Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

41–50 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#41

This seems like the kind of technology that could make the problem described in https://www.gnu.org/philosophy/can-you-trust.en.html a lot worse. Do you have any plans for making sure it doesn't get used for that?

half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.

Re: Lennart Poettering, Christian Brauner founded a new company

#43
post #23

Can you share more details at this point about what you are trying to tackle as a first step?

As per the announcement, we’ll be building this over the next months and sharing more information as this rolls out. Much of the fundamentals can be extracted from Lennart’s posts and the talks from All Systems Go! over the last years.

I'm sorry, you're "happy to answer questions" and this is your reply to such a softball? What kind of questions will you answer? Favorite color?

Re: Lennart Poettering, Christian Brauner founded a new company

#44
post #2

So LP is or has left Microsoft ? >We are building cryptographically verifiable integrity into Linux systems I wonder what that means ? It could be a good thing, but I tend to think it could be a privacy nightmare depending on who controls the keys.

rust-vmm-based environment that verifies/authenticates an image before running ? Immutable VM (no FS, root dropper after setting up network, no or curated device), 'micro'-vm based on systemd ? vmm captures running kernel code/memory mapping before handing off to userland, checks periodically it hasn't changed ? Anything else on the state of the art of immutable/integrity-checking of VMs?

Re: Lennart Poettering, Christian Brauner founded a new company

#45
post #37

Hi Chris, One of the most grating pain points of the early versions of systemd was a general lack of humility, some would say rank arrogance, displayed by the project lead and his orbiters. Today systemd is in a state of "not great, not terrible" but it was (and in some circles still is) notorious for breaking peoples' linux installs, their workflows, and generally just causing a lot of headaches. The systemd project…

As someone who's lost many hours troubleshooting systemd failures, I would like an answer to this question, too.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services (systemd-analyze security), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc.

It improves on about every level compared to what came before. And no, nothing is perfect and you sometimes have to troubleshoot it.

Re: Lennart Poettering, Christian Brauner founded a new company

#46
The typical HN rage-posting about DRM aside, there's no reason that remote attestation can't be used in the opposite direction: to assert that a server is running only the exact code stack it claims to be, avoiding backdoors. This can even be used with fully open-source software, creating an opportunity for OSS cloud-hosted services which can guarantee that the OSS and the build running on the server match. This is a really cool opportunity for privacy advocates if leveraged correctly - the idea could be used to build something like Apple's Private Cloud Compute but even more open.

Re: Lennart Poettering, Christian Brauner founded a new company

#47

Hi Chris, One of the most grating pain points of the early versions of systemd was a general lack of humility, some would say rank arrogance, displayed by the project lead and his orbiters. Today systemd is in a state of "not great, not terrible" but it was (and in some circles still is) notorious for breaking peoples' linux installs, their workflows, and generally just causing a lot of headaches. The systemd project…

Thank you for this question, it perfectly captures something that I believe many would like answered.

Re: Lennart Poettering, Christian Brauner founded a new company

#48

This seems like the kind of technology that could make the problem described in https://www.gnu.org/philosophy/can-you-trust.en.html a lot worse. Do you have any plans for making sure it doesn't get used for that?

half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.

My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon:

- your bank won't let you log in from an "insecure" device.

- you won't be able to play videos on an "insecure" device.

- you won't be able to play video games on an "insecure" device.

And so on, and so forth.

Re: Lennart Poettering, Christian Brauner founded a new company

#50

Earlier quoted context omitted.

> Sounds like kernel mode DRM or some similarly unwanted bullshit. Look, I hate systemd just as much as the next guy - but how are you getting "DRM" out of this?

Remote attestation is literally a form of DRM

There are genuine positive applications for remote attestation. E.g., if you maintain a set of servers, you can verify that it runs the software it should be running (the software is not compromised). Or if you are running something similar to Apple's Private Compute Cloud to run models, users can verify that it is running the privacy-preserving image that it is claiming to be running.

There are also bad forms of remote attestation (like Google's variant that helps them let banks block you if you are running an alt-os). Those suck and should be rejected.

Edit: bri3d described what I mean better here: https://news.ycombinator.com/item?id=46785123

Post reply on HN