The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up. https://chromium-review.googlesource.com/c/chromiumos/platfo...
That patch seems to be just checking more devices/partitions for images?
Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
191–200 of 203 posts
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#192I wouldn't have a career in IT if I hadn't spent many hours at ages 11 to 15 trying to get round my schools network security. My logon was frequently disabled for misuse and I was even suspended for a couple of days once but I learnt more that way than in any class I've ever taken.
I was really lucky that our Computer Teacher/IT guy (this was back in the early 2000s) was really cool and allowed us a bit of leeway to break things. After the first time we got caught (there was three of us) he sat down with us, and essentially gave us some rules of engagement, anything we got around, or defeated we had to write up a short report and turn it into him, explaining what we were able to accomplish, the…
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#193Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#194Earlier quoted context omitted.
I was lucky enough to go to a school with uniforms. I thought it was stupid at the time. As an adult, I realize now what that did was level the playing field between the rich kids and poor kids. I can’t even imagine being a kid in school these days with an off brand smartphone or ipods, especially when Apple actively promotes bullying non users.
Android user in sophomore year here, no one really cares
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#195Earlier quoted context omitted.
Chromebooks don't even have a Terminal for the kids. Vim's great, but VScode with Jupyter Notebook support would make the computers we bought for them into great offline calculators, too. VSCode on a Chromebook requires VMs and Containers which require "Developer Tools" and "Powerwash"; or the APK repack of VSCodium that you can't even sideload and manually update sometimes (because it's not on the 15-30% cut, and mu…
Good point. Wasn't aware of the Family Link restrictions. Will see what can be done here. Disclaimer: I work on ChromeOS.
Are flatpaks out of the question? Used to be "Gnome and Chrome" on ~Gentoo.
Shouldn't the ChromiumOS host be running SELinux, if the ARC support requires extended filesystem attributes for `ls -alz` and `ps -aufxz` to work?
Chromium and Chrome appear to be running unconfined? AppArmor for Firefox worked years ago?
https://www.google.com/search?q=chromium+selinux ; chrome_selinux ?
It seems foolish to have SELinux in a guest VM but not the host.
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#196Earlier quoted context omitted.
Good point. Wasn't aware of the Family Link restrictions. Will see what can be done here. Disclaimer: I work on ChromeOS.
VSCode + containers + the powerwash feature would enable kids to STEM. Are flatpaks out of the question? Used to be "Gnome and Chrome" on ~Gentoo. Shouldn't the ChromiumOS host be running SELinux, if the ARC support requires extended filesystem attributes for `ls -alz` and `ps -aufxz` to work? Chromium and Chrome appear to be running unconfined? AppArmor for Firefox worked years ago? https://www.google.com/search?q=c…
`adb shell pm list packages` and `adb install` a list of APKs and CRXs.
Here's chromebook_ansible: https://github.com/seangreathouse/chromebook-ansible/blob/ma...
Systemd-homed is portable. Still, "Reprovision" the broken userspace for the user.
Local k8s like microshift that does container-selinux like RH / Fedora, with Gnome and Waydroid would be cool to have for the kids.
Podman-desktop (~Docker Desktop) does k8s now.
K8s defaults to blocking containers that run as root now, and there's no mounting thee --privileged docket socket w/ k8s either. Gitea + DroneCI/ACT/ci_runner w/ rootless containers. Gvisor is considered good enough for shared server workloads.
Repo2docker + caching is probably close to "kid proof" or "reproducible".
VScode has "devcontainer.json". Scipy stacks ( https://jupyter-docker-stacks.readthedocs.io/en/latest/using... ) and Kaggle/docker-python (Google) take how many GB to run locally for users Task: Learn automated testing, bash, git, and python (for Q12 K12CS STEM)
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#197The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up. https://chromium-review.googlesource.com/c/chromiumos/platfo...
That patch seems to be just checking more devices/partitions for images?
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#198Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#199Earlier quoted context omitted.
It definitely is sandboxed. I think the concern is that kids will get off task with it by installing games and stuff.
IMHO, a limited (read: CLI) but general-purpose computing environment is exactly what we should be providing our kids. No one would play TI-83 games if they had other options... but it'd be hard to say writing and modifying them wasn't educational.
Re: Sh1mmer – An exploit capable of unenrolling enterprise-managed Chromebooks
#200Earlier quoted context omitted.
> Hard to tune out of a lecture when you are literally writing everything down, at speed. Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time.
> Hard to actually consume the contents of a lecture when you are frantically trying to reproduce a powerpoint slide and transcript of what someone is saying in real time I would postulate that for the majority of people, in the majority of learning situations, writing out notes could (should?) be an integral part of consuming the contents of a lecture. There's a 2021 paper from the University of Tokyo entitled "Pape…
Making a hand written transcript of every word said - like a court stenographer is not necessarily listening or consuming the things said, especially when they are new or challenging concepts that require the student to apply some critical thinking or form connections with other knowledge.