3 ms·

This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Signed code path from first boot to use

This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Signed code path from first boot to user space code. Remote attestation because you can NEVER trust the client. Microsoft and especially Apple are already doing this. Linux needs an answer, and "no, it's too user hostile" is NOT a valid answer; it will just make Linux an untenable security risk. It's like I keep saying, the Wild West 90s internet is long gone and nothing will bring it back. This is where things are headed, because the risks of the status quo are too great. Suck it up and get on with your life.

krzyk 4y ago
> This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Yeah, sure - in a fantasy dream world. But the real world has a bit more sophisticated cyberattackers that will find a way in. And at the same time normal and powerusers of computers will have to deal with all the total-control-state-class "security" measures. This looks pretty the same as "think of the children" censorship.
RalfWausE 4y ago
>the Wild West 90s internet is long gone and nothing will bring it back. This is where things are headed, because the risks of the status quo are too great. Suck it up and get on with your life. The "Wind West internet" is very much alive, but as it was in the 90s, its hidden and far away from the "normal" users. And regarding the part with the "suck it up and get on with your life" - I always was a "Don Quijote" type personality, i don't think i will change this attitude...
selfhoster11 4y ago
You don’t need signing, you need a way to make changing a boot path impossible by anyone who is not the user or the OS (or at least, tamper-evident on reboot). Simply storing hashes that are set on first boot (much like SSH does with known host hashes), and allowing the user/OS to reset the hashes, will be sufficient. M1 does this, as far as I know. > Remote attestation because you can NEVER trust the client. IRL, I don’t carry a weapon everywhere I go, because it’s clearly overkill. For this exact reason, overkill measures like remote attestation should not be a thing on general purpose computers.
0xdeadbeefbabe 4y ago
Lack of electricity is a cyberattack too.

krzyk 4y ago

> This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Yeah, sure - in a fantasy dream world. But the real world has a bit more sophisticated cyberattackers that will find a way in. And at the same time normal and powerusers of computers will have to deal with all the total-control-state-class "security" measures. This looks pretty the same as "think of the children" censorship.

RalfWausE 4y ago

>the Wild West 90s internet is long gone and nothing will bring it back. This is where things are headed, because the risks of the status quo are too great. Suck it up and get on with your life. The "Wind West internet" is very much alive, but as it was in the 90s, its hidden and far away from the "normal" users. And regarding the part with the "suck it up and get on with your life" - I always was a "Don Quijote" type personality, i don't think i will change this attitude...

selfhoster11 4y ago

You don’t need signing, you need a way to make changing a boot path impossible by anyone who is not the user or the OS (or at least, tamper-evident on reboot). Simply storing hashes that are set on first boot (much like SSH does with known host hashes), and allowing the user/OS to reset the hashes, will be sufficient. M1 does this, as far as I know. > Remote attestation because you can NEVER trust the client. IRL, I don’t carry a weapon everywhere I go, because it’s clearly overkill. For this exact reason, overkill measures like remote attestation should not be a thing on general purpose computers.

0xdeadbeefbabe 4y ago

Lack of electricity is a cyberattack too.