241–250 of 770 posts
Hello Chris, I am glad to see these efforts are now under an independent firm rather than being directed by Microsoft. What is the ownership structure like? Where/who have you received funding from, and what is the plan for ongoing monetization of your work? Would you ever sell the company to Microsoft, Google, or Amazon? Thanks.
No matter what the founders say, the answer to this question is always yes.
"We are building cryptographically verifiable integrity into Linux systems. Every system starts in a verified state and stays trusted over time." What does this mean? Why would anyone want this? Can you explain this to me like I'm five years old?
Remote attestation is another technology that is not inherently restrictive of software freedom. But here are some examples of technologies that have already restricted freedom due to oligopoly combined with network effects: * smartphone device integrity checks (SafetyNet / Play Integrity / Apple DeviceCheck) * HDMI/HDCP * streaming DRM (Widevine / FairPlay) * Secure Boot (vendor-keyed deployments) * printers w/ sign…
It's interesting there's no remote attestation the other way around, making sure the server is not doing something to your data that you didn't approve of.
Earlier quoted context omitted.
“ensure that things are as they are expected to be” according to who, and for who's benefit? Certainly not the person sitting in front of the computer.
The system owner. Usually that is the same entity that owns the secure boot keys, which can be the person that bought a device or another person if the buyer decides to delegate that responsibility (whether knowingly or unknowingly). In my case I am talking about myself. I prefer to actually know what is running on my systems and ensure that they are as I expect them to be and not that they may have been modified unb…
Earlier quoted context omitted.
>We are building cryptographically verifiable integrity into Linux systems. Every system starts in a verified state and stays trusted over time. What problem does this solve for Linux or people who use Linux? Why is this different from me simply enabling encryption on the drive?
It prevents malware that obtained root access once from forever replacing your kernel/initrd and achieving persistence that way.
I'll ask the dumb question sorry! Who is this for / what problem does it solve? I guess security? Or maybe reproducability?
My guess the problem being solved is how to get acquired by a big Linux vendor.
Earlier quoted context omitted.
You'll understand if I don't think the tradeoffs were necessary, or worthwhile.
Ambition does really weird things to people. But I'm sure in this case when they achieve some kind of dominant position and Microsoft offers to re-absorb them they will do the honorable thing.
Earlier quoted context omitted.
Verifiable to who? Some remote third party that isn't me? The hell would I want that?
https://0pointer.net/blog/authenticated-boot-and-disk-encryp... You. The money quote about the current state of Linux security: > In fact, right now, your data is probably more secure if stored on current ChromeOS, Android, Windows or MacOS devices, than it is on typical Linux distributions. Say what you want about systemd the project but they're the only ones moving foundational Linux security forward, no one else e…
Earlier quoted context omitted.
Interesting. So what did the attestation say once I (random Internet user) updated the firmware to something I wrote or compiled from another source?
> Interesting. So what did the attestation say once I (random Internet user) updated the firmware to something I wrote or compiled from another source? The update is predicated on a valid signature.