23
Accelerating Ubuntu Core Desktop (discourse.ubuntu.com)
submitted 4 days ago by to c/linux@programming.dev
12 comments fedilink hide all child comments
 

cross-posted from: https://programming.dev/post/58633410

Ubuntu Core Desktop is Canonical’s (currently unreleased) immutable and attestable Linux desktop. It represents the most fundamental shift in Ubuntu’s desktop architecture to date, and will mature into the default experience for Ubuntu Desktop over time.

...

With this transition comes the promise of greater resilience, better security, more composability, but also more engineering complexity. In this post I’ll outline the vision, roadmap, and some of the complexities we hope to tackle.

...

We want to build a modular desktop architecture that defines clear interfaces between components. Components such as the display manager, desktop environment, multimedia servers, networking and other core capabilities should adhere to well-defined interfaces and remain implementation agnostic.

The result will be a desktop whose constituent parts can evolve independently, without forcing the rebuild of the entire operating system image every time something changes - one of the key differentiators from other immutable operating system implementations.

all 12 comments

sorted by: hot top controversial new old
[–] 1 point 2 days ago

Does this mean there will finally be an immutable LTS distro? That might be kinda cool for Grandma PCs. I wonder if it would be easy to fork to make a "it just works" competitor to Bazzite

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 4 days ago (2 children)

    Immutable systems are... challenging.

    They're good at resilliance, reboot and "important stuff" gets restored to its state when locked.

    (Some of) the problems are: how to draw the line between "important stuff" that should never change and "configuration parameters" that need to be periodically modified, and storage like log files that change all the time. Then, occasionally you need to open up the "immutable" partition and make changes there as well, and during those openings you are basically as, perhaps a bit more, vulnerable to attack as traditional systems.

    The fact that Ubuntu has been working on this for so many years and it's still not ready for release tells you something...

    I have developed a few systems on RaspberryPi where the immutability protects the immutable microSD filesystem from corruption when power is lost without graceful shutdown, which is pretty much every shutdown in real-world deployments...

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 3 days ago (1 child)

    /etc is usually writeable XD

    Unless you are on NixOS where you need to use nix for EVERYTHING

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 days ago

    And how much can you screw up with a "sudo rm -rf /etc" ?

    If ALL the software on the system was mine, that would be a reset to defaults, where the executable would re-write what it needs to default values instead of just failing to start.

    Of course the whole reason for configurability is that defaults don't always work in all cases.

  • permalink
  • fedilink
  • source
  • parent
    • [–] -3 points 4 days ago (4 children)

    AI slop

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 2 points 3 days ago (3 children)

    The article or the project or both?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • [–] 0 points 4 days ago (2 children)

    attestable

    Please don't bring this utter shit to Linux.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 3 days ago (1 child)

    Corpos do weird shit and call that attestation

    Having integrity verification of the system is very useful and essential for things like Banking software to be potentially available on Linux.

    If we want that proprietary malware... another question. Do we have a choice?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 8 hours ago

    Integrity verification and immutability doesn't need to be implemented through attestation. Attestation is a horrible concept used by companies to dictate you what you can and what you can not use on your hardware.

    Attestation has nothing to do with security.

    First, because attestation doesn't enforce any security standards by default, it just requires an "official" hardware-software stack. It may be used for such enforcement, but no one gives a shit, including Google with their Play Integrity Protection that allows immensely outdated devices to be accepted as "secure".

    Second, because one leaked key, and all the devices signed with that key immediately become a security circus. Yes, eMudhra way.

    Banking software

    Banking software is an absolutely horrible thing both security-wise and privacy-wise. Having it on Linux is exactly the opposite of what Linux needs.

    Do we have a choice?

    Yes. Do not use anti-consumer tech. Do not use services that require such anti-consumer tech. Demand from your banks and your government support for open technologies and standards (literally W3C-compliant web browsers are enough for practically anything).

    I do realize that it's extremely difficult and barely possible at all. But bringing that crap to open ecosystems is not the answer.

  • permalink
  • fedilink
  • source
  • parent