4 ms·
A computer that requires the firmware to be replaced to boot Linux is already at the point where 99% of users are just not going to install Linux (I've personal
by mjg59 5y ago
A computer that requires the firmware to be replaced to boot Linux is already at the point where 99% of users are just not going to install Linux (I've personally ported Coreboot to two of my laptops, and even I would never buy hardware that required me to do that before I could run Linux).
And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based attacks have existed for over a decade, and the Hacking Team leak included a firmware implant targeted at some ThinkPads. Do I think most users need to worry about this? No, I don't, and I don't know that there's enough people who do need to worry about this that it should be the default (I have thoughts on this, I'll write them up later this evening). But to deny that some people do need to worry about this is just inaccurate.
And Microsoft has required secure boot and TPMs on all certified client systems since Windows 8.1. Almost all shipped hardware already has all this functionality. If Microsoft had any interest in being evil here, they've had the opportunity to do so for years.
Anyway! Even if you can't replace the firmware, the secure boot database is in an unprotected variable store, so you can just replace it even if PSB is enabled. You're welcome.
- KennyBlanken 5y ago> And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based attacks have existed for over a decade This is a pure cash grab by Lenovo and AMD, not about mitigating attacks. If this were about platform security for the benefit of the owner, it would not be permanent, nor enabled by default. All this does is create more e-waste and nuke resale value for Lenovo systems and Ryzen CPUs. Lenovo has been increasingly slimy for years now (I guess everyone forgets that they've been caught distributing spyware in their products multiple times?) and this is just yet another stop on the road. I hope Lenovo and AMD both get their asses sued.
- mjg59 5y ago> it would not be permanent If it's not permanent then it doesn't work - any plausible mechanism for allowing it to be disabled can be triggered by whoever's replacing your firmware (which makes AMD's approach somewhat bewildering here, given that you can just replace the CPU). But yes, I agree that enabling it by default is probably the wrong approach here.
- mjg59 5y agoOk, as promised, I wrote up my thoughts at https://mjg59.dreamwidth.org/58424.html https://mjg59.dreamwidth.org/58424.html . I think with a few small tweaks Boot Guard could be turned into something that offered the same security benefits without being as user-hostile. PSB may require more work in this respect, but it should be technically possible to achieve the same outcome.
- fsflover 5y agoSee also: https://puri.sm/posts/the-future-of-computers-the-neighborhood-and-the-nursing-home/ https://puri.sm/posts/the-future-of-computers-the-neighborho....