Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

671–680 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#671

Post by lazide »

charcircuit wrote: post #644
direwolf20 wrote: post #628

Earlier quoted context omitted.

Hopefully not. What you have just said is a synonym for "But hopefully over time manufacturers will be able to completely prevent users from running unapproved software."

In the case of video game consoles that could be the case. It turned out that being able to run unapproved software results mainly in people playing pirated games. These security measures are reactive to the actions other people have taken. We already experimented with computing being the wild west where there was little to no security. It turned out that bad actors will abuse anything they can find. Even if it's not…

Huh? Why should people who pay for the hardware not be able to run whatever they want? Why include them as ‘attackers’?

Re: Lennart Poettering, Christian Brauner founded a new company

#672

Post by teddyh »

yjftsjthsd-h wrote: post #187
Foxboron wrote: post #116

Earlier quoted context omitted.

> * Secure Boot (vendor-keyed deployments) I wish this myth would die at this point. Secure Boot allows you to enroll your own keys. This is part of the spec, and there are no shipped firmwares that prevents you from going through this process.

> This is part of the spec, and there are no shipped firmwares that prevents you from going through this process. Microsoft required that users be able to enroll their own keys on x86. On ARM, they used to mandate that users could not enroll their own keys. That they later changed this does not erase the past. Also, I've anecdotally heard claims of buggy implementations that do in fact prevent users from changing sec…

“buggy”

Re: Lennart Poettering, Christian Brauner founded a new company

#673

Post by yjftsjthsd-h »

teddyh wrote: post #672
yjftsjthsd-h wrote: post #187

Earlier quoted context omitted.

> This is part of the spec, and there are no shipped firmwares that prevents you from going through this process. Microsoft required that users be able to enroll their own keys on x86. On ARM, they used to mandate that users could not enroll their own keys. That they later changed this does not erase the past. Also, I've anecdotally heard claims of buggy implementations that do in fact prevent users from changing sec…

“buggy”

Don't get me wrong, I'm happy to attribute a lot of malice to Microsoft, but in this case I really do believe that it was incompetence. Everything I've ever read about 90%+ of hardware vendors is that shipping hilariously broken firmware is an everyday occurrence for them.

(This is separate from Windows RT, of course)

Re: Lennart Poettering, Christian Brauner founded a new company

#674

Post by direwolf20 »

cbarrick wrote: post #668
curt15 wrote: post #659

Earlier quoted context omitted.

> At the end of the day, as long as the owner of the hardware gets to control the keys, this seems like fantastic tech. The problem is that there are powerful corporate and government interests who would love nothing more than to prevent users from controlling the keys for their own computers, and they can make their dream come true simply by passing a law. It may be the case that certain users want to ensure that th…

That's like saying we shouldn't build anything that can be used for good if it can also be used for evil. By that logic, we should just turn off the internet. Too much potential for evil there. More seriously, the argument being presented seems to just be "attestation tech has been used for evil in the past, therefore all attestation tech is bad," which is obviously an unsound argument. A sound argument would have to…

Attestation tech is much more useful for evil than for good.

Re: Lennart Poettering, Christian Brauner founded a new company

#675

Post by direwolf20 »

lazide wrote: post #671
charcircuit wrote: post #644

Earlier quoted context omitted.

In the case of video game consoles that could be the case. It turned out that being able to run unapproved software results mainly in people playing pirated games. These security measures are reactive to the actions other people have taken. We already experimented with computing being the wild west where there was little to no security. It turned out that bad actors will abuse anything they can find. Even if it's not…

Huh? Why should people who pay for the hardware not be able to run whatever they want? Why include them as ‘attackers’?

Shareholders über alles?

Re: Lennart Poettering, Christian Brauner founded a new company

#676

Post by curt15 »

cbarrick wrote: post #668
curt15 wrote: post #659

Earlier quoted context omitted.

> At the end of the day, as long as the owner of the hardware gets to control the keys, this seems like fantastic tech. The problem is that there are powerful corporate and government interests who would love nothing more than to prevent users from controlling the keys for their own computers, and they can make their dream come true simply by passing a law. It may be the case that certain users want to ensure that th…

That's like saying we shouldn't build anything that can be used for good if it can also be used for evil. By that logic, we should just turn off the internet. Too much potential for evil there. More seriously, the argument being presented seems to just be "attestation tech has been used for evil in the past, therefore all attestation tech is bad," which is obviously an unsound argument. A sound argument would have to…

>if I want e2e attestation of the software stack on my own devices, isn't this a good thing for me?

The building blocks are already there for a sufficiently motivated user to build their own verified OS image. Google has been doing that with ChromeOS for years. The danger I see is that once there is a low-friction, turnkey solution for locking down general purpose systems, then the battle for control over users' devices reduces to control over the keys. That is much easier for well-heeled interests to dominate than outlawing Linux outright.

The status quo is a large population of unverified but fully user-configurable systems. While the ideal end state is a large population of verified and fully user-configurable systems, it is more likely that the tools for achieving that outcome will be co-opted by corporate and political interests to bend the population toward verified and un-configurable systems. That outcome would be far worse than the status quo.

Re: Lennart Poettering, Christian Brauner founded a new company

#677

Post by magicalhippo »

jcgl wrote: post #658
magicalhippo wrote: post #647

Earlier quoted context omitted.

So that's why I find his statements disturbing. If he really don't want targets to deliver failed/success guarantees, then they've massively miscommunicated in their documentation. That in my book is a huge deal. In either case the issue should in no circumstance be casually dismissed as not-a-bug without further action.

I don't personally find it as disturbing as you do, I think. Which isn't to say that I don't think it should be fixed, etc. etc. I'm sure the project would accept a documentation patch to amend this discrepancy. At the end of the day (despite what some people on the internet might like to allege), systemd is a free software project that, despite having (more or less) a BIFL, is ultimately a relatively bazaar-like pro…

The disturbing part isn't the bug in time-sync.target or documentation, the disturbing part is how casually he brushes the issue away.

To me this is a huge red flag for a senior contributer to a core systems component, signalling some fundamental lack of understanding or imagination.

I very much disagree with not fixing time-sync.target, but if he had instead written a well-reasoned explanation for why time-sync.target should not propagate failed states and flagging it as a documentation bug, then that's something I'd respect and would be fine with. Or, even better IMHO, he'd fix time-sync.target and state that users who wants to boot regardless should use Wants instead.

Re: Lennart Poettering, Christian Brauner founded a new company

#678

Post by NekkoDroid »

plagiarist wrote: post #664
NekkoDroid wrote: post #642

Earlier quoted context omitted.

nspawn containers aren't really any different to regular system images/archives other than they don't need a kernel. I don't think the setting is exposed to regular service units (it might be able to in the future, I don't know) and I don't think podman has any integration with it. What kinda service do you have where you need a full range of UIDs?

I don't need a full range. I would just like to run podman under a non-root user using regular system services. Especially where a persistent volume or bind mount is involved. Let's say Home Assistant. It would be nice to have a have some system user "homeassistant" with no home directory that owns the process and owns its /var/whereever/config.conf . It would be nice to have the isolation on host in addition to the…

podman quadlet doesn't seem to support running at a "system level" as a non-root user, at least according to their docs[0]. I assume they make some assumptions which wouldn't hold up if the user actually changed when running at a system level, dunno.

> But I don't want to be rebuilding any containers to get that, unless I am misunderstanding something on nsresourced.

Setting up the user namespace would be part of the container manager and not the containers themselves, so they shouldn't need any rebuilding or special handling (possibly the files might need to be shifted into the "foreign ID" range[1, 2], but I might be lying with this and this isn't necessary for this usecase) but the container manager needs to be specifically make use of nsresourced.

I really think currently the best option is to go with either systemd as your "container manager" (e.g. just regular system files with sandboxing or nspawn images or maybe systemd-portabled[3]) or podman as your container manager. As much as I too would love to mix them, I don't think it's the best idea (at least in the current state) and just go with what is more suited for the task (in your case it sounds like podman would be the most suited option).

> there seems to be problems with informing systemd (as a non-root user) that the running process is different from the one it started.

Yea, I don't think systemd likes double forking. The best option would be to keep the process that spawned your actual process alive until the child exists and just bubble up the exit code. There is the `PIDFile=` option with `Type=forking`, but I haven't used it, nor looked much into it.

[0]: https://docs.podman.io/en/v5.7.1/markdown/podman-systemd.uni...

[1]: https://www.freedesktop.org/software/systemd/man/latest/syst...

[2]: https://systemd.io/UIDS-GIDS/#special-systemd-uid-ranges

[3]: https://systemd.io/PORTABLE_SERVICES/

Re: Lennart Poettering, Christian Brauner founded a new company

#679

Post by bri3d »

egorfine wrote: post #652
bri3d wrote: post #46

The typical HN rage-posting about DRM aside, there's no reason that remote attestation can't be used in the opposite direction: to assert that a server is running only the exact code stack it claims to be, avoiding backdoors. This can even be used with fully open-source software, creating an opportunity for OSS cloud-hosted services which can guarantee that the OSS and the build running on the server match. This is a…

> there's no reason that remote attestation can't be used in the opposite direction There is: corporate will fund this project and enforce its usage for their users not for the sake of the users and not for the sake of doing any good. What it will be used for is to bring you a walled garden into Linux and then slowly incentivize all software vendors to only support that variety of Linux. LP has a vast, vast experienc…

> There is: corporate will fund this project and enforce its usage for their users not for the sake of the users and not for the sake of doing any good.

I'd really love to see this scenario actually explained. The only place I could really see client-side desktop Linux remote attestation gaining any foothold is to satisfy anti-cheat for gaming, which might actually be a win in many ways.

> What it will be used for is to bring you a walled garden into Linux and then slowly incentivize all software vendors to only support that variety of Linux.

What walled garden? Where is the wall? Who owns the garden? What is the actual concrete scenario here?

> LP has a vast, vast experience in locking down users' freedom and locking down Linux.

What? You can still use all of the Linuxes you used to use? systemd is open source, open-application, and generally useful?

Like, I guess I could twist my brain into a vision where each Ubuntu release becomes an immutable rootfs.img and everyone installs overlays over the top of that, and maybe there's a way to attest that you left the integrity protection on, but I don't really see where this goes past that. There's no incentive to keep you from turning the integrity protection off (and no means to do so on PC hardware), and the issues in Android-land with "typical" vendors wanting attestation to interact with you are going to have to come to MacOS and Windows years before they'll look at Linux.

Re: Lennart Poettering, Christian Brauner founded a new company

#680

Post by NekkoDroid »

yjftsjthsd-h wrote: post #673
teddyh wrote: post #672

Earlier quoted context omitted.

“buggy”

Don't get me wrong, I'm happy to attribute a lot of malice to Microsoft, but in this case I really do believe that it was incompetence. Everything I've ever read about 90%+ of hardware vendors is that shipping hilariously broken firmware is an everyday occurrence for them. (This is separate from Windows RT, of course)

This reminds me of when I enrolled only my own keys into a gigabyte AB350 and I just soft-bricked it because presumably some opt-rom required MS keys.

I exchanged it for an Asrock board and there I can enable secure boot without MS keys and still have it boot cuz they actually let you choose what level of signing the opt-rom needs when you enable secure boot.

What I want to say with this is that it requires the company to actually care to provide a good experience.

Post reply on HN