Top all-time · #1259
James Bottomley
Personal blog · blog.hansenpartnership.comsystemssecurityprogramming
James Bottomley's personal blog at blog.hansenpartnership.com covers systems, security and programming. Since 2012, 55 different Hacker News readers have linked it 76 times, most often “Owning Your Own Copyrights in Open Source”. It is still writing: the last post was on 2026-01-22, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link James Bottomley's posts on UEFI Secure Boot and owning your own keys, GPL/CDDL licensing for ZFS, and security measurement. Commenters cite them as sources in licensing and boot debates.
- Recommended for · 2 comments
- Called 'a good read' on owning your own copyright; the 'Vertical/Horizontal Attack Profile' idea is called interesting and possibly useful for measuring securit
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Owning Your Own Copyrights in Open Source3 people · 4 mentions · first linked 2021-03-31
- Webauthn in Linux with a TPM via the Hid Gadget3 people · 3 mentions · first linked 2019-08-19
- Solving the Looming Developer Liability Problem3 people · 3 mentions · first linked 2023-12-12
- GPL as the best licence3 people · 3 mentions · first linked 2018-01-10
- /are-gplv2-and-cddl-incompatible/3 people · 3 mentions · first linked 2017-09-04
- Lessons from the Gnome Patent Troll Incident3 people · 3 mentions · first linked 2020-09-04
- /owning-your-windows-8-uefi-platform/2 people · 3 mentions · first linked 2013-02-28
- Paying Maintainers Isn’t a Magic Bullet2 people · 3 mentions · first linked 2022-09-29
- Deploying Encrypted Images for Confidential Computing2 people · 3 mentions · first linked 2021-01-04
- A Roadmap for Eliminating Patents in Open Source2 people · 2 mentions · first linked 2019-03-31
What Hacker News says?
This seems like FUD, people have analyzed the licensing, and the openzfs project is independent of any company. Would you say OpenJDK was murky? I don't think so. https://blog.hansenpartnership.com/are-gplv2-and-cddl-incomp...
Comment linking /are-gplv2-and-cddl-incompatible/
on ““Oracle laid off all Solaris tech staff in a classic silent EOL of the product””Submitted Lessons from the Gnome Patent Troll Incident as a story · 175 points
HN discussionJames Bottomley navigated the bureaucracy and lived to tell about it: https://blog.hansenpartnership.com/adventures-in-microsoft-u...
Comment linking /adventures-in-microsoft-uefi-signing/
on “Uncorrectable freedom and security issues on x86 platforms (2016)”Submitted Creating a Home IPv6 Network as a story · 155 points
HN discussionSo you're implying that Oracle would use its standing as a Linux copyright holder to sue Canonical for violating the GPL by integrating the (Oracle copyrighted!) CDDL'd ZFS? On the one hand, I give points for the absurdity of the scenario -- and that it makes no sense would certainly not dissuade Oracle. But on the other hand, even this bizarre scenario is missing something that all of these litigation scenarios see…
Comment linking /are-gplv2-and-cddl-incompatible/
on “Big News for ZFS on Linux”Submitted Linux Foundation Secure Boot System Released as a story · 125 points
HN discussionBrowsers toyed with the idea of using DNSSEC + DANE which would allow a website owner to use self-signed certificates and have them trusted just like commercial certificates. A DNS record (TLSA) would tell the browser how to deal with trusting the certificate, its public key or to validate the chain of certificates, etc: https://www.rfc-editor.org/rfc/rfc7671.html . This would have radically changed the landscape of…
Comment linking /dnssec-dane-and-the-failure-of-x-509/
on “Safari will no longer trust certs valid for more than 13 months”Submitted The Community Corrosive Effects of CLAs (2021) as a story · 73 points
HN discussionYou can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection? 1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi...
Comment linking /owning-your-windows-8-uefi-platform/
on “Torvalds clarifies Linux's Windows 8 Secure Boot position”Submitted A Roadmap for Eliminating Patents in Open Source as a story · 71 points
HN discussionFor OEM to allow reinstall done "normally", yes. But DB entries can also contain SHA-256 hashes of the image to load (with the image stripped of the signature, which btw allows you to also resign it). https://blog.hansenpartnership.com/the-meaning-of-all-the-ue... https://www.nsa.gov/Portals/70/documents/what-we-do/cybersec...
Comment linking /the-meaning-of-all-the-uefi-keys/
on “Quibble – Custom Windows Bootloader”Submitted Lessons from the Gnome Patent Troll Incident as a story · 7 points
HN discussionIt's not always easy to do (and Microsoft could always exempt themselves from surface devices) - I think the spec only requires that it is possible, not that there is a nice dialog box in the bootloader to do it (unfortunately). You need to put the device into setup mode first, which should be possible by disabling secure boot then deleting the platform key. Then you can update the DB, then KEK and finally PK using…
Comment linking /owning-your-windows-8-uefi-platform/
on “Understanding modern UEFI-based platform boot”Submitted Adventures in Microsoft UEFI Signing as a story · 6 points
HN discussionI keep hearing that the GPL and CDDL are incompatible. But repeating something doesn't make it true. And I have read both licenses, and have come to the conclusion that they're unlikely to be incompatible in the first place. Unfortunately, every time this line of argument come up, it tends to get buried in discussion. The basis of the incompatibility claim seems to be from 3 arguments: 1) Statements from the FSF web…
Comment linking /are-gplv2-and-cddl-incompatible/
on “ZFS for Linux”Submitted Horizontal Attack Profile Comparison (Docker vs. GVisor vs. Nabla) as a story · 5 points
HN discussion>If the OS refuses to boot when you disable Secure Boot, then you can't dual boot the pre-installed OS, and it takes a lot of effort to get things working again. What? Which OS refuses to boot when you disable Secure Boot? >This is all a stupid mess which could have been solved by allowing users to install their own certificates Exactly which UEFI Secure Boot does. Here's a guide. http://blog.hansenpartnership.com/o…
Comment linking /owning-your-windows-8-uefi-platform/
on “Linux users file EU complaint against Microsoft”Submitted James Bottomley: Containers and Cloud Security as a story · 4 points
HN discussionJust a weakly related comment here. When one talks about security, it's really hard for people to follow what she really means; the context has always been qualitative, but not quantitative. I found the idea "Vertical/Horizontal Attack Profile" interesting, which may help measure security when people argues different container solutions or even VMs. https://blog.hansenpartnership.com/measuring-the-horizontal-...
Comment linking /measuring-the-horizontal-attack-profile-of-nabla-containers/
on “BSDs or Illumos may be good alternatives to Linux (2017)”Submitted GPL as the best licence as a story · 3 points
HN discussionmisleading title: it’s not complicated, but you can make it complicated. Just use cc-by (sa or nd) and an osi approved foss license. A good read: https://blog.hansenpartnership.com/owning-your-own-copyright... or see https://blog.codeforscience.org/intellectual-property-in-ope... to keep it simple!
Comment linking /owning-your-own-copyrights-in-open-source/
on “Software and Copyright: It’s Complicated”Submitted Securing the Google SIP Stack as a story · 3 points
HN discussionHere's the how-to to add your own keys. http://blog.hansenpartnership.com/owning-your-windows-8-uefi...
Comment linking /owning-your-windows-8-uefi-platform/
on “What I would like to see from Microsoft regarding OSS”Submitted Deploying Encrypted Images for Confidential Computing as a story · 3 points
HN discussion> Which major distro allows using ZFS from its official installer…? That says more about the distributions than about ZFS’s fitness or maturity as a file system. It’s understandable that many distributions don’t bundle ZFS, since the licensing is still an open debate. Although that’s not so cut-and-dried [1], I wouldn’t expect broad support from distributions unless and until these issues have been tested and proved…
Comment linking /are-gplv2-and-cddl-incompatible
on “The Future of ZFS on Ubuntu Desktop Is Not Looking Good”Submitted Lessons from the Gnome Patent Troll Incident as a story · 3 points
HN discussionHe's not the only person that feels CDDL and GPL licenses are compatible. Their alleged incompatibility[1] seems to stem from a lot of hair splitting over technicalities that don't align with the spirit of either license. [2][3][4] It's particularly funny that the community (except Canonical and a handful of individuals) largely settled on the CDDL-GPL issue--deciding they were incompatible and giving up on the poss…
Comment linking /are-gplv2-and-cddl-incompatible/
on “Oracle Attorney Disagrees That ZFS-Linux Combination Is a GPL License Violation”Submitted A Roadmap for Eliminating Patents in Open Source as a story · 3 points
HN discussionIt's been a few years, but the main references I remember using: 1. Windows: https://github.com/frankmorgner/vsmartcard/tree/master/virtu... , which is a fix-up of the older https://www.codeproject.com/Articles/134010/An-UMDF-Driver-f... , and https://github.com/Watfaq/SoftU2F-Win/tree/master/SoftU2FDri... . Note that neither of these actually implement CTAP2. 2. Linux: There's plenty to refer to on HID gadgets, but…
Comment linking /webauthn-in-linux-with-a-tpm-via-the-hid-gadget/
on “On-device WebAuthn and what makes it hard to do well”Submitted Why Microsoft is a good steward for GitHub as a story · 3 points
HN discussion
