Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Steve Litt
On Mon, 13 Jun 2016 21:14:00 +0200 Edward Bartolo wrote: > But I still am convinced with a signed kernel one can still use it to > boot any installed OS. My reasoning goes like this: once the signed > kernel boots, it would be in control of the machine. A running kernel > can be used to run any

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread dr . klepp
Am Montag, 13. Juni 2016 schrieb Adam Borowski: > On Mon, Jun 13, 2016 at 09:14:00PM +0200, Edward Bartolo wrote: > > But I still am convinced with a signed kernel one can still use it to > > boot any installed OS. My reasoning goes like this: once the signed > > kernel boots, it would be in contro

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Adam Borowski
On Mon, Jun 13, 2016 at 09:14:00PM +0200, Edward Bartolo wrote: > But I still am convinced with a signed kernel one can still use it to > boot any installed OS. My reasoning goes like this: once the signed > kernel boots, it would be in control of the machine. A running kernel > can be used to run

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Simon Hobson
Edward Bartolo wrote: > But I still am convinced with a signed kernel one can still use it to > boot any installed OS. My reasoning goes like this: once the signed > kernel boots, it would be in control of the machine. A running kernel > can be used to run any executable provided the latter is co

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Edward Bartolo
Hi SteveT, GRUB2 has a small kernel, on can always replace that with a full blown signed kernel and this would not introduce another step in the boot procedure. Edward On 13/06/2016, Edward Bartolo wrote: > Hi, > > SteveT wrote: > << > Most of those remaining in the Debian user world are pure i

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Edward Bartolo
Hi, SteveT wrote: << Most of those remaining in the Debian user world are pure idiots. They'll pull any old pseudofact out of thin air, and state it as an absolute truth. Notice that his web reference's date is October 2012. Last time I googled this subject (probably 9 months ago), DIY secure boo

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-13 Thread Steve Litt
On Sun, 12 Jun 2016 18:00:13 +0200 Edward Bartolo wrote: > Hi, > > In line with: << > That way only the big distros will be able to provide a bootable OS > and the poor DIY guy will be definitely disgusted. This EFI thingy > will in no way improve the security. It is a pure fallacy. > > We

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-12 Thread Simon Hobson
Edward Bartolo wrote: > I have been 'told' that any kernel can still be booted under UEFI > Secure Boot. For now, how long until that changes ? > Refer to forums.debian.net thread: > http://forums.debian.net/viewtopic.php?p=609579&sid=c65ab3dc5f980e0c1f79b7b7a5116511#p609579 And as pointed out

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-12 Thread Edward Bartolo
Hi, In line with: << That way only the big distros will be able to provide a bootable OS and the poor DIY guy will be definitely disgusted. This EFI thingy will in no way improve the security. It is a pure fallacy. We can survive as long as the BIOS allows non-EFI boot. I hope they will be fo

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-12 Thread Didier Kryn
Le 12/06/2016 09:14, Jaromil a écrit : On Sun, 12 Jun 2016, Adam Borowski wrote: Until systemd gets some DRM components, that is. I suspect this is going to happen sooner than later. This is just speculation of course, but the sort of vertically integrated architecture systemd is implementin

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-12 Thread Lars Noodén
On 06/12/2016 10:14 AM, Jaromil wrote: > On Sun, 12 Jun 2016, Adam Borowski wrote: > >> Until systemd gets some DRM components, that is. > > I suspect this is going to happen sooner than later. This is just > speculation of course, but the sort of vertically integrated > architecture systemd is

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-12 Thread Jaromil
On Sun, 12 Jun 2016, Adam Borowski wrote: > Until systemd gets some DRM components, that is. I suspect this is going to happen sooner than later. This is just speculation of course, but the sort of vertically integrated architecture systemd is implementing goes in the direction of playing the DR

Re: [DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-11 Thread Adam Borowski
On Sun, Jun 12, 2016 at 06:54:20AM +0200, Arnt Karlsen wrote: > ..another new(?) step towards Debian systemd: > linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys... : > https://packages.debian.org/sid/linux-image-4.6.0-1-rt-amd64-signed > https://wiki.debian.org/SecureBoot > https://burtness.word

[DNG] ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys...

2016-06-11 Thread Arnt Karlsen
Hi, ..another new(?) step towards Debian systemd: linux-image-4.6.0-1[-rt]-amd-signed, with MSTF keys... : https://packages.debian.org/sid/linux-image-4.6.0-1-rt-amd64-signed https://wiki.debian.org/SecureBoot https://burtness.wordpress.com/2014/02/08/secure-boot-with-debian-testing/ ..we reall