Live data from Hacker News

Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

sh1mmer.me

191–200 of 203 posts

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#191

The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up. https://chromium-review.googlesource.com/c/chromiumos/platfo...

That patch seems to be just checking more devices/partitions for images?

I'm not sure how to explain what is going on in there, but that is the patch for shimmer.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#192
post #113

I wouldn't have a career in IT if I hadn't spent many hours at ages 11 to 15 trying to get round my schools network security. My logon was frequently disabled for misuse and I was even suspended for a couple of days once but I learnt more that way than in any class I've ever taken.

I was really lucky that our Computer Teacher/IT guy (this was back in the early 2000s) was really cool and allowed us a bit of leeway to break things. After the first time we got caught (there was three of us) he sat down with us, and essentially gave us some rules of engagement, anything we got around, or defeated we had to write up a short report and turn it into him, explaining what we were able to accomplish, the…

[deleted]

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#193

Earlier quoted context omitted.

This really is not something that I have thought about very much as they very likely have phones where they are able to view all of the same content, anyway.

Why would you watch porn at school

[deleted]

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#194

Earlier quoted context omitted.

I was lucky enough to go to a school with uniforms. I thought it was stupid at the time. As an adult, I realize now what that did was level the playing field between the rich kids and poor kids. I can’t even imagine being a kid in school these days with an off brand smartphone or ipods, especially when Apple actively promotes bullying non users.

Android user in sophomore year here, no one really cares

That’s encouraging. Save your money and invest it. Trust me on this. Old people told me this.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#195
post #163

Earlier quoted context omitted.

Chromebooks don't even have a Terminal for the kids. Vim's great, but VScode with Jupyter Notebook support would make the computers we bought for them into great offline calculators, too. VSCode on a Chromebook requires VMs and Containers which require "Developer Tools" and "Powerwash"; or the APK repack of VSCodium that you can't even sideload and manually update sometimes (because it's not on the 15-30% cut, and mu…

Good point. Wasn't aware of the Family Link restrictions. Will see what can be done here. Disclaimer: I work on ChromeOS.

VSCode + containers + the powerwash feature would enable kids to STEM.

Are flatpaks out of the question? Used to be "Gnome and Chrome" on ~Gentoo.

Shouldn't the ChromiumOS host be running SELinux, if the ARC support requires extended filesystem attributes for `ls -alz` and `ps -aufxz` to work?

Chromium and Chrome appear to be running unconfined? AppArmor for Firefox worked years ago?

https://www.google.com/search?q=chromium+selinux ; chrome_selinux ?

It seems foolish to have SELinux in a guest VM but not the host.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#196
post #163

Earlier quoted context omitted.

Good point. Wasn't aware of the Family Link restrictions. Will see what can be done here. Disclaimer: I work on ChromeOS.

VSCode + containers + the powerwash feature would enable kids to STEM. Are flatpaks out of the question? Used to be "Gnome and Chrome" on ~Gentoo. Shouldn't the ChromiumOS host be running SELinux, if the ARC support requires extended filesystem attributes for `ls -alz` and `ps -aufxz` to work? Chromium and Chrome appear to be running unconfined? AppArmor for Firefox worked years ago? https://www.google.com/search?q=c…

Task: "Reprovision" the default VMs and Containers after "Powerwash" `rm -rf`s everything

`adb shell pm list packages` and `adb install` a list of APKs and CRXs.

Here's chromebook_ansible: https://github.com/seangreathouse/chromebook-ansible/blob/ma...

Systemd-homed is portable. Still, "Reprovision" the broken userspace for the user.

Local k8s like microshift that does container-selinux like RH / Fedora, with Gnome and Waydroid would be cool to have for the kids.

Podman-desktop (~Docker Desktop) does k8s now.

K8s defaults to blocking containers that run as root now, and there's no mounting thee --privileged docket socket w/ k8s either. Gitea + DroneCI/ACT/ci_runner w/ rootless containers. Gvisor is considered good enough for shared server workloads.

Repo2docker + caching is probably close to "kid proof" or "reproducible".

VScode has "devcontainer.json". Scipy stacks ( https://jupyter-docker-stacks.readthedocs.io/en/latest/using... ) and Kaggle/docker-python (Google) take how many GB to run locally for users Task: Learn automated testing, bash, git, and python (for Q12 K12CS STEM)

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#197

The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up. https://chromium-review.googlesource.com/c/chromiumos/platfo...

That patch seems to be just checking more devices/partitions for images?

The patch causes a different root filesystem to be used. Specifically, if the kernel command line specifies a root filesystem that must be used, then that one will always be mounted, even if other devices are available.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#199
post #157

Earlier quoted context omitted.

It definitely is sandboxed. I think the concern is that kids will get off task with it by installing games and stuff.

IMHO, a limited (read: CLI) but general-purpose computing environment is exactly what we should be providing our kids. No one would play TI-83 games if they had other options... but it'd be hard to say writing and modifying them wasn't educational.

Yes but that's a decision for the administrators, they may well not want portscans etc happening on their network.

Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks

#200
post #81

Earlier quoted context omitted.

> Hard to tune out of a lecture when you are literally writing everything down, at speed. Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time.

> Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time I would postulate that for the majority of people, in the majority of learning situations, writing out notes could (should?) be an integral part of consuming the contents of a lecture. There's a 2021 paper from the University of Tokyo entitled "Pape…

I would postulate that for the majority of people, in the majority of learning situations, listening, consciously should be an integral part of consuming the contents of a lecture.

Making a hand written transcript of every word said - like a court stenographer is not necessarily listening or consuming the things said, especially when they are new or challenging concepts that require the student to apply some critical thinking or form connections with other knowledge.

Post reply on HN