10 ms·

And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you

And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? The ubuntu usb key you are booting is safer than what you already got installed...

peoplefromibiza 4y ago
> And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.
- vetinari 4y ago
  > I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
  - peoplefromibiza 4y ago
    it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
    - vetinari 4y ago
      And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
      - peoplefromibiza 4y ago
        > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.
        vetinari 4y ago
        It is not a solution, it is a bad workaround. > device guard and secure boot are different things, related, but different. The problem is that it can have potentially catastrophic impact. If the user enabled Bitlocker, and didn't save recovery key (it will happen for mainstream users), he can lose his windows drive when he tries linux. As I wrote above, another extra-hop for those who would like to go off the beaten windows path.
        peoplefromibiza 4y ago
        > It is not a solution, it is a bad workaround. it's a configuration option. it's a bad workaround for you. I disagree. > If the user enabled Bitlocker, and didn't save recovery key then the user is responsible of being incautious. case closed.
        vetinari 4y ago
        > then the user is responsible of being incautious. Congratulation, you just invalidated the entire raison d'etre of both Secure Boot and this new Device Guard.
- realusername 4y ago
Avamander 4y ago
Funny thing here is that the feature OP stumbled upon, Device Guard, does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one.
- AshamedCaptain 4y ago
  This is ridiculous. Lenovo controls all the preinstalled software as well as the drivers that are shipped with the device. Any of them could install a Superfish-like thing at any point.
  - Avamander 4y ago
    They may control those parts, but Device Guard won't let you install most rootkits. Starting from Secure Boot and Virtualization Based Security ending with Trusted Boot, the system should be capable of rejecting unsigned privileged components and remain secure. Then an AV is probably capable of detecting and removing actual malware. Still not perfect, but way better than without.
    - AshamedCaptain 4y ago
      Superfish was not a kernel rootkit by any measure of the word. You just have to install a new CA then a NDIS filter, neither of these is either a rare or even blocked operation since they are required for preinstalled software such as drivers or even an AV. There would be absolutely no difference on whether you used Secure Boot or not. But worst of all: Superfish was actually _signed_ itself. MS has improved the level of vetting they do now, specially for kernel drivers, but how come anyone can still claim with a serious face that a signature requirement from one CA specifically improves security against malware _from that CA_ (or their associates) ?
      - Avamander 4y ago
        > Superfish was not a kernel rootkit by any measure of the word. I didn't say it was, you kinda ignored the context. The person who I replied to was asking how can they trust their Windows is genuine, I replied to them that the feature causing a stir here does protect against some types of malware. It's a fair assumption that the next thing akin to Superfish would try to implant itself deeper, if given the chance, Device Guard does eliminate some of those ways. > for preinstalled software such as drivers If that driver is actually malicious then Early-Launch Antimalware alongside the kernel being protected, can get rid of it. > There would be absolutely no difference on whether you used Secure Boot or not. I wasn't talking exclusively about Secure Boot. > But worst of all: Superfish was actually _signed_ itself. Sure, now there's a toggle that won't trust some signatures that aren't as heavily vetted (amongst many other things). How is that "ridiculous" or "won't make a difference". Are you just looking for a reason to argue?

peoplefromibiza 4y ago

> And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways? Lenovo does that for you They are legally responsible. > The ubuntu usb key you are booting is safer than what you already got installed... Have you read my post? I use Linux, I'm writing from Debian, on a Lenovo laptop. It took 10 seconds to allow Linux to boot.

vetinari 4y ago
> I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot. On this specific Z13? Or other model, which wasn't "improved" yet?
- peoplefromibiza 4y ago
  it's simply a matter of disabling secure boot. 10 seconds at most. no need for being sarcastic.
  - vetinari 4y ago
    And that's exactly the wrong solution. I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't. There was no sarcasm.
    - peoplefromibiza 4y ago
      > And that's exactly the wrong solution. it's a solution it's only a matter of choice, there's no wrong choice, choices are personal. You're complaining about something that's very easy to overcome. > I do want to use secure boot and TPM2 (I do, currently). Just not with windows You can. just disable device guard. > Why should be secure boot windows exclusive feature? you are angry about the wrong thing device guard and secure boot are different things, related, but different.
      - vetinari 4y ago
        It is not a solution, it is a bad workaround. > device guard and secure boot are different things, related, but different. The problem is that it can have potentially catastrophic impact. If the user enabled Bitlocker, and didn't save recovery key (it will happen for mainstream users), he can lose his windows drive when he tries linux. As I wrote above, another extra-hop for those who would like to go off the beaten windows path.
        peoplefromibiza 4y ago
        > It is not a solution, it is a bad workaround. it's a configuration option. it's a bad workaround for you. I disagree. > If the user enabled Bitlocker, and didn't save recovery key then the user is responsible of being incautious. case closed.
        vetinari 4y ago
        > then the user is responsible of being incautious. Congratulation, you just invalidated the entire raison d'etre of both Secure Boot and this new Device Guard.
realusername 4y ago

Avamander 4y ago

Funny thing here is that the feature OP stumbled upon, Device Guard, does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one.

AshamedCaptain 4y ago
This is ridiculous. Lenovo controls all the preinstalled software as well as the drivers that are shipped with the device. Any of them could install a Superfish-like thing at any point.
- Avamander 4y ago
  They may control those parts, but Device Guard won't let you install most rootkits. Starting from Secure Boot and Virtualization Based Security ending with Trusted Boot, the system should be capable of rejecting unsigned privileged components and remain secure. Then an AV is probably capable of detecting and removing actual malware. Still not perfect, but way better than without.
  - AshamedCaptain 4y ago
    Superfish was not a kernel rootkit by any measure of the word. You just have to install a new CA then a NDIS filter, neither of these is either a rare or even blocked operation since they are required for preinstalled software such as drivers or even an AV. There would be absolutely no difference on whether you used Secure Boot or not. But worst of all: Superfish was actually _signed_ itself. MS has improved the level of vetting they do now, specially for kernel drivers, but how come anyone can still claim with a serious face that a signature requirement from one CA specifically improves security against malware _from that CA_ (or their associates) ?
    - Avamander 4y ago
      > Superfish was not a kernel rootkit by any measure of the word. I didn't say it was, you kinda ignored the context. The person who I replied to was asking how can they trust their Windows is genuine, I replied to them that the feature causing a stir here does protect against some types of malware. It's a fair assumption that the next thing akin to Superfish would try to implant itself deeper, if given the chance, Device Guard does eliminate some of those ways. > for preinstalled software such as drivers If that driver is actually malicious then Early-Launch Antimalware alongside the kernel being protected, can get rid of it. > There would be absolutely no difference on whether you used Secure Boot or not. I wasn't talking exclusively about Secure Boot. > But worst of all: Superfish was actually _signed_ itself. Sure, now there's a toggle that won't trust some signatures that aren't as heavily vetted (amongst many other things). How is that "ridiculous" or "won't make a difference". Are you just looking for a reason to argue?