Hacker News Reader

Comment by BirAdam | Hacker News Reader

Personally, I don't really care either way. I am more comfortable with sysv init because I used it far longer, and I can rock out with some shell, but systemd seems to work okay on any decently modern system.

My real issue is that Microsoft is now pushing toward TPM being required in Linux, they fund the Linux foundation and kernel development, they employ Lennart (afaik), and this feels very very much like their old "embrace, extend, extinguish" modus operandi. It also screams of the Halloween documents where Microsoft talked about needing to kill off open protocols.

Now, it's given that sysv is still around and could be used (is used by some distros still) in the event that systemd takes a bad road, but given how much stuff has become dependent upon it, that may not be easy. Likewise the code base of systemd has grown quite large so a fork would carry a very large maintenance burden.

View on HN

> Microsoft is now pushing toward TPM being required in Linux

Oh? I think you may be reading too much into what Microsoft has actually done here. How exactly could a TPM be required for Linux?

> It also screams of the Halloween documents where Microsoft talked about needing to kill off open protocols.

Wow this is a blast from the past! Almost twenty five years ago! I think it's fine to not like Windows (yep), even hate (somewhat irrationally, sure) Microsoft for the company they were, but a generation has passed since 1998. Maybe its time to find some new material.

> Oh? I think you may be reading too much into what Microsoft has actually done here. How exactly could a TPM be required for Linux?

Push hardware vendors to require it to boot OS or else they don't get certification for new windows release - same as they did with secure boot

> Push hardware vendors to require it to boot OS

AFAIK the requirement only applies to Windows? And hardware vendors care about working on Windows, news at 11. Show me where "Microsoft is now pushing toward TPM being required in Linux."

I fail to understand your's or the GP's point. I think you think "We got 'em!" On what? A vibes violation? A TPM, or something like a TPM, seems pretty sensible these days.

It moves process from "put any distro and just install it" to "open the bios, find the right options to change or disable and then you can actually install it".

Why would this even have to be the case? Linux will work on hardware with a TPM chip. It will also work on hardware without a TPM chip. If you're saying one day, some distro may choose not work on hardware without a TPM chip, take it up with that disto (in your imaginary future)? It's not Microsoft's problem?

> How exactly could a TPM be required for Linux?

"The laws of Australia will trump the laws of mathematics: Turnbull"

https://www.zdnet.com/article/the-laws-of-australia-will-tru...

Ahh, the government would mandate it? That sounds likely. /s

... Still doesn't have much to do with Microsoft?

If Microsoft didn't mandate TPMs for hardware running Windows 11 (or kept Windows 10 supported in parallel indefinitely), then governments wouldn't be able to pass such a law without potentially bricking the computers of millions of citizens.

I'm not expecting Microsoft to make a moral stand against TPMs, but they could at least have accidentally been on the right side just by not mandating TPM support.

You have to look at the incentives, though. If a government passed this law, it would put huge barriers in the way of people developing innovative new Linux distros, especially if, in practice, every distro had to pay a "tax" to Microsoft to have their signing keys whitelisted by device manufacturers.

Even if Microsoft didn't see this as a way to stifle niche OSes, industry groups (of which Microsoft is a member) would push for such laws just to prevent "software piracy", and of course Hollywood would push for the laws to prevent "media piracy". That would in turn raise demand for mainstream OSes, because those would be the only ones that could stream movies and music.

So when I suggest that the government would mandate it, that's in the context of a political climate where big businesses often write and lobby for laws which make it difficult for smaller competitors to challenge them. Whether Microsoft does that lobbying publicly, or privately, or via proxies, is somewhat immaterial to my argument.

> a generation has passed since 1998

And yet, many of the current senior management were there in 1998 and were obviously fine with it. Most of the rest joined shortly after and were obviously also fine with it.

And yet you should still get some new material. I don't like Windows and I still have bad taste in my mouth re: Microsoft from the 90s, but I/the world got over it. You should too.

> How exactly could a TPM be required for Linux?

Of course it would not be "required" required—so long as you're okay with maintaining your own distro, with forks of everything having essential TPM-based security features excised, working with your own builds of the kernel. Good luck selling this your employer.

> Of course it would not be "required" required

So, it's not literally true. It's just vibes, man. And I guess that's what disappoints me.

If lots of Linux people see TPM as a good thing that should be adopted in the major distros (not unlike systemd), because of the benefits, what's the problem?

> Good luck selling this your employer.

What are you selling exactly?

> Personally, I don't really care either way.

Perhaps you need to consider the possibility that the battle between systemd vs sysv init is not unrelated to the desire of Microsoft (and others) to lock down general purpose computers.

By giving Linux one tightly-coupled system that controls everything from the boot process to process permissions, it becomes much easier to add the missing "features" needed to implement such a lock down (and harder for distros to support "non-standard" configurations which slow the adoption of this).

This probably already sounds like a conspiracy theory, but I absolutely believe that intelligence agencies are eagerly awaiting the day they can convince governments to ban "insecure" computers from going online, where "insecure" means "not supporting Secure Boot attestations and not supporting an app blacklisting service like Gatekeeper[0]".

The existence of Linux (especially non-mainstream distros) is an impediment to a government introducing such a law right now, but if 90% of Linux users are running systemd, and users can install some future "systemd-gatekeeperd" with a couple of clicks, then no government will hear the cries of the greybeards who refuse to configure their machines this way.

Once the law is in place, the loopholes for distributing and running "unapproved" code will be slowly closed one by one, meaning fewer and fewer people will have access to apps/protocols like Tor, BitTorrent, E2EE messengers, and VPNs (unless those apps/protocols also include endpoint blacklists and do client-side scanning for illegal files).

[0] https://www.pcmag.com/news/apple-explains-why-it-grabs-data-...

The push for everything to go to HTTPS feels like it fits in here. I'm envisioning one day your browser just doesn't speak unencrypted HTTP and you can no longer bypass warnings for untrusted/self-signed certificates. You can't use a better browser or install/remove certificates as you please without illegal jailbreaking.

I'm not quite sure what the threat model is that you're suggesting. Are you imagining that a government will demand that browsers drop support for unencrypted HTTP? It would be simpler for that government to just demand that ISPs drop traffic on port 80 (or do deep packet inspection for a slightly more sophisticated approach).

But in any case, what's the danger with that? Are you worried that a government could tell all CAs not to issue certificates to "subversive" websites? Obviously there are jurisdictional problems with ordering CAs in foreign countries not to issue certificates, but I suppose a government could instead require that all browsers (within their jurisdiction) only trust certs from the government-run CA.

Those would certainly be bad outcomes, but if your threat model includes "the government controls what your browser can do" then I don't see how the situation is any worse due to widespread adoption of HTTPS. If the government is going to interfere with your browsing, then it's actually some consolation that other random attackers aren't also able to do that.

The only extra attack I can think of that mandatory TLS makes possible, is that this government which controls its citizens' browsers in this way could then put pressure on Let's Encrypt (via the US government?) to require ID information from all their users (and a similar rule for other CAs, which wouldn't be too hard as most of them require non-anonymous financial transactions). That still seems like a lot of unnecessary work for little benefit, though, surveilling web publishers when this government already controls its citizens' browsers.

Reply on news.ycombinator.com