Youtuber explores how booting Linux from Google Drive could spark changes in PC ownership

[Redaktion]

A recent video from Mental Outlaw explores what it means to be able to boot from Google Drive, how it is possible, and how this proof of concept could impact future PC hardware.

https://www.notebookcheck.net/Youtuber-explores-how-booting-Linux-from-Google-Drive-could-spark-changes-in-PC-ownership.860295.0.html

[Alexander_]

Very interesting topic.
For "local storage", I think it will be possible to do without some kind of flash drives.

But there are several questions at once:
1. How long will the download/download of OS files be protected?
2. Will synchronization of work documents be online [as usual when using GoogleDrive/DropBox similar]?

It looks good.
It's as if you take a flash drive with a part of the OS, but instead of saving settings and own files there, everything is extracted from the cloud, and unlike the work of a thin client, it will already be done on the PC.

[indy]

Not sure hosting my files on a server I do not manage is "safer."

I get that Google and Microsoft have some of the best minds in the business, but those minds are managed by corporations *always* looking out for return on shareholder value, well before the safety of my data.

It is for that reason I don't plan on this system. It simply, ultimately, is not a priority for them.

Ultimately, I attempt to simplify my life as much as possible. I manage my own open source machines, and I am realistic in the sense that eventually I may be breached. I am ok with that eventuality if it's my own undoing. If it is someone else's mistake or oversight? Well, then I can't really say I managed my data as best I could, can I?

Saving money is not worthwhile in this case, ultimately. I will stick with self-hosted OS and data storage.
Besides, how much ransomware is targeting locked-down Linux installs?

[George]

Here's a concept for you - 3 letters - R, O & M.

"Read Only Memory"

If only the OS did not need constant & seemingly unending updates it could be burned to ROM and only elements held in RAM might be infected.

I do have in my possession an old 256MB thumb drive that has a unique feature - a physical WRITE DISABLE switch!!

Sure, a 'thin client' could be burned to a protectable storage medium and the rest could be  'cloud based' however why not go the extra steps and make the entire OS AND applications burned on protected storage and then leave only 'data' to be backed up and/or mirrored to the 'cloud'??

Since the OS and Applications are stored in unwriteable medium no 'infection' would survive a memory flush or boot cycle.

However then again NOBODY seems to want to create a secure operating system/environment to work in. :(

[vertigo]

I might be missing something, but what's the point? You still need a computer to run the OS. You still need storage for the initial bits. But you also need an internet connection, likely a decently fast one, which also presents a security vulnerability if the (hopefully encrypted) tunnel is breached. You're allowing whatever provider you're using, in this case Google, access not only to your files but to your OS and everything you do on it. You're probably going to have to pay for enough storage for the OS and snapshots, in which case you could take that money and put it towards hardware that you own.

Anybody doing this would likely not be doing anything extensive, as manipulating large amounts of data would require more storage and bandwidth than they would likely have, and would slow things down too much, and anyone doing basic tasks could do so with a <$200 computer. The only possible reason I can see for this would be to use their powerful computers for computationally heavy tasks to avoid having to buy an "expensive" computer, but you can get a pretty powerful computer for fairly cheap these days, so not sure how much benefit that would actually be. Or perhaps to run a desktop OS on a phone/tablet.

If I already have a flash drive for the startup files (kernel, etc) and possibly some config files, data, etc, I'm just going to house the entire OS on it. As for snapshots, that can be done locally as well, and again, likely at a cheaper cost by buying a cheap drive rather than renting storage indefinitely.

So unless you want to run a true DE from a mobile device, this seems pointless. And I feel like there are probably better ways to do that, such as simply, again, having your own computer running it and remoting in.

[vertigo]

Here's a concept for you - 3 letters - R, O & M.

"Read Only Memory"

If only the OS did not need constant & seemingly unending updates it could be burned to ROM and only elements held in RAM might be infected.

I do have in my possession an old 256MB thumb drive that has a unique feature - a physical WRITE DISABLE switch!!

Sure, a 'thin client' could be burned to a protectable storage medium and the rest could be  'cloud based' however why not go the extra steps and make the entire OS AND applications burned on protected storage and then leave only 'data' to be backed up and/or mirrored to the 'cloud'??

Since the OS and Applications are stored in unwriteable medium no 'infection' would survive a memory flush or boot cycle.

However then again NOBODY seems to want to create a secure operating system/environment to work in. :(

While the OS/apps being infected is certainly a concern, it's not generally the main one. It's the data that's important (notwithstanding keyloggers, etc), so even if the OS can't get infected/corrupted, malware can still be in RAM and act on the data, log your activity, etc, so all you've really accomplished is to make an OS that nobody wants to use, because it can't be modified, including by the user, and only offers a slight security advantage in return.

There's a reason it's always a balance between usability and security. It's certainly possible to make a "completely" secure (ok, nothing is 100%, but the point is valid) computer, but it would be unusable for anything but very basic and specific tasks. For a computer/OS to be adaptable to each user and their needs, it has to be modifiable, which means "vulnerable" (again, the data is always going to be vulnerable).

*nux is, for the most part, heavily focused on security, arguably much more than Windows, which is more focused on presenting ads, snooping on the user, and otherwise being malware in and of itself. But even it needs to balance usability with that.

If you want a secure OS, just airgap it. But seriously, run anything and make sure it's updated and use an anti-exe software, and keep offline/offsite data backups, as well as a few other practices, and that's about as secure as you can get or need to be. You should also look into DARPA's project regarding this, as contrary to your last statement, they absolutely do want to create a secure OS, and they have done an incredibly impressive job so far. Not that it's likely to be available to the public, nor would it likely work well for that, since it would probably be too limited in use. Again, usability vs security.

[Alexander_]

protected storage

What do you mean? A drive with read-only functionality and encryption?

Are you sure this is a protected option?
And if someone physically gets access to such a storage device and, by connecting to the controller, gets access to the memory?

Take iStorage diskAshur M2
Install Tails on it.
Configure in such a way that the settings are still saved on the drive. And then turn on the "Read only" function in the Enclosure
And this is what you describe.

Will you use this? No? Why?

[indy]

A read only operating system would be one of the most vulnerable operating systems out there. They would just attack memory buffer overflows, which exist in every OS. It would be unpatchable...because the OS is read only.

Hence why gaming systems in the '80s and '90s are easily hackable.

[A]

Here's a concept for you - 3 letters - R, O & M.

"Read Only Memory"

If only the OS did not need constant & seemingly unending updates it could be burned to ROM and only elements held in RAM might be infected.

I do have in my possession an old 256MB thumb drive that has a unique feature - a physical WRITE DISABLE switch!!

Sure, a 'thin client' could be burned to a protectable storage medium and the rest could be  'cloud based' however why not go the extra steps and make the entire OS AND applications burned on protected storage and then leave only 'data' to be backed up and/or mirrored to the 'cloud'??

Since the OS and Applications are stored in unwriteable medium no 'infection' would survive a memory flush or boot cycle.

However then again NOBODY seems to want to create a secure operating system/environment to work in. :(

Read only is silly, as others have mentioned that sometimes you get hardware exploits that you need software to patch up. Spectre and the recent bios exploit shows that

The best way in which operating systems are going is immutable and transaction based. What that means is read only up until you restart the system. And any write doesn't overwrite anything but creates a layer on top via transaction

[indy]

Read only is silly, as others have mentioned that sometimes you get hardware exploits that you need software to patch up. Spectre and the recent bios exploit shows that

The best way in which operating systems are going is immutable and transaction based. What that means is read only up until you restart the system. And any write doesn't overwrite anything but creates a layer on top via transaction

Exploitable at the transaction level, and boot level.  So, no change to today's tech (Bootloader exploits.)

There is no way currently to secure an OS because there is no secure hardware. With physical access to hardware we can manipulate software. We do have encryption, so at least data at rest is safe, for the most part, but there are many exploits for that, also.

[A]

Exploitable at the transaction level, and boot level.  So, no change to today's tech (Bootloader exploits.)

There is no way currently to secure an OS because there is no secure hardware. With physical access to hardware we can manipulate software. We do have encryption, so at least data at rest is safe, for the most part, but there are many exploits for that, also.

Immutable systems bring installation of software to the user level so many things can be done without root as software is executed inside isolated containers

Transactions let you patch the system in a recoverable manner

It doesn't mean it is 100% exploit proof, but it is far more secure

[NikoB]

Hence why gaming systems in the '80s and '90s are easily hackable.

Tell us, who managed to hack modification-protected BIOS since 2016, digitally signed by the manufacturer? If this is possible, why did all the sites for BIOS mods for systems already released in this mode immediately close in 2016 (or find themselves in oblivion for new hardware)?

Even a programmer will not help you - the chip only accepts signed firmware and nothing else. All you can do is flash a signed BIOS of the old version, which is prohibited from downgrading, but no more.

And only the presence of private keys or a found exploit (for some reason, no one has done such exploits for most series of such exploits) allows you to freely modify the BIOS firmware since 2016. Leaks of private keys for signing BIOS on behalf of the manufacturer are extremely rare (MSI/Intel had previously ).

In general, the industry, as in smartphones, is moving towards its goal - building a digital concentration camp for the majority (the key word here is for the "majority", even if there is a small % able to bypass the restriction), where an environment and restrictions are imposed on you, and censorship from those interested parties is common.

[indy]

EUFI exploits since 2016

ESET identified LoJax in 2018 and ESpector last year. Qihoo360 spotted CosmicStrand in 2017. And Kaspersky found FinSpy, MosaicRegressor, and Moonbounce in 2020, 2021, and 2022, respectively. Kaspersky also independently discovered CosmicStrand. In Monday's report, the Kaspersky researchers warned that "the multiple rootkits discovered so far evidence a blind spot in our industry that needs to be addressed sooner rather than later."