Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

581–590 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#581

Post by preisschild »

account42 wrote: post #546
surajrmal wrote: post #529

Earlier quoted context omitted.

Linux has been majority developed by large tech companies for the last 20+ years. If not for them, it would not be anywhere close to where it is today. You may not like this fact, but it's not really a new development nor something that can be described as infiltration. At the end of the day, maintaining software without being paid to do so is not generally sustainable.

Considering some of the changes to the ecosystem in the last 20 years it's not clear that this has made things better.

It is very clear that this has made things better

A lot more programs are available for linux, drivers and subsystems have gotten better, more features that benefit everyone (such as eBPF) and more

Re: Lennart Poettering, Christian Brauner founded a new company

#582

Post by fc417fc802 »

blacklion wrote: post #512
esjeon wrote: post #436

Earlier quoted context omitted.

Attestation is a critical feature for many H/W companies (e.g. IoT, robotics), and they struggle with finding security engineers who expertise in this area (disclaimer: I used to work as a operating system engineer + security engineer). Many distros are not only designed for desktop users, but also for industrial uses. If distros ship standardized packages in this area, it would help those companies a lot.

IoT and robotics should (dare I say "must"?) not use general-purpose OSes at all. This «Linux have a finger in every pie» attitude is very harmful for industry, IMHO.

Why shouldn't they use the kernel, systemd, and a few core utilities? Why reinvent the wheel? There's nothing requiring them to pull in a typical desktop userspace.

Re: Lennart Poettering, Christian Brauner founded a new company

#585

Post by fc417fc802 »

drdaeman wrote: post #379
cyphar wrote: post #51

Earlier quoted context omitted.

I'm Aleksa, one of the founding engineers. We will share more about this in the coming months but this is not the direction nor intention of what we are working on. The models we have in mind for attestation are very much based on users having full control of their keys. This is not just a matter of user freedom, in practice being able to do this is far more preferable for enterprises with strict security controls. I…

Can you (or someone) please tell what’s the point, for a regular GNU/Linux user, of having this thing you folks are working on? I can understand corporate use case - the person with access to the machine is not its owner, and corporation may want to ensure their property works the way they expect it to be. Not something I care about, personally. But when it’s a person using their own property, I don’t quite get the p…

The value is being able to easily and robustly verify that my device hasn't been compromised. Binding disk encryption keys to the TPM such that I don't need to enter a password but an adversary still can't get at the contents without a zero day.

Of course you can already do the above with secure boot coupled with a CPU that implements an fTPM. So I can't speak to the value of this project specifically, only build and boot integrity in general. For example I have no idea what they mean by the bullet "runtime integrity".

Re: Lennart Poettering, Christian Brauner founded a new company

#586

Post by ahepp »

blueflow wrote: post #450
ahepp wrote: post #369

Earlier quoted context omitted.

https://0pointer.net/blog/authenticated-boot-and-disk-encryp... Yes, system data should be locked to the system with a TPM. That way your system can refuse to boot if it's been modified to steal your user secrets.

... and it will also refuse to boot if it has been modified by the user. Preventing this was the reason we had free software in the first place.

Increasing security for the system owner will necessarily decrease the ability of others to modify the system in ways the owner doesn't like.

Re: Lennart Poettering, Christian Brauner founded a new company

#587

Post by brockers »

Remote attestation requires a great deal of trust... I know this comment is likely to be down-voted, but I can't think of a Lennart Poettering project that didn't try to extend, centralize, and conglomerate Linux with disastrous results in the short term; and less innovation, flexibility, and functionality in the long term. Trading the strength of Unix systems for goal of making them more "Microsoft" like.

Remote attestation requires a great deal of trust, and I simply don't have it when it comes to this leadership team.

Re: Lennart Poettering, Christian Brauner founded a new company

#588

Post by jcgl »

magicalhippo wrote: post #525
blibble wrote: post #252

Earlier quoted context omitted.

it's the "usually" that's the problem this service (untouched by me) had: After=local-fs.target network-online.target remote-fs.target time-sync.target but it was still started without an IP address, and then failed to bind just like this sort of problem: https://github.com/systemd/systemd/issues/4880#issuecomment-... the entire thing is unreliable and doesn't act like you'd expect > Or you can do something with Exec…

> https://github.com/systemd/systemd/issues/4880 I'm not a systemd hater or anything, but I continue to read stuff from Poettering which to me is deeply disturbing given the programs he works on. Saying it's not a bug that service is launched despite a stated required prerequisite dependency failed... WTF? Sure, I agree with him that most computers should probably boot despite NTP being unable to sync. But proposing…

I'm not sure I understand why you think the solution proposed there is so bad.

The question in that issue is around the semantics of time-sync.target. Targets are synchronization points for the system and don't (afaik) generally make promises about the units that are ordered before them (in this case chrony-wait.service.

Does that answer your specific objection of "proposing that the solution to that is breaking Requires is just wild to me"? Basically, what is proposed in that issue is not breaking Requires=. The proposition is that the user add their own, specific Requires= as a drop-in configuration since that's not a generally-applicable default.

Re: Lennart Poettering, Christian Brauner founded a new company

#589

Post by [deleted] »

PaulDavisThe1st wrote: post #358
dijit wrote: post #158

Earlier quoted context omitted.

You think? It took us nearly a decade and a half to unfuck the pulseaudio situation and finally arrive at a simple solution (pipewire). SystemD has a lot more people refining it down but a clean (under the hood) implementation probably won't be witnessed in my lifetime.

anyone who thinks that pipewire - pipewire! - is "a simple solution" understands nothing about pipewire. don't get me wrong, i use pipewire all day every day, and wrote one of the APIs (JACK) that it implements (pretty well, too!). but pipewire is an order of magnitude more complex than pulseaudio.

[deleted]

Re: Lennart Poettering, Christian Brauner founded a new company

#590

Post by jcgl »

direwolf20 wrote: post #238
jorvi wrote: post #235

Earlier quoted context omitted.

> like "at least one real IP address is available" or "time has been synced" "network-online.target is a target that actively waits until the network is “up”, where the definition of “up” is defined by the network management software. Usually it indicates a configured, routable IP address of some kind. Its primary purpose is to actively delay activation of services until the network has been set up." For time sync ch…

Is it possible for network-online to mean that, or does network-on actually mean that? It is possible for a specification to be so abstract that it's useless.

That's entirely defined by whatever units order themselves before network-online.target (normally a network management daemon like NetworkManager or systemd-networkd). systemd itself doesn't define the details; that's left up to how that distro and sysadmin have configured the network manager/system.
Post reply on HN