

But ultimately, while I always wanted people to take training courses in computer use, I still implemented security measures, because I knew that people were at the company to work, not to take training courses. I want security measures in place for the same reason I want computers in the first place: so that I can let the computer worry about it for me. I don't want to have phishing awareness campaigns when I can just make the spam filter more effective. I don't want to tech people not to click the flashing greed download button when I can just roll out an ad blocker across the entire organization. I don't want to send an emergency email blast to my coworkers telling them not to download TOTALLY_NOT_A_VIRUS.PDF.EXE from the chain email going around and keep one step ahead of the mixture of malice and idiocy out there when I can just set up a system to scan email attachments for viruses in the first place. Yes, I want a more informed and educated workplace, and I worked to make that happen, but I want computers to work for me and do the hard part for me as well

Re: Brave New Trusted Boot World

#124

Post by vetinari »

krzyk wrote: post #101
gsich wrote: post #35

Earlier quoted context omitted.

Going back to the init.d clusterfuck is insane.

Why? It was simple and understandable. systemd has everything and a kitchen sink, it is a big blob of software. Finding out why the heck my resolv.conf contains some 127.0.0.x entry and not the real nameserver was the final thing that made me question sanity of distro maintainers and author of two worse pieces of software: pulseaudio and systemd. (I was very surprised that it was the same person).

> Why? It was simple and understandable.

Also brittle and unreliable. Every distribution needed custom-made init.d script, incompatible with every other distribution. No, thanks.

> systemd has everything and a kitchen sink, it is a big blob of software.

You can still pick and choose. Systemd is an umbrella project.

> Finding out why the heck my resolv.conf contains some 127.0.0.x entry and not the real nameserver

systemd-resolved is exactly one of the things that you can pick and choose.

> was the final thing that made me question sanity of distro maintainers

And there are good reasons for that:

1) /etc/resolv.conf cannot be extended; you cannot express all the configuration that is needed for resolver today (e.g. per subnet zones) or dynamic enough (user-managed network links that go up and down).

2) applications are not supposed to use resolv.conf directly anyway; if they do, they are broken. The local nss config may be such, that they won't be able to find all hostnames, or the above mentioned per subnet zones, which they won't be able to resolve. Hence, they are supposed to use libc, which does the right thing. Even golang runtime respects this and thunks into libc for nss.

Re: Brave New Trusted Boot World

#125

Post by vetinari »

Arch-TK wrote: post #59
TeMPOraL wrote: post #57

Earlier quoted context omitted.

To preempt the "but slippery slope!" counters, where we're currently at is "you may not use your bank's mobile app on a phone that isn't running genuine, unmodded, unrooted version of the hardware and OS it came with". This is the reality of modern Android devices. And it's not worse only because, like with any API, adoption of new-and-improved Safenet / Play $forgot-the-name APIs takes time. The slippery slope is no…

At least so far my bank hasn't prevented me from using my web browser on linux to access the banking website. But I am certain they will once Windows 11 gets enough traction in a few years.

However, my bank requires second factor for authenticating, when using the banking website. And that second factor used to be SMS, but nowadays it is their banking app on a mobile device. Exactly that one that has to run on "genuine, unmodded, unrooted version of the hardware and OS it came with".

Re: Brave New Trusted Boot World

#126

Post by RetpolineDrama »

chabad360 wrote: post #120

I fail to see what all the panic is about. All of the SystemD tools mentioned here (iirc) don't actually rely much on SystemD proper and especially systemd-boot and the boot stub are just SystemD in name (I use both). But regardless, this entire article is about how to have an actually secure boot on Linux (and not remote attestation), something which is certainly good for the user. Otherwise you're actually more eas…

> but ironically, don't encrypt my root, so go figure

Oh man that takes me back. The last time I went down that rabbit hole was ~2015, I tried to implement a "fully encrypted" setup and started with Ubuntu (I know I know). Something something LUKS.

I spent ~2 days tinkering with it and never got it to work, something with the setup flow was totally broken if you also tried to encrypt root (or boot? idk like I said it's been _years_).

I also remember fun problems with grub. I was trying to dual-boot and the windows partition was using hardware-bitlocker (samsung SSD). Some kind of weird interaction was going on between grub, whatever the windows bootloader is called, and my motherboard's EFI I think. Anyways grub ended up fucking bitlocker up and I almost lost all my gaming saves. Had to use some kind of arcane recovery process to get back to being able to even _insert_ the key so the SSD would unlock and windows could continue booting.

Ended up saying screw it after a few days and just going back to windows for my gaming PC, vowing to never try dual-boot again.

Re: Brave New Trusted Boot World

#127

Post by vetinari »

yjftsjthsd-h wrote: post #113
retrobrandcool wrote: post #53

I had a laptop with UEFI make it’s way into my tech junk stack sort of recently - pain in my ass!

Er, you mean secure boot? UEFI is fine IME

Depends. In theory it is fine, in practice it is a big ball of mud.

I'm starting to like Apple's approach more. It allows to have multiple OSes installed and each to have different level of trust. In UEFI, the equivalent would be that you could have Secure-core like security for one installed instance, 3rd party UEFI-enabled Secure Boot for another and no Secure Boot for yet another installed OS. Unfortunately, in UEFI it is all-or-nothing instead.

Re: Brave New Trusted Boot World

#128

Post by biorach »

hdjjhhvvhga wrote: post #40
kevincox wrote: post #34

Earlier quoted context omitted.

A developer that has been able to make tough choices and drive them well enough to get mass adoption? He definitely isn't perfect but this sounds like quite the feat in Open Source.

There is a huge difference between a developer who creates a superior project that everybody loves to use so it gets mass adoption and one who makes a product that gets pushed by their employer on everyone whether they want it or not. I don't want to get into details as the subject has been beaten to death but as for Systemd* there was the case of integration with graphical login that made choice difficult. Had the a…

> a product that gets pushed by their employer on everyone whether they want it or not.

Highly inaccurate

Re: Brave New Trusted Boot World

#129

Post by nonrandomstring »

ranger207 wrote: post #123
nonrandomstring wrote: post #118

Earlier quoted context omitted.

It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt". Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and sh…

I don't want my users to be clueless. I want them to better understand the technical systems they use every day so they can employ them more effectively. But they and I have a job as well. When I was in tech support, I spent hours some weeks with one particular user working on her software and teaching her more effective use of her computer. But I could only do that during slow weeks: I didn't have enough time to do…

Sounds like you're a good sysadmin and mentor. There's no possible way you should have to take on the burden of schooling everyone. You probably already go far beyond the call of duty.

What we need to do with Digital Self Defence is raise awareness of civic cyber-security needs from school ages 5 upwards (My government in the UK have started on this project). We also need to screen for digital literacy.

Re: Brave New Trusted Boot World

#130

Post by mistrial9 »

AshamedCaptain wrote: post #68
growse wrote: post #39

Earlier quoted context omitted.

No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.

This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.

no, MSFT wants to sell software workers the signing keys to boot and use the cloud each day. It is their worldview as the largest OS monopoly company, and antithetical to individual rights to owning your own equipment. Similar moves as tractors that phone home constantly.
Post reply on HN