Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brave New Trusted Boot World

0pointer.net

Post reply on HN
Print view View original

131–140 of 178 posts

Re: Brave New Trusted Boot World

#131

Post by nonrandomstring »

nonrandomstring wrote: post #107
api wrote: post #65

Earlier quoted context omitted.

The problem isn’t that you can’t trust people. The problem is that people are defenseless in the face of malicious hackers with vastly more expertise and zero day vulnerabilities. It’s not that you can’t trust your employees. It’s that you can’t trust them to defend themselves from being mugged. The forcing function for all this removal of freedom is defense against malicious hackers. The removal of freedom is not th…

Some good points. Lets see what we can do here: > The problem isn’t that you can’t trust people. Good. It's always best to have an optimistic view of our fellows, that's how we build good social structures. > The problem is that people are defenceless in the face of malicious hackers So. Make then not defenceless. We arm them. With education and other tools they need to defend themselves. Digital Self Defence (Or Dig…

I am at a loss to understand your disapproval of my remarks. Do please have the courtesy to respond in words with constructive, challenging ideas.

Re: Brave New Trusted Boot World

#132

Post by carapace »

jle17 wrote: post #24
denton-scratch wrote: post #19

I'm OK with making sure the software I'm running is the software I thought I was running. But because trusted boot runs so deep, and is intentionally hard to get around, it's vital that the implementation is trustworthy. I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork. I wish this work were being done by just about any other…

> I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork. They have been developing software, that enough people have deemed useful to include it in their distributions. Some have disagreed, and have made other choices. No one was forced to do anything, there have been no "foisting" and the "need" for Devuan is a subjective opinion.…

You are completely missing the point.

Please don't fan this flame.

Re: Brave New Trusted Boot World

#133

Post by rollcat »

RetpolineDrama wrote: post #126
chabad360 wrote: post #120

I fail to see what all the panic is about. All of the SystemD tools mentioned here (iirc) don't actually rely much on SystemD proper and especially systemd-boot and the boot stub are just SystemD in name (I use both). But regardless, this entire article is about how to have an actually secure boot on Linux (and not remote attestation), something which is certainly good for the user. Otherwise you're actually more eas…

> but ironically, don't encrypt my root, so go figure Oh man that takes me back. The last time I went down that rabbit hole was ~2015, I tried to implement a "fully encrypted" setup and started with Ubuntu (I know I know). Something something LUKS. I spent ~2 days tinkering with it and never got it to work, something with the setup flow was totally broken if you also tried to encrypt root (or boot? idk like I said it…

Huh? I've been using LUKS for FDE (with unencrypted /boot) way before 2015, and it's never been a problem. Debian has offered an option to set it up during installation, and it was 100% smooth sailing from there.

More recently, you can even set up GRUB to ask you for the passphrase, so even /boot is encrypted, you only need a tiny 2MB partition at the front to hold the bootloader.

Re: Brave New Trusted Boot World

#134

Post by selfhoster11 »

growse wrote: post #41
kevincox wrote: post #38

Earlier quoted context omitted.

You see this on Android, my banking app requires that it is running an OS approved by a big vendor. Their website, especially the mobile version, is getting more and more tedious to use. I want to be able to access all services with whatever client I please. Not be required to run approved software and hardware that puts them in control.

It sounds like you're demanding to use someone's service on your own terms. I'm not sure why it's obvious that the service provider is under any obligation to entertain your desires. So.... vote with your feet and choose a bank that shares your values more closely?

Voting with your feet has always been bullshit. We simply don’t have the critical mass to effect change.

Re: Brave New Trusted Boot World

#135

Post by entropicdrifter »

mistrial9 wrote: post #130
AshamedCaptain wrote: post #68

Earlier quoted context omitted.

This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.

no, MSFT wants to sell software workers the signing keys to boot and use the cloud each day. It is their worldview as the largest OS monopoly company, and antithetical to individual rights to owning your own equipment. Similar moves as tractors that phone home constantly.

While they are the largest desktop OS monopoly company, Google is currently the largest OS monopoly company, with 43% of the total market going to Android and 29% going to Windows.

https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

Re: Brave New Trusted Boot World

#136

Post by Foxboron »

denton-scratch wrote: post #119
Foxboron wrote: post #60

Earlier quoted context omitted.

>But this was one of the critical elements of the system and they had to fork the entire distro because the way it was done actually made the choice more limited. This isn't very accurate. When Debian decided to switch to systemd, they also agreed to support other inits in the distribution. This wasn't good enough, so Devuan itself was forked before this decision was made. The end result is that Debian had less peopl…

> they also agreed to support other inits in the distribution. That's true, but with systemd being the only init that packages had to support. Accordingly many package maintainers choose to only support systemd. So if you want to run Debian without systemd, you have to be prepared for your fave packages to drop support for the other inits. It follows that you can't rely on the Debian package repository. So to support…

I think the situation would have been better if the people opposed to Debian would contribute to better init script support then just forking it.

Re: Brave New Trusted Boot World

#137

Post by selfhoster11 »

bitwize wrote: post #95
no_time wrote: post #2

>System ready for easy remote attestation, to prove validity of booted OS, configuration and local identity >“Democratize” use of PCR policies by defining PCR register meanings, and making binding to them robust against updates, so that external projects can safely and securely bind their own data to them (or use them for remote attestation) without risking breakage whenever the OS is updated. In what world is this a…

This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Signed code path from first boot to user space code. Remote attestation because you can NEVER trust the client. Microsoft and especially Apple are already doing this. Linux needs an answer, and "no, it's too user hostile" is NOT a valid answer; it will just make Linux an untenable security risk. It…

You don’t need signing, you need a way to make changing a boot path impossible by anyone who is not the user or the OS (or at least, tamper-evident on reboot).

Simply storing hashes that are set on first boot (much like SSH does with known host hashes), and allowing the user/OS to reset the hashes, will be sufficient. M1 does this, as far as I know.

> Remote attestation because you can NEVER trust the client.

IRL, I don’t carry a weapon everywhere I go, because it’s clearly overkill. For this exact reason, overkill measures like remote attestation should not be a thing on general purpose computers.

Re: Brave New Trusted Boot World

#138

Post by selfhoster11 »

denton-scratch wrote: post #19

I'm OK with making sure the software I'm running is the software I thought I was running. But because trusted boot runs so deep, and is intentionally hard to get around, it's vital that the implementation is trustworthy. I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork. I wish this work were being done by just about any other…

I’d trust Poetteringware over any given UEFI implementation that’s supposed to provide a trusted boot chain.

Re: Brave New Trusted Boot World

#139

Post by retrobrandcool »

yjftsjthsd-h wrote: post #113
retrobrandcool wrote: post #53

I had a laptop with UEFI make it’s way into my tech junk stack sort of recently - pain in my ass!

Er, you mean secure boot? UEFI is fine IME

Right, it was secured(from a foreclosure auction). My collection is fairly modest, and getting more and more dated every day, so it was a bit of a curveball to run into something with not the usual BIOS. I think i sent it to GoodWill.

Re: Brave New Trusted Boot World

#140

Post by RetpolineDrama »

rollcat wrote: post #133
RetpolineDrama wrote: post #126

Earlier quoted context omitted.

> but ironically, don't encrypt my root, so go figure Oh man that takes me back. The last time I went down that rabbit hole was ~2015, I tried to implement a "fully encrypted" setup and started with Ubuntu (I know I know). Something something LUKS. I spent ~2 days tinkering with it and never got it to work, something with the setup flow was totally broken if you also tried to encrypt root (or boot? idk like I said it…

Huh? I've been using LUKS for FDE (with unencrypted /boot) way before 2015, and it's never been a problem. Debian has offered an option to set it up during installation, and it was 100% smooth sailing from there. More recently, you can even set up GRUB to ask you for the passphrase, so even /boot is encrypted, you only need a tiny 2MB partition at the front to hold the bootloader.

Well I remember getting completely stuck at one part and the cause was my samsung SSD's funny behavior in the "locked" state.

I had to set some kind of kernel flag or something (sorry, it's been years) to get it to ignore the drive until I unlocked it, as there was some kind of tight-loop where it would just keep trying to connect infinitely and not progress/fail/timeout.

I've been meaning to get back into linux again but it's going to be on a pristine/new machine.

Post reply on HN