3 ms·

I am happy there is info on how to "liberate" these devices. The school's usecases are much more around having a locked down environment so that kids' systems c

by rtpg 3y ago

I am happy there is info on how to "liberate" these devices. The school's usecases are much more around having a locked down environment so that kids' systems can be recovered easily, and I don't know if just installing Ubuntu helps a lot with that use case. Given enterprise environments exist though, I do feel like there must be _some_ sort of setup that could be done to get a fairly robust environment. Especially if the kid's accounts are locked down enough. Bit of an OS distro problem, but the market might be there given what we're seeing here!

toast0 3y ago
Once you have a decent UEFI boot environment, I think you can install Chrome OS Flex. At that point, it's basically the same as Chrome OS, except you're missing out on boot security, which is maybe not enough for some environments, but should be good enough for many. I haven't done this yet, though. I've got an old chromebook that kind of half works (touchpad is dead) and I put FreeBSD on when I stopped using it for Chrome OS; a Chromebox that I bought to put Windows on (and now runs FreeBSD) and my current ChromeOS device just ran out of updates but is still in good shape (it's one of the ones in the list in the article); the write protect screw seems hard to get to, so I'm going to wait for the last build to be 6 months old or a scary vulnerability to come out before I take it apart. [1] https://chromeenterprise.google/os/chromeosflex/ https://chromeenterprise.google/os/chromeosflex/
WWLink 3y ago
> I am happy there is info on how to "liberate" these devices. The school's usecases are much more around having a locked down environment so that kids' systems can be recovered easily, and I don't know if just installing Ubuntu helps a lot with that use case. I know it's not practical, but man that sounds like a hell of a cop out. But that's where we are. I feel like with school computers the focus shouldn't be on locking them down but making them easy to restore if they get screwed up. And the students who do screw their computer up should be walked through fixing it. Actually they all should be walked through fixing it. That should be day 1 when the laptops are handed out with no OS on them.
- sdenton4 3y ago
  When I was a kid, they handed us a blank laptop and a Gentoo Stage-0 install CD. And we liked it!
  - mavhc 3y ago
    You had a CD? We had to flip switches to install the bootloader by hand. My security at school is: 1. Set bios password, 2. Set computer to only boot from FDE ssd, 3. Secure boot, 4. Filesystem ACL, 5. set to only run code from places users can't write to
- rtpg 3y ago
  IT professionals with a decade of experience routinely fuck up their own environments and struggle to fix it. Asking IT staff to walk thorough “fixing up” a borked Linux env (for example because some kid is half following some tutorial to get some weird thing working and in the process breaking repos) is a major ask. Having said that… yeah what I meant really is “have an easy way to reset it all”. This is what home directory partitions and the like are for, of course! And schools are not in the business of teaching kids how to install an OS to a laptop. There are real things to do in the world. Imagine being a kid who does not care about computers. You are now being asked to install an OS so you can use some word processor. What? Interested kids should have good outlets and ways to experiment (like these tech interns fixing the busted computers!), but really the point of giving kids computers is not to get them learning sysops
  - NoZebra120vClip 3y ago
    One time I got a bee in my bonnet about cross-grading my Ubuntu system from 32-bit to 64-bit. I blame Chris Siebenmann for linking me to the HOWTO article. Cross-grading is not for the faint of heart. It's the worst I've ever messed up any system, personal or at work. All kinds of things broke in novel ways, and it took me about 2 weeks to put it together again, which was a miraculous event in itself. I rejoiced when X and KDE were able to start again. And that's the price I paid to have an up-to-date system without reformatting.
xet7 3y ago
Here is info how I installed Debian to Chromebook: https://github.com/xet7/chromebook https://github.com/xet7/chromebook If it needs locking down, just not give root password to students. Manage them all with SaltStack etc.

by rtpg 3y ago

toast0 3y ago

Once you have a decent UEFI boot environment, I think you can install Chrome OS Flex. At that point, it's basically the same as Chrome OS, except you're missing out on boot security, which is maybe not enough for some environments, but should be good enough for many. I haven't done this yet, though. I've got an old chromebook that kind of half works (touchpad is dead) and I put FreeBSD on when I stopped using it for Chrome OS; a Chromebox that I bought to put Windows on (and now runs FreeBSD) and my current ChromeOS device just ran out of updates but is still in good shape (it's one of the ones in the list in the article); the write protect screw seems hard to get to, so I'm going to wait for the last build to be 6 months old or a scary vulnerability to come out before I take it apart. [1] https://chromeenterprise.google/os/chromeosflex/ https://chromeenterprise.google/os/chromeosflex/

WWLink 3y ago

> I am happy there is info on how to "liberate" these devices. The school's usecases are much more around having a locked down environment so that kids' systems can be recovered easily, and I don't know if just installing Ubuntu helps a lot with that use case. I know it's not practical, but man that sounds like a hell of a cop out. But that's where we are. I feel like with school computers the focus shouldn't be on locking them down but making them easy to restore if they get screwed up. And the students who do screw their computer up should be walked through fixing it. Actually they all should be walked through fixing it. That should be day 1 when the laptops are handed out with no OS on them.

sdenton4 3y ago
When I was a kid, they handed us a blank laptop and a Gentoo Stage-0 install CD. And we liked it!
- mavhc 3y ago
  You had a CD? We had to flip switches to install the bootloader by hand. My security at school is: 1. Set bios password, 2. Set computer to only boot from FDE ssd, 3. Secure boot, 4. Filesystem ACL, 5. set to only run code from places users can't write to
rtpg 3y ago
IT professionals with a decade of experience routinely fuck up their own environments and struggle to fix it. Asking IT staff to walk thorough “fixing up” a borked Linux env (for example because some kid is half following some tutorial to get some weird thing working and in the process breaking repos) is a major ask. Having said that… yeah what I meant really is “have an easy way to reset it all”. This is what home directory partitions and the like are for, of course! And schools are not in the business of teaching kids how to install an OS to a laptop. There are real things to do in the world. Imagine being a kid who does not care about computers. You are now being asked to install an OS so you can use some word processor. What? Interested kids should have good outlets and ways to experiment (like these tech interns fixing the busted computers!), but really the point of giving kids computers is not to get them learning sysops
- NoZebra120vClip 3y ago
  One time I got a bee in my bonnet about cross-grading my Ubuntu system from 32-bit to 64-bit. I blame Chris Siebenmann for linking me to the HOWTO article. Cross-grading is not for the faint of heart. It's the worst I've ever messed up any system, personal or at work. All kinds of things broke in novel ways, and it took me about 2 weeks to put it together again, which was a miraculous event in itself. I rejoiced when X and KDE were able to start again. And that's the price I paid to have an up-to-date system without reformatting.

xet7 3y ago

Here is info how I installed Debian to Chromebook: https://github.com/xet7/chromebook https://github.com/xet7/chromebook If it needs locking down, just not give root password to students. Manage them all with SaltStack etc.