It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work. The next logical step is severely limiting internet traffic.

One dual-boots to a reputable Linux vendor’s signed/sealed OS image with secure boot enabled in BIOS, so that the attestations are valid; financially supports said vendor; contacts them quarterly with check-ins on the status of their lockdown+attestation roadmap and uses professional journalism approaches to highlight their (in/)action; and, contacts one’s relevant governing body to petition for the addition of that vendor’s signed/sealed product line to be added to the authorized signatures list by both government-sponsored apps and to the verification platforms of the competing vendors (in order to balance the necessities of attestations with an appropriate degree of anti-monopolistic protections for consumers).

> It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work

This confidence that ‘attestation doesn’t really work’ is the same sort of confidence that lead the Linux user community to largely scoff at, and ignore, attestation’s threat from when it was ballistically launched three decades ago towards the future. Options are now very limited for stopping it, and largely reduced to ‘getting some Linux into the approval list’. Severe compromises in user freedom will be required for the signed+sealed distro images to receive government approvals.

Imagine if Linux were an app on a video game console and you start to see the outcome: it’s a perfectly great working environment into which all of /usr/local and /opt and /home are writable, but the lockdown prevents you from modifying the OS in any way that could defeat the attestation protections. Apps you install into /opt can only access their own /opt/prefix, apps you install into /usr/local can access $HOME. The apps you install can choose to write session data (such as digital age verification certificates) to a system-protected /data store keyed first by the kernel’s signature, and second by the vendor signature the kernel reads from the app; with the understanding that an attestation latch-forward after an exploit patch will wipe that store, and that dual-booting to a different vendor will suspend access to sessions stored by that vendor.

This is, to climb on my hobby horse for a moment, why I continue to believe that Valve will be the first Linux vendor to receive government attestation approval alongside Apple / Google / Microsoft have previously across the desktop and mobile spaces. I’d really prefer that to be Graphene, Ubuntu, and Valve — but Graphene’s customer base is hostile to this, Ubuntu doesn’t have any incentive to care, and of the Linux vendors out there, Valve has a decade-long head start on the need for a locked-down and attested platform for business reasons. All of the above falls out naturally from considering how to defend one app from another on Android, iOS, Steam Deck, and Xbox. So far as I can tell today, though, Linux intends to be left out in the cold on all this. Oh well.

So, in the scenario posed (quoted above again for context) that I’m responding to, where the government has mandated attestation online, it seems like you’re arguing that Linux should continue to opt-out of attestation, and thus be forced into non-internet uses only. Do I misunderstand your intended outcome to the scenario here? I took for granted that Linux users would want to retain access to the internet as a critical priority, given how strongly they’re objecting to attestation of internet apps (and eventually internet access), but if I’m mistaken then I’m happy to reverse course!

Don't fall for the trap that all of this is inevitable, you have to try and resist it first.

Been resisting for years, since I learned of that first Intel presentation, as best as I knew how at each of the various life phases. At least for the last few years people started to pay attention as it starts to affect them personally, rather than just dismissing it as an implausible scenario back when it could have been stopped by regulations for the first twenty-five. Note that protesting through boycott requires not buying any big-three mobile phone or big-three video game console (each of these is a beachfront for widespread attestation), which is essentially a dealbreaker right out of the gate for most theoretical objectors. I remain hopeful that my cynical outlook will be disproven in outcome, but I also continue honing this high-level plan for any Linux that would ship sealed/signed OS images with gov't approval. One need not simply bet on red or black, after all!

This way we will just have unremovable age verification, spyware, online accounts to use the os, name another bs from other vendors. What's the point of Linux then? The moment big corps and the state can seal spyware into your computer, they'll happily do it.

I'd rather have a separate burn device with whatever os for state services which lives in a faraday cage most of the time and have a proper OS I control on the main device than give somebody control over it.

"Starting anaconda", "Enable Kdump", on anything RedHat.

Debian spews an ancient terminal window of options upon options and who knows how to install Arch.

Linux installations has never been click, click go. Installation wizards are still designed for the tech enabled and not the common user.

We have a helicopter on Mars yet they still can't master a installation wizard.

Unexpectedly, the 'bootable thumb drive' models are actually pretty great — not the installers, but the ones that boot straight into a GUI that works and is usable. I haven't used one as my personal Linux uses predated thumb drives, but I have always (mistakenly?) assumed that once you're booted into a liveCD, you can click 'Install on a drive partition' and it will actually do something coherent and GUI and reasonable. Have I been too optimistic? Probably, yeah :(

When you accept government gift in approval consider it tapped. At any point they can return to the vendor and go "install this". No? Okay bye to your certification.

Call me paranoid.

I bet you would, though, if the built OS image were 100% reproducible except for the signature. Once you have a fully reproducible Linux OS build, you can literally copy paste the cryptosig from the vendor and it will work with the image you built yourself from source that you inspected yourself. Then it’s impossible for the government to tap it without breaking the reproducible image checksum and thus the published cryptosig. It’s a better defense than any warrant canary would be, and it satisfies your concerns fully.

Arch shows only 15 packages left for their core OS to be built reproducibly; what I don’t see at their dashboard is the state of their ISO build reproducibility, but I imagine that’s the same as the core, so maybe it’s just unstated for obviousness. https://reproducible.archlinux.org/

Does GrapheneOS publish their repro build efforts as a dashboard anywhere?

Instructions to fully reproduce a build are here: https://grapheneos.org/build#reproducible-builds (disclaimer: I never tried using them).

CryptoSecure, depends how done but again, neither can be fully trusted when they were headed by government agencies in the past.

I don't trust Linux now that Microsoft got mits on it with WSL. RedHat sold-out to IBM and Debian got in bed with Canonical. Arch & Valve I might lead more too but then again I guess they've got to make money somehow.

I use FreeBSD and I don't trust that either unless I can do make install world.

They do with enterprise but not the way they do with consumers. There is no point selling data for ads on couple thousand servers for pennies when they make millions with licensing and support.

All the code microsoft, redhat and canonical contribute to linux is open source anyways.

Genuine question. That's news to me and I'm here.

It mostly happened already and it's in motion.

    - drop wireguard / OpenVPN packets crossing the country border
    - analyze https traffic to detect traffic patterns not matching https fully and block such connections

EDIT: I might be confusing vless/xray/reality but seems like there are no problems to block it based on ip reputation + tls fingerprint + amount of connections https://habr.com/ru/articles/1044396/

Of course this would block some valid websites but when has government cared about that

If you are willing to block browsing all ordinary web sites fronted with a CDN, then yes you can block reality/xhttp. You cannot, however, differentially block it via any of the three things you mentioned.

The government (any government) hates its citizens and the freedoms it had to allow them

I don’t think that will stop them trying though

[0]: https://www.birminghammail.co.uk/news/midlands-news/new-vpn-...

https://youtube.com/shorts/WvHl3G6KojI

I believe they're "doing research" into it, which basically means they don't understand how any of it works.

“Every time we see a Google Pixel, we suspect it might belong to a drug dealer,” said a police official leading the anti-drug operation in Catalonia.."

Seems like some countries/areas are already targeting the Pixel (really its because of GrapheneOS)

There's really something to be said for greedily signing up for most things and trying to get grandfathered before the zipcuffs tighten.

IRL, though, fuck this. Home depot added flock cams and broad facial recognition, grocery store installed turnstiles, haven't stepped foot in either since. I'm just dropping out of the IRL retail economy left and right.

I really, really, really dont understand why people keep avoiding saying the obvious.

DON'T TREAT YOUR PHONE AS YOUR PRIMARY ENTERTAINMENT DEVICE.

Have two phones. One is the real one. The one you use. The other one is the "cops and bank" phone.