Morten Linderud

F/OSS Hacker. Arch Linux Developer, Security Team, Reproducible Builds. General Linux stuff and supply chain issues.

Writes in English and Norwegian from time to time

Public Key

npub1wvthm9yvfzly58n3z8hlcjymnly0cfpsyzkl0k8kyqsq6rv3qt4qx9y89f

NIP-05 Address

Foxboron_at_chaos.social@mostr.pub

Profile Code

nprofile1qqs8x9majjxy30j2rec3rmlufzdelj8uysczpt0hmrmzqgqdpkgs96spz4mhxue69uhhyetvv9ujumt0wd68ytnsw43q0enkuu

Publishing to

relay.mostr.pub

Author Public Key

npub1wvthm9yvfzly58n3z8hlcjymnly0cfpsyzkl0k8kyqsq6rv3qt4qx9y89f

Show more details

Last Notes

2024-09-15 09:46:47

Heading to Vienna for #LPC and #LSS this week!
Feel free to reach out if you want to talk about Linux distros, reproducible builds, secure boot, TPMs or supply chain security stuff.
Sponsored by NUUG Foundation.

2024-09-09 18:29:26

- reply

@npub1yfp…996n That is veryvery funny!

2024-09-09 18:06:55

- reply

@npub1s6d…w7cn
Sir, please put away the computer.

2024-09-09 18:06:22

"Nobody Cares About Security", ah yes. Bold take.
/me checks resume
Ah, previous employment at Solarwinds. This tracks.

2024-09-09 10:08:56

- reply

@npub1r5v…fw5s
Perl 5.19.3 was released 11 years ago, I don't find this unreasonable at all from openssl.

2024-09-07 09:54:29

Booking in Berlin was cancelled today, two weeks before arrival in the busiest week ever.
This is stress I don't need in my life 🫠

2024-09-02 11:48:06

- reply

@npub1lks…a4mq
The week after is ASG in Berlin which has mostly platform security talks this year.
https://cfp.all-systems-go.io/all-systems-go-2024/schedule/

2024-09-01 22:24:11

- reply

@npub1gqs…3qas
This is funny. I wrote a SSH server that writes out the script to Hackers while ignoring Ctrl-C.

2024-08-31 16:37:12

Blogged a bit about my SSH+TPM CA shenanigans.
Attempts to explain how ssh-tpm-ca-authority works.
https://linderud.dev/blog/ssh-ca-with-device-and-identity-attestation-ssh-tpm-ca-authority/
#TPM #SSH #Security

2024-08-28 12:25:34

- reply

@npub1eh4…8h0k
Right, this is the "privacy proxy" setup TCG has been describing several times when trying to describe an attestation setup.

2024-08-28 12:24:39

- reply

@npub1eh4…8h0k
Sure, but is the TPM interaction detailed anywhere? If you promise device bound keys and can't reasonably prove they are device bound, what are you actually getting?

2024-08-28 11:48:05

Anyone looked at Device Bound Session Credentials and figured out how they ensure you are actually dealing with a device bound key?
As long as there isn't any pre-established trust to some hierarchy then I assume you can just fake the key creation?
#TPM #DBSC #Security

2024-08-27 20:33:29

Because of some changes to the #asg2024 schedule I'll talk about my TPM and SSH shenanigans :)
> SSH authentication using user and machine identities
https://cfp.all-systems-go.io/all-systems-go-2024/talk/JCJ9YT/
#tpm #ssh

2024-08-26 21:07:16

- reply

@npub1ka7…qqd2
You joke but I have done this!

2024-08-26 21:01:55

wtf is a zero trust build.

2024-08-24 21:13:38

- reply

@npub17qe…v7la
Isn't there a difference between linking towards and copying the code over?

2024-08-24 20:43:04

- reply

@npub17qe…v7la
Slight question as you are copying code from linux, doesn't this "force" the Go compiler to be distributed under the terms of GPLv2?
The license of the copied code is not clearly defined either.

2024-08-24 20:12:50

> NixOS and Guix are designed to be reproducible, so they are close to fully reproducible.
(╯°□°)╯︵ ┻━┻
plz, lwn.

2024-08-16 13:29:27

- reply

@npub1eh4…8h0k
HCL is a DSL. It's unclear to me why you would want a general purpose language for this?

2024-08-14 20:27:14

- reply

It sports 0 authentication, but has a landlock setup that allows you one port and one file.

2024-08-14 20:22:39

and for no particular reason at all, here is an ssh server that just prints you the script of some random movie.
https://github.com/Foxboron/ssh-the-planet

2024-08-14 20:22:07

I'll be talking about my TPM and SSH shenanigans at bSides Oslo in October :)
https://bsidesoslo.no/
#bsidesoslo

2024-08-14 09:25:38

- reply

@npub17yy…3gvz
I don't think that is incorrect. But by that view the one month closed source repo for opentofu with a bunch of hype seems extremely weird.

2024-08-14 08:38:12

- reply

@npub17yy…3gvz
How was the license change more brutal though?

2024-08-14 07:44:43

- reply

Possibly related,
https://lists.archlinux.org/archives/list/arch-dev-public@lists.archlinux.org/thread/2ERGX565GSSBUMADBG7DQJYNPJD5GUXD/

2024-08-14 07:44:08

Hopefully someone does a study between opentofu and valkey.
To me it seems opentofu largely didn't live up to the hype the company behind the fork tried to build up, while valkey is actively replacing redis in the community.

2024-08-12 14:02:43

- reply

@npub10zm…zrpx
I don't. Someone on IRC wrote that you refused to give out the source.

2024-08-12 13:29:09

@npub10zm…zrpx
Remember you can't legally sell ISOs and our GPL licenced code without giving away the code.
That is in breach with the GPL, and specifically my copyright.
Thanks for your cooperation.

2024-08-11 18:03:23

I've realized `ssh-tpm-ca-authority` as an awfully redundant name.

2024-08-11 09:53:38

- reply

@npub1gc3…nv55
Sir, please explain why you need funding for flathub when nixpkgs is right there.

2024-08-11 09:48:43

- reply

@npub1gc3…nv55
Sir, this project is interesting. But <insert dead previously NGI0 funded nix-specific solution> solves almost the same problem.
Have you considered contributing to this instead?

2024-08-10 14:41:00

New release of ssh-tpm-agent.
https://github.com/Foxboron/ssh-tpm-agent/releases/tag/v0.6.0
#OpenSSH #security #TPM

2024-08-10 12:25:55

- reply

@npub1sjm…e9hs
Unauthorized code is the nickname I give all the code I write.

2024-08-10 11:53:31

As if my impression of #Defcon couldn't get worse. lol

2024-08-07 23:18:21

Custom molded ACS earplugs are easily the best investment i have done this year.

2024-08-07 23:16:42

- reply

@npub1ysm…k82h
https://en.m.wikipedia.org/wiki/Club-Mate#Tschunk

2024-08-07 23:16:11

- reply

@npub1pt8…eexx
Haha, amazing.
They only have 0,5 club mate here do they would mix it in a drink glass I assume.
It's 9 euros pr normal bottle so not very cheap :p

2024-08-07 22:18:16

- reply

@npub1pt8…eexx
So next time in Oslo go to Jæger and ask for a tschunk.
It will help me make this a thing.

2024-08-07 22:09:05

Lol, at a rave in a local club and saw them had Club Mate among the mixing sodas. Asked what they mixed it with and guy said vodka..?
Explained tschunk, got a tschunk. It's a bad tschunk, but still a tschunk.

2024-08-06 23:38:50

But to mention some positive, LSS and LPC looks 🔥 this year.
Tiny bit of SOSS sprinkled into it as well.
#linuxsecuritysummit #LinuxPlumbers
https://assets.chaos.social/media_attachments/files/112/917/699/657/816/122/original/91bb48a0207351f9.png

2024-08-06 23:01:15

- reply

@npub1c90…qhz4
Cool! OpenUK seems like a decent thing the UK has got going for them.
Bookmarked, thanks!

2024-08-06 23:00:09

- reply

@npub1lks…a4mq
How are you exposing the yubikey to the browser? Are you using uhid or is there other ways?

2024-08-06 22:53:39

- reply

There is one.
https://osseu2024.sched.com/event/1ej5i?iframe=no
But the title could be less condescending I guess.

2024-08-06 22:48:02

Reading the Open-Source Summit and the SOSS Community Days schedules and being irrationally annoyed..angry(?) at the space mainly being occupied by companies talking about risk management for FOSS consumption.
Give me just *one* talk about funding maintainers or giving back to FOSS.

2024-08-06 12:02:14

- reply

@npub1lnj…66zl
This isn't different from vim, emacs or even bash itself.
However I'm not sold on the frameworks and abstractions people make on top of this.

2024-08-06 11:44:32

- reply

@npub1rvq…l5r8
This is what RH does internally with toolbx.

2024-08-06 11:43:48

- reply

@npub1lnj…66zl
Should specify it was towards lazyvim and not neovim itself :)

2024-08-06 11:41:30

Lazyvim feels like someone looked at vim and said "We can do a NixOS here".
Cool to see what neovim can do these days, but lord I'm getting "oh-my-zsh"-reimplement-all-the-things vibes.

2024-08-06 11:39:27

- reply

@npub1rvq…l5r8
You want toolbox.
https://containertoolbx.org/

2024-08-06 10:24:16

- reply

@npub1dgr…ssty
Seems to me like /etc/mkinitcpio.conf contains modules in the MODULES array that doesn't exist?

2024-08-06 10:23:06

Visiting Defcon once would be cool, but man the entire thing seems so extremely bizarre as well.

2024-08-05 17:47:07

- reply

@npub1tpx…33ew
I'll probably just smash the session key with the ciphertext with some length prefixes and yolo it. It should work.

2024-08-05 17:31:24

- reply

@npub1tpx…33ew
https://github.com/getsops/sops
I'm trying to implement native TPM keys.

2024-08-05 17:17:45

Okay, #sops gives me a datakey to encrypt. I have an ECDSA key and #sops doesn't give me any medium for a shared secret where I can do ECDH.
Do I yolo it and include a session key inside the ciphertext (which is what the age ciphertext does) or is there a more clever way?
#cryptography #security

2024-08-05 13:32:09

Okay, this should fix the remaining landlock issues in sbctl.
https://github.com/Foxboron/sbctl/releases/tag/0.15.4
#landlock #SecureBoot #sbctl #Security

2024-08-04 14:06:50

- reply

@npub16n0…g59h
That's a one time thing and something that is hardly widely available. It requires you to have the resources to figure that out.

2024-08-04 12:54:32

- reply

@npub1scy…a7h6
Sir, It's the internet. Which discussion has ever stopped?

2024-08-04 12:17:56

- reply

@npub123w…fvyq
Ah, License Violation Sunday is a thing now, then.

2024-08-04 12:15:38

- reply

Is CC-BY-SA and GDFL compatible? Asking for a friend.

2024-08-04 12:13:33

Lol. I was being a bit annoyed at the wording of the #ecdsa concern section in the #archwiki as it lacks neuance and largely just quotes You Know Why^tm as the source.
However it seems like #Wikipedia has almost an identical section on it's wikipage.
Turns out someone just copypasted the section from archwiki.
https://en.wikipedia.org/w/index.php?title=Elliptic_Curve_Digital_Signature_Algorithm&diff=prev&oldid=819880847
https://wiki.archlinux.org/index.php?title=SSH_keys&diff=prev&oldid=406036

2024-08-04 11:57:43

- reply

@npub1l3h…ms36 @npub16r0…z5pl
That is not a user friendly solution.

2024-08-04 11:47:32

- reply

@npub1yck…wk79
This is why you FIDO is always a second factor.

2024-08-04 11:45:46

- reply

@npub16r0…z5pl
It does if you have a similar implementation like Windows and OSX.

2024-08-04 11:27:35

- reply

@npub16r0…z5pl
Linux should support passkeys natively like Windows and OSX.

2024-08-03 16:09:56

- reply

https://github.com/Foxboron/ssh-tpm-ca-authority/commit/1e971fbd253645587449528ef1c6cb2f2fd2b96f

2024-08-03 15:59:59

- reply

Lol, it works.

2024-08-03 15:05:05

(Ab)using sigstore, TPMs and SSH CA signing into something that probably works?

2024-08-02 14:39:14

- reply

Lol, it worked. #books
https://assets.chaos.social/media_attachments/files/112/892/939/301/217/677/original/d7e7eb697bd287e8.jpg

2024-08-02 13:24:29

- reply

@npub1rgl…muxf
:)
https://assets.chaos.social/media_attachments/files/112/892/645/131/489/072/original/3e1a5e3d72bb597c.jpg

2024-08-02 13:23:45

- reply

@npub173m…t2d3
Okay, I reserved it. Lets see if I can get it.

2024-08-02 13:22:59

- reply

@npub1rgl…muxf
It's only the pocket... yolo. Lets see if it works

2024-08-02 13:22:48

- reply

@npub173m…t2d3
https://www.ark.no/produkt/boker/skjonnlitteratur/the-mercy-of-gods-9780356517803
:)

2024-08-02 12:03:55

Apparently a bookstore is selling the new James SA Corey book 5 days early. And I'm tempted heading over there to see if I can actually buy it.

2024-08-01 09:41:10

- reply

@npub1xre…lvxz
That shouldn't happen. Feel free to make an issue upstream, might be due to landlock.

2024-07-31 22:59:00

- reply

@npub1nnw…mtq5
But then it's not your problem! You can just walk away 😄

2024-07-31 21:53:29

- reply

@npub1t27…u8jh
No comment.

2024-07-31 21:53:06

- reply

Lol, three bugfix releases in a day. I need a beer.

2024-07-31 13:59:47

Pushing landlock in the same release I refactored *everything* was a mistake.

2024-07-31 11:04:08

Released sbctl 0.15!
https://github.com/Foxboron/sbctl/releases/tag/0.15
New features:
- Configuration file
- `sbctl setup`
- TPM key files
- A large refactoring with no bugs. Pinky promise.
#sbctl #security #secureboot #TPM

2024-07-30 22:17:36

- reply

https://github.com/Foxboron/sbctl/pull/332
A calm 2 weeks of hacking and refactoring the entire backend to make the TPM key implementation be a nice 500 lines of mostly self-contained code.

2024-07-30 21:41:36

- reply

@npub19c5…n6uf
Thanks!

2024-07-30 21:21:54

👀
#sbctl #TPM #secureboot
https://assets.chaos.social/media_attachments/files/112/877/532/193/725/898/original/5ddf81f7406b676a.png

2024-07-30 20:49:33

Hmm edk2 did not like my NIST P256 keys.

2024-07-30 15:53:13

- reply

@npub13ev…dykm
I found the answer and it made me sufficiently unhappy that I decided to read a Dune novel instead.

2024-07-30 14:22:49

- reply

@npub1y4a…spdz
Hmm, I don't *really* feel like shelling out to an executable for this. But I could check the implementation.

2024-07-30 14:19:30

- reply

@npub17yy…3gvz
It's tied up with the gnupg ecosystem and requires reading the `gpg-agent.conf` file to even figure out what binary the user wants.
Not great if you appliction has nothing to do with gnupg to begin with.

2024-07-30 14:11:38

Okay, what is the modern way to request a password or secret from the user in this day and age?
Pinentry and ssh-askpass is no go and I can't quite grok the dbus secret service from the polkit auth?
#Linux #dbus #polkit

2024-07-29 21:01:02

Implemented #landlock support in #sbctl
https://github.com/Foxboron/sbctl/commit/c9d25391a9703aab524d739e13cd0e3220d2b7ec
I suspect it's a bit rushed, but it works on my machine!
#Linux #Security

2024-07-29 15:04:02

I still can't get over that the Norwegian Unix User Group decided to celebrate their 40th anniversary by collocating with the Miss Norway finale.

2024-07-28 13:41:02

@npub1jgg…4p8z
What would be required to make RWDir/RWFile work on /sys/firmware/efi/efivars/?
Currently trying to implement landlock in my Secure Boot tooling and I realized that these are of course not regular files :)

2024-07-27 11:11:58

Okay, I might have made an strava club for #ArchLinux.
https://www.strava.com/clubs/archlinux
#Strava

2024-07-26 22:45:42

With a little bit of memory magic I've managed to do end-to-end testing of sbctl using a virtual filesystem implementation and a virtual efivarfs layover implementation.
It will probably not be bug-free, but it allows as a quicker canary for issues instead of doing full VM integration testing.
https://github.com/Foxboron/sbctl/blob/morten/setup/cmd/sbctl/setup_test.go
#SecureBoot #sbctl #Golang

2024-07-26 15:52:31

- reply

@npub19u5…3n6l
Nothing to compromise if you don't define a security boundary during boot :)

2024-07-26 13:19:24

- reply

@npub13v9…wner
Hack the planet.

2024-07-26 11:32:21

Mom, can I have security boundary?
No, we have security boundary at home.
At home: "DO NOT TRUST"
#Security #secureboot

2024-07-25 22:17:26

Why go to bed when I can read Secure Boot hot takes on the internet.

2024-07-25 18:58:16

I was like "getting TPM support into sops is easy".
And now I'm sitting here realizing I don't really like asymmetric encryption at all.

2024-07-25 18:20:34

- reply

@npub1hyp…aehm
Sure, but this is an important point and feature in the UEFI spec.
And I'd gladly argue this has become simpler with the work I and others have been doing here.

2024-07-25 17:07:13

- reply

@npub1hyp…aehm
Just the title with the CFP announcement :)
https://x.com/binarly_io/status/1815876366073749596

2024-07-25 17:04:41

- reply

@npub1hyp…aehm
Bro, Binarly already wrote the title yesterday. You can do with a bit more details.
> "PKFAIL: Supply-Chain Failures in Secure Boot Key Management"