289 karma · joined July 19, 2023
You're absolutely not the target audience of Arch Linux, nor this "Arch-like" Windows install guide.
Personally, I learned more about modern Linux userspace by following the Arch install process (and subsequently maintaining an Arch install for daily-driver use) than I ever did from 5+ years of using Ubuntu desktop.
But also, federal/state/municipal authorities do eminent seizure on private property all the time, when it is necessary for a larger public need. Forcing title holders to sell back their "water rights" and then putting them on level footing isn't that much different, is it?
I know it'll never happen because we live in the reality where everything must be awful all the time, but I'll continue dreaming of a day where large internet platforms are regarded and regulated as public utilities.
They run servers with no hard drives: https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infr...
No, I don't believe any of those p-hacked/biased stats that conveniently portray something, that is sold as BETA SOFTWARE by a company with a multi-billion market cap and a world-class marketing division, to be "safer" than an average driver.
FWIW I'm also not thrilled with the idea of the average person being permitted to get behind the wheel of a 5 tonne death machine, either.
> So maybe we should worry more about the average American?
As an outsider (Australian) watching the American empire decline so rapidly in recent years, I assure you I'm also quite worried about America, and the average American.
Your approach sounds pretty cool, by the way. I've thought about such an approach in the past, and I've used it for some auxiliary computers under my control, but not for my daily driver. I have a Framework laptop and I could indeed use this approach in quite a stylish way, though: https://frame.work/de/en/products/storage-expansion-card?v=F...
If a discrete TPM (separate chip on the mobo, rather than an fTPM which runs in the CPU/SoC) is in use, one can also use bus sniffing to pwn TPM protection: https://blog.scrt.ch/2021/11/15/tpm-sniffing/
As an example, Arch Wiki encourages you to bind to PCR 0+7: https://wiki.archlinux.org/title/Trusted_Platform_Module#sys... ... both of those are firmware-level PCRs, not OS ones.
Once you have physical access to a computer, the sky really is the limit on the kinds of exploits (both hardware and software) you can execute on an unsuspecting victim.
Disk password and no TPM binding? `dd` the entire contents of the victim's disk to an external disk. Then infect the bootloader so that the early initrd (which is responsible for that disk password prompt) will send the key to you as soon as network connectivity is established. Game over.
Secure boot? Pwn it with something like the technique I explained already.
Actually good secure boot (custom PK+MOK and a locked down BIOS config)? Pop the laptop lid, solder some wires (or in some cases, just a SOIC clip) to the BIOS flash chip (example: https://forum.phala.network/t/topic/2584), dump the BIOS, flash an insecure one, then do the same bootloader trick already described.
Of course depending on how hardened the computer being attacked it, the attacks get more sophisticated, but if someone is at the point where they're invading your physical boundaries and messing with your hardware in person, they're probably willing and capable to deploy fairly sophisticated attacks?
Gaining a shell using the technique in this article is functionally equivalent to the bypass Secure Boot -> boot live Linux scenario I described in parent comment.
The article notes that Windows "avoids" this issue by measuring into PCR11 as early as possible, but it stands to reason that any kind of exploit that is found in the windows boot flow that happens before this moment would be the same issue as the described Clevis+initrd issue.
But see my sibling comment about the possibilities of trivially bypassing Secure Boot.
It's also worth noting that, in 2016 when Linus shared this view, NVIDIA's market cap was 60B. It's now 1200B: https://www.macrotrends.net/stocks/charts/NVDA/nvidia/market...
At some point, when you have a trillion dollar entity acting in bad faith for that long, maybe your only option left (besides giving them the finger) is to pursue them in courts.
But IMO unless you run a very hardened setup, protecting against evil maid attacks (wherein the attacker has physical access to your machine in its entirety) is really hard, and possibly always will be. In a hardened setup you lock down the emergency initrd shell - either it's not allowed at all, or it uses a password which hopefully is a little more secure against an attacker pressing the Enter key a lot ;)
The real eye opener for me is what Ventoy can do. You can plug it into a computer with Secure Boot enabled, and it will give you a nice user-friendly way to just ... completely and trivially bypass Secure Boot protection. Yes, really: https://www.ventoy.net/en/doc_secure.html
It won't work for every mobo/firmware combo. It worked first try for me on some used Lenovo ThinkCentre M710q I bought on eBay, though. Even with the latest June 2023 BIOS installed.
Ventoy does this by using a known exploit in a GRUB shim that is signed with the official Microsoft certs (that ones that are embedded in virtually every mobo sold with Secure Boot support), in order to pop the KeyEnroll UEFI application and then enroll its own keys in there. Or something like that.
Sure, M$ put out a windows update ages ago that updates the DBX to prevent this particular signed shim with known vulnerabilities: https://support.microsoft.com/en-us/topic/kb5012170-security... ... but who knows how many more are out there in the wild?
Once you've pwned Secure Boot (and I'm making the case here that any script kiddy can do this on a vast majority of commonly available/used mobos, let alone a professional cybercrime gang/local LE division or, god-forbid, 3 letter agency), then you can simply pop in your favourite (Arch, obviously) Linux live USB and `cryptsetup open` your favourite encrypted drive in seconds.
For unattended machines, especially if you've already bothered to stick a Clevis in there, you really ought to blend your TPM ping with a SSS (min 2) one-two combo-punch of a Tang pin.
But again, if the attacker is literally sitting at your desk typing in your computer connected to your trusted networks and such, you're always gonna be pretty screwed.
> ... most straightforward ROMs I've used ...
ahem I believe GrapheneOS is an OS, and not a ROM... The project founder really wants you to use the "right" terminology: https://news.ycombinator.com/item?id=33567842 ;)
I'm currently leasing my Fairphone 4 from Commown, so I'm fairly sure it will go on to live a healthy and productive life elsewhere. I also purchased a used Pixel 6 Pro from eBay.
As per my comment elsewhere in this post, I'm switching away from Fairphone because I care more about the security and software-level ownership of my device. If GrapheneOS had support for Fairphone, I would have stuck with my FP4 for many years to come.
https://nl.linkedin.com/in/luca-weiss?trk=public_post_feed-r...
There would still be warranty periods. But the company would be required to indefinitely continue selling replacement parts, provide repair services (or support third party repair services with manuals, schematics, etc), issue security updates for critical vulnerabilities, etc.
https://support.fairphone.com/hc/en-us/articles/360047776791...
Also a different form factor, but look at what Framework laptops are doing. You can upgrade every part, including the mainboare, individually. If it's possible for an ultrabook form factor, it should be possible for a slate handset form factor (IMO)
Well obviously they can't back down on their promise to support FP4 for 5 years. But for example back in the FP2 era they went above and beyond and released Android 10 6 years after the release of the FP2. With more and more product lines to support, it seems less likely that such a thing would be feasible in future (limited resources and all that).
> Does the existence of a Fairphone 5 make any practical difference to an owner of an FP4? Or is it just the concern that some people will think, "Wah, this isn't the company's latest phone any more!" and upgrade sooner than they might otherwise?
A bit of both, I think.
The reality is a lot of consumers are still in the mindset that there's no problem with their individual behavior ("it's the fault of Exxon that our planet is doomed, not little ol' me buying a new phone every year!"). So Fairphone is enabling that bad behaviour, here.
Also, by matching the release cadence of the other companies, they're sending a signal that such a thing is okay (I think it isn't). Releasing "upgrade kits" that encourage consumers to extend the life of their handset by another couple of years, is a very different signal.
https://wiki.postmarketos.org/wiki/Fairphone_2_(fairphone-fp...
https://wiki.postmarketos.org/wiki/Fairphone_3_(fairphone-fp...
https://wiki.postmarketos.org/wiki/Fairphone_4_(fairphone-fp...
It's worth noting, however, that all of their newer flagships (based on a CPU design they have more control over) have guaranteed security updates for 5 years after release.
FWIW I despise Google and do my absolute best to avoid compensating them, but I do think things like their guaranteed security updates are a step in the right direction, and hopefully we can only get further improvements from here.
This announcement makes me even more sure of my choice, because it seems Fairphone are starting to lose their way.
One of the reasons I really liked the company in the past was their commitment to extend the longevity of their flagships. They released a "plus upgrade" kit for both the FP2 and the FP3.
To see them release a whole new flagship only a year or so after the FP4 release is ... a shame.
Flatly put, their products aren't very good when you compare them to the "big" vendors like Samsung/Apple/Google. What differentiates them is their commitment to environmental sustainability, un-sucking the rare-metals supply chain, etc. If they're going to release a new flagship every year, how does that make them any better (from a sustainbility POV) to the morally and ethically bankrupt companies they're competing with?
On the one hand, they have proven themselves in the past with things like working with the community to get Android 10 ported to the Fairphone 2 [1].
On the other hand, they always seem to be pretty behind on security updates. They got particularly eviscerated by the GrapheneOS project lead [2].
My hot take is Fairphone is a pretty small company that is trying to fill too many niches at once. It's great that they're working on making the supply chain for gold less awful ([3]). It's also great that they're continuing to prove that repairable / user-upgradeable flagship(-ish) phones are possible. I originally chose Fairphone for those reasons, because they align with my values.
Ultimately, though, I want a phone that I can rely on to be rock solid, secure, and highly usable. It's the thing I carry with me everywhere and rely on in emergencies, etc. To that end I recently ordered a used Pixel 6 Pro and plan to switch to that + GrapheneOS in the near future. I hope that Fairphone continues to succeed and help reform the (completely awful, IMO) mobile handset industry.
[1]: https://www.theverge.com/2021/11/23/22798512/fairphone-2-and... [2]: https://www.reddit.com/r/GrapheneOS/comments/10b5x4n/has_any... [3]: https://www.fairphone.com/en/2021/11/30/fairtrade-hirose/
Yes, this is why user-replaceable batteries (which mobile phones had for many years) are important. So much so that the EU has passed legislation to force the industry to do the right thing. [1]
> and keep it wrapped up in some huge case
Depends on your phone, but I believe there's plenty of reasonable options to protect your pocket computing device that aren't "some huge case". Further, you should always invest in a decent screen protector. Scratches and damage to the screen impacts the usability of a slate form factor smartphone (since other than one or two hardware buttons, the entirety of your interaction with the device takes place through the screen).
> Add into that knocks and bumps and scratches and they're basically junk by then.
Why does some scuffing on the edges of the bezels turn a device into "junk", for you?
[1]: https://www.theverge.com/2023/6/24/23771064/european-union-b...