2 ms·
Systems have been shipping for years without any untrusted DMA-capable buses (source: I audited a bunch of this in a large enterprise). Anyone who's currently s
by mjg59 4y ago
Systems have been shipping for years without any untrusted DMA-capable buses (source: I audited a bunch of this in a large enterprise). Anyone who's currently shipping systems with the 3rd Party UEFI CA disabled by default who isn't disabling untrusted DMA-capable buses is selling snakeoil, and the ones who do aren't obtaining meaningful additional security by doing so.
- Avamander 4y ago> Systems have been shipping for years without any untrusted DMA-capable buses (source: I audited a bunch of this in a large enterprise) That's your mistake here, you saw it in a large enterprise, the context is "average user". > 3rd Party UEFI CA disabled by default who isn't disabling untrusted DMA-capable buses is selling snakeoil, and the ones who do aren't obtaining meaningful additional security by doing so. Some of the buses that haven't been whitelisted are only internal, so technically not snakeoil, just won't let you auto-enable encryption.
- mjg59 4y agoHonestly onus is on you to prove that current hardware that disables the 3rd Party UEFI CA doesn't also enable TPM-backed Bitlocker by default, because all examples I've seen do.