3 ms·

This is not what's happening here. The systems don't have a disk, period. The bootloader downloads an OS image from a provisioning server into RAM that's verifi

This is not what's happening here. The systems don't have a disk, period. The bootloader downloads an OS image from a provisioning server into RAM that's verified and then run. Past the bootloader, the system doesn't have access to the provisioning server. Every program the server needs or may need to run at one point is already in memory. Outside of RAM there is nowhere to read more data from, not even a read-only disk, nor anywhere to write it to.

ignoramous 3y ago
If one is already running only "verified" (attested) code (with a read-only partition), diskless doesn't buy you much? Android, for example, does this: The system partition where the OS is remains immutable unless there's a signed update (or the bootloader is "unlocked").
- ziddoap 3y ago
  They briefly explain some of the reasoning here: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... >If the computer is powered off, moved or confiscated, there is no data to retrieve. >We get the operational benefits of having fewer breakable parts. Disks are among the components that break often. Therefore, switching away from them makes our infrastructure more reliable. >The operational tasks of setting up and upgrading package versions on servers become faster and easier. >Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved.
  - yjftsjthsd-h 3y ago
    Yeah, I don't have their opsec concerns but I'm very tempted to try implementing something similar just to enforce having a stateless system (easier to manage IMO) with a nice bonus of no longer caring about host disk failures.
lopkeny12ko 3y ago
This seems like a very roundabout and unnecessary solution to a problem that is already solved with tmpfs.
drexlspivey 3y ago
In such a setup where does the key to verify the image come from?
- ziddoap 3y ago
  More info about stboot is available here: https://www.system-transparency.org/ https://www.system-transparency.org/ and here:https://git.glasklar.is/system-transparency/core/system-transparency/#system-transparency-tooling https://git.glasklar.is/system-transparency/core/system-tran... The second link talks about network boot mode and signature validation.

ignoramous 3y ago

If one is already running only "verified" (attested) code (with a read-only partition), diskless doesn't buy you much? Android, for example, does this: The system partition where the OS is remains immutable unless there's a signed update (or the bootloader is "unlocked").

ziddoap 3y ago
They briefly explain some of the reasoning here: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... >If the computer is powered off, moved or confiscated, there is no data to retrieve. >We get the operational benefits of having fewer breakable parts. Disks are among the components that break often. Therefore, switching away from them makes our infrastructure more reliable. >The operational tasks of setting up and upgrading package versions on servers become faster and easier. >Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved.
- yjftsjthsd-h 3y ago
  Yeah, I don't have their opsec concerns but I'm very tempted to try implementing something similar just to enforce having a stateless system (easier to manage IMO) with a nice bonus of no longer caring about host disk failures.

lopkeny12ko 3y ago

This seems like a very roundabout and unnecessary solution to a problem that is already solved with tmpfs.

drexlspivey 3y ago

In such a setup where does the key to verify the image come from?

ziddoap 3y ago
More info about stboot is available here: https://www.system-transparency.org/ https://www.system-transparency.org/ and here:https://git.glasklar.is/system-transparency/core/system-transparency/#system-transparency-tooling https://git.glasklar.is/system-transparency/core/system-tran... The second link talks about network boot mode and signature validation.