4 ms·

How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes

How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes, at least.

peoplefromibiza 4y ago
> How is it a dangerous attack vector? The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?). Not trusting external and/or removable storage as a valid bootable source is a sensible default. p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.
- vetinari 4y ago
  So they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing). The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
  - peoplefromibiza 4y ago
    > The default for years was to boot from external storage, when the internal is not bootable Not on my computers for the past 20 years. If the default is not bootable a “no bootable device found” message appears. computers should never automatically boot from external storage, unless the user wants to.
    - vetinari 4y ago
      For devices that I've bought in the last ~10 years (i.e. coming with UEFI, between Thinkpad T430s in 2012 and NUC11 few weeks ago), the default was: - try to boot the internal devices - then try external (some even distinguish optical and key fobs) - then try PXE and only when all of these fail, message the user "no bootable device found".
      - peoplefromibiza 4y ago
        I remember some desktop computers did, but it was when external boot devices where CD-ROM And even then this message appeared Press any key to boot from CD... https://i.imgur.com/VyZOuob.png https://i.imgur.com/VyZOuob.png
        vetinari 4y ago
        It is legacy boot, not UEFI. And I vaguely remember that this message came from the boot loader on the CD, of all places. It was a convenience for the user, who forgot the CD in the drive.
        peoplefromibiza 4y ago
        > It was a convenience for the user, who forgot the CD in the drive. because computers should never automatically boot from external or removable storage that's why a more modern version of the same message exists https://i.imgur.com/JVW8c7b.png https://i.imgur.com/JVW8c7b.png
        vetinari 4y ago
        This is what I'm getting: https://imgur.com/a/C7NNXCr https://imgur.com/a/C7NNXCr It won't boot from USB if the internal drive boots, or unless I manually change boot order.
        ciupicri 4y ago
        That's a message from the Windows installer. Normally you would have to remove the optical disc after the files are copied or change the boot order/devices when the first stage of the installation ends and the computer is rebooted. With this trick, you don't have to do anything.
    - Lukineus 4y ago
      A former work computer of mine (a Lenovo, too!) wouldn't boot one day. After some time trying to figure out the issue I discovered I'd left a (non-bootable) USB drive attached to the machine. Removed the drive and it booted fine. Having said all that, this comment is all anecdotal, much like yours.
- realusername 4y ago
  And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you are booting is safer than what you already got installed...
  - peoplefromibiza 4y ago
    > And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.
    - vetinari 4y ago
      > I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
      - peoplefromibiza 4y ago
        it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
        vetinari 4y ago
        And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
        peoplefromibiza 4y ago
        > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.

How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes, at least.

peoplefromibiza 4y ago

> How is it a dangerous attack vector? The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?). Not trusting external and/or removable storage as a valid bootable source is a sensible default. p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.

vetinari 4y ago
So they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing). The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
- peoplefromibiza 4y ago
  > The default for years was to boot from external storage, when the internal is not bootable Not on my computers for the past 20 years. If the default is not bootable a “no bootable device found” message appears. computers should never automatically boot from external storage, unless the user wants to.
  - vetinari 4y ago
    For devices that I've bought in the last ~10 years (i.e. coming with UEFI, between Thinkpad T430s in 2012 and NUC11 few weeks ago), the default was: - try to boot the internal devices - then try external (some even distinguish optical and key fobs) - then try PXE and only when all of these fail, message the user "no bootable device found".
    - peoplefromibiza 4y ago
      I remember some desktop computers did, but it was when external boot devices where CD-ROM And even then this message appeared Press any key to boot from CD... https://i.imgur.com/VyZOuob.png https://i.imgur.com/VyZOuob.png
      - vetinari 4y ago
        It is legacy boot, not UEFI. And I vaguely remember that this message came from the boot loader on the CD, of all places. It was a convenience for the user, who forgot the CD in the drive.
        peoplefromibiza 4y ago
        > It was a convenience for the user, who forgot the CD in the drive. because computers should never automatically boot from external or removable storage that's why a more modern version of the same message exists https://i.imgur.com/JVW8c7b.png https://i.imgur.com/JVW8c7b.png
        vetinari 4y ago
        This is what I'm getting: https://imgur.com/a/C7NNXCr https://imgur.com/a/C7NNXCr It won't boot from USB if the internal drive boots, or unless I manually change boot order.
      - ciupicri 4y ago
        That's a message from the Windows installer. Normally you would have to remove the optical disc after the files are copied or change the boot order/devices when the first stage of the installation ends and the computer is rebooted. With this trick, you don't have to do anything.
  - Lukineus 4y ago
    A former work computer of mine (a Lenovo, too!) wouldn't boot one day. After some time trying to figure out the issue I discovered I'd left a (non-bootable) USB drive attached to the machine. Removed the drive and it booted fine. Having said all that, this comment is all anecdotal, much like yours.
realusername 4y ago
And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you are booting is safer than what you already got installed...
- peoplefromibiza 4y ago
  > And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.
  - vetinari 4y ago
    > I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
    - peoplefromibiza 4y ago
      it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
      - vetinari 4y ago
        And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
        peoplefromibiza 4y ago
        > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.