Hacker News Reader

Comment by bayindirh | Hacker News Reader

Hi Daan,

Thanks for the answer. Let me ask you something close with a more blunt angle:

Considering most of the tech is already present and shipping in the current systemd, what prevents our systems to become a immutable monolith like macOS or current Android with the flick of a switch?

Or a more grave scenario: What prevents Microsoft from mandating removal of enrollment permissions for user keychains and Secure Boot toggle, hence every Linux distribution has to go through Microsoft's blessing to be bootable?

View on HN

So adding all of this technology will certainly make it more easy to be used for either good or bad. And it will certainly become possible to build an OS that will be less hackable than your run of the mill Linux distro.

But we will never enforce using any of these features in systemd itself. It will always be up to the distro to enable and configure the system to become an immutable monolith. And I certainly don't think distributions like Fedora or Debian will ever go in that direction.

We don't really have any control over what Microsoft decides to do with Secure Boot. If they decide at one point to make Secure Boot reject any Linux distribution and hardware vendors prevent enrolling user owned keys, we're in just as much trouble as everyone else running Linux will be.

I doubt that will actually happen in practice though.

I would be _shocked_ if, conditional on your project being successful, this _wasn't_ commonly used to lock down computing abilities commonly taken for granted today. And I think you know this.

> So adding all of this technology will certainly make it more easy to be used for either good or bad.

Then maybe you shouldn't be doing it?

> we will never enforce using any of these features in systemd itself. It will always be up to the distro

So, plausible deniability. It's not the systemd project, it's the distro.

> I certainly don't think distributions like Fedora or Debian will ever go in that direction.

In the past they made decisions that we can call unexpected. I believe that in the short term future they won't but in say ten years? I'm not sure. The technology (created by Amutable?) will be mature by that time and ready to close Linux down.

Building stuff like this is wrong. You should find a different job.

Hopefully cartel regulation would prevent Microsoft from using their market leader position to force partners to remove all support for competitors.

But I'm losing hope with those.

> What prevents Microsoft from mandating removal of enrollment permissions for user keychains and Secure Boot toggle

Theoretically, nothing. But it's worth pointing out that so far they have actually done the opposite. They currently mandate that hardware vendors must allow you to enroll your own keys. There was a somewhat questionable move recently where they introduced a 'more secure by default' branding in which the 3rd party CA (used e.g. go sign shim for Linux) is disabled by default, but again, they mandated there must be an easy toggle to enable it. I don't begrudge them to much for it, because there have been multiple instances of SB bypass via 3rd party signed binaries.

All of this is to say: this is not a scenario I'm worried about today. Of course this may change down the line.

> today. Of course this may change down the line.

Given Microsoft's track record I don't believe this will stay that way for long.

> What prevents Microsoft from mandating removal of enrollment permissions for user keychains and Secure Boot toggle, hence every Linux distribution has to go through Microsoft's blessing to be bootable?

Why are you buying hardware that Microsoft controls if you're concerned about this?

With TPM, Microsoft controls practically all the Intel hardware.

Nothing, but openbsd is amazing and just works. Anyone still using Linux on the desktop in 2026 should switch.

"Just don't use X" doesn't solve any problems in any space, unfortunately.

Plus, it's an avoidant and reductionist take.

Note: I have nothing against BSDs, but again, this is not the answer.

It works for me and for millions of others.

Stop trying to make everyone act like you act.

> Stop trying to make everyone act like you act.

Yeah! Telling people what to do is rude!

> Anyone still using Linux on the desktop in 2026 should switch

Oh.

I'm not trying to make everyone act like I act.

Also, I know. A few of my colleagues run {open, free, dragonfly}BSD as their daily drivers for more than two decades. Also, we have BSD based systems at a couple of places.

However, as a user of almost all mainstream OSes (at the same time, for different reasons), and planning to include OpenBSD to that roster (taking care of a fleet takes time), I'd love to everyone select the correct tool for their applications and don't throw stones at people who doesn't act like them.

Please remember that we all sit in houses made of glass before throwing things to others.

Oh, also please don't make assumptions about people you don't know.

You could describe Richard Stallman as someone who refuses to use proprietary software because he sees using it as becoming complicit--however indirectly--in a technology ecosystem that violates the values he’s committed to.

"Just don't use X" is in fact a very engaged and principled response. Try again.

(I like OpenBSD, but) It is extremely hard to compete with Linux on hardware support / driver coverage.

I like the GPL for the kernel, so I wouldn't switch.

What should I do if I like AGPLv3 kernels?

then you'd have a write a new kernel

Reply on news.ycombinator.com