Hacker News Reader

Comment by kelvie | Hacker News Reader

Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on Framework, where I set this up from scratch.

Anyone can say what they want about chromeOS not being a real OS (I disagree, that's off-topic), but it was built to be secure-by-default -- at least with regard to basically everything in this article.

Even with a stock, up-to-date linux kernel (I use arch BTW), there are a ton of gotchas, such as the fact that lockdown mode disables hibernate (!)-- I needed to patch the kernel to tell it I know better (there are some good LWN articles on why they did it, it's cause there are far too many gotchas):

https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1...

Chromebook on Framework actually seems like a great value prop in this regard, but of course you have to sell your metadata to big G.

View on HN

Note that encryption handling on ChromeOS is not that great at all. The wrapped encryption key is protected with the hardware id and user passphrase, and the passphrase gets sent to Google's server without client side hashing.

Essentially, anyone with access to Google's web servers and physical access to your hardware can just unlock and decrypt your device.

Not to derail the thread, but i'm interested in your disagreement. It seemed really restricted for the few moments i played with it.

By default, yeah it's just running chrome on what sometimes seems like hardware that is overkill for it, but then you have:

https://support.google.com/chromebook/answer/9145439?hl=en

It runs a VM that runs LXC on it, and by default installs a debian container you get root to. They also created a X11/wayland bridge so that graphical apps work, even 3d acceleration to some degree, as well as volume mounts from the host, and USB passthrough.

I was able to use OpenSCAD on it.

You can even install containers of your choice, e.g.: https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini

You get a full linux container inside your secure Chrome OS, the main limitation being that you have to use whatever kernel their presumably signed VM uses. All this without needing to disable secure boot or booting into a "developer" mode or whatever.

Thank you for the detailed answer. You're right. It is interesting.

Most people disable hibernate because they use ssd’s for boot disks, no?

Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.

Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.

It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect:

1. The laptop to sleep

2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend

3. When I fire it up on monday, whatever I was working on is still there.

It's hard to do this without hibernate (or a _really_ efficient sleep).

You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).

My power on self-test takes an order of magnitude longer than the whole rest of the boot process... so I sleep or hibernate whenever I can.

Lenovo?

> I use arch BTW

Sigh you people...

Reply on news.ycombinator.com