7 ms·

As somone who never really viewed systemd as a problem I'm starting to think the systemd "haters" were actually right, at least somewhat... Viewing Poettering

As somone who never really viewed systemd as a problem I'm starting to think the systemd "haters" were actually right, at least somewhat... Viewing Poettering as some kind malicious entity undermining projects sounds like a conspiracy theory. But now with him working for Microsoft his actions do look like a lot like the "embrace, extend, and extinguish" pattern to me. Yes, yes "Microsoft <3 Linux", of course... And now I am supposed to cheer for the groundwork for the creation of an allmighty authority with the ability to "sanction" some (parts of) operating systems, but not others?

jart 4y ago
I always thought this outcome was obvious. Systemd controls everything that happens before Linux boots. It controls everything that happens after Linux boots. Might as well call it GNU/Systemd at this point. It's the silent revolution no one wanted. The name itself implies a manifest destiny because System D is 100x greater than System V and they intentionally break POSIX compliance too. Now that the guy who owns the systemd project works for Microsoft, in addition to the fact that the Linux kernel now needs to be a Windows executable in order to boot, that really tells you all you need to know.
- growse 4y ago
  No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.
  - recuter 4y ago
    For now.
  - mid-kid 4y ago
    This number diminishes every passing year, with only debian being a bastion of sanity on the "user friendly" side of the distro spectrum.
    - growse 4y ago
      Why do you think that is?
      - ddalex 4y ago
        Because more and more software developers use hard dependencies on SystemD making alternatives difficult to maintain ?
        Avamander 4y ago
        Because systemd has moved forward while the alternatives haven't. Systemd is not making the alternatives more difficult to maintain, the alternatives are more difficult and more difficult to maintain. Matter of perspective, really.
        ddalex 4y ago
        I disagree - SystemD has the approach of embrace-extend-extinguish, where it gobbles up services and turns them into their own hard dependency - from DNS to device managers, etc It's a very MS approach instead of a UNIX - do one job.
        Avamander 4y ago
        I don't think you're very familiar about the difference between systemd the project and systemd-* the different services under that project. They're not that coupled together, including the two you've just listed.
    - candiddevmike 4y ago
      Debian only supports systemd though? No sure what you mean by bastion in the context of systemd. Devuan is the Debian non-systemd fork.
      - mid-kid 4y ago
  - deleted 4y ago
    [deleted]
  - AshamedCaptain 4y ago
    This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.
    - growse 4y ago
      I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?
      - candiddevmike 4y ago
        There are quite a few instances[1] where adding your own signing keys bricks the device. [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_your_own_keys https://wiki.archlinux.org/title/Unified_Extensible_Firmware...
        growse 4y ago
        Huh, wasn't aware of that. Reading through, it looks like this is just talking about Microsoft "Secured-core" hardware, which seems to be hardware specifically marketed to provide a Microsoft-certified boot chain. I'm not sure that's the same thing as Microsoft making it harder in general for people to bring and use their own keys (or just turn it off altogether).
        Foxboron 4y ago
        It's a bit more complicated. The UEFI drivers and Linux distributions are signed by the same certificate, the "Microsoft 3rd party UEFI Certificate". UEFI Drivers can be Option ROM on the PCIe cards, commonly found of graphics cards. If you where to leave this certificate out of your boot chain, how would you validate this drivers? Well, you can't. This results in your not having any GPUs and your device is "bricked" until you can hopefully piggyback on something else. It's not really a proper brick. This is just a design flaw in my opinion. Microsoft taking the easy route for being the org responsible for signing UEFI code when there was no other options (LetsEncrypt wasnt a thing in 2010/2012). And I don't think Microsoft envisioned themselves in the position they are currently inn. There are workarounds though, you can read the drivers loaded during boot from the TPM Eventlog and enroll each driver into the approve list for Secure Boot (The `db` variable). But this isn't necessarily future proof if anything changes.
keikobadthebad 4y ago
This stuff predates poettering. If distros are going to support encrypted rootfs boot then it's better it is actually secure then... in the end locks are neutral so long as the locks on your stuff only accept keys you control.
noobermin 4y ago
Never attribute to malice what could be explained by... well Poettering isn't stupid really, he's clearly very talented and intelligent, but I don't think he's doing it with intent more than he doesn't really think ahead to what the system he's creating is turning into. Again, I'd say most of the developer world has this issue, just see the post a few days ago from the guy who volunteers to help elderly folks with their computers.
- blueflow 4y ago
  Its Foresight. Poettering is a able person, but lacks any foresight on what world he is creating.
  - bayindirh 4y ago
    Yeah, he's extremely satisfied by the things he accomplish, but he doesn't think (or care) about the effects of his accomplishments.
- candiddevmike 4y ago
  If I was Lennart I'd gladly go along with whatever evil scheme MS has in mind to exact my revenge on all the neckbeards that have attacked him over the years.
MisterTea 4y ago
Poettering's work is a love letter to windows xp.
sophacles 4y ago
I fail to see how the ability to have all the bits on my unencrypted uefi partition be signed is such a doom and gloom scenario. Having a world writeable initrd - that is an fs image with executables to be run as root before any other security settings have been enabled (etc) has always struck me as a bad idea. Yes I'm aware that this technology, like literally every other technology ever invented (from the pointy stick all the way up), can be used for evil. That is a human problem not a "this technology exists problem"... > ...the groundwork for the creation of an allmighty authority with the ability to "sanction" some (parts of) operating systems, but not others "We must backdoor/ban all crypto because imagine what the criminals would do with it!"
jacooper 4y ago
But the issue isn't the technology, its that Microsoft is the only trusted CA for secure boot. So if we want to actually change this, we should aim to create another CA, not attack sysD or secure boot(though its design is stupid to rely on Microsoft but it's too late now).
jeroenhd 4y ago
I don't see the problem. I want this tech. I paid good money for a laptop with a TPM and a secure UEFI config, let secure boot work for me instead of for Microsoft. I don't trust these groups or corporations so I'll stick to custom keys for this stuff, but I think having a working group with a signed boot loader is much better than the current situation (Microsoft signs a shim that basically bypasses secure boot on some devices and then Linux users set up a Rube Goldberg machine of 4 different levels of bootloader to get verified boot working). I'm running the MS shim right now and I don't see why the systemd shim would be worse in any way.

jart 4y ago

I always thought this outcome was obvious. Systemd controls everything that happens before Linux boots. It controls everything that happens after Linux boots. Might as well call it GNU/Systemd at this point. It's the silent revolution no one wanted. The name itself implies a manifest destiny because System D is 100x greater than System V and they intentionally break POSIX compliance too. Now that the guy who owns the systemd project works for Microsoft, in addition to the fact that the Linux kernel now needs to be a Windows executable in order to boot, that really tells you all you need to know.

growse 4y ago
No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.
- recuter 4y ago
  For now.
- mid-kid 4y ago
  This number diminishes every passing year, with only debian being a bastion of sanity on the "user friendly" side of the distro spectrum.
  - growse 4y ago
    Why do you think that is?
    - ddalex 4y ago
      Because more and more software developers use hard dependencies on SystemD making alternatives difficult to maintain ?
      - Avamander 4y ago
        Because systemd has moved forward while the alternatives haven't. Systemd is not making the alternatives more difficult to maintain, the alternatives are more difficult and more difficult to maintain. Matter of perspective, really.
        ddalex 4y ago
        I disagree - SystemD has the approach of embrace-extend-extinguish, where it gobbles up services and turns them into their own hard dependency - from DNS to device managers, etc It's a very MS approach instead of a UNIX - do one job.
        Avamander 4y ago
        I don't think you're very familiar about the difference between systemd the project and systemd-* the different services under that project. They're not that coupled together, including the two you've just listed.
  - candiddevmike 4y ago
    Debian only supports systemd though? No sure what you mean by bastion in the context of systemd. Devuan is the Debian non-systemd fork.
    - mid-kid 4y ago
- deleted 4y ago
  [deleted]
- AshamedCaptain 4y ago
  This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.
  - growse 4y ago
    I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?
    - candiddevmike 4y ago
      There are quite a few instances[1] where adding your own signing keys bricks the device. [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_your_own_keys https://wiki.archlinux.org/title/Unified_Extensible_Firmware...
      - growse 4y ago
        Huh, wasn't aware of that. Reading through, it looks like this is just talking about Microsoft "Secured-core" hardware, which seems to be hardware specifically marketed to provide a Microsoft-certified boot chain. I'm not sure that's the same thing as Microsoft making it harder in general for people to bring and use their own keys (or just turn it off altogether).
        Foxboron 4y ago
        It's a bit more complicated. The UEFI drivers and Linux distributions are signed by the same certificate, the "Microsoft 3rd party UEFI Certificate". UEFI Drivers can be Option ROM on the PCIe cards, commonly found of graphics cards. If you where to leave this certificate out of your boot chain, how would you validate this drivers? Well, you can't. This results in your not having any GPUs and your device is "bricked" until you can hopefully piggyback on something else. It's not really a proper brick. This is just a design flaw in my opinion. Microsoft taking the easy route for being the org responsible for signing UEFI code when there was no other options (LetsEncrypt wasnt a thing in 2010/2012). And I don't think Microsoft envisioned themselves in the position they are currently inn. There are workarounds though, you can read the drivers loaded during boot from the TPM Eventlog and enroll each driver into the approve list for Secure Boot (The `db` variable). But this isn't necessarily future proof if anything changes.

keikobadthebad 4y ago

This stuff predates poettering. If distros are going to support encrypted rootfs boot then it's better it is actually secure then... in the end locks are neutral so long as the locks on your stuff only accept keys you control.

noobermin 4y ago

Never attribute to malice what could be explained by... well Poettering isn't stupid really, he's clearly very talented and intelligent, but I don't think he's doing it with intent more than he doesn't really think ahead to what the system he's creating is turning into. Again, I'd say most of the developer world has this issue, just see the post a few days ago from the guy who volunteers to help elderly folks with their computers.

blueflow 4y ago
Its Foresight. Poettering is a able person, but lacks any foresight on what world he is creating.
- bayindirh 4y ago
  Yeah, he's extremely satisfied by the things he accomplish, but he doesn't think (or care) about the effects of his accomplishments.
candiddevmike 4y ago
If I was Lennart I'd gladly go along with whatever evil scheme MS has in mind to exact my revenge on all the neckbeards that have attacked him over the years.

MisterTea 4y ago

Poettering's work is a love letter to windows xp.

sophacles 4y ago

I fail to see how the ability to have all the bits on my unencrypted uefi partition be signed is such a doom and gloom scenario. Having a world writeable initrd - that is an fs image with executables to be run as root before any other security settings have been enabled (etc) has always struck me as a bad idea. Yes I'm aware that this technology, like literally every other technology ever invented (from the pointy stick all the way up), can be used for evil. That is a human problem not a "this technology exists problem"... > ...the groundwork for the creation of an allmighty authority with the ability to "sanction" some (parts of) operating systems, but not others "We must backdoor/ban all crypto because imagine what the criminals would do with it!"

jacooper 4y ago

But the issue isn't the technology, its that Microsoft is the only trusted CA for secure boot. So if we want to actually change this, we should aim to create another CA, not attack sysD or secure boot(though its design is stupid to rely on Microsoft but it's too late now).

jeroenhd 4y ago

I don't see the problem. I want this tech. I paid good money for a laptop with a TPM and a secure UEFI config, let secure boot work for me instead of for Microsoft. I don't trust these groups or corporations so I'll stick to custom keys for this stuff, but I think having a working group with a signed boot loader is much better than the current situation (Microsoft signs a shim that basically bypasses secure boot on some devices and then Linux users set up a Rube Goldberg machine of 4 different levels of bootloader to get verified boot working). I'm running the MS shim right now and I don't see why the systemd shim would be worse in any way.