qyliss changed the topic of #spectrum to: A compartmentalized operating system | https://spectrum-os.org/ | Logs: https://logs.spectrum-os.org/spectrum/
<pie_> fun times... :I
<IdleBot_59b8da4c> I wonder if there is anyone left who knows what NOBUS means _and_ believes in it
<pie_> #angst
<pie_> IdleBot_59b8da4c: alternatively, they are also "US"
<IdleBot_59b8da4c> And Shadow Brokers, who also get the NOBUS capabilities by breaking security on intermediate deployment servers? If they want to maintain simultaneously that SB=US _and_ SB=Russia, that would be pretty revealing… (it might be that there are bureaucracy natural selection effects that do lead to interests of nominally-in-conflict elites better aligned than inside-country alignment, but normally the special services deny _that_ level of mar
IdleBot_59b8da4c has quit [Remote host closed the connection]
IdleBot_51f8eb57 has joined #spectrum
<pie_> you fuck up sometimes
<pie_> xD
<pie_> ok i wasnt being serious, hold onű
<pie_> whats SB?
<pie_> I havent read as many spy books as im starting to assume you ahve
<pie_> oh its shadowbrokers
<pie_> duh.
<IdleBot_51f8eb57> There is some number of failures when «nobody except those who managed to use our failures, which happen at least quarterly» starts sounding unconvincing
<pie_> not to defend them, but can you even have NOBUS for software
<IdleBot_51f8eb57> I am criticizing the claim more than failure to achieve it
<pie_> hm
tilpner_ is now known as tilpner
<qyliss> Interesting
<IdleBot_51f8eb57> does not seem to say anything about constraints on the motherboard design (and probably a lot of other things) needed to make this useful
<tazjin> IdleBot_51f8eb57: afaict this is just the initial project launch - we do all motherboard design in-house, so it's likely <speculation>that the opentitan team want to find external motherboard manufacturers to collaborate with before publishing information on how titan can be used for mb integrity verification etc. </speculation>
<tazjin> small steps, but it's starting to feel like trust issues are being worked on on so many fronts that we're slowly getting somewhere
<IdleBot_51f8eb57> At that point I guess I can say we are getting to a worse place. If only large companies can be remotely sure that the MB integration is done right, devices are easier to lock, but no easier to trust
<tazjin> but publishing integration info in tandem with a manufacturer actually announcing support for it doesn't mean that it's just that manufacter that *can* support it
<tazjin> maybe I misunderstand what you mean
<IdleBot_51f8eb57> Well, when mainboard manufacturers who also happen to be laptop manufacturers just happen to ship the systems with badly-written malware (vulnerable to secondary exploitation by non-author) in the official OS image, trusting that integration of RoT has been done correctly seems optimistic
<IdleBot_51f8eb57> And if they do integrate it correctly, they get a useful tool from imposing the configuration on the user
<IdleBot_51f8eb57> (like unlocked Chromebooks with a single-button (!!!) wipe on a 10s boot warning)
<hyperfekt> qyliss: finally got myself to take a look at the crosvm stuff
<qyliss> hyperfekt: yeah?
<hyperfekt> qyliss: push'd
<hyperfekt> have you gotten virtfs to work? if so i might want to add a test for crosvm
<qyliss> hyperfekt: I still haven't got it to boot lol
<qyliss> Because I don't want an initrd
<hyperfekt> oh wow, google is implementing virtio-fs for crosvm this very moment
<qyliss> :3
<IdleBot_51f8eb57> I have virtio-9p working inside NixOS initramfs iff CrosVM is run with --disable-sandbox
<IdleBot_51f8eb57> Of course virtio-fs in crosvm is Not Paranoid Enough for our long-termplan as it requires host FS access
<IdleBot_51f8eb57> I have no idea how, but inside CrosVM I do not get working overlayfs. Go figure
<IdleBot_51f8eb57> I guess it would be nice if we could have one VM export FS via virtio to another VM that imports it via virtio and then runs virtio-fs on top of that
<tilpner> Custom kernel, IdleBot_51f8eb57?
<IdleBot_51f8eb57> No, I decided to try booting a standard NixOS build-vm
<tilpner> Huh
<tilpner> :q
* tilpner wrong focus
Thierry64 has quit [Ping timeout: 240 seconds]
<hyperfekt> IdleBot_51f8eb57: What would be the point of chaining virtfs and virtio-fs?
<IdleBot_51f8eb57> Not chaining: serving FS from a VM to a sibling VM, using virtio as transport to avoid networking overhead
<hyperfekt> oh so you just mean inter-vm virtio-fs, gotcha
<IdleBot_51f8eb57> I am not sure CrosVM currently supports non-built-in virtio endpoints, which is sad