James Bottomley

misleading title: it’s not complicated, but you can make it complicated. Just use cc-by (sa or nd) and an osi approved foss license. A good read: https://blog.hansenpartnership.com/owning-your-own-copyrights-in-open-… or see https://blog.codeforscience.org/intellectual-property-in-open-projects… to keep it simple!

Just a weakly related comment here. When one talks about security, it's really hard for people to follow what she really means; the context has always been qualitative, but not quantitative. I found the idea "Vertical/Horizontal Attack Profile" interesting, which may help measure security when people argues different container solutions or even VMs. https://blog.hansenpartnership.com/measuring-the-horizontal-attack-pro…

> Which major distro allows using ZFS from its official installer…? That says more about the distributions than about ZFS’s fitness or maturity as a file system. It’s understandable that many distributions don’t bundle ZFS, since the licensing is still an open debate. Although that’s not so cut-and-dried [1], I wouldn’t expect broad support from distributions unless and until these issues have been tested and proved out one way or the other. No organization wants to insert themselves into a legal skirmish. The best (and probably only good thing) to come out of Ubuntu’s support for ZFS is the vote of confidence in favor of ZFS’s legality in-base from a major corporate entity. We can hope more distributions pick up on this, but I’m not holding my breath. But legal issues and technicalities say nothing at all about the relative technical merit of ZFS (or any other file system). > how many people use it as a filesystem for the linux root? Never seen anyone putting the main OS on zfs Quite a lot of users, actually. There’s a significant community around ZFS, including an ecosystem of some robust tooling. ZFSBootMenu is evidence enough that people want to run root on ZFS, and that root on ZFS is both feasible and highly desirable. Compare its feature list to what you can achieve with root-on-Btrfs, and ZFS pretty handily comes out ahead as the more powerful file system in terms of real world administrative capabilities. [1]…

For OEM to allow reinstall done "normally", yes. But DB entries can also contain SHA-256 hashes of the image to load (with the image stripped of the signature, which btw allows you to also resign it). https://blog.hansenpartnership.com/the-meaning-of-all-the-uefi-keys/ https://www.nsa.gov/Portals/70/documents/what-we-do/cybersecurity/prof…

This seems like FUD, people have analyzed the licensing, and the openzfs project is independent of any company. Would you say OpenJDK was murky? I don't think so. https://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/

James Bottomley navigated the bureaucracy and lived to tell about it: https://blog.hansenpartnership.com/adventures-in-microsoft-uefi-signin…

So you're implying that Oracle would use its standing as a Linux copyright holder to sue Canonical for violating the GPL by integrating the (Oracle copyrighted!) CDDL'd ZFS? On the one hand, I give points for the absurdity of the scenario -- and that it makes no sense would certainly not dissuade Oracle. But on the other hand, even this bizarre scenario is missing something that all of these litigation scenarios seem to lack: damages. James Bottomley explored this issue[1], and I continue to be amazed that others either ignore it or don't treat it explicitly, as it will be the first question that will be asked by any lawyer: where are the damages? I actually ask this earnestly: can those who fear litigation here at least take a swing at establishing the economic harm here? [1] http://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/

Here's the how-to to add your own keys. http://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform/

You can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection? 1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform/

Browsers toyed with the idea of using DNSSEC + DANE which would allow a website owner to use self-signed certificates and have them trusted just like commercial certificates. A DNS record (TLSA) would tell the browser how to deal with trusting the certificate, its public key or to validate the chain of certificates, etc: https://www.rfc-editor.org/rfc/rfc7671.html. This would have radically changed the landscape of certificate authorities and browser vendors. Google and Mozilla implemented it back in the day but changed directions. Among other issues, doing additional DNS lookups when you're trying to get the page on the screen as quickly as possible put the kibosh on things. Plus politics. Mind you, using DANE + TLSA is the defacto standard for Mail Transfer Agents to do secure email with each other but SMTP and HTTP have different security requirements. We may eventually get there, but there are political and technical hurdles to overcome when it comes to DNSSEC, which is required for DANE and all the rest. It's really taken off in parts of the European Union, South America, and Asia, but not so much in the US, where only about 25% of internet users are behind a DNSSEC-aware resolver: https://stats.dnssec-tools.org. The article DNSSEC, DANE and the failure of X.509 is a pretty good summary: https://blog.hansenpartnership.com/dnssec-dane-and-the-failure-of-x-50…

It's not always easy to do (and Microsoft could always exempt themselves from surface devices) - I think the spec only requires that it is possible, not that there is a nice dialog box in the bootloader to do it (unfortunately). You need to put the device into setup mode first, which should be possible by disabling secure boot then deleting the platform key. Then you can update the DB, then KEK and finally PK using keytool.efi. There's many guides on the process, see for example: https://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform… and https://www.rodsbooks.com/efi-bootloaders/controlling-sb.html. Specifically, what I'd do is: disable secure boot, copy shell.efi and keytool to the ESP, add a boot entry for the shell.efi entry, always useful, then boot to it, run keytool, clear the PK - voila you are in setup mode and should be able to change everything. Be aware that once you set a platform key, updates to any key database are checked for valid signatures. Updates to the KEK must be signed by PK, updates to the DB, DBX must be signed by the KEK, etc. If there's no dialog, you might also want to back up the keys, if you want to set the machine back to its factory default setting. I can imagine Microsoft might not have enabled this level of control for their surface devices, although as I understand their HCK, they should. Perhaps they exempt themselves :(

I keep hearing that the GPL and CDDL are incompatible. But repeating something doesn't make it true. And I have read both licenses, and have come to the conclusion that they're unlikely to be incompatible in the first place. Unfortunately, every time this line of argument come up, it tends to get buried in discussion. The basis of the incompatibility claim seems to be from 3 arguments: 1) Statements from the FSF website, but those have no legal bearing against the actual text of the licenses 2) Claims that the CDDL was engineered to be incompatible with the GPL, again, it's an interesting hypothesis but has little bearing against the actual text of the licenses 3) Derivative Work argument from the GPL. This seems to be the only one that could hold water; however, I doubt that a court would find ZFS to be derivative work of the Linux kernel. Furthermore, even if you argue that the "derviative work" clause makes them incompatible, there’s no way actually to prosecute such a violation. Copyright law is something called a tort in law, which means you have to show that someone violated the rules AND also caused quantifiable harm. What would our theory of harm be? (https://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/)

It's been a few years, but the main references I remember using: 1. Windows: https://github.com/frankmorgner/vsmartcard/tree/master/virtualsmartcar… which is a fix-up of the older https://www.codeproject.com/Articles/134010/An-UMDF-Driver-for-a-Virtu… and https://github.com/Watfaq/SoftU2F-Win/tree/master/SoftU2FDriver. Note that neither of these actually implement CTAP2. 2. Linux: There's plenty to refer to on HID gadgets, but https://blog.hansenpartnership.com/webauthn-in-linux-with-a-tpm-via-th… and the code at https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-ctap-gadget… were my entrypoint and cover the whole idea of WebAuthn in software. 3. Mac: I ended up not implementing a Mac version, but GitHub themselves used to support a CTAP1/U2F software authenticator, now archived at https://github.com/github/SoftU2F. I was going to work from that. For the service I looked at different software "devices" interfacing with these kinds of drivers (or just the browser directly in Firefox's case). 1. Generic NIST SP 800-73 PIV: https://github.com/CCob/PIVert. Very limited scope, pentest tool with no extraneous features. It uses the BixVReader driver. 2. U2F: Just the corresponding driver repos I think. 3. CTAP2: Firefox Soft Token code, https://github.com/ellerh/softfido, https://github.com/bulwarkid/virtual-fido (the one you found).