Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

321–330 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#321

Post by michaelmrose »

michaelmrose wrote: post #184
cyphar wrote: post #51

Earlier quoted context omitted.

I'm Aleksa, one of the founding engineers. We will share more about this in the coming months but this is not the direction nor intention of what we are working on. The models we have in mind for attestation are very much based on users having full control of their keys. This is not just a matter of user freedom, in practice being able to do this is far more preferable for enterprises with strict security controls. I…

This is extremely bad logic. The technology of enforcing trusted software is without inherent value good or ill depending entirely on expected usage. Anything that is substantially open will be used according to the values of its users not according to your values so we ought instead to consider their values not yours. Suppose you wanted to identify potential agitators by scanning all communication for indications in…

TLDR We already know how this will be misused to take away people's freedom not to run their own software stack but to dissent against fascism. It's immoral to build even with the best intentions.

Re: Lennart Poettering, Christian Brauner founded a new company

#322

Post by TacticalCoder »

ajnin wrote: post #304

Everyday the world is becoming more polarized. Technology corporations gain ever more control over people's lives, telling people what they can do on their computers and phones, what they can talk about on social platforms, censoring what they please, wielding the threat of being cutoff from their data, their social circles on a whim. All over the world, in dictatorships and also in democratic countries, governments…

> To me Linux is not a technological object, it is also a political statement. It is about choice, personal freedom ...

I use Linux since the Slackware day. Poettering is the worse thing that happened to the Linux ecosystem and, of course, he went on to work for Microsoft. Just to add a huge insult to the already painful injury.

This is not about security for the users. It's about control.

At least many in this thread are criticizing the project.

And, once again of course, it's from a private company.

Full of ex-Microsofties.

I don't know why anyone interested in hacking would cheer for this. But then maybe HN should be renamed "CN" (Corporate News) or "MN" (Microsoft News).

Re: Lennart Poettering, Christian Brauner founded a new company

#323

Post by jacquesm »

esseph wrote: post #311
jacquesm wrote: post #199

Earlier quoted context omitted.

I can totally relate to this, it's gotten to the point that I'm just as scared of rebooting my Linux boxes as I was of rebooting my windows machine a couple of decades ago. And quite probably more scared.

What distro?

The box that I'm worried about in particular is running RedHat.

Ubuntu boxes: usually ok as long as you stay away from anything python related in the core system.

Re: Lennart Poettering, Christian Brauner founded a new company

#324

Post by jacquesm »

direwolf20 wrote: post #303
jacquesm wrote: post #287

Earlier quoted context omitted.

I think at some point we will see a steep increase in value of old hardware that can still run unsigned binaries.

It won't be able to interact with any online services like Google or Hacker News.

Google I can live without ;)

Re: Lennart Poettering, Christian Brauner founded a new company

#325

Post by blibble »

TacticalCoder wrote: post #322
ajnin wrote: post #304

Everyday the world is becoming more polarized. Technology corporations gain ever more control over people's lives, telling people what they can do on their computers and phones, what they can talk about on social platforms, censoring what they please, wielding the threat of being cutoff from their data, their social circles on a whim. All over the world, in dictatorships and also in democratic countries, governments…

> To me Linux is not a technological object, it is also a political statement. It is about choice, personal freedom ... I use Linux since the Slackware day. Poettering is the worse thing that happened to the Linux ecosystem and, of course, he went on to work for Microsoft. Just to add a huge insult to the already painful injury. This is not about security for the users. It's about control. At least many in this threa…

> Poettering is the worse thing that happened to the Linux ecosystem and, of course, he went on to work for Microsoft. Just to add a huge insult to the already painful injury.

agreed, and now he's planning on controlling what remains of your machine cryptographically!

Re: Lennart Poettering, Christian Brauner founded a new company

#326

Post by TacticalCoder »

eth0up wrote: post #135
smartmic wrote: post #94

Earlier quoted context omitted.

And Void Linux. And Gentoo. And Alpine Linux. And Slackware. And others.

After over a decade of Debian, when I upgraded my PC, I tried every big systemd-based distro, including opensuse, which I wholly loathed. I finally decided on Void and feel at home as I did 20+ years ago when I began. There are serious problems with the systemd paradigm, most of which I couldn't argue for or against. But at least in Void, I can remove network-manger altogether, use cron as I always have, and generall…

> Void is as good as I could have wanted. If that ever goes, I guess it's either BSD or a cave somewhere.

If systemd-less Linux ever go, there are indeed still the BSDs. But I thought long and hard about this and already did some testing: I used to run Xen back in the early hardware-virt days and nowadays I run Proxmox (still, sadly, systemd-based).

An hypervisor with a VM and GPU passthrough to the VM is at least something too: it's going to be a long long while before people who want to take our ability to control our machines will be able to prevent us from running a minimal hypervisor and then the "real" OS in a VM controlled by the hypervisor.

I did GPU passthrough tests and everything works just fine: be it Linux guests (which I use) or Windows guests (which I don't use).

My "path" to dodge the cave you're talking about is going to involved an hypervisor (atm I'm looking at the FreeBSD's bhyve hypervisor) and then a VM running systemd-less Linux.

And seen that, today, we can run just about every old system under the sun in a VM, I take we'll all be long dead before evil people manage to prevent us from running the Linux we want, the way we want.

You're not alone. And we're not alone.

I simply cannot stand the insufferable arrogance of Agent Poettering. Especially not seen the kitchen sink that systemd is (systemd ain't exactly a homerun and many are realizing that fact now).

Re: Lennart Poettering, Christian Brauner founded a new company

#327

Post by nextaccountic »

Nextgrid wrote: post #98
MarkusWandel wrote: post #78

My only experience with Linux secure boot so far.... I wasn't even aware that it was secure booted. And I needed to run something (I think it was the Displaylink driver) that needs to jam itself into the kernel. And the convoluted process to do it failed (it's packaged for Ubuntu but I was installing it on a slightly outdated Fedora system). What, this part is only needed for secure boot? I'm not sec... oh. So go bac…

Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads. Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives. Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only t…

here is some actual security: encrypted /boot, encrypted everything other than the boot loader (grub in this case)

sign grub with your own keys (some motherboards let you to do so). don't let random things signed by microsoft to boot (it defeats the whole point)

so you have grub in an efi partition, it passes secure boot, loads, and attempts to unlock a luks partition with the user provided passphrase. if it passed secure boot it should increase confidence that you are typing you password into the legit thing

so anyway, after unlocking luks, it locates the kernel and initrd inside it, and boots

https://wiki.archlinux.org/title/GRUB#Encrypted_/boot

the reason I don't do it is.. my laptop is buggy. often when I enable secure boot, something periodically gets corrupted (often when the laptop powers off due to low power) and when it gets up, it doesn't verify anything. slightly insane tech

however, this is still better than, at failure, letting anything run

sophisticated attackers will defeat this, but they can also add a variety of attacks at hardware level

Re: Lennart Poettering, Christian Brauner founded a new company

#328

Post by blibble »

graykey31 wrote: post #140

No. Esp with LP’s track record in systemd. See: “it’s just an init system”where it’s now also a resolver, log system, etc. I can buy good intentions, but this opens up too much possibility for not-so-good-intended consequences. Deliberate or emergent.

it's not just a resolver, log system, etc

it's a buggy-as-hell resolver, buggy-as-hell log system, buggy-as-hell ntp client, buggy-as-hell network manager, ...

Re: Lennart Poettering, Christian Brauner founded a new company

#329

Post by charcircuit »

LooseMarmoset wrote: post #262
Foxboron wrote: post #116

Earlier quoted context omitted.

> * Secure Boot (vendor-keyed deployments) I wish this myth would die at this point. Secure Boot allows you to enroll your own keys. This is part of the spec, and there are no shipped firmwares that prevents you from going through this process.

Android lets you put your own signed keys in on certain phones. For now. The banking apps still won't trust them, though. To add a quote from Lennart himself: "The OS configuration and state (i.e. /etc/ and /var/) must be encrypted, and authenticated before they are used. The encryption key should be bound to the TPM device; i.e system data should be locked to a security concept belonging to the system, not the user.…

Then work with the bank to prove the signer is trustworthy.

Re: Lennart Poettering, Christian Brauner founded a new company

#330

Post by marcthe12 »

direwolf20 wrote: post #245
NekkoDroid wrote: post #127

Earlier quoted context omitted.

The system owner. Usually that is the same entity that owns the secure boot keys, which can be the person that bought a device or another person if the buyer decides to delegate that responsibility (whether knowingly or unknowingly). In my case I am talking about myself. I prefer to actually know what is running on my systems and ensure that they are as I expect them to be and not that they may have been modified unb…

I don't think this is right. Usually, the entity that owns secure boot keys is a large tech corporation which paid to install their keys on all new computers.

You can enroll your own and LP goal is basically based on the assumption that you can enroll your own
Post reply on HN