Earlier quoted context omitted.
I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?
The Microsoft policies are unclear. I was around when Fedora came up with its current Secure Boot policies and may even have contributed to a somewhat maximalist interpretation. Fedora and others operate under the assumption that Secure Boot needs to prevent the execution of unsigned code in ring 0 (or the Arm equivalent), but is this actually required for a signature from Microsoft? Unclear. Plenty of distributions…
Brave New Trusted Boot World
161–170 of 178 posts
Re: Brave New Trusted Boot World
#162Earlier quoted context omitted.
Huh? I've been using LUKS for FDE (with unencrypted /boot) way before 2015, and it's never been a problem. Debian has offered an option to set it up during installation, and it was 100% smooth sailing from there. More recently, you can even set up GRUB to ask you for the passphrase, so even /boot is encrypted, you only need a tiny 2MB partition at the front to hold the bootloader.
Well I remember getting completely stuck at one part and the cause was my samsung SSD's funny behavior in the "locked" state. I had to set some kind of kernel flag or something (sorry, it's been years) to get it to ignore the drive until I unlocked it, as there was some kind of tight-loop where it would just keep trying to connect infinitely and not progress/fail/timeout. I've been meaning to get back into linux agai…
Re: Brave New Trusted Boot World
#163Earlier quoted context omitted.
Well I remember getting completely stuck at one part and the cause was my samsung SSD's funny behavior in the "locked" state. I had to set some kind of kernel flag or something (sorry, it's been years) to get it to ignore the drive until I unlocked it, as there was some kind of tight-loop where it would just keep trying to connect infinitely and not progress/fail/timeout. I've been meaning to get back into linux agai…
You're definitely overcomplicating it. Security that's too hard to make use of isn't really accomplishing anything.
Re: Brave New Trusted Boot World
#164Earlier quoted context omitted.
You're definitely overcomplicating it. Security that's too hard to make use of isn't really accomplishing anything.
Well the work is in setting it up. Once it's working you just enter a password. I'm sure hardware FDE support in linux has come a long way since I last tried.
Re: Brave New Trusted Boot World
#165Earlier quoted context omitted.
Systemd was designed in a way that was more tightly coupled than the alternatives and made adopting it an all-or-nothing proposition, and other projects (particularly Gnome) were also tightly coupled to it. It was absolutely foisted on people: a lot of people didn't want it but found they were nevertheless obliged to install it. The whole thing abused the goodwill of the free software community: systemd folks added s…
The tight coupling, the non-portability, all of that are technical choices, that can be debated on their own merit without the need to attribute malevolent intentions to the developers. Projects merged changes because they wanted them, not because their goodwill was abused to make them merge anything. People got systemd on their OSes because they chose OSes whose developers chose to move to systemd. It's not like Len…
They can't. GNU was a political project from day 1, with explicitly political goals; the unix-like design is for political, not technical, reasons.
> Projects merged changes because they wanted them, not because their goodwill was abused to make them merge anything.
Citation needed. If you maintain a widely-used open-source project there's a pretty strong social norm/pressure to merge contributions that don't have anything obviously wrong with them, even if the functionality they implement is something you don't actually want or need.
> People got systemd on their OSes because they chose OSes whose developers chose to move to systemd.
Because they chose OSes whose non-technical leadership chose to move to systemd, in violation of the project constitution, and then had the rump technical committee rubber-stamp it once the principled technical leadership had resigned in disgust and the decision was already a fait accompli, the way I remember it.
> It's not like Lennart comes to your home with a gun if you install OpenBSD.
Some will rob you with a six-gun, and some with a fountain pen. No, Lennart won't hack into your computer with an SSH exploit, but he'll get the software you're using (like Gnome) to push updates that stop it working on your computer, and so the end result ends up much the same.
Re: Brave New Trusted Boot World
#166Smh, the FUD is suffocating in here. And really, a round of applause for everyone butting into say they don't need this. Do you have a habit of doing this for all features? Sorry, but I expect my Linux install to be at least as secure as my Windows (Pro) installation. And without this, it's not. It's that simple. In years, most of you will be benefiting from this, it will become table stakes and the FUD will subside.…
I just don’t trust a company and its employees which actively tried to kill Linux back in the day. Adding the fact that said company is designer, enforcer and gatekeeper of such technology makes everything more worrisome. Lastly, telling that people are spreading FUD against the company which defined and is synonymous with FUD is ironic. That’s all, Thank you.
Please, you must understand, you devalue your point by demonstrating that you either don't understand the layering at play here, and where the real risks are, or you don't care to advocate in any sort of meaningful or compelling way. Instead, you just repeated FUD and waved your arms more. Again, about something we probably agree about, but is simply not at hand here.
I mean the issue that you're worried about? How about the millions of capable smartphones being tossed because of closed bootloaders? Android manufacturers, Google's Nest and Chromecast products, and Apple's iOS devices here are far greater offenders. And just more insidious. My 3 year old phone that works damn fine is considered literal garbage by Google (no security updates, means I use Lineage, means I can't bank, watch Netflix, use credit card apps, and more). Microsoft has never used security features to invalidate my old hardware. Ever.
Again, totally tangential from whether or not SystemD has first-rate support for this (mostly because at this point it's about UX and distro mechanics such that users and distros can freely secure their computers. The functionality to just lock-er-down has been here. For a decade). This issue is about capitalism, economic incentives, social politics, etc. But, I don't expect that conversation to play out on this site much.
Finally, Pixel and Chromebook prove that secure computing AND user freedom CAN be respected and can be user-empowering. Please, if you care, advocate for their models. (Which, again, I can also do on all x86 Microsoft devices and Microsoft Surface ARM, at least, today).
Re: Brave New Trusted Boot World
#167You can sign initrd and check it using (signed) grub. But yes you need local key enrollment. Maybe making this easier is the solution though? Instead of relying on Microsoft to be charitable with its keys.
>No rollback protection (no way to cryptographically invalidate access to TPM-bound secrets on OS updates)
Revoke the key used to sign either grub, the kernel or the initrd?
>Unified Kernel Image
UKI are systemd-specific and mostly a joke AFAICT. Linux supports embedding an initrd into its efi bin. Why make a new thing?
The main object of this whole article is to make PCRs contain hashes of the current system state. Its only advantage is that it can be used to restrict some TPM access. To do that, it tries to introduce a new way to do things which adds nothing to the average user. This is mainly useful for distributions that want to have complete control on the boot process (most Linux distributions do not). A distribution can already do most (everything?) of what is suggested using rotating keys/key revocation locally, but this would introduce the possibility of forced attestation of local state. It's a plus for big organizations, but I fail to see how this improves the state of Linux for the user. At best it's an alternative to using local signing (which is already possible), at worst it's an entry into attestation of local state (DRM).
Re: Brave New Trusted Boot World
#168Re: Brave New Trusted Boot World
#169Earlier quoted context omitted.
If you were responsible for the security of your enterprise network, would you vehemently fight for your user's rights to run the ransomware executable they just get sent over email?
This may come as a shock to you, but computers exist outside of a corporate context.
Re: Brave New Trusted Boot World
#170Earlier quoted context omitted.
Going back to the init.d clusterfuck is insane.
Why? It was simple and understandable. systemd has everything and a kitchen sink, it is a big blob of software. Finding out why the heck my resolv.conf contains some 127.0.0.x entry and not the real nameserver was the final thing that made me question sanity of distro maintainers and author of two worse pieces of software: pulseaudio and systemd. (I was very surprised that it was the same person).
Maybe conceptually simple, but far from it in terms of reliability, predictability and ease-of-use.
> Finding out why the heck my resolv.conf contains some 127.0.0.x entry and not the real nameserver was the final thing [...]
So you read the comment at the top of the file and that made you question someone's sanity?