[flagged]
[flagged]
[flagged]
Lennart Poettering, Christian Brauner founded a new company
171–180 of 770 posts
Re: Lennart Poettering, Christian Brauner founded a new company
#172I'll ask the dumb question sorry! Who is this for / what problem does it solve? I guess security? Or maybe reproducability?
My guess the problem being solved is how to get acquired by a big Linux vendor.
Re: Lennart Poettering, Christian Brauner founded a new company
#173My only experience with Linux secure boot so far.... I wasn't even aware that it was secure booted. And I needed to run something (I think it was the Displaylink driver) that needs to jam itself into the kernel. And the convoluted process to do it failed (it's packaged for Ubuntu but I was installing it on a slightly outdated Fedora system). What, this part is only needed for secure boot? I'm not sec... oh. So go bac…
Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads. Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives. Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only t…
Isn't it possible to force TPM measurements for stuff like the kernel command line or initramfs hash to match in order to decrypt the rootfs? Or make things simpler with UKIs?
Most of the firmwares I've used lately seem to allow adding custom secureboot keys.
Re: Lennart Poettering, Christian Brauner founded a new company
#174Re: Lennart Poettering, Christian Brauner founded a new company
#175What is the endgame here? Obviously "heightened security" in some kind of sense, but to what end and what mechanisms? What is the scope of the work? Is this work meant to secure forges and upstream development processes via more rigid identity verification, or package manager and userspace-level runtime restrictions like code signing? Will there be a push to integrate this work into distributions, organizations, or the kernel itself? Is hardware within the scope of this work, and to what degree?
The website itself is rather vague in its stated goals and mechanisms.
Re: Lennart Poettering, Christian Brauner founded a new company
#176Earlier quoted context omitted.
How can you be "pretty sure" they're going to develop precisely the technology needed to implement DRM but also will never use or allow it to be used by anybody but the lawful owners of the hardware? You can't. It's like designing new kinds of nerve gas, "quite sure" that it will only ever be in the hands of good guys who aren't going to hurt people with it. That's powerful naïveté. Once you make it, you can't contro…
The technology needed to implement DRM has been there for 20+ years and has already evolved in the space where it makes sense from an "evil" standpoint (if you're on that particular side of the fence - Android client attestation), so someone implementing the flip side that might actually be useful doesn't particularly bother me. I remember the 1990s "cryptography is the weapon of evil" arguments too - it's funny how…
The technology already exists and also there is unmet industrial market demand for the technology. Incoherent. If it already exists as you say, then Lennart should fuck off and find something else to make.
Re: Lennart Poettering, Christian Brauner founded a new company
#177Earlier quoted context omitted.
[flagged]
That's a proxy metric for what we really care about: acceptance of differences, tolerance of others, diversity of perspectives, etc. In principle, you can achieve these goals with a team whose members are all one ethnicity and gender; it's just that a fair selection process won't produce such a team often . And, as it turns out, optimising for the "people who look different" proxy metric doesn't do a terrible job of…
[flagged]
Re: Lennart Poettering, Christian Brauner founded a new company
#178Earlier quoted context omitted.
> Sounds like kernel mode DRM or some similarly unwanted bullshit. Look, I hate systemd just as much as the next guy - but how are you getting "DRM" out of this?
Secure boot and attestation both generally require a form of DRM. It’s a boon for security, but also for control.
> Secure boot and attestation both generally require a form of DRM.
They literally don't.
For a decade, I worked on secure boot & attestation for a device that was both:
- firmware updatable - had zero concept or hardware that connected it to anything that could remotely be called a network
Re: Lennart Poettering, Christian Brauner founded a new company
#179Earlier quoted context omitted.
The problem is not systemd vs SysV et al, the problem is systemd spreading like a cancer throughout the entire operating system. Also trying to use systemd with podman is frustrating as hell. You just cannot run a system service using podman as a non-root user and have it work correctly.
Quadlet actually solves this. It's the newer way to define containers for systemd and handles the rootless user case properly. I migrated my services to it recently and it's much more robust than the old generate scripts.
Could you give an example system-level quadlet that accepts connections on a low port, like 80, but runs the actual container as a non-root user (and plays nice with systemd, no force kill after timeout to stop, no reporting as failed for a successful stop)?
My understanding is quadlet does not solve this, and my options are calling "systemctl --user" or "--userns auto". I would love to be wrong here.
Re: Lennart Poettering, Christian Brauner founded a new company
#180Earlier quoted context omitted.
Hi Daan, Thanks for the answer. Let me ask you something close with a more blunt angle: Considering most of the tech is already present and shipping in the current systemd, what prevents our systems to become a immutable monolith like macOS or current Android with the flick of a switch? Or a more grave scenario: What prevents Microsoft from mandating removal of enrollment permissions for user keychains and Secure Boo…
Nothing, but openbsd is amazing and just works. Anyone still using Linux on the desktop in 2026 should switch.
(I like OpenBSD, but) It is extremely hard to compete with Linux on hardware support / driver coverage.