I continue to be uncomfortable that we are sending out restricted / locked-down machines without a clear need. The arguments made so far for this are<br><br> 1. "Getting G1G1 people to test security steps"<br> 2. "Protecting G1G1 donors from installing anything but signed builds"<br>
3. "Showing a pretty boot screen"<br><br>3. represents a bug that should be fixed. Tying pretty boot to machine-lockdown is arbitrary.<br><br>2. assumes that this is the best result for G1G1 donors, which seems unlikely to me. Discovering how to update to anything but the most aggressively promoted builds is already a sign of tech savvy. This protection would still effectively be in place for the vast majority of users for whom it matters if we aggressively recommended to users (say, after a couple of days of use) that they get a developers key if they want full control of their machines for any reason.<br>
<br>1. is an interesting argument. As with 2, it would still hold if recipients were actively encouraged to get developers keys if they have any interest in having full control of their machines (indeed you could say that they we would have a much better test of the dev-key acquisition process, which currently works more clearly in large batches for countries than for individuals). <br>
<br>SJ<br><br><div class="gmail_quote">On Tue, Jun 3, 2008 at 9:46 PM, Kim Quirk <<a href="mailto:kim@laptop.org">kim@laptop.org</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Developer program laptops are shipped out as US/International<br>
keyboards, English language, AK flag set, which means they do NOT need<br>
activation. They are permanently activated in the manufacturing data.<br>
<br>
The only thing they need to be a developer unit is a developer key.<br>
<br>
One more reason to add to Scott's list of why laptops are sent out to<br>
G1G1 'write protected' is so they are protected from non-signed images<br>
coming from malicious sources. If you don't use a developer's key to<br>
un protect the laptop, then you can only upgrade to OLPC signed<br>
builds. This is an important part of the bitfrost security that is<br>
implemented and working!<br>
<br>
FFM - if you really got two laptops from the developer's program that<br>
weren't activated, then could you put those details into an RT ticket<br>
and we'll debug it there. If there really are laptops going out that<br>
are un-activated that we don't know about, that will be a serious<br>
problem.<br>
<br>
The ONLY un-activated laptops are ones built for Peru, Mexico, and<br>
Uruguay. These are very specific SKUs and that include Spanish<br>
keyboards. Please open a ticket and let's figure that out.<br>
<br>
Thanks,<br>
<font color="#888888">Kim<br>
</font><div><div></div><div class="Wj3C7c"><br>
<br>
On Tue, Jun 3, 2008 at 1:07 PM, C. Scott Ananian <<a href="mailto:cscott@laptop.org">cscott@laptop.org</a>> wrote:<br>
> On Tue, Jun 3, 2008 at 12:43 PM, Bert Freudenberg <<a href="mailto:bert@freudenbergs.de">bert@freudenbergs.de</a>> wrote:<br>
>> On 03.06.2008, at 18:33, ffm wrote:<br>
>>> On Tue, Jun 3, 2008 at 12:29 PM, C. Scott Ananian<br>
>>> <<a href="mailto:cscott@laptop.org">cscott@laptop.org</a>> wrote:<br>
>>>> Machines sent out via our developer program are always shipped out<br>
>>>> unsecured.<br>
>>><br>
>>> Yet I've just recived two laptops via said program that had security<br>
>>> enabled.<br>
>><br>
>> Indeed. The machines distributed at LinuxTag last week also came w/o<br>
>> dev key - I think it is only the activation part that is disabled.<br>
><br>
> My information may be out of date on the developer's program, since<br>
> Adam has rebooted it recently and I don't think that developer's<br>
> program machines actually come through OLPC any more. I should have<br>
> said, "used to be shipped out unsecured". Adam, are the new<br>
> developer's program machines shipped direct, or do we have an<br>
> opportunity to (at least) include a flyer explaining how to disable<br>
> security on the machine?<br>
> --scott<br>
><br>
> --<br>
> ( <a href="http://cscott.net/" target="_blank">http://cscott.net/</a> )<br>
> _______________________________________________<br>
> Devel mailing list<br>
> <a href="mailto:Devel@lists.laptop.org">Devel@lists.laptop.org</a><br>
> <a href="http://lists.laptop.org/listinfo/devel" target="_blank">http://lists.laptop.org/listinfo/devel</a><br>
><br>
_______________________________________________<br>
Devel mailing list<br>
<a href="mailto:Devel@lists.laptop.org">Devel@lists.laptop.org</a><br>
<a href="http://lists.laptop.org/listinfo/devel" target="_blank">http://lists.laptop.org/listinfo/devel</a><br>
</div></div></blockquote></div><br>