Matthew Garrett

"Interesting place, never heard of it before ..." The only reason I have ever heard of dreamwidth is because Matthew Garrett (mjg59) has his excellent blog there: http://mjg59.dreamwidth.org/ ... otherwise I don't think I ever see that domain anywhere ...

Existing systems are going to continue to boot. The expiry date is enforced for signing new binaries, not for deciding whether an already signed binary is allowed to boot (barring buggy firmware). https://mjg59.dreamwidth.org/72892.html (Secure boot certificate rollover is real but probably won't hurt you) https://wiki.debian.org/SecureBoot/CAChanges#OMG.21.21.21_Will_all_my_…

In 2012, Windows 8 stopped booting on computers without UEFI secure boot. Hardware companies weren’t enthusiastic, but they couldn’t ignore Microsoft’s demand. Microsoft published the spec for how Windows 8 would handle secure boot, and that included the crypto key that will be expiring in September. Microsoft’s spec did actually have provisions for non-Microsoft operating systems. Linux developers didn’t all agree about whether Linux needed to do anything about Microsoft’s plan, but ultimately a Red Hat programmer convinced enough people that it would be easier to follow Microsoft’s spec than to tell new users to “turn off secure boot” if they wanted to run Linux ( https://mjg59.dreamwidth.org/12368.html ). This wasn’t a popular decision, and it hasn’t become any more popular over time, but it has worked.

Apparently this is Matthew Garrett's blog. It contains one article. Looking at his more common blog, https://mjg59.dreamwidth.org/ ... it says he's moved to this one. Any particular reason he's no longer using Dreamwidth?

This is a FUD take. Are you griping about TPMs? I run Linux on every one of my personal machines and I run the software I want and I use my TPMs for useful things. I keep hearing this cry about hardware manufactures are coming for our hardware freedoms and I have seen one instance this year where Lenovo did some stupid stuff[1] on a specific piece of hardware. Now that I know that, I am not going to buy that specific hardware for my needs. If they follow onto their other models, I will find a hardware vendor that doesn't do stupid stuff. The market will adjust and you will have options like the Framework laptop to give you the freedom you want with your hardware. Also, even with the above stupid stuff, you can disable secure boot for now and move on with your life. 1: https://mjg59.dreamwidth.org/59931.html

I bet Matthew Garret of Linux Kernel fame is going to be ecstatic about this. https://mjg59.dreamwidth.org/

Reminds me of mjg's recent attack on Bird: https://mjg59.dreamwidth.org/53258.html > Digging through the code revealed 8 bytes worth of key fairly quickly, but the other 8 bytes were less obvious. I finally figured out that 4 more bytes were the value of another Bluetooth variable which could be simply read out by a client. The final 4 bytes were more confusing, because all the evidence made no sense. It looked like it came from passing the scooter serial number to atoi(), which converts an ASCII representation of a number to an integer. But this seemed wrong, because atoi() stops at the first non-numeric value and the scooter serial numbers all started with a letter[2]. It turned out that I was overthinking it and for the vast majority of scooters in the fleet, this section of the key was always "0".

The X210 from 51nb is a fantastic upgrade, with i5-8250u or i7-8550u processors, M.2 slot with NVME support, DisplayPort output, support for 32GB of RAM and eDP displays. I'm running NixOS on it as well. Matthew Garrett even ported Coreboot to it[1]. [1]: https://mjg59.dreamwidth.org/50924.html

Well, firstly, don't connect your machine to networks you don't trust the members of :) If your machine's manufacturer still supports the device, check if they have any firmware updates available. Hopefully they will have recent updates that include a fix for the AMT authn issue. If you want to disable it, Intel has provided a mitigation guide which has instructions on disabling LMS (which AMT is part of): https://downloadmirror.intel.com/26754/eng/Intel-SA-00075%20Mitigation… I've not had to follow it myself, good luck if you do :) I'm just repeating stuff I've read from MJG, take a look at his FAQ around this issue: https://mjg59.dreamwidth.org/48429.html

From http://mjg59.dreamwidth.org/48429.html > What do we not know? We have zero information about the vulnerability, other than that it allows unauthenticated access to AMT. One big thing that's not clear at the moment is whether this affects all AMT setups, setups that are in Small Business Mode, or setups that are in Enterprise Mode. If the latter, the impact on individual end-users will be basically zero - Enterprise Mode involves a bunch of effort to configure and nobody's doing that for their home systems. If it affects all systems, or just systems in Small Business Mode, things are likely to be worse. > What should I do? Make sure AMT is disabled. If it's your own computer, you should then have nothing else to worry about. If you're a Windows admin with untrusted users, you should also disable or uninstall LSM by following these instructions.

Canonical is attempting to use copyright law to enforce its trademark policy, at least according to mjg59. If you only work with upstream sources, that isn't a problem, but redistributing binaries is an important use case, especially with Docker. > Canonical assert that the act of compilation creates copyright over the binaries, and you may not redistribute those binaries unless (a) the license prevents Canonical from restricting redistribution (eg, the GPL), or (b) you follow the terms of their IP policy. This means that, no matter what Dustin's blogpost says, Canonical's position is that you must ask for permission before distributing any custom container images that contain Ubuntu binaries, even if you use no Ubuntu trademarks in the process. Doing so without their permission is an infringement of their copyright. https://mjg59.dreamwidth.org/37113.html

> As an aside, goddamn is UEFI ugly. You're goddamn right it is. Matthew Garrett [0] used to do UEFI stuff for -IIRC- RedHat. He has MANY blog posts about fucked-up parts of the spec, and horrifyingly fucked-up implementations of the same. Sadly, it looks like most (if not all) of his posts are now tagged "advogato, fedora", so I can't point you specifically to the UEFI gore posts. [0] http://mjg59.dreamwidth.org/

"If you are smart enough, you can spin anything towards the direction of your choosing." We see this all the time in online communities and we see it again with all this "hatred" against the Ubuntu community. Here is Mark Shuttleworth replying to Garret: http://mjg59.dreamwidth.org/38467.html?thread=1474883#cmt1474883 So Garret contacted Ubuntu for some unspecified project that he claimed he wanted to start. In reality, he was mining for quotes to misinterpret. Sad git.

A few followups: http://ebb.org/bkuhn/blog/2015/07/15/ubuntu-ip-policy.html https://mjg59.dreamwidth.org/35969.html http://jriddell.org/2015/07/15/ubuntu-policy-complies-with-gpl-but-fai…

> I read an article a couple of months back (like October-Novemberish 2014) about the NSA putting a virus into the firmware of a RAID controller on some Dell servers that would patch Windows Server 2003 (R2?) during startup. The NSA and the PRC will get their payloads signed with the appropriate keys. Everyone else will do something cheaper and simpler, like reading their target's gmail accounts. > So, while I am by no means a security expert, I have been wondering the same thing. The entire "Secure Boot" stuff just seems like a lame excuse to allow vendors control over what operating systems you can boot on their devices. Yes: http://mjg59.dreamwidth.org/20187.html [1] [1]: It's worth noting that mjg59 is a big secure boot fan, and did most/all of the Linux implementation.

That's a pretty good one! There are many ways for the bootloader to screw you even after it has passed control away from itself. I think my favorite similar story is when Matt Garrett discovered this on a Mac which forgot to shut off its wireless card's DMA controls before passing control into a UEFI client: http://mjg59.dreamwidth.org/11235.html

Look at the fine print when you contribute patches then. For individuals: http://www.canonical.com/sites/default/files/active/images/Canonical-H… 2.3 Outbound License Based on the grant of rights in Sections 2.1 and 2.2, if We include Your Contribution in a Material, We may license the Contribution under any license, including copyleft, permissive, commercial, or proprietary licenses. As a condition on the exercise of this right, We agree to also license the Contribution under the terms of the license or licenses which We are using for the Material on the Submission Date. Same goes for the entity license: http://www.canonical.com/sites/default/files/active/images/Canonical-H… You might also want to read the following: http://mjg59.dreamwidth.org/25376.html

it is absolutely not misinformed FUD, fedora is not using the linux foundation bootloader. Please read http://mjg59.dreamwidth.org/12368.html its the best document detailing the changes they are putting into place.

Err, why is this being downvoted? If anything, this should be pinned as the top comment. Anyway, thanks for an excellent and detailed technical take on the situation as opposed to the knee jerk bashing in many of the other posts. There's also some excellent detail in the below article without the histrionics. http://mjg59.dreamwidth.org/23400.html

Matthew’s earlier article “Why UEFI secure boot is difficult for Linux” is worth reading: http://mjg59.dreamwidth.org/9844.html

For those curious; kernel hacker Matthew Garrett wrote a great post on this subject: http://mjg59.dreamwidth.org/8705.html

> HN doesn't have a universal opinion about anything. That's a matter of perspective. I don't think a literal interpretation is useful. There will always be some troll promoting vile or insane things for attention (among other reasons). Functionally? The internet tends to ensure there is always some zeitgeist. Eg https://mjg59.dreamwidth.org/28232.html The world is a big pile of topics, including recent events and discoveries. Users don't see the most sacred cows or derided topics, because they are not promoted, flagged or otherwise down in the pile. This is common among most modern internet communities, as opposed to flat hierarchy formats like newsgroups. > HN commenters overall have pretty diverse opinions about those things I'm not as sure about that as you are, looking at another topic that's in the top 20 today - from https://news.ycombinator.com/item?id=39851564 * Snapchat has a long history of accusations regarding the damage to youth * I have no love for social media companies, but as a citizen of Ontario this is also not what I want my tax dollars going towards. * There's a lot more to be pissed off about, like the OTPP pissing away $95MM on FTX. (the closest thing to a defense, is whataboutism here) * If you work for/with these platforms, you are the baddie * Because no adult wants to provide ID to access normal websites with tracking tied unambiguously to their govt ID etc. [Edit] Not without irony, this Policing story was flagged.

The pervasiveness of secure boot has genuinely made things difficult for attackers - there'd have been no reason for the Black Lotus bootkit to jump through all the hoops it did if it weren't for secure boot, and the implementation of UEFI secure boot does make it possible to remediate in a way that wouldn't be the case without it. But secure boot at the OS level (in the PC world, at least) is basically guaranteed to give users the ability to enable or disable it, change the policy to something that uses their own keys, and ensure that the system runs the software they want. When applied to firmware, that's not the case - if Boot Guard (or AMD's equivalent, Platform Secure Boot) is enabled, you don't get to replace your firmware with code you control. There's still a threat here (we've seen firmware-level attacks for pre-Boot Guard systems), but the question is whether the security benefit is worth the loss of freedom. I wrote about this a while back (https://mjg59.dreamwidth.org/58424.html) but I lean towards thinking that in most cases the defaults are bad, and if users want to lock themselves into only using vendor firmware that's something that users should be able to opt into.

> It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years. I see this claim made over and over, yet we are still to see an actual "act of aggression" (modulo incompetence of an individual vendor - slip ups happen[0]). Every single PC system I ever heard of, allows either enrolling your own keys, or just disabling secure boot; most accept the MS-signed bootloader shim found in common desktop distros; I think this is even mandated in MS' specification that it must be possible for the users to bypass this. If you haven't had a trojan in the last 20 years, you have been diligent and/or lucky. Scattershot malware (cryptolockers, miners) is incredibly common, one of our customers was hit several times (on systems we weren't managing). More sophisticated attacks are an everyday thing against high-value targets[1][2]. Exploiting computer (in)security is a multi-billion dollar business, platforms far more locked down than PC are being routinely targeted and exploited. Real people, fighting for IRL freedom - journalists, activists, opposition politicians - are in danger. Please stop spreading the FUD against secure boot, and please back your claims with facts. [0]: https://mjg59.dreamwidth.org/59931.html https://news.ycombinator.com/item?id=32023868 [1]: https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-sour… [2]: https://xeiaso.net/blog/spearphishing

Something that I would offer that, though Purism does advertise, I do wish they would hit it home more, they give a lot to the FOSS community. No really, they give back A LOT. - Phosh, their phone shell, it being worked into upstream GNOME, and libhandy, which they started, is in upstream gtk4. GNOME Calls used to be a Purism app, now it is a GNOME app being maintained primarily by Purism. - Several of their full time staff are Debian Maintainers and Debian Developers. One of the full time staff is a Mobian Developer and is very active in maintaining/developing Mobian. - Purism has made a lot of effort to ensure that their applications and framework is available to the Pinephone, and to the greater community. Purism's work has helped advanced the Pinephone many times over. - Several Purism employees are active in the Pinephone community, and help out not only the devs, but users who need help! - For those that know my work (I have been working on MMS and VVM for the Pinephone/Librem 5), the Purism developers took a lot of time to help and mentor me so that I could get these features out there. They simply did not have to do that, but they did. I simply do not think those features would be available at all if it weren't for their help. (To those devs, I won't name you as I don't know if you want to be named, but you know who you are, You have my sincere gratitude.) - Their Coreboot efforts has enabled others to port coreboot to other laptops. Here is one example:…

The video starts off with a factual error: > MIT fired him from his job as a professor at the university He had no such job - he in fact emphatically left MIT employment (as research staff, he was never a professor) before starting GNU so that MIT wouldn't have a copyright claim on his work. He had an office at MIT, nonetheless, because he had politically powerful friends. See https://www.gnu.org/gnu/thegnuproject.en.html: "In January 1984 I quit my job at MIT and began writing GNU software. Leaving MIT was necessary so that MIT would not be able to interfere with distributing GNU as free software. If I had remained on the staff, MIT could have claimed to own the work, and could have imposed their own distribution terms, or even turned the work into a proprietary software package. I had no intention of doing a large amount of work only to see it become useless for its intended purpose: creating a new software-sharing community. However, Professor Winston, then the head of the MIT AI Lab, kindly invited me to keep using the lab's facilities." The speaker goes on to make these comments about what cancel culture teaches: > The other thing that cancel culture teaches that there's no forgiveness about anything, right? The minute you make a mistake, you are forever shunned by everyone else, and - that's wrong, that's completely antithetical to everything the free software movement is about. That's an excellent sign that what happened to RMS is not cancel culture - multiple…

The proposal talks a lot about using btrfs features, but there doesn't appear to be anything based on that. However if you look at the design goals, most of them have been implemented, although there is not yet wide usage. The best way to try this out in a runable desktop OS is probably Silverblue. https://silverblue.fedoraproject.org/ > We want a unified scheme, how we can install and update OS images, user apps, runtimes and frameworks. The storage backend for this is OSTree, using HTTP as the transport; it's analogous to Git for binary files and does not require special filesystem features, only hardlinks. https://ostree.readthedocs.io/en/latest/ > We want a unified scheme how you can relatively freely mix OS images, apps, runtimes and frameworks on the same system. Flatpak provides the abstraction layer for this; the base OS can be anything and the applications use only libraries from a Flatpak runtime; by default, Flatpak uses OSTree to store applications. Snap is similar, although it requires AppArmor, so can't run on many popular distros, and I think there's only one runtime that you're required to use, so no "mix and match". Docker is similar, although it can't handle desktop applications in a sensible manner (no sandbox). > We want a fully trusted system, where cryptographic verification of all executed code can be done, all the way to the firmware, as standard feature of the system. There are several points here: * firmware/pre-boot: [Edit: TPM can…

> Here is all of the stuff, filtered through Wikipedia's editorial process that is intended to eliminate unfounded personal opinion, stuff from unidentifiable sources, nonsense, and bias. Look, it isn't a hate parade; therefore there is no hate parade as M. Shuttleworth claimed. Actually, that Wikipedia link is not meant as evidence against Shutterworth's comments or in defense of my own. It's provided merely as context to those who are just now hearing about this situation. No, my comment regarding the lack of a hate parade is supported only by common sense. A position easily taken once one digs a bit deeper into this subject. You should click through some of the actual references mentioned in (and outside of) that Wikipedia article: Matthew Garrett's comments, http://mjg59.dreamwidth.org/25376.html Bradley Kuhn's comments, http://ebb.org/bkuhn/blog/2011/07/07/harmony-harmful.html Jonathan Riddell's comments, https://blogs.kde.org/2013/06/26/kubuntu-wont-be-switching-mir-or-xmir Aaron Seigo's comments, https://plus.google.com/+AaronSeigo/posts/76Nd9RSTZWp Then, tell me if these opinions or the community comments they generated actually seem hateful. In fact, the only substantial hate generated by this debacle was really in response to Canonical's unfounded swipe at Wayland, which was later retracted, and Shutterworth branding of opponents as "The Open Source Tea Party". And even that level of grandstanding only generated a modicum of hate from the community in…

I'm sorry, I was overreaching. Your reply seemed to support the OPs idea that Adria Richards was harassed for no reason by "MRA losers". >These are the people I'm talking about - the ones who've largely left this place behind because the tone of the community has shifted to one where any talk of race, gender, or even age (or in fact any talk of institutional problems in the industry) is automatically the work of professional victims (and a largely fictional narrative of a "social justice warrior") out to oppress techies. I won't deny that the MRA side is often reactionary, but you must admit that the "social justice" side is just as bad. The internet of today is designed for reactionism, makes it so easy to react and so easy to find controversial conversations. This is something I've noticed a lot - both sides are as bad as each other. Both claim to be better people, but both are so mired in faeces that they haven't even noticed they're throwing it themselves. (I've been up for 36 hours that's the best I can come up with). > (and a largely fictional narrative of a "social justice warrior") That's a very opinionated statement. Unfortunately, few agree on the definition of SJW, so everyone makes up their own. Pretending that there isn't a clique of 'progressives' in the tech world doing their best to cause trouble is just fantasy. Look at Adria's creepshot/dog whistling, the elevatorgate thing, that time Ben Noordhuis was forced out of the Node community because of a SJW…