Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LineageOS 23.2

lineageos.org

Post reply on HN
Print view View original

21–30 of 64 posts

Re: LineageOS 23.2

#21

Post by close04 »

RedComet wrote: post #14
dijit wrote: post #10

Earlier quoted context omitted.

Yes, I understand the value of signatures, but thats not how PKI works.

If the owner of a device can't sign and install their own software, then your definition of PKI doesn't "work" at all. The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.

The difference between “PKI” and “just signing with a private key” is the trusted authority infrastructure. Without that you still get the benefit of signatures and some degree of verification, you can still validate what you install.

But in reality this trustworthiness check is handed over by the manufacturer to an infrastructure made up of these trusted parties in the owner’s name, and there’s nothing the owner can do about it. The owner may be able to validate software is signed with the expected key but still not be able to use it because the device wants PKI validation, not owner validation.

I’ve been self-signing stuff in my home and homelab for decades. Everything works just the same technically but step outside and my trustworthiness is 0 for everyone else who relies on PKI.

Re: LineageOS 23.2

#22

Post by Aachen »

dijit wrote: post #15
RedComet wrote: post #14

Earlier quoted context omitted.

If the owner of a device can't sign and install their own software, then your definition of PKI doesn't "work" at all. The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.

[flagged]

> My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys

Maybe read the actual definition before assuming you're so much smarter than "HN". One doesn't need third parties to have pki, it's a concept, you can roll out your own

Re: LineageOS 23.2

#24

Post by dijit »

Aachen wrote: post #22
dijit wrote: post #15

Earlier quoted context omitted.

[flagged]

> My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys Maybe read the actual definition before assuming you're so much smarter than "HN". One doesn't need third parties to have pki, it's a concept, you can roll out your own

“read the actual definition”;stellar contribution there, mate. I checked and sure enough its exactly in line with my comments.

I’ve been discussing the practical implementation of PKI as it exists in the real world, specifically in the context of bootloader verification and TLS certificate validation. You know, the actual systems people use every day.

But please, do enlighten me with whatever Wikipedia definition you’ve just skimmed that you think contradicts anything I’ve said. Because here’s the thing: whether you want to pedantically define PKI as “any infrastructure involving public keys” or specifically as “a hierarchical trust model with certificate authorities,” my point stands completely unchanged.

In the context that spawned this entire thread, LineageOS and bootloader signature verification, there is a chain of trust, there are designated trusted authorities, and signatures outside that chain are rejected. That’s PKI. That’s how it works. That’s what I described.

If your objection is that I should have been more precise about distinguishing between “Web PKI” and “PKI generally,” then congratulations on missing the forest for the trees whilst simultaneously contributing absolutely nothing of substance to the discussion.

But sure, I’m the one who needs to read definitions. Perhaps you’d care to actually articulate which part of my explanation was functionally incorrect for the use case being discussed, rather than posting a single snarky sentence that says precisely nothing?

EDIT: your edit is much more nuanced but still misses the point; https://imgur.com/a/n2VwltC

Re: LineageOS 23.2

#25

Post by junon »

dijit wrote: post #15
RedComet wrote: post #14

Earlier quoted context omitted.

If the owner of a device can't sign and install their own software, then your definition of PKI doesn't "work" at all. The first party must be able to entirely decide that "some third party" for it to be anything more than an obfuscation of digital serfdom.

[flagged]

You misunderstood, it appears.

Re: LineageOS 23.2

#26

Post by dijit »

junon wrote: post #25
dijit wrote: post #15

Earlier quoted context omitted.

[flagged]

You misunderstood, it appears.

Or its collective ignorance, can’t be sure.

Public key infrastructure without CAs isn’t a thing as far as I can see, I’m willing to be proven wrong, but I thought the I in PKI was all about the CA system.

We have PGP, but that's not PKI, thats peer-based public key cryptography.

Re: LineageOS 23.2

#27

Post by realusername »

snvzz wrote: post #11
rixrax wrote: post #3

Earlier quoted context omitted.

Why is this?

Because it is more profitable for smartphone makers if you need to buy a new one. Unless there's legislation to force them to allow enrolling new keys or otherwise disabling secure boot, the abuse will continue.

Third party roms also do not include all the bloatware and spyware they are loading into the phone, they aren't a fan of losing control.

Re: LineageOS 23.2

#28

Post by JamesTRexx »

I enjoyed LineageOS for years on my Samsung S4 until it finally broke from a fall. It's a shame there was no image to install on my new Xcover 7, but not unexpected as it was a newly released phone. But I doubt there will be an alternative/stripped Android available for this model as I haven't seen anything supporting a Xcover version anywhere. Best I can hope for is eventually a support for rooting and de-installing unwanted bloat with an app manager.

Re: LineageOS 23.2

#29

Post by Aachen »

dijit wrote: post #24
Aachen wrote: post #22

Earlier quoted context omitted.

> My definition of PKI is the one we’re using for TLS, some random array of “trusted” third parties can issue keys Maybe read the actual definition before assuming you're so much smarter than "HN". One doesn't need third parties to have pki, it's a concept, you can roll out your own

“read the actual definition”;stellar contribution there, mate. I checked and sure enough its exactly in line with my comments. I’ve been discussing the practical implementation of PKI as it exists in the real world, specifically in the context of bootloader verification and TLS certificate validation. You know, the actual systems people use every day. But please, do enlighten me with whatever Wikipedia definition you…

Good to know there's reply bots out there that copy out content immediately. I rarely run into edit conflicts (where someone reads before I add in another thing) but it happens, maybe this is why. Sorry for that

Besides the "what does pki mean" discussion, as for who "misses the point" here, consider that both sides in a discussion have a chance at having missed the original point of a reply (it's not always only about how the world is / what the signing keys are, but how the world should be / whose keys should control a device). But the previous post was already in such a tone that it really doesn't matter who's right, it's not a discussion worth having anymore

Post reply on HN