Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

81–90 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#81

Post by dTal »

cyphar wrote: post #51
josephcsible wrote: post #39

This seems like the kind of technology that could make the problem described in https://www.gnu.org/philosophy/can-you-trust.en.html a lot worse. Do you have any plans for making sure it doesn't get used for that?

I'm Aleksa, one of the founding engineers. We will share more about this in the coming months but this is not the direction nor intention of what we are working on. The models we have in mind for attestation are very much based on users having full control of their keys. This is not just a matter of user freedom, in practice being able to do this is far more preferable for enterprises with strict security controls. I…

Thanks for the reassurance, the first ray of sunshine in this otherwise rather alarming thread. Your words ring true.

It would be a lot more reassuring if we knew what the business model actually was, or indeed anything else at all about this. I remain somewhat confused as to the purpose of this announcement when no actual information seems to be forthcoming. The negative reactions seen here were quite predictable, given the sensitive topic and the little information we do have.

Re: Lennart Poettering, Christian Brauner founded a new company

#82

Post by noosphr »

bayindirh wrote: post #72
noosphr wrote: post #71

Earlier quoted context omitted.

Nothing, but openbsd is amazing and just works. Anyone still using Linux on the desktop in 2026 should switch.

"Just don't use X" doesn't solve any problems in any space, unfortunately. Plus, it's an avoidant and reductionist take. Note: I have nothing against BSDs, but again, this is not the answer.

It works for me and for millions of others.

Stop trying to make everyone act like you act.

Re: Lennart Poettering, Christian Brauner founded a new company

#84

Post by bayindirh »

bri3d wrote: post #66
bayindirh wrote: post #61

Earlier quoted context omitted.

You're absolutely right , but considering Windows requirements drive the PC spec, this capability can be used to force Linux distributions in bad ways. So, some of the people doing "typical HN rage-posting about DRM" are also absolutely right . The capabilities locking down macOS and iOS and related hardware also can be used for good, but they are not used for that.

> but considering Windows requirements drive the PC spec, this capability can be used to force Linux distributions in bad ways What do you mean by this? Is the concern that systemd is suddenly going to require that users enable some kind of attestation functionality? That making attestation possible or easier is going to cause third parties to start requiring it for client machines running Linux? This doesn't even re…

Microsoft has a "minimum set of requirements" document about "Designed for Windows" PCs. You can't sell a machine with Windows or tell it's Windows compatible without complying with that checklist.

So, every PC sold to consumers is sanctioned by Microsoft. This list contains Secure Boot and TPM based requirements, too.

If Microsoft decides to eliminate enrollment of user keys and Secure Boot toggle, they can revoke current signing keys for "shims" and force Linux distributions to go full immutable to "sign" their bootloaders so they can boot. As said above, it's not something Amutable can control, but enable by proxy and by accident.

Look, I work in a datacenter, with a sizeable fleet. Being able to verify that fleet is desirable for some kinds of operations, I understand that. On the other hand, like every double edged sword, this can cut in both ways.

I just want to highlight that, that's all.

Re: Lennart Poettering, Christian Brauner founded a new company

#85

Post by cwillu »

DaanDeMeyer wrote: post #64
bayindirh wrote: post #58

Earlier quoted context omitted.

Hi Daan, Thanks for the answer. Let me ask you something close with a more blunt angle: Considering most of the tech is already present and shipping in the current systemd, what prevents our systems to become a immutable monolith like macOS or current Android with the flick of a switch? Or a more grave scenario: What prevents Microsoft from mandating removal of enrollment permissions for user keychains and Secure Boo…

So adding all of this technology will certainly make it more easy to be used for either good or bad. And it will certainly become possible to build an OS that will be less hackable than your run of the mill Linux distro. But we will never enforce using any of these features in systemd itself. It will always be up to the distro to enable and configure the system to become an immutable monolith. And I certainly don't t…

I would be _shocked_ if, conditional on your project being successful, this _wasn't_ commonly used to lock down computing abilities commonly taken for granted today. And I think you know this.

Re: Lennart Poettering, Christian Brauner founded a new company

#87

Post by Nextgrid »

toast0 wrote: post #73
microtonal wrote: post #45

Earlier quoted context omitted.

You won't believe how many hours we have lost troubleshooting SysV init and Upstart issues. systemd is so much better in every way, reliable parallel init with dependencies, proper handling of double forking, much easier to secure services ( systemd-analyze security ), proper timer handling (yay, no more cron), proper temporary file/directory handling, centralized logs, etc. It improves on about every level compared…

> systemd is so much better in every way, How can I cancel a systemd startup task that blocks the login prompt? / how is forcing me to wait for dhcp on a network interface that isn't even plugged in a better experience?

Your distribution has configured your GDM or Getty to have some dependency on something that ultimately waits on dhcpcd/network-online.target.

It’s not really the fault of systemd; it just enables new possibilities that were previously difficult/impossible and now the usage of said possibilities is surfacing problems.

Re: Lennart Poettering, Christian Brauner founded a new company

#88

Post by weinzierl »

Lennart will be involved with at least three events at FOSDEM on the coming weekend. The talks seem unrelated at first glance but maybe there will be an opportunity to learn more about his new endeavor.

https://fosdem.org/2026/schedule/speaker/lennart_poettering/

Re: Lennart Poettering, Christian Brauner founded a new company

#89

Post by bayindirh »

noosphr wrote: post #82
bayindirh wrote: post #72

Earlier quoted context omitted.

"Just don't use X" doesn't solve any problems in any space, unfortunately. Plus, it's an avoidant and reductionist take. Note: I have nothing against BSDs, but again, this is not the answer.

It works for me and for millions of others. Stop trying to make everyone act like you act.

I'm not trying to make everyone act like I act.

Also, I know. A few of my colleagues run {open, free, dragonfly}BSD as their daily drivers for more than two decades. Also, we have BSD based systems at a couple of places.

However, as a user of almost all mainstream OSes (at the same time, for different reasons), and planning to include OpenBSD to that roster (taking care of a fleet takes time), I'd love to everyone select the correct tool for their applications and don't throw stones at people who doesn't act like them.

Please remember that we all sit in houses made of glass before throwing things to others.

Oh, also please don't make assumptions about people you don't know.

Re: Lennart Poettering, Christian Brauner founded a new company

#90

Post by cwillu »

NekkoDroid wrote: post #62
s_dev wrote: post #59

Earlier quoted context omitted.

>We are building cryptographically verifiable integrity into Linux systems. Every system starts in a verified state and stays trusted over time. What problem does this solve for Linux or people who use Linux? Why is this different from me simply enabling encryption on the drive?

Drive encryption is only really securing your data at rest, not while the system is running. Ideally image based systems also use the kernels runtime integrity checking (e.g. dm-verity) to ensure that things are as they are expected to be.

“ensure that things are as they are expected to be” according to who, and for who's benefit? Certainly not the person sitting in front of the computer.
Post reply on HN