The creator of systemd wants your entire system validated by SecureBoot

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨namingthingsiseasy@programming.dev⁩ to ⁨technology@lemmy.world⁩

https://0pointer.net/blog/fitting-everything-together.html

The creator of systemd (Lennart Poettering) has recently created a new company dedicated to bringing hardware attestation to open source software.

What might this entail? A previous blog post could provide some clues:

So, let’s see how I would build a desktop OS. The trust chain matters, from the boot loader all the way to the apps. This means all code that is run must be cryptographically validated before it is run. This is in fact where big distributions currently fail pretty badly. This is a fault of current Linux distributions though, not of SecureBoot in general.

If this technology is successful, the end result could be that we would see our Linux laptops one day being as locked down as an Iphone or Android device.

There are lots of others who are equally concerned about this possibility: news.ycombinator.com/item?id=46784572

source

Comments

Sort:hotnew top

baronvonj@piefed.social ⁨3⁩ ⁨weeks⁩ ago
Because if there’s one thing Linux users think about their systems .. it’s “hey why does this thing let me do what I want?”

source
- breezeblock@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
  There’s a universe of difference between changes you intended to make in your system, and changes you didn’t intend because a state actor attacked you based on your social media criticism.
  
  Unlike with closed source software, you can always decide you don’t want your software to be secure.
  
  What you should be worried about is not software but hardware.
  
  source
- just_another_person@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  Uhhhh…wha?
  
  This would be a big deal for hardware manufacturers or product manufacturers in securing their devices. Only a tiny, tiny fraction of Linux users are just desktop jockeys.
  
  source
  - baronvonj@piefed.social ⁨3⁩ ⁨weeks⁩ ago
    I was referring to this
    
    If this technology is successful, the end result could be that we would see our Linux laptops one day being as locked down as an Iphone or Android device.
    
    source
    -> View More Comments
Brummbaer@pawb.social ⁨3⁩ ⁨weeks⁩ ago
I don’t trust Microsoft, why should I start trusting IBM/Canonical or Poettering now.

If the possibility is there they will happily lock you out of your own hardware.

source
- namingthingsiseasy@programming.dev ⁨3⁩ ⁨weeks⁩ ago
  I’ve made other comments before about how we used to cheer for Google back in the 00’s because they were the upstart that took on the entrenched competitors (Microsoft primarily). Look what Google has become today - the very thing we hoped they would destroy, and they are so much worse about it.
  
  Red Hat/IBM ultimately owned by the same people as Google: shareholders. Nothing will ever stand in the way of their greed. If this technology is allowed to exist, there’s no reason to think that it too will be used against our interests.
  
  source
cmnybo@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
Secureboot is worthless if the Microsoft keys are still enabled. It should only allow code that you sign yourself to boot.

source
- Godort@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
  If the end user can arbitrarily sign code themselves that is bootable then it kind of defeats the purpose of secure boot.
  
  The whole idea is that it makes it impossible to start if the chain of trust is broken.
  
  source
  - cmnybo@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
    It keeps someone from booting code that hasn’t been signed with my key. That’s the whole point of secure boot. If someone else has the key, then it’s not secure anymore.
    
    source
  - mech@feddit.org ⁨3⁩ ⁨weeks⁩ ago
    You’re arguing for protecting the PC from malicious changes made by you, the owner.
    This is corporate speak. Yes, it would make sense to lock down a PC like that in a corporate setting.
    For private use, the point is to secure the PC against malicious changes made by other people.
    In this case, signing code yourself is perfectly fine.
    
    source
  - nyan@lemmy.cafe ⁨3⁩ ⁨weeks⁩ ago
    The chain of trust starts with the owner of the hardware, not some random corporation that happens to make an OS. The owner can, if they wish, outsource the root of the chain of trust to a corporation, but that should be an active decision on their part, not something that happens just because the hardware was shipped with some random OS preloaded.
    
    source
    -> View More Comments
  - lmmarsano@group.lt ⁨2⁩ ⁨weeks⁩ ago
    
    If the end user can arbitrarily sign code themselves that is bootable then it kind of defeats the purpose of secure boot.
    
    They can & it doesn’t. They can change the platform key to become the platform owner & control the public keys they keep in the code signing databases. Secure Boot gives the platform owner control over authorized code signers of boot processes.
    
    source
tabular@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Who decides what SecureBoot considers trustworthy? If SecureBoot is controlled by someone else then it can be used against the user. The aversion to SecureBoot is justified.

source
- UnfortunateShort@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  It’s configurable.
  
  source
jollyrogue@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
This is needed. Servers need it, and it would be a nice feature to enable for personal systems. We would need to be able to build our own images with our own keys to really make this worthwhile. Especially with programs in my bin dir I’ve compiled or downloaded.

Do I trust Lennart to not do something asinine to turn this into a shit show? I do not. This would be better if it was someone who has security experience and system design cred.

source
- tomalley8342@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  I can’t imagine anyone sane would hold onto the belief that it will remain just “a nice feature to enable” after looking at the historical encroachment of commercial interests in mobile boot chain setups. I tell you the truth that after widespread adoption this WILL turn into a “not nice feature that you cannot disable”, and you can forget about enrolling your own keys as well.
  
  source
arcine@jlai.lu ⁨3⁩ ⁨weeks⁩ ago
The option of having a full auth trust chain would be nice for some security applications, but the implication that it could be made compulsory is terrifying.

source
- sunbeam60@feddit.uk ⁨3⁩ ⁨weeks⁩ ago
  It’s Linux. In what world do you imagine there wouldn’t be 87 forks that went in a different direction.
  
  Linux cannot be controlled, at least as it stands today.
  
  When Linux disappears I have some fears. But jerk as he may be, he’s also incredibly effective at keeping it open.
  
  source
  - vacuumflower@lemmy.sdf.org ⁨2⁩ ⁨weeks⁩ ago
    
    In what world do you imagine there wouldn’t be 87 forks that went in a different direction.
    
    In every world. Linux is not just the codebase, it’s all the developer work going into it daily. Hundreds of forks and downstreams can pick whichever direction they want, most of that work will still be directed one way.
    
    source
    -> View More Comments
- corsicanguppy@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
  It’ll start as an option and slide into compulsory later. It’s the Systemd way.
  
  source
  - arcine@jlai.lu ⁨2⁩ ⁨weeks⁩ ago
    I have no idea what life was like before systemd so while I like it I have no way to compare
    
    source
- Azzu@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
  You can already secure boot if you want. But like always, you gotta set it up yourself in a complicated manner :D
  
  source
  - arcine@jlai.lu ⁨2⁩ ⁨weeks⁩ ago
    Of course I use SecureBoot, if you know how to set it up it has no inconvenients ! But that doesn’t go all the way up to the apps !
    
    source
pHr34kY@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I wonder if this would allow an anti-cheat system to get acceptable trust of a system without having to access ring 0.

Of course, we’d then need the OS / kernel images to be signed. I think most gamers run stock kernels anyway.

I just don’t want see the garbage that is the Android Play Store where apps refuse to run because we run an OS that isn’t profitable to Google.

source
- namingthingsiseasy@programming.dev ⁨3⁩ ⁨weeks⁩ ago
  
  I just don’t want see the garbage that is the Android Play Store where apps refuse to run because we run an OS that isn’t profitable to Google.
  
  I think the possibility that this could happen is dangerously high.
  
  Everything starts with good intentions. Everything ultimately leads to locking end users out of their personal freedoms.
  
  source
  - leftzero@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago
    
    Everything starts with good intentions.
    
    No it doesn’t.
    
    When it comes to privacy, politics, and capitalism, almost nothing starts with good intentions.
    
    Most everything starts for the short term benefit of whoever starts it and any investors putting money into it, at the expense of everyone else and ignoring any future negative consequences unless profit can be extracted from them.
    
    It hurting people the starter doesn’t like (even if it will come back to hurt the starter in the long time) is also a very important factor, though secondary to the short term profit one.
    
    source
- xep@discuss.online ⁨3⁩ ⁨weeks⁩ ago
  Since the user is the one doing the cheating, most likely no, unfortunately.
  
  source
- thatonecoder@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
  Anti-cheats do NOT need to be client-side… Polar is server-sided, yet it has practically killed cheating in Minecraft.
  
  source
- cmhe@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  That would actually be the wrong thing to want. In an ideal system trust would always begin by the owner of the hardware, where possible, not the software or vendor they decide to trust.
  
  First the person that bought the system should take the ownership by overwriting the previous owners keys, and from there start signing the vendors key, they decide to put their trust in. Because it is important that the system is trustworthy to the end user/owner first.
  
  Any anti-cheat mechanism relies on not trusting the person that owns the hardware, and why would that be good?
  
  source
thatradomguy@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
An alternative to secureboot that isn’t secureboot but behaves like it. Wonderful 🙄

Another Poettering “masterpiece” ready to be gobbled up by his fanbase who will flock towards the new and shiny toy that forgoes the things that actually work fine or aren’t solving an actual problem with 99% of whatever it’s used by. Great 🙄 🙄 🙄

source
corsicanguppy@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
Fuck no. He’s fucking done enough.

I say that as a long-time Linux user, a developer and a security researcher. He’s set us back a decade with his metastatic cancer.

source
- maplesaga@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Explain like I’m five?
  
  source
AudaciousArmadillo@piefed.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
In the comments they clarify that is mostly targeted at servers and IoT first. In the enterprise world attestation is absolutely needed. And on personal devices? I’d be very happy if I had a secure boot chain for full disk encryption working out of the box. At least for portable devices…

source
RVGamer06@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
Can’t wait to not be able to VR game with my Nvidia GPU on Linux cuz they can’t be arsed to properly sign their damn proprietary drivers.

source
- jj4211@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Nvidia can’t meaningfully sign their Linux drivers. A distribution can, in theory, include Nvidia drivers in their build and sign it, but the logistics of out of tree drivers is just impossible.
  
  Redhat toys with the concept of a whitelisted ABI for some limited range of kernels, but I’ve never seen a driver actually roll with that.
  
  Basically Linux would need to embrace some form of ABI, and there’s been zero interest in doing so.
  
  source
raspberriesareyummy@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Oh wow. I thought I couldn’t despise that piece of shit any more than I already did. Fuck you, Lennart Poettering, may you burn in some fiery place in the afterlife you useless corporate lickspittle.

source
in_my_honest_opinion@piefed.social ⁨3⁩ ⁨weeks⁩ ago
Amutable are a gaggle of fucks

source
HubertManne@piefed.social ⁨2⁩ ⁨weeks⁩ ago
Im fine with anything that is gpl as long as its through the whole stack starting at hardware.

source
Lumisal@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Why not just expand on Libreboot instead?

source
mlg@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I forgot already but doesn’t he work for MSFT now?

I swear the moment he got a new job is when he came out with run0

source
- namingthingsiseasy@programming.dev ⁨3⁩ ⁨weeks⁩ ago
  He was there for a brief period. According to Wikipedia he was there from 2022-2026 and seems to have left to create his new company in early 2026.
  
  source
  - Telorand@reddthat.com ⁨3⁩ ⁨weeks⁩ ago
    Anyway, somebody working for Microsoft isn’t proof positive that they share the values of Microsoft (unless you’re in upper admin); you’re not guilty by association. People generally need to work to eat in this capitalist hellscape, and FOSS doesn’t tend to pay well.
    
    source
Retail4068@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
The anti MS morons who don’t understand secure boot and just regurgitating we hate this because it’s associated with them 🙄

source