Foxboron

It does. Manually checking a couple of AUR packages is easy. Installing a thousand AUR packages is not something anyone should be doing.

> I'm assuming people are using the AUR to install programs that are sufficiently complex and the idea one can trivially audit a complex program and all of its dependencies is foolish. The foolishness of that expectation scales with the number of complex programs installed.

Nobody is asking them to do that. The premise is that the `PKGBUILD` and auxillary files provided by the AUR should be checked.

> The idea that users should "just check the source code every single time" has never been, nor will it ever be, a reasonable solution to supply chain attacks.

Again, nobody is asking anyone to do this.

How many AUR packages are you assuming people are installing?

For the cloud? You would probably have a software TPM so not super secure, but you would still prevent the keys from being extracted away from the server. And if you don't trust your hypervisor/cloud provider you probably have other issues?

In my head the security guarantees are more straightforward for physical servers where you have a fTPM or a dTPM.

> My question after reading the README.md: what are the requirements from the OS? Can it be Windows, Linux, etc?

This only supports Linux.

It somehow got hyper-fixated on "three" for no particular reason and seems like it decided to harpen down that fact without explaining anything around it?

The `base` hook installs the shell PID 1, the `systemd` hook installs systemd as PID1. The default hook setup was changed with the latest'ish release to default too the `systemd` hook setup.

Shell `init`; https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio...

Laughable.

This is a tiny, if even unimportant, fraction of the FOSS community that runs the modern tech stack.

The first hit I could find of a git repository hosted on `archlinux.org` is from 2007; https://web.archive.org/web/20070512063341/http://projects.a...

But, who is counting?

Right, no it can't.

But this was not really something the TPM was suppose to solve.

I wish this myth would die at this point.

Secure Boot allows you to enroll your own keys. This is part of the spec, and there are no shipped firmwares that prevents you from going through this process.

The system could extend one of the PCRs, or an NVPCR, with some unique user credential locked to the user directory. Then you can't recreate the PCR records in any immediate way.

But you can't just recreate a key under one of the hierarchies anyway. You still need to posses the keyfile.

That is not your claim. Your claim is that they "are on the payroll of one of the big tech interests or a foundation funded by them". Which is simply not true.

You can easily find several maintainers of these projects doing this as their part-time hobby project, have cut a deal at work or simply don't work at place that funds Linux development.

I'm not going to call out individual I know the situation and/or their employment history.

For Linux "all the major contributors and maintainers are on the payroll of one of the big tech interests or a foundation funded by them" is simply not true. It's trivial to prove this by just looking at the maintainers of the subsystems. Making this claim is nonsense to begin with.

Same is true for several major contributors to the Python compiler and subsequent libraries as well.

You will move the goalpost by trying to narrow down what "major contributor" means.

> It's software subject to economic coercion owing to the lack of means of its maintainership. It's 100% fine for you to write and release software for free, but if a third party bets their own product on it they're subject to an attack where I hand you $7M to look the other way while I borrow your shell.

So without knowing anyone you are making a value judgement on the (probable?) lack of ethics? Excuse me?

"almost" is the load bearing word here, and/or a weasel word. Define what an "economically important project" is.

> Also just to be clear: node is filled with povertyware and you should be extremely careful what you grab from npm.

Is "povertyware" what we call software written by people and released for free now?

They can just not threaten the population of Italy? They are a 2 billion dollar company that has apparently scheduled a meeting with the vice president of the US on short notice? This is going to be resolved politically.

> Btw, I recently "threatened" Switzerland to withdraw my business from there because the cost of doing business there (complying with their VAT regulation) is higher than my revenue from there (maybe 1-2 licenses a year). The whole Switzerland will not be able to buy my software because of that. I didn't think of posting about it on Twitter though.

You have not given "free services" to 20% of the world wide web that you are now using as leverage.

EDIT: And fwiw, "Why would you continue doing business in Italy?" is not what is being proposed. They are threatening to block 55 million people from ~20% of the world wide web.

However a fine that amounts to ~0.7% of the annual revenue and they threaten to block an entire country?

This makes the HN front-page less of an organic thing, and this is an implicit vote ring behavior few people have access to. It also makes people interested in lobste.rs for this behavior, which our community is not interested inn.

This is my cue.

https://github.com/Foxboron/ssh-tpm-agent

All talks will be live streamed, and right after the talk is done you have a rough cut available instantly under "re-live" you can watch until the final recording is available; https://streaming.media.ccc.de/39c3/relive

The final recording will appear under a day or two after the talk is held: https://media.ccc.de/c/39c3

EDIT: A different variant of the schedule with better filtering is available here: https://events.ccc.de/congress/2025/hub/en/schedule

I should note that some talks will not be recorded, and only available at the congress. These are clearly marked on the congress hub website, but not easily available on the fahrplan view.