[dead]
Lanzaboote – NixOS Secure Boot
11–20 of 22 posts
Re: Lanzaboote – NixOS Secure Boot
#12That looks like a really nice hackathon! That said, the fact that they probably had a majority of the best NixOS developers in the world under one roof and they weren't solely focused on NixOS error messages is borderline criminal...
Re: Lanzaboote – NixOS Secure Boot
#13Secure boot protects against evil maid attacks, but no one would ever need use an evil maid attack on a NixOS user because anyone can merge whatever they want to NixOS without signature or review, particularly given that any maintainer can merge their own commits from their own pseudonyms.
NixOS is always one compromised Github API token away from a backdoor into everything built with NixOS.
I cannot imagine a threat model that would need secure boot yet accept the risks of NixOS.
Re: Lanzaboote – NixOS Secure Boot
#14this is how Microsoft wins the war against general computing you must not join it, refuse to lockdown your computer
Secure boot and TPM are good technologies. You can roll your own keys and Microsoft won't have anything on it. Do people still think you need to have your boot program signed by Microsoft in order to use it? I also wonder if this sentiment is what stalled development in other more traditional projects like BSD derivatives. I'd love to have FreeBSD with secure boot and loading ZFS keys from the TPM.
Microsoft's certification states that OEM's must allow the user to configure secure boot to trust other bootloader's.
https://learn.microsoft.com/en-us/windows/security/operating...
However OEM's like HP are ignoring the certification requirements:
https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-...
https://h30434.www3.hp.com/t5/Notebook-Boot-and-Lockup/How-t...
Re: Lanzaboote – NixOS Secure Boot
#15Earlier quoted context omitted.
Secure boot and TPM are good technologies. You can roll your own keys and Microsoft won't have anything on it. Do people still think you need to have your boot program signed by Microsoft in order to use it? I also wonder if this sentiment is what stalled development in other more traditional projects like BSD derivatives. I'd love to have FreeBSD with secure boot and loading ZFS keys from the TPM.
Microsoft's certification states that OEM's must allow the user to configure secure boot to trust other bootloader's. https://learn.microsoft.com/en-us/windows/security/operating... However OEM's like HP are ignoring the certification requirements: https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-... https://h30434.www3.hp.com/t5/Notebook-Boot-and-Lockup/How-t...
Interesting. I had a 705 G4 (or 74 g5? Idk the one with the Ryzen 2400Ge) and the firmware supported putting the machine secure boot system on setup mode.
Re: Lanzaboote – NixOS Secure Boot
#16Lanzaboote is great, I've been using it for almost a year now in a dual boot with Windows 11 for full secure boot on my desktop. It is quite stable (notably was set and forget) and the initial setup was relatively easy.
Does it play well with bitkeeper full disk encryption?
Previous attempts at dual booting windows 11 on a laptop - I had issues when Linux updated boot alternatives - windows would demand bitkeeper recovery key input.
Re: Lanzaboote – NixOS Secure Boot
#17Secure boot protects against evil maid attacks, but no one would ever need use an evil maid attack on a NixOS user because anyone can merge whatever they want to NixOS without signature or review, particularly given that any maintainer can merge their own commits from their own pseudonyms. NixOS is always one compromised Github API token away from a backdoor into everything built with NixOS. I cannot imagine a threat…
> without signature or review
What are you on about now? I got _one_ of my projects accepted into NixPkgs a couple years ago and have never done it since due to the huge PITA it was to find someone with contributor rights to sign off on it. If I want to update it, same hassle. Now I prefer to just throw a flake in the root of the project and call it good, which actually works really well.
Wait until you find out that Arch has both secure boot and the AUR.
Re: Lanzaboote – NixOS Secure Boot
#18Earlier quoted context omitted.
Secure boot and TPM are good technologies. You can roll your own keys and Microsoft won't have anything on it. Do people still think you need to have your boot program signed by Microsoft in order to use it? I also wonder if this sentiment is what stalled development in other more traditional projects like BSD derivatives. I'd love to have FreeBSD with secure boot and loading ZFS keys from the TPM.
Microsoft's certification states that OEM's must allow the user to configure secure boot to trust other bootloader's. https://learn.microsoft.com/en-us/windows/security/operating... However OEM's like HP are ignoring the certification requirements: https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-... https://h30434.www3.hp.com/t5/Notebook-Boot-and-Lockup/How-t...
Some cases OEMs ignore the requirement the other way round, e.g. the MSI boards that perform zero signature checking with secure boot on.
Re: Lanzaboote – NixOS Secure Boot
#19Secure boot protects against evil maid attacks, but no one would ever need use an evil maid attack on a NixOS user because anyone can merge whatever they want to NixOS without signature or review, particularly given that any maintainer can merge their own commits from their own pseudonyms. NixOS is always one compromised Github API token away from a backdoor into everything built with NixOS. I cannot imagine a threat…
> without signature or review What are you on about now? I got _one_ of my projects accepted into NixPkgs a couple years ago and have never done it since due to the huge PITA it was to find someone with contributor rights to sign off on it. If I want to update it, same hassle. Now I prefer to just throw a flake in the root of the project and call it good, which actually works really well. Wait until you find out that…
Anyone with contributor rights can make a fake identity, make a PR with it, then merge their own PR. Effectively no oversight.
Also, because there is no signing, git history can be rewritten easily or people can impersonate each other in git history easily.
This sort of posture is why I am totally serious when I say one compromised Github token can backdoor all nix users.
Re: Lanzaboote – NixOS Secure Boot
#20Lanzaboote is great, I've been using it for almost a year now in a dual boot with Windows 11 for full secure boot on my desktop. It is quite stable (notably was set and forget) and the initial setup was relatively easy.
Does it play well with bitkeeper full disk encryption? Previous attempts at dual booting windows 11 on a laptop - I had issues when Linux updated boot alternatives - windows would demand bitkeeper recovery key input.
I don't know, my Windows 11 setup does not use FDE (afaik). It is exclusively for games which require kernel level anti-cheat with secure boot.
However when I setup Windows it wiped my TPM keys for LUKS so maybe there is a potential conflict there.