4 ms·

> The Register understands that this debug-mode policy was accidentally shipped on retail devices, and discovered by curious minds including Slip and MY123. >

> The Register understands that this debug-mode policy was accidentally shipped on retail devices, and discovered by curious minds including Slip and MY123. > The policy was effectively inert and deactivated on these products but present nonetheless. Whenever I read things like this, I always envision that it's not a cock-up at all, but instead a deliberate effort by righteous free software-minded people who happen to work at Microsoft and are dismayed by the things they're asked to do. But that is probably because I wish it so.

ge0rg 10y ago
a deliberate effort by righteous free software-minded people who happen to work at Microsoft Or maybe a deliberate effort by developers who are paid by a three letter agency to sneak in a backdoor that looks like an accidental bug. In this case you might be right, but the last time a similar issue was widely circulated (Heartbleed in OpenSSL), it also looked like an accident (or rather gross negligence), but its effect was much more beneficial to agencies and not usable to increase FOSS domination.
- josteink 10y ago
  > Or maybe a deliberate effort by developers who are paid by a three letter agency to sneak in a backdoor that looks like an accidental bug. Why would a three-letter agency bother to do that, when they could just as well get their malware EFI module signed by MS, and thus pass the secure-boot requirement? That way they wont risk exposing the existence of a backdoor on every single Windows-copy deployed worldwide. I honestly don't see the value in it for them.
  - ge0rg 10y ago
    when they could just as well get their malware EFI module signed by MS This is exactly what the FBI tried with Apple, causing an enormous public mud fight. Besides, the outlined method would rather be deployed by NSA, or maybe a foreign service, without legal means to get a signed malware module. Even if such legal means would exist, it would be in Microsofts best interest to fight them in court: once leaked, the malware would be clearly attributable to MS.

ge0rg 10y ago

a deliberate effort by righteous free software-minded people who happen to work at Microsoft Or maybe a deliberate effort by developers who are paid by a three letter agency to sneak in a backdoor that looks like an accidental bug. In this case you might be right, but the last time a similar issue was widely circulated (Heartbleed in OpenSSL), it also looked like an accident (or rather gross negligence), but its effect was much more beneficial to agencies and not usable to increase FOSS domination.

josteink 10y ago
> Or maybe a deliberate effort by developers who are paid by a three letter agency to sneak in a backdoor that looks like an accidental bug. Why would a three-letter agency bother to do that, when they could just as well get their malware EFI module signed by MS, and thus pass the secure-boot requirement? That way they wont risk exposing the existence of a backdoor on every single Windows-copy deployed worldwide. I honestly don't see the value in it for them.
- ge0rg 10y ago
  when they could just as well get their malware EFI module signed by MS This is exactly what the FBI tried with Apple, causing an enormous public mud fight. Besides, the outlined method would rather be deployed by NSA, or maybe a foreign service, without legal means to get a signed malware module. Even if such legal means would exist, it would be in Microsofts best interest to fight them in court: once leaked, the malware would be clearly attributable to MS.