5 ms·

Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on

by kelvie 3y ago

Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on Framework, where I set this up from scratch. Anyone can say what they want about chromeOS not being a real OS (I disagree, that's off-topic), but it was built to be secure-by-default -- at least with regard to basically everything in this article. Even with a stock, up-to-date linux kernel (I use arch BTW), there are a ton of gotchas, such as the fact that lockdown mode disables hibernate (!)-- I needed to patch the kernel to tell it I know better (there are some good LWN articles on why they did it, it's cause there are far too many gotchas): https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1350 https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1... Chromebook on Framework actually seems like a great value prop in this regard, but of course you have to sell your metadata to big G.

7speter 3y ago
Most people disable hibernate because they use ssd’s for boot disks, no?
- kogir 3y ago
  Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.
  - patrick451 3y ago
    Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.
- kelvie 3y ago
  It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect: 1. The laptop to sleep 2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend 3. When I fire it up on monday, whatever I was working on is still there. It's hard to do this without hibernate (or a _really_ efficient sleep). You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).
- fn-mote 3y ago
  My power on self-test takes an order of magnitude longer than the whole rest of the boot process... so I sleep or hibernate whenever I can.
  - rmellow 3y ago
    Lenovo?
ndesaulniers 3y ago
> I use arch BTW Sigh you people...
monsieurgaufre 3y ago
Not to derail the thread, but i'm interested in your disagreement. It seemed really restricted for the few moments i played with it.
- kelvie 3y ago
  By default, yeah it's just running chrome on what sometimes seems like hardware that is overkill for it, but then you have: https://support.google.com/chromebook/answer/9145439?hl=en https://support.google.com/chromebook/answer/9145439?hl=en It runs a VM that runs LXC on it, and by default installs a debian container you get root to. They also created a X11/wayland bridge so that graphical apps work, even 3d acceleration to some degree, as well as volume mounts from the host, and USB passthrough. I was able to use OpenSCAD on it. You can even install containers of your choice, e.g.: https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini You get a full linux container inside your secure Chrome OS, the main limitation being that you have to use whatever kernel their presumably signed VM uses. All this without needing to disable secure boot or booting into a "developer" mode or whatever.
  - monsieurgaufre 3y ago
    Thank you for the detailed answer. You're right. It is interesting.
TommyTran732 3y ago
Note that encryption handling on ChromeOS is not that great at all. The wrapped encryption key is protected with the hardware id and user passphrase, and the passphrase gets sent to Google's server without client side hashing. Essentially, anyone with access to Google's web servers and physical access to your hardware can just unlock and decrypt your device.

by kelvie 3y ago

7speter 3y ago

Most people disable hibernate because they use ssd’s for boot disks, no?

kogir 3y ago
Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.
- patrick451 3y ago
  Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.
kelvie 3y ago
It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect: 1. The laptop to sleep 2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend 3. When I fire it up on monday, whatever I was working on is still there. It's hard to do this without hibernate (or a _really_ efficient sleep). You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).
fn-mote 3y ago
My power on self-test takes an order of magnitude longer than the whole rest of the boot process... so I sleep or hibernate whenever I can.
- rmellow 3y ago
  Lenovo?

ndesaulniers 3y ago

> I use arch BTW Sigh you people...

monsieurgaufre 3y ago

Not to derail the thread, but i'm interested in your disagreement. It seemed really restricted for the few moments i played with it.

kelvie 3y ago
By default, yeah it's just running chrome on what sometimes seems like hardware that is overkill for it, but then you have: https://support.google.com/chromebook/answer/9145439?hl=en https://support.google.com/chromebook/answer/9145439?hl=en It runs a VM that runs LXC on it, and by default installs a debian container you get root to. They also created a X11/wayland bridge so that graphical apps work, even 3d acceleration to some degree, as well as volume mounts from the host, and USB passthrough. I was able to use OpenSCAD on it. You can even install containers of your choice, e.g.: https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini You get a full linux container inside your secure Chrome OS, the main limitation being that you have to use whatever kernel their presumably signed VM uses. All this without needing to disable secure boot or booting into a "developer" mode or whatever.
- monsieurgaufre 3y ago
  Thank you for the detailed answer. You're right. It is interesting.

TommyTran732 3y ago

Note that encryption handling on ChromeOS is not that great at all. The wrapped encryption key is protected with the hardware id and user passphrase, and the passphrase gets sent to Google's server without client side hashing. Essentially, anyone with access to Google's web servers and physical access to your hardware can just unlock and decrypt your device.