Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

231–240 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#231

Post by Fischgericht »

Nextgrid wrote: post #98
MarkusWandel wrote: post #78

My only experience with Linux secure boot so far.... I wasn't even aware that it was secure booted. And I needed to run something (I think it was the Displaylink driver) that needs to jam itself into the kernel. And the convoluted process to do it failed (it's packaged for Ubuntu but I was installing it on a slightly outdated Fedora system). What, this part is only needed for secure boot? I'm not sec... oh. So go bac…

Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads. Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives. Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only t…

Yes, "just as secure as proprietary OSes" who due to failed signature verification are no longer able to start notepad.exe.

I think you might want to go re-read the last ~6 months of IT news in regards of "secure proprietary OSes".

Re: Lennart Poettering, Christian Brauner founded a new company

#232

Post by LooseMarmoset »

jacquesm wrote: post #201

Will you always offer an option to end users to disable the system if they so desire?

it won’t matter if you disable it. You simply won’t be able to use your PC with any commercial services, in the same way that a rooted android installation can’t run banking apps without doing things to break that, and what they’re working on here aims to make that “breakage“ impossible.

Re: Lennart Poettering, Christian Brauner founded a new company

#233

Post by zb3 »

bayindirh wrote: post #29
zb3 wrote: post #17

Earlier quoted context omitted.

Just to make it clear - on Android you don't have the keys. Even with avb_custom_key you can't modify many partitions.

None of the consumer mobile devices give you all the keys. There are many reasons for that, but 99.9% of them are monetary reasons.

But I want to buy that kind of device for money and I can't.. something is wrong with the market, looks like collusion..

Re: Lennart Poettering, Christian Brauner founded a new company

#234

Post by greenbit »

shrubble wrote: post #74
microtonal wrote: post #45

Earlier quoted context omitted.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services ( systemd-analyze security ), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc. It improves on about every level compared…

There’s a reason why Devuan (a non systemd Debian) exists. Don’t want to get into a massive argument, but there are legitimate reasons for some to go in a different direction.

And "because I want to" is a legitimate reason, if it's my system. It's not up for discussion.

Re: Lennart Poettering, Christian Brauner founded a new company

#235

Post by jorvi »

blibble wrote: post #214
jorvi wrote: post #204

Earlier quoted context omitted.

> it's literally a new random problem every other boot because of this non-deterministic startup, which was never a problem with traditional init or /etc/rc This gave me a good chuckle. Systemd literally was created to solve the awful race conditions and non-determinism in other init systems. And it has done a tremendous job at it. Hence the litany of options to ensure correct order and execution: https://www.freedes…

yeah, many options that are complicated beyond the understanding of the distro maintainers, and yet still don't allow expression of common semantics required to support network services reliably like "at least one real IP address is available" or "time has been synced" and it's not esoteric, even ListenAddress with sshd doesn't even work reliably the ONLY piece of systemd I've not had problems with is systemd-boot, a…

> like "at least one real IP address is available" or "time has been synced"

"network-online.target is a target that actively waits until the network is “up”, where the definition of “up” is defined by the network management software. Usually it indicates a configured, routable IP address of some kind. Its primary purpose is to actively delay activation of services until the network has been set up."

For time sync checks, I assume one of the targets available will effectively mean a time sync has happened. Or you can do something with ExecStartPre. You could run a shell command that checks for the most recent time sync or forces one.

Re: Lennart Poettering, Christian Brauner founded a new company

#236

Post by direwolf20 »

jorvi wrote: post #204
blibble wrote: post #183

Earlier quoted context omitted.

I only use debian pulseaudio I had to fight every single day, with my "exotic" setup of one set of speakers and a headset with pipewire, I've never had to even touch it systemd: yesterday I had a network service on one machine not start up because the IP it was trying to bind to wasn't available yet the dependencies for the .service file didn't/can't express the networking semantics correctly this isn't some hacked u…

> it's literally a new random problem every other boot because of this non-deterministic startup, which was never a problem with traditional init or /etc/rc This gave me a good chuckle. Systemd literally was created to solve the awful race conditions and non-determinism in other init systems. And it has done a tremendous job at it. Hence the litany of options to ensure correct order and execution: https://www.freedes…

systemd was created to solve the problems of a directory full of shell scripts. A single shell script has completely different problems. And traditional init uses inittab, which is not /etc/init.d, and works more like runit.

runit's approach is to just keep trying to start the shell script every 2 seconds until it works. One of those worse–is–better ideas, it's really dumb, and effective. You can check for arbitrary conditions and error–exit, and it will keep trying. If you need the time synced you can just make your script fail if the time is not synced.

traditional inittab is older than that and there's not any reason to use it when you could be using runit, really.

Re: Lennart Poettering, Christian Brauner founded a new company

#237

Post by Fischgericht »

Ah, good old remote attestation. Always works out brilliantly.

I have this fond memory of that Notary in Germany who did a remote attestation of me being with him in the same room, voting on a shareholder resolution.

While I was currently traveling on the other side of the planet.

This great concept that totally will not blow up the planet has been proudly brought to you by Ze Germans.

No matter what your intentions are: It WILL be abused and it WILL blow up. Stop this and do something useful.

[While systemd had been a nightmare for years, these days its actually pretty good, especially if you disable the "oh, and it can ALSO create perfect eggs benedict and make you a virgin again while booting up the system!" part of it. So, no bad feelings here. Also, I am German. Also: Insert list of history books here.]

Re: Lennart Poettering, Christian Brauner founded a new company

#238

Post by direwolf20 »

jorvi wrote: post #235
blibble wrote: post #214

Earlier quoted context omitted.

yeah, many options that are complicated beyond the understanding of the distro maintainers, and yet still don't allow expression of common semantics required to support network services reliably like "at least one real IP address is available" or "time has been synced" and it's not esoteric, even ListenAddress with sshd doesn't even work reliably the ONLY piece of systemd I've not had problems with is systemd-boot, a…

> like "at least one real IP address is available" or "time has been synced" "network-online.target is a target that actively waits until the network is “up”, where the definition of “up” is defined by the network management software. Usually it indicates a configured, routable IP address of some kind. Its primary purpose is to actively delay activation of services until the network has been set up." For time sync ch…

Is it possible for network-online to mean that, or does network-on actually mean that?

It is possible for a specification to be so abstract that it's useless.

Re: Lennart Poettering, Christian Brauner founded a new company

#239

Post by direwolf20 »

blibble wrote: post #206
jacquesm wrote: post #199

Earlier quoted context omitted.

I can totally relate to this, it's gotten to the point that I'm just as scared of rebooting my Linux boxes as I was of rebooting my windows machine a couple of decades ago. And quite probably more scared.

everyone attacking Microslop for a bug where Windows won't shut down properly well, systemd's got them beat there!

The good thing about systemd or any other Linux software is that you don't have to use it, until this company gets off the ground.

Re: Lennart Poettering, Christian Brauner founded a new company

#240

Post by direwolf20 »

ahepp wrote: post #173
Nextgrid wrote: post #98

Earlier quoted context omitted.

Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads. Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives. Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only t…

Isn't it possible to force TPM measurements for stuff like the kernel command line or initramfs hash to match in order to decrypt the rootfs? Or make things simpler with UKIs? Most of the firmwares I've used lately seem to allow adding custom secureboot keys.

Fine as long as it's managed by the user. A good check is who installed the keys. A user–freedom–respecting secureboot must have user–generated keys.
Post reply on HN