News for hackers. Stuff that matters.
Re:Desktop Linux Hardening by kelvie on Monday June 12, 2023 @01:04PM (#36296902)
Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on Framework, where I set this up from scratch.

Anyone can say what they want about chromeOS not being a real OS (I disagree, that's off-topic), but it was built to be secure-by-default -- at least with regard to basically everything in this article.

Even with a stock, up-to-date linux kernel (I use arch BTW), there are a ton of gotchas, such as the fact that lockdown mode disables hibernate (!)-- I needed to patch the kernel to tell it I know better (there are some good LWN articles on why they did it, it's cause there are far too many gotchas):

https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1...

Chromebook on Framework actually seems like a great value prop in this regard, but of course you have to sell your metadata to big G.

Re:Desktop Linux Hardening by 7speter on Monday June 12, 2023 @01:28PM (#36297398)
Most people disable hibernate because they use ssd’s for boot disks, no?
Re:Desktop Linux Hardening by kelvie on Monday June 12, 2023 @01:35PM (#36297571)
It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect:

1. The laptop to sleep 2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend 3. When I fire it up on monday, whatever I was working on is still there.

It's hard to do this without hibernate (or a _really_ efficient sleep).

You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).

Re:Desktop Linux Hardening by kogir on Monday June 12, 2023 @01:34PM (#36297539)
Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.
Re:Desktop Linux Hardening by patrick451 on Monday June 12, 2023 @02:28PM (#36298580)
Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.
Re:Desktop Linux Hardening by fn-mote on Monday June 12, 2023 @02:20PM (#36298418)
My power on self-test takes an order of magnitude longer than the whole rest of the boot process... so I sleep or hibernate whenever I can.
Re:Desktop Linux Hardening by rmellow on Monday June 12, 2023 @10:04PM (#36304204)
Lenovo?
Re:Desktop Linux Hardening by ndesaulniers on Monday June 12, 2023 @01:47PM (#36297816)
> I use arch BTW

Sigh you people...

Re:Desktop Linux Hardening by monsieurgaufre on Monday June 12, 2023 @02:36PM (#36298723)
Not to derail the thread, but i'm interested in your disagreement. It seemed really restricted for the few moments i played with it.
Re:Desktop Linux Hardening by kelvie on Monday June 12, 2023 @02:45PM (#36298901)
By default, yeah it's just running chrome on what sometimes seems like hardware that is overkill for it, but then you have:

https://support.google.com/chromebook/answer/9145439?hl=en

It runs a VM that runs LXC on it, and by default installs a debian container you get root to. They also created a X11/wayland bridge so that graphical apps work, even 3d acceleration to some degree, as well as volume mounts from the host, and USB passthrough.

I was able to use OpenSCAD on it.

You can even install containers of your choice, e.g.: https://wiki.archlinux.org/title/Chrome_OS_devices/Crostini

You get a full linux container inside your secure Chrome OS, the main limitation being that you have to use whatever kernel their presumably signed VM uses. All this without needing to disable secure boot or booting into a "developer" mode or whatever.

Re:Desktop Linux Hardening by monsieurgaufre on Monday June 12, 2023 @02:53PM (#36299049)
Thank you for the detailed answer. You're right. It is interesting.
Re:Desktop Linux Hardening by TommyTran732 on Monday June 12, 2023 @05:21PM (#36301334)
Note that encryption handling on ChromeOS is not that great at all. The wrapped encryption key is protected with the hardware id and user passphrase, and the passphrase gets sent to Google's server without client side hashing.

Essentially, anyone with access to Google's web servers and physical access to your hardware can just unlock and decrypt your device.