4 ms·

"Protecting" exactly how? Giving the user more hops to jump through, when they want to try alternate (signed!) operating systems? Like, you have nice encrypted

"Protecting" exactly how? Giving the user more hops to jump through, when they want to try alternate (signed!) operating systems? Like, you have nice encrypted disk here, are you willing to lose it, when you flip the setting?

peoplefromibiza 4y ago
computers should never boot by default from USB sticks or external storage in general. it's a very dangerous attack vector. EDIT: writing from a Lenovo laptop where Linux it's the sole OS installed. Allowing Linux to boot was a hundred times simpler than allowing DOOM to run on my 486 with 4MB of RAM.
- vetinari 4y ago
  How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes, at least.
  - peoplefromibiza 4y ago
    > How is it a dangerous attack vector? The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?). Not trusting external and/or removable storage as a valid bootable source is a sensible default. p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.
    - vetinari 4y ago
      So they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing). The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
      - peoplefromibiza 4y ago
        > The default for years was to boot from external storage, when the internal is not bootable Not on my computers for the past 20 years. If the default is not bootable a “no bootable device found” message appears. computers should never automatically boot from external storage, unless the user wants to.
        vetinari 4y ago
        For devices that I've bought in the last ~10 years (i.e. coming with UEFI, between Thinkpad T430s in 2012 and NUC11 few weeks ago), the default was: - try to boot the internal devices - then try external (some even distinguish optical and key fobs) - then try PXE and only when all of these fail, message the user "no bootable device found".
        peoplefromibiza 4y ago
        I remember some desktop computers did, but it was when external boot devices where CD-ROM And even then this message appeared Press any key to boot from CD... https://i.imgur.com/VyZOuob.png https://i.imgur.com/VyZOuob.png
        vetinari 4y ago
        It is legacy boot, not UEFI. And I vaguely remember that this message came from the boot loader on the CD, of all places. It was a convenience for the user, who forgot the CD in the drive.
        peoplefromibiza 4y ago
        > It was a convenience for the user, who forgot the CD in the drive. because computers should never automatically boot from external or removable storage that's why a more modern version of the same message exists https://i.imgur.com/JVW8c7b.png https://i.imgur.com/JVW8c7b.png
    - realusername 4y ago
      And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you are booting is safer than what you already got installed...
      - peoplefromibiza 4y ago
        > And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.
        vetinari 4y ago
        > I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
        peoplefromibiza 4y ago
        it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
        vetinari 4y ago
        And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
        peoplefromibiza 4y ago
        > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.
- phendrenad2 4y ago
  I think they should. My home PC, which is used for gaming, is not likely subject to an evildoer with a kali linux USB stick. So I should be able to boot it from MY USB sticks without any hassle. It should be a BIOS boot menu option. If people in corporate environments want to disable this, they can set a BIOS password to keep others out of the boot menu.

peoplefromibiza 4y ago

computers should never boot by default from USB sticks or external storage in general. it's a very dangerous attack vector. EDIT: writing from a Lenovo laptop where Linux it's the sole OS installed. Allowing Linux to boot was a hundred times simpler than allowing DOOM to run on my 486 with 4MB of RAM.

vetinari 4y ago
How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes, at least.
- peoplefromibiza 4y ago
  > How is it a dangerous attack vector? The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?). Not trusting external and/or removable storage as a valid bootable source is a sensible default. p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.
  - vetinari 4y ago
    So they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing). The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
    - peoplefromibiza 4y ago
      > The default for years was to boot from external storage, when the internal is not bootable Not on my computers for the past 20 years. If the default is not bootable a “no bootable device found” message appears. computers should never automatically boot from external storage, unless the user wants to.
      - vetinari 4y ago
        For devices that I've bought in the last ~10 years (i.e. coming with UEFI, between Thinkpad T430s in 2012 and NUC11 few weeks ago), the default was: - try to boot the internal devices - then try external (some even distinguish optical and key fobs) - then try PXE and only when all of these fail, message the user "no bootable device found".
        peoplefromibiza 4y ago
        I remember some desktop computers did, but it was when external boot devices where CD-ROM And even then this message appeared Press any key to boot from CD... https://i.imgur.com/VyZOuob.png https://i.imgur.com/VyZOuob.png
        vetinari 4y ago
        It is legacy boot, not UEFI. And I vaguely remember that this message came from the boot loader on the CD, of all places. It was a convenience for the user, who forgot the CD in the drive.
        peoplefromibiza 4y ago
        > It was a convenience for the user, who forgot the CD in the drive. because computers should never automatically boot from external or removable storage that's why a more modern version of the same message exists https://i.imgur.com/JVW8c7b.png https://i.imgur.com/JVW8c7b.png
  - realusername 4y ago
    And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you are booting is safer than what you already got installed...
    - peoplefromibiza 4y ago
      > And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.
      - vetinari 4y ago
        > I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
        peoplefromibiza 4y ago
        it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
        vetinari 4y ago
        And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
        peoplefromibiza 4y ago
        > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.
phendrenad2 4y ago
I think they should. My home PC, which is used for gaming, is not likely subject to an evildoer with a kali linux USB stick. So I should be able to boot it from MY USB sticks without any hassle. It should be a BIOS boot menu option. If people in corporate environments want to disable this, they can set a BIOS password to keep others out of the boot menu.