Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

611–620 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#611

Post by jcgl »

Nextgrid wrote: post #392
Gigachad wrote: post #381

Earlier quoted context omitted.

Isn’t the idea that the kernel will verify anything beneath it. Secure boot verifies the kernel and then it’s in the hands of the kernel to keep verifying or not.

> the kernel will verify anything beneath it Yes that's the case - my argument is that Linux currently doesn't have anything standardized to do that. Your best bet for now is to use a read-only dm-verity-protected volume as the root partition, encode its hash in the initrd, combine kernel + initrd into a UKI and sign that . I would welcome a standardized approach.

Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together.

ParticleOS[0] gives a look at how this can all fit together, in case you want to see some of it in action.

[0] https://github.com/systemd/particleos

Re: Lennart Poettering, Christian Brauner founded a new company

#612

Post by jcgl »

magicalhippo wrote: post #606
jcgl wrote: post #588

Earlier quoted context omitted.

I'm not sure I understand why you think the solution proposed there is so bad. The question in that issue is around the semantics of time-sync. target . Targets are synchronization points for the system and don't (afaik) generally make promises about the units that are ordered before them (in this case chrony-wait.service. Does that answer your specific objection of "proposing that the solution to that is breaking Re…

No, that does not make sense, because it goes against the systemd documentation. Targets[1]: Target units do not offer any additional functionality on top of the generic functionality provided by units. They merely group units, allowing a single target name to be used in Wants= and Requires= settings to establish a dependency on a set of units defined by the target, and in Before= and After= settings to establish ord…

That seems like a fair point about the documentation! As far as I can see, you're right.

Re: Lennart Poettering, Christian Brauner founded a new company

#613

Post by drdaeman »

fc417fc802 wrote: post #607
drdaeman wrote: post #593

Earlier quoted context omitted.

I don’t think attestation can provide such guarantees. To best of my understanding, it won’t protect from any RCE, and it won’t protect from malicious updates to configuration files. It won’t let me run arbitrary binaries (putting a nail to any local development), or if it will - it would be a temporary security theater (as attackers would reuse the same processes to sign their malware). IDSes are sufficient for this…

I think all of that comes down to being a matter of what precisely you're attesting? So I'm not actually clear what we're talking about here. Given secure boot and a TPM you can remotely attest, using your own keys, that the system booted up to a known good state. What exactly that means though depends entirely on what you configured the image to contain. > it won’t protect from malicious updates to configuration fil…

Well, maybe we're talking about different things, because I've asked from a regular GNU/Linux user perspective. That is, I have my computers and I'm concerned I would lose my freedoms to use them as I wish, because this attestation would be adopted and become de-facto mandatory if I ever want to do something online. Just like what happened to mobile, and what's currently slowly happening to other desktop OSes.

Production servers are a whole different story - it's usually not my hardware to begin with. But given how things are mostly immutable those days (shipped as images rather than installed the old-fashioned sysadmin way), I'm not really sure what to think of it...

Re: Lennart Poettering, Christian Brauner founded a new company

#614

Post by cbarrick »

2pEXgD0fZ5cF wrote: post #500

Well I was wondering when the war on general computing and computer ownership would be carried into the heart of the open source ecosystems. Sure, there are sensible things that could be done with this. But given the background of the people involved, the fact that this is yet another clear profit-first gathering makes me incredibly pessimistic. This pessimism is made worse by reading the answers of the founders here…

> [T]he war on general computing and computer ownership [...] It is exhausting to see the hatred some have for people just owning their hardware.

The integrity of a system being verified/verifiable doesn't imply that the owner of the system doesn't get to control it.

This sort of e2e attestation seems really useful for enterprise or public infrastructure. Like, it'd be great to know that the ATMs or transit systems in my city had this level of system integrity.

You argument correctly points out that attestation tech can be used to restrict software freedom, but it also assumes that this company is actively pursuing those use cases. I don't think that is a given.

At the end of the day, as long as the owner of the hardware gets to control the keys, this seems like fantastic tech.

Re: Lennart Poettering, Christian Brauner founded a new company

#615

Post by fc417fc802 »

charcircuit wrote: post #608
fc417fc802 wrote: post #591

Earlier quoted context omitted.

Why should I need a separate device? Doesn't a hardware security token suffice? I wouldn't even mind bringing my own but my bank doesn't accept them last I checked. (Do any of them?) If the bank can't be bothered to either implement support for U2F or else clearly articulate why U2F isn't sufficient then they don't have a valid position. Anything else they say on the matter should be disregarded.

A hardware token would not suffice. When you login with a hardware token it will generate some sort of token or cookie for further requests. This is where malware can steal that key and use it for whatever it wants. There is a benefit it knowing there is a high chance that the such a key is protected by the operating system's sandboxing technology. Without remote attestation you don't know if the sandbox is actually…

On the contrary, a hardware token will suffice to thwart both phising and MitM which covers ~everything for all practical threat and liability models. What exactly is the concern here? A widespread worm that no one is yet aware of that's dumping people's bank accounts into crypto? It might make for a decent Hollywood plot but is pulling that off actually easier than attacking the bank directly?

Keep in mind that the businesses pushing this stuff still don't support U2F by and large. When I can go down in person to enroll a hardware token I might maybe consider listening to what they have to say on the subject. Maybe. (But probably not.)

Re: Lennart Poettering, Christian Brauner founded a new company

#616

Post by NewJazz »

Phelinofist wrote: post #457
NewJazz wrote: post #198

Hello Chris, I am glad to see these efforts are now under an independent firm rather than being directed by Microsoft. What is the ownership structure like? Where/who have you received funding from, and what is the plan for ongoing monetization of your work? Would you ever sell the company to Microsoft, Google, or Amazon? Thanks.

> Where/who have you received funding from I don't think you will ever get a response to that

It's pretty normal to say who leads your investing rounds is it not?

I'm not asking for a client list, to be clear.

Re: Lennart Poettering, Christian Brauner founded a new company

#617

Post by plagiarist »

NekkoDroid wrote: post #600
plagiarist wrote: post #537

Earlier quoted context omitted.

He really will just close a ticket because he disagrees with how Linux works. I read about systemd sysusers and thought they would be neat for running containerized services. But Poettering doesn't like the /etc/subuid files and refuses to work with them.

Well, he specifically doens't like the static allocation of subuids. There is a reason `systemd-nsresourced` exists.

How do I have nsresourced work in a regular systemd service or quadlet so that I can have an ephemeral user run a container? I am trying to find information and just seeing it as part of nsspawn, that seems to require a container specifically built around a root filesystem.

I am not going to struggle with systemd if I have to build containers specifically for it. If I have to rearrange everything I am doing I would just learn to do it on a minimal Kubernetes install instead.

Re: Lennart Poettering, Christian Brauner founded a new company

#618

Post by fc417fc802 »

drdaeman wrote: post #613
fc417fc802 wrote: post #607

Earlier quoted context omitted.

I think all of that comes down to being a matter of what precisely you're attesting? So I'm not actually clear what we're talking about here. Given secure boot and a TPM you can remotely attest, using your own keys, that the system booted up to a known good state. What exactly that means though depends entirely on what you configured the image to contain. > it won’t protect from malicious updates to configuration fil…

Well, maybe we're talking about different things, because I've asked from a regular GNU/Linux user perspective. That is, I have my computers and I'm concerned I would lose my freedoms to use them as I wish, because this attestation would be adopted and become de-facto mandatory if I ever want to do something online. Just like what happened to mobile, and what's currently slowly happening to other desktop OSes. Produc…

You originally asked what the value proposition for a regular (non-corporate) user was. Then you raised some objections to my answer (or at least so I thought).

Granted these technologies can also be abused. But that involves running third party binaries that require SGX or other DRM measures before they will unlock or decrypt content or etc. Or querying a security element to learn who signed the image that was originally booted. Devices that support those things are already widespread. I don't think that's what this project is supposed to be. (Although I could always be wrong. There's almost no detail provided.)

Re: Lennart Poettering, Christian Brauner founded a new company

#619

Post by direwolf20 »

chris_wot wrote: post #552
pseudohadamard wrote: post #442

Earlier quoted context omitted.

But what's it attesting? Their byline "Every system starts in a verified state and stays trusted over time" should be "Every system starts in a verified state of 8,000 yet-to-be-discovered vulns and stays in that vulnerable state over time". The figure is made up but see for example https://tuxcare.com/blog/the-linux-kernel-cve-flood-continue... . So what you're attesting is that all the bugs are still present, not t…

Well, if a rootkit gets installed later, attention might be handy? Or am I missing something?

It comes rootkitted from the factory, and if you remove the rootkit, the device stops working.
Post reply on HN