Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

401–410 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#401

Post by PunchyHamster »

notepad0x90 wrote: post #383
cferry wrote: post #367

Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…

Please do, I disagree with this commenter. You already trust third parties, but there is no reason why that third party can't be the very same entity publishing the distribution. The role corporations play in attestation for the devices you speak of can be displaced by an open source developer, it doesn't need to require a paid certificate, just a trusted one. Furthermore, attestation should be optional at the hardwa…

see latest "MS just divilged disk encryption keys to govt" news to see why this is a horrid idea

Re: Lennart Poettering, Christian Brauner founded a new company

#402

Post by deknos »

quotemstr wrote: post #353

People demonize attestation. They should keep in mind that far from enslaving users, attestation actually enables some interesting, user-beneficial software shapes that wouldn't be possible otherwise. Hear me out. Imagine you're using a program hosted on some cloud service S. You send packets over the network; gears churn; you get some results back. What are the problems with such a service? You have no idea what S i…

> Attestation, secure enclaves, and other technologies create ways to distribute software that otherwise wouldn't exist. How many things are in the cloud solely to enforce access control? What if they didn't have to be?

To be honest, mainly companies need that. personal users do not need that. And additionally companies are NOT restrained by governments not to exploit customers as much as possible.

So... i also see it as enslaving users. And tell me, for many private persons, where does this actually give them for PRIVATE persons, NOT companies a net benefit?

Re: Lennart Poettering, Christian Brauner founded a new company

#403

Post by Nextgrid »

ahepp wrote: post #357
nextaccountic wrote: post #327

Earlier quoted context omitted.

here is some actual security: encrypted /boot, encrypted everything other than the boot loader (grub in this case) sign grub with your own keys (some motherboards let you to do so). don't let random things signed by microsoft to boot (it defeats the whole point) so you have grub in an efi partition, it passes secure boot, loads, and attempts to unlock a luks partition with the user provided passphrase. if it passed s…

Doing secure boot properly is kind of difficult. There are a bunch of TPM measurement registers for various bits and bobs (kernel, initramfs, cmdline, lots more). Using UKIs simplifies it a lot, but it’s not trivial to do right at the moment.

Secure Boot and TPM are separate things. The current Secure Boot policy gets measured by the TPM but that's about it.

Re: Lennart Poettering, Christian Brauner founded a new company

#404

Post by deknos »

bri3d wrote: post #46

The typical HN rage-posting about DRM aside, there's no reason that remote attestation can't be used in the opposite direction: to assert that a server is running only the exact code stack it claims to be, avoiding backdoors. This can even be used with fully open-source software, creating an opportunity for OSS cloud-hosted services which can guarantee that the OSS and the build running on the server match. This is a…

WHAT is the usage and benefit for private users? This is always neglected.

avoiding backdoors as a private person you always can only solve with having the hardware at your place, because hardware ALWAYS can have backdoors, because hardware vendors do not fix their shit.

From my point of view it ONLY gives control and possibilities to large organizations like governments and companies. which in turn use it to control citizens

Re: Lennart Poettering, Christian Brauner founded a new company

#406

Post by JasonADrury »

stackghost wrote: post #48
enriquto wrote: post #41

Earlier quoted context omitted.

half of the founders of this thing come from Microsoft. I suppose this makes the answer to your question obvious.

My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.

Is the joke here that all of those things have already been happening for a while now?

Re: Lennart Poettering, Christian Brauner founded a new company

#407

Post by cferry »

notepad0x90 wrote: post #383
cferry wrote: post #367

Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…

Please do, I disagree with this commenter. You already trust third parties, but there is no reason why that third party can't be the very same entity publishing the distribution. The role corporations play in attestation for the devices you speak of can be displaced by an open source developer, it doesn't need to require a paid certificate, just a trusted one. Furthermore, attestation should be optional at the hardwa…

Whoever uses this seeks to ensure a certain kind of behavior on a machine they typically don't own (in the legal sense of it). So of course you can make it optional. But then software that depends on it, like your banking Electron app or your Steam game, will refuse to run... so as the user, you don't really have a choice.

I would love to use that technology to do reverse attestation, and require the server that handles my personal data to behave a certain way, like obeying the privacy policy terms of the EULA and not using my data to train LLMs if I so opted out. Something tells me that's not going to happen...

Re: Lennart Poettering, Christian Brauner founded a new company

#408

Post by no_time »

Terrible idea, I hope go bankrupt.

I can see like a 100 ways this can make computing worse for 99% people and like 1-2 scenarios where it might actually be useful.

Like if the politicians pushing for chat control/on device scanning of data come knocking again and actually go through (they can try infinitely) tech like this will really be "useful". Oops your device cannot produce a valid attestation, no internet for you.

Re: Lennart Poettering, Christian Brauner founded a new company

#410

Post by vbezhenar »

Nextgrid wrote: post #98
MarkusWandel wrote: post #78

My only experience with Linux secure boot so far.... I wasn't even aware that it was secure booted. And I needed to run something (I think it was the Displaylink driver) that needs to jam itself into the kernel. And the convoluted process to do it failed (it's packaged for Ubuntu but I was installing it on a slightly outdated Fedora system). What, this part is only needed for secure boot? I'm not sec... oh. So go bac…

Secure Boot only extends the chain of trust from your firmware down the first UEFI binary it loads. Currently SB is effectively useless because it will at best authenticate your kernel but the initrd and subsequent userspace (including programs that run as root) are unverified and can be replaced by malicious alternatives. Secure Boot as it stands right now in the Linux world is effectively an annoyance that’s only t…

It is not useless. I'm using UKI, so initrd is built into the kernel binary and signed. I'm not using bootloader, so UEFI checks my kernel signature. My userspace is encrypted and key is stored in TPM, so the whole boot chain is verified.
Post reply on HN