Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

511–520 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#511

Post by blibble »

jorvi wrote: post #503
blibble wrote: post #252

Earlier quoted context omitted.

it's the "usually" that's the problem this service (untouched by me) had: After=local-fs.target network-online.target remote-fs.target time-sync.target but it was still started without an IP address, and then failed to bind just like this sort of problem: https://github.com/systemd/systemd/issues/4880#issuecomment-... the entire thing is unreliable and doesn't act like you'd expect > Or you can do something with Exec…

Are you running this particular unit file as a user unit or a system unit? Some targets like network-online.target don't work from user unit files. You could also try targeting NetworkManager or networkd's "wait-online" services. Or if that doesn't work, something is telling systemd that you have an IP when you don't. NetworkManager has "ipv4.may-fail" and "ipv6.may-fail" that might be errenously true. > at that poin…

it's a system service file

the problem is systemd

> The difference is that systemd is much better at ensuring correctness.

yeah, whatever mate

Re: Lennart Poettering, Christian Brauner founded a new company

#512

Post by blacklion »

esjeon wrote: post #436
cferry wrote: post #367

Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…

Attestation is a critical feature for many H/W companies (e.g. IoT, robotics), and they struggle with finding security engineers who expertise in this area (disclaimer: I used to work as a operating system engineer + security engineer). Many distros are not only designed for desktop users, but also for industrial uses. If distros ship standardized packages in this area, it would help those companies a lot.

IoT and robotics should (dare I say "must"?) not use general-purpose OSes at all.

This «Linux have a finger in every pie» attitude is very harmful for industry, IMHO.

Re: Lennart Poettering, Christian Brauner founded a new company

#513

Post by LtWorf »

dijit wrote: post #157
stackghost wrote: post #48

Earlier quoted context omitted.

My thoughts exactly. We're probably witnessing the beginning of the end of linux users being able to run their own kernels. Soon: - your bank won't let you log in from an "insecure" device. - you won't be able to play videos on an "insecure" device. - you won't be able to play video games on an "insecure" device. And so on, and so forth.

Unfortunately the parent commenter is completely right. The attestation portion of those systems is happening on locked down devices, and if you gain ownership of the devices they no longer attest themselves. This is the curse of the duopoly of iOS and Android. BankID in Sweden will only run with one of these devices, they used to offer a card system but getting one seems to be impossible these days. So you're really…

I just received by mail a card to replace my soon expiring one… (not a debt card, the one to do internet banking and so on).

However the problem is that A LOT of things only work with the mobile app.

Re: Lennart Poettering, Christian Brauner founded a new company

#514

Post by iugtmkbdfil834 »

2pEXgD0fZ5cF wrote: post #500

Well I was wondering when the war on general computing and computer ownership would be carried into the heart of the open source ecosystems. Sure, there are sensible things that could be done with this. But given the background of the people involved, the fact that this is yet another clear profit-first gathering makes me incredibly pessimistic. This pessimism is made worse by reading the answers of the founders here…

Yeah, as I am reading the landing page, the direction seems clear. It sucks, because as an individual there is not much one can do, and there is no consensus that it is a bad thing ( and even if there was, how to counter it ). Honestly, there are times I feel lucky to be as dumb as I am. At least I don't have the same responsibility for my output as people who create foundational tech and code.

Re: Lennart Poettering, Christian Brauner founded a new company

#515

Post by jnwatson »

cferry wrote: post #367

Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…

It is already part of the most common Linux distribution, Android.

Re: Lennart Poettering, Christian Brauner founded a new company

#516

Post by iugtmkbdfil834 »

Joker_vD wrote: post #465
coppsilgold wrote: post #424

Earlier quoted context omitted.

It's a privacy consideration. If you desire to juggle multiple private profiles on a single device extreme care needs to be taken to ensure that at most one profile (the one tied to your real identity) has access to either attestation or DRM. Or better yet, have both permanently disabled. Hardware fingerprinting in general is a difficult thing to protect from - and in an active probing scenario where two apps try to…

Which is why I personally filed off the VIN from my car's engine.

I just put up 'do not track' flag in my browser:D

Re: Lennart Poettering, Christian Brauner founded a new company

#518

Post by trollbridge »

esjeon wrote: post #436
cferry wrote: post #367

Please don't bring attestation to common Linux distributions. This technology, by essence, moves trust to a third party distinct of the user. I don't see how it can be useful in any way to end users like most of us here. Its use by corporations has already caused too much damage and exclusion in the mobile landscape, and I don't want folks like us becoming pariahs in our own world, just because we want machines we bo…

Attestation is a critical feature for many H/W companies (e.g. IoT, robotics), and they struggle with finding security engineers who expertise in this area (disclaimer: I used to work as a operating system engineer + security engineer). Many distros are not only designed for desktop users, but also for industrial uses. If distros ship standardized packages in this area, it would help those companies a lot.

Then they can go and buy some other OS like VxWorks.

Re: Lennart Poettering, Christian Brauner founded a new company

#519

Post by password4321 »

wolvoleo wrote: post #483
esjeon wrote: post #436

Earlier quoted context omitted.

Attestation is a critical feature for many H/W companies (e.g. IoT, robotics), and they struggle with finding security engineers who expertise in this area (disclaimer: I used to work as a operating system engineer + security engineer). Many distros are not only designed for desktop users, but also for industrial uses. If distros ship standardized packages in this area, it would help those companies a lot.

This is the problem with Linux in general. It's way too much infiltrated by our adversaries from big tech industry. Look at all the kernel patch submissions. 90% are not users but big tech drones. Look at the Linux foundation board. It's the who's who of big tech. This is why I moved to the BSDs. Linux started as a grassroots project but turned commercial, the BSDs started commercial but are hardly still used as such…

> This is why I moved to the BSDs. Linux started as a grassroots project but turned commercial

Thanks, this may be the key takeaway from this discussion for me

Re: Lennart Poettering, Christian Brauner founded a new company

#520

Post by gorgoiler »

nextaccountic wrote: post #472
gorgoiler wrote: post #412

Earlier quoted context omitted.

I’d much rather have tamper detection. Encryption is great should the device is stolen but it feels like the wrong tool for defending against evil maids. All I’d want is that any time you open the case or touch the cold external ports (ie unbolted) you have to re-authenticate with a master password. I’m happy to use cabled peripherals to achieve this. Chaining trust from POST to login feels like trying to make a theo…

Encryption is just a baseline. Nobody should have unencrypted personal computers. You can have both full disk encryption AND a tamper protection!

Sorry, I wasn’t clear enough. We’re talking about three things here:

(1) Encryption: fast and fantastic, and a must-have for at-rest data protection.

It is vulnerable to password theft though. An attacker might insert evil code between power-on and disk-password-entry. With a locked down BIOS / UEFI, the only way to insert the code is to take the boot drive out of the device, modify it, put it back, and hope no one notices. “Noticing” in this case is done by either:

(2) Trust chaining: verify the signatures of the entire boot process to detect evil code.

(3) Tamper detection: verify the physical integrity of the device.

My point is that (1) is a given, and out of (2) or (3), I’d rather have the latter than deal with the shoddiness of the former

Post reply on HN