Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google engineers want to make ad-blocking (near) impossible

stackdiary.com

Post reply on HN
Print view View original

471–480 of 486 posts

Re: Google engineers want to make ad-blocking (near) impossible

#471

Post by hollerith »

jeroenhd wrote: post #361
codedokode wrote: post #289

Earlier quoted context omitted.

> I don't see why a signed bootloader starting a signed attestation engine wouldn't be trusted by third party websites. Do you mean a kind of Linux where root cannot do anything he wants? Like Android?

Yes, a kind of Linux like Ubuntu or Fedora that already boots with secure boot enabled with full support of TPMs and similar technologies. The kind of Linux 99% of Linux users are running today. More secure variants like Android, leveraging SELinux and such, help with sandboxing but I don't think that SELinux is a struct requirement.

Huh? Fedora defaults to secure boot's being off and it is complicated to get it turned on.

Even after you manage to turn it on, it only verifies the kernel and cannot do anything about malware hiding in /usr. There is no Linux distro AFIAK that has verification of the entire system like ChromeOS, MacOS, iOS, Android and Windows have.

Re: Google engineers want to make ad-blocking (near) impossible

#472

Post by jeroenhd »

hollerith wrote: post #471
jeroenhd wrote: post #361

Earlier quoted context omitted.

Yes, a kind of Linux like Ubuntu or Fedora that already boots with secure boot enabled with full support of TPMs and similar technologies. The kind of Linux 99% of Linux users are running today. More secure variants like Android, leveraging SELinux and such, help with sandboxing but I don't think that SELinux is a struct requirement.

Huh? Fedora defaults to secure boot's being off and it is complicated to get it turned on. Even after you manage to turn it on, it only verifies the kernel and cannot do anything about malware hiding in /usr. There is no Linux distro AFIAK that has verification of the entire system like ChromeOS, MacOS, iOS, Android and Windows have.

Fedora's own website [1] states:

> Fedora includes support for the UEFI Secure Boot feature, which means that Fedora can be installed and run on systems where UEFI Secure Boot is enabled. On UEFI-based systems with the Secure Boot technology enabled, all drivers that are loaded must be signed with a valid certificate, otherwise the system will not accept them. All drivers provided by Red Hat are signed by the UEFI CA certificate.

Running your own secure boot CA is not enabled out of the box (for obvious reasons), but that does not pose a problem on most systems. Secure boot only needs special care if you need to load unsigned kernel modules (DKMS, Nvidia) or if you run on a super duper special Microsoft device that doesn't have the third party CA certificate by default.

[1]: https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...

Re: Google engineers want to make ad-blocking (near) impossible

#473

Post by nequo »

paulmd wrote: post #462
nequo wrote: post #411

Earlier quoted context omitted.

Time to start donating to Mozilla.

Maybe if I donate to American Petroleum Institute I can help tilt their agenda in a more green direction. Maybe if I donate to NRA-ILA I can tilt their agenda towards gun control. you’re not going to tilt a think tank against its master, and the point of Mozilla is controlled opposition so google can point out they’re not quite a monopoly.

What do you propose as an alternative? Safari?

Re: Google engineers want to make ad-blocking (near) impossible

#474

Post by hollerith »

jeroenhd wrote: post #472
hollerith wrote: post #471

Earlier quoted context omitted.

Huh? Fedora defaults to secure boot's being off and it is complicated to get it turned on. Even after you manage to turn it on, it only verifies the kernel and cannot do anything about malware hiding in /usr. There is no Linux distro AFIAK that has verification of the entire system like ChromeOS, MacOS, iOS, Android and Windows have.

Fedora's own website [1] states: > Fedora includes support for the UEFI Secure Boot feature, which means that Fedora can be installed and run on systems where UEFI Secure Boot is enabled. On UEFI-based systems with the Secure Boot technology enabled, all drivers that are loaded must be signed with a valid certificate, otherwise the system will not accept them. All drivers provided by Red Hat are signed by the UEFI CA…

Nothing you wrote contradicts anything I wrote. Specifically, although Fedora support secure boot, if you follow the standard install process, you will get a system with secure boot turned off. I know because I've installed Fedora on a system capable of secure boot.

And, again, it is complicated to get it turned on. How complicated? Take a look:

https://nwildner.com/posts/2021-04-10-secureboot-fedora/

>The kind of Linux 99% of Linux users are running today.

I severely doubt that even 5% of Linux installs have secure boot turned on because of how complicated it is to get it working. Specifically I imagine that the complicated instructions on the page I just linked will need to be modified depending on the specific secure-boot firmware.

Re: Google engineers want to make ad-blocking (near) impossible

#475

Post by jeroenhd »

hollerith wrote: post #474
jeroenhd wrote: post #472

Earlier quoted context omitted.

Fedora's own website [1] states: > Fedora includes support for the UEFI Secure Boot feature, which means that Fedora can be installed and run on systems where UEFI Secure Boot is enabled. On UEFI-based systems with the Secure Boot technology enabled, all drivers that are loaded must be signed with a valid certificate, otherwise the system will not accept them. All drivers provided by Red Hat are signed by the UEFI CA…

Nothing you wrote contradicts anything I wrote. Specifically, although Fedora support secure boot, if you follow the standard install process, you will get a system with secure boot turned off. I know because I've installed Fedora on a system capable of secure boot. And, again, it is complicated to get it turned on. How complicated? Take a look: https://nwildner.com/posts/2021-04-10-secureboot-fedora/ >The kind of Li…

> Earlier I wrote, "it is complicated to get it turned on". How complicated? Take a look:

> https://nwildner.com/posts/2021-04-10-secureboot-fedora/

Most motherboards ship with secure boot enabled out of the box. Fedora will install and boot in that configuration without any changes to your system or motherboard settings. You actually have to go out of your way to disable it. The manual (https://docs.fedoraproject.org/en-US/fedora/f36/install-guid...) does not mention any such setting changes.

The page you link goes into custom secure boot keys, which are usually unnecessary. They're arguably more secure, but it's an entirely optional step unless you decide to load unsigned kernel modules.

Re: Google engineers want to make ad-blocking (near) impossible

#476

Post by hollerith »

jeroenhd wrote: post #475
hollerith wrote: post #474

Earlier quoted context omitted.

Nothing you wrote contradicts anything I wrote. Specifically, although Fedora support secure boot, if you follow the standard install process, you will get a system with secure boot turned off. I know because I've installed Fedora on a system capable of secure boot. And, again, it is complicated to get it turned on. How complicated? Take a look: https://nwildner.com/posts/2021-04-10-secureboot-fedora/ >The kind of Li…

> Earlier I wrote, "it is complicated to get it turned on". How complicated? Take a look: > https://nwildner.com/posts/2021-04-10-secureboot-fedora/ Most motherboards ship with secure boot enabled out of the box. Fedora will install and boot in that configuration without any changes to your system or motherboard settings. You actually have to go out of your way to disable it. The manual ( https://docs.fedoraproject.o…

If secure boot is enabled on the motherboard, Fedora can be installed and used without going into the motherboard firmware and turning it off, but that is different from secure boot's providing to the Fedora install the kind of security assurances that secure boot provides to the other mainstream operating systems (Windows, MacOS, iOS, Android and ChromeOS).

For instance, initrd is not verified: https://news.ycombinator.com/item?id=36717975

>The page you link goes into custom secure boot keys, which are usually unnecessary.

You might be right about that.

Re: Google engineers want to make ad-blocking (near) impossible

#477

Post by jeroenhd »

hollerith wrote: post #476
jeroenhd wrote: post #475

Earlier quoted context omitted.

> Earlier I wrote, "it is complicated to get it turned on". How complicated? Take a look: > https://nwildner.com/posts/2021-04-10-secureboot-fedora/ Most motherboards ship with secure boot enabled out of the box. Fedora will install and boot in that configuration without any changes to your system or motherboard settings. You actually have to go out of your way to disable it. The manual ( https://docs.fedoraproject.o…

If secure boot is enabled on the motherboard, Fedora can be installed and used without going into the motherboard firmware and turning it off, but that is different from secure boot's providing to the Fedora install the kind of security assurances that secure boot provides to the other mainstream operating systems (Windows, MacOS, iOS, Android and ChromeOS). For instance, initrd is not verified: https://news.ycombina…

It's true initrd is not verified; the system boots but the security secure boot is supposed to provide is not available by default. I don't think many Fedora users care, but that can be an issue.

To use secure boot without calls to mokutil and friends, Unified Kernel Images are introduced in Fedora 38. These images contain everything (kernel, initrd, and so on) in one, published package. If https://bugzilla.redhat.com/show_bug.cgi?id=2159490 is to be believed, UKIs are live already in Fedora 38.

I can only find pregenerated UKIs for virtual machines in the Fedora repositories and I can't tell if they're properly signed or not, but support is being extended and this problem is being solved.

As for providing security: Linux really needs an easy, user-friendly GUI application for setting up proper secure boot. Of course at least one step is out of the control of Linux developers (configuring the firmware to load new keys) but right now "I want to load my system keys (and also the keys for my Linux dual boot)" is awful on any Linux distro. Every guide presents scripts to call scripts to call automated tools but none of them seem to make the process any easier or friendlier.

Re: Google engineers want to make ad-blocking (near) impossible

#478

Post by hollerith »

jeroenhd wrote: post #477
hollerith wrote: post #476

Earlier quoted context omitted.

If secure boot is enabled on the motherboard, Fedora can be installed and used without going into the motherboard firmware and turning it off, but that is different from secure boot's providing to the Fedora install the kind of security assurances that secure boot provides to the other mainstream operating systems (Windows, MacOS, iOS, Android and ChromeOS). For instance, initrd is not verified: https://news.ycombina…

It's true initrd is not verified; the system boots but the security secure boot is supposed to provide is not available by default. I don't think many Fedora users care, but that can be an issue. To use secure boot without calls to mokutil and friends, Unified Kernel Images are introduced in Fedora 38. These images contain everything (kernel, initrd, and so on) in one, published package. If https://bugzilla.redhat.co…

Unified Kernel Images sounds like a useful improvement. I imagine that when combined with whole-disk encryption it provides useful protection against evil-maid attacks, but I haven't been able to find any signs that there is any Linux install in existence anywhere--except for Android and ChromeOS--where the boot process can detect an alteration to a file in /usr/ (e.g., the system's C library) and refuse to boot or at least warn the user. Unlike an evil maid, malware that has succeeded in its goal of running in a privileged process can alter any file in the unencrypted root filesystem.

In my search I focused on the "immutable" distros like Silverblue because it seems to me that the immutability would make the implementation easier.

In contrast, all the other mainstream OSes can detect an alteration in something like the C library during boot.

Re: Google engineers want to make ad-blocking (near) impossible

#479

Post by heisenbit »

smeej wrote: post #100
heisenbit wrote: post #75

Earlier quoted context omitted.

What is wrong when walking into a web shop with disclosing how much money you earn and may be able to part with?

It terrifies me that I'm actually unsure whether this comment is sarcastic.

Rest assured it is sarcastic. It is terrifying because you start sensing what power shift that is. And it is not theoretical in the slightest, my wife starts complaining about dynamic pricing in web shops where she used to find deals at seasons end.

Or what is wrong with meeting politicians what have always a very good brief in their hands telling them what words have maximum impact on the small group before them? It seems to work looking at the increasing number of spineless chameleons.

Re: Google engineers want to make ad-blocking (near) impossible

#480

Post by linza »

notpushkin wrote: post #466
linza wrote: post #464

Earlier quoted context omitted.

I find that condescending but I'm sure you didn't mean it that way and had good intentions asking that. The problems I experienced that can be fixed in Firefox itself probably already got fixed. My (personal) problem with Firefox is that functionally it's not Chrome and doesn't look/feel like it. The claimed non-functional improvements (privacy, freedom, ...) DON'T make up for the difference for me personally. If Fir…

Absolutely not intended to sound condescending, sorry if that came across that way. I see your point and it is absolutely within your right to stay on Chrome if you don't want to change. I've found it pretty much identical in terms of functionality and UX for the past decade though. Do you have any particular functional improvements in mind that you're missing in Firefox?

As an example: https://ibb.co/Wynn5Tg Subjectively(!) Firefox is cluttered and takes much more space than Chrome for itself. Unfocused tabs are hard for me to make out on Firefox.

I think that personally I'm a lost cause. Either give me Firefox in a Chrome's pelt or I stay with Chrome. And maybe that's good this way: Firefox should just focus on new users and make the best browser for "them".

Post reply on HN