583 karma · joined October 7, 2019
[Verifying my OpenPGP key: openpgp4fpr:4BCF3BA4BE9FC8194C6FF7BC0A6BE3C9CD4A46F4]
To be honest, this is something I'd be willing to pay a lot of money for...
But regardless, this entire article is about how to have an actually secure boot on Linux (and not remote attestation), something which is certainly good for the user. Otherwise you're actually more easily susceptible to malicious actors stealing your data on the system you "trust". None of the steps listed here require trusting anyone other than the TPM (which is admittedly a flaw so long as we cannot audit them) and you can even use your own keys in pretty much all cases (provided -as discussed in other comments- MS hasn't f'd that up). I personally use a boot-stub based booting method with my own SB keys (but ironically, don't encrypt my root, so go figure), so I can vouch for the fact that it was actually quite painless to setup. Please don't jump down the slippery slope before you actually try these methods and realize that this is just as easy to deploy (you only need to disable secure boot first) and certainly a more secure option than using shim and an unsecured initrd.
Also, I don't understand where remote attestation entered the conversation here, and I also don't see why that can't be a community based thing (al la let's encrypt is now everyone's CA) where you can choose your providers or even roll it yourself.
I don't have any links on me at the moment but it shouldn't be too hard to find details on Google.
A 301 (or 302) redirect means setting the status code header to 301 and providing a location header with the place to redirect to. Last I checked GitHub doesn't allow any of this, or setting any other headers (like cache-control). To work around this, I've been putting cloudflare in front of my site which lets me use page rules to set redirects if necessary.
Also, type parameters were supposed to be included, but were dropped because it made the implementation more complex.
I will agree that the ergonomics of this method aren't perfect by any means. But what it does accomplish, is that it forces you to declare your dependency explicitly (which seems to be one of Go's underlying principles).
Having just checked their website, I'm pretty certain this hasn't happened yet.
It makes using fusion on wine really easy, and it runs surprisingly well too.
Judging from the current top comments, it seems the general sentiment is that this post is incorrect and ignores a number of points.