4 ms·

You still are scaremongering. Secured core is a class of device security specifically intended to be highly locked down. From https://docs.microsoft.com/en-us

by ziml77 4y ago

You still are scaremongering. Secured core is a class of device security specifically intended to be highly locked down. From https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure https://docs.microsoft.com/en-us/windows-hardware/design/dev...: > Secured-core PCs provide protections that are useful against sophisticated attacks and can provide increased assurance when handling mission-critical data in some of the most data-sensitive industries, such as healthcare workers that handle medical records and other personally identifiable information (PII), commercial roles that handle high business impact and highly sensitive data, such as a financial controller with earnings data. > For general purpose laptops, tablets, 2-in-1’s, mobile workstations, and desktops, Microsoft recommends using Security baselines for optimal configuration. For more info, see Windows security baselines.

MereInterest 4y ago
I don't see why Microsoft working to make an extremely locked-down class of devices should be taken as evidence that Microsoft isn't working to lock down devices, or that they wouldn't have an incentive to lock down devices.
- Avamander 4y ago
  That's not what the person they replied to said though. Providing the means to harden a device do not mean you can't boot non-MS operating systems. It does show intent to harden devices yes, but not what was replied to.
  - AshamedCaptain 4y ago
    > we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated is literally on the first paragraph of my comment.
  - MereInterest 4y ago
    Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. By placing more and more restrictions on the default, each of which must be individually researched and disabled, fewer people are able to exercise their choice. There doesn't need to be a definitive deathblow if you can bleed away the opportunity to choose.
    - Avamander 4y ago
      > Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. It's a huge stretch to call a single toggle in UEFI an "obstacle" if you're already competent enough to install an OS from scratch. Maybe the focus should be on that, how to provide preinstalled Linux instead. > each of which must be individually researched and disabled Or you read the user manual.
      - MereInterest 4y ago
        Hurdles like these are why "competent enough to install an OS" is considered a bar in the first place. I agree that it is good when OEMs offer Linux preinstalled, but that doesn't absolve Microsoft from adding obstacles in cases where OEMs do not. Reading the user manual is a form of research that must be done. When software doesn't allow an action, and doesn't immediately explain what can be done to override the restriction, that's a form of additional research.
AshamedCaptain 4y ago
Only when MS allows booting "vetted" non-MS OSes _with the same amount of effort_ as it takes to boot MS OSes (like what they do already in other devices) there is any minimal chance of believing this is for security, and not for pure market control. If they wanted to have a setting to control whether to block non-MS OSes to boot, they could have put THAT as the hard-to-find option, rather than the opposite. They would not have needed to make an entire class of separate hardware whose only difference is apparently that by default it boots MS OSes only, and who knows how is being pushed behind the scenes.
raxxorraxor 4y ago
But it is untrue that these devices are particularly secure, especially compared to the average linux distribution. This is Microsoft marketing and nothing else. On the contrary, the case for security is not to use MS systems because one of the largest threats for industry is industrial espionage and a lot of Microsoft components and data retention cannot be audited. Boot sector attacks have become quite rare and a sensible threat analysis is the basis of good security. Otherwise you could sell any crap as security. Unplugging your keyboard stops a lot of attacks actually...

by ziml77 4y ago

MereInterest 4y ago

I don't see why Microsoft working to make an extremely locked-down class of devices should be taken as evidence that Microsoft isn't working to lock down devices, or that they wouldn't have an incentive to lock down devices.

Avamander 4y ago
That's not what the person they replied to said though. Providing the means to harden a device do not mean you can't boot non-MS operating systems. It does show intent to harden devices yes, but not what was replied to.
- AshamedCaptain 4y ago
  > we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated is literally on the first paragraph of my comment.
- MereInterest 4y ago
  Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. By placing more and more restrictions on the default, each of which must be individually researched and disabled, fewer people are able to exercise their choice. There doesn't need to be a definitive deathblow if you can bleed away the opportunity to choose.
  - Avamander 4y ago
    > Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. It's a huge stretch to call a single toggle in UEFI an "obstacle" if you're already competent enough to install an OS from scratch. Maybe the focus should be on that, how to provide preinstalled Linux instead. > each of which must be individually researched and disabled Or you read the user manual.
    - MereInterest 4y ago
      Hurdles like these are why "competent enough to install an OS" is considered a bar in the first place. I agree that it is good when OEMs offer Linux preinstalled, but that doesn't absolve Microsoft from adding obstacles in cases where OEMs do not. Reading the user manual is a form of research that must be done. When software doesn't allow an action, and doesn't immediately explain what can be done to override the restriction, that's a form of additional research.

AshamedCaptain 4y ago

Only when MS allows booting "vetted" non-MS OSes _with the same amount of effort_ as it takes to boot MS OSes (like what they do already in other devices) there is any minimal chance of believing this is for security, and not for pure market control. If they wanted to have a setting to control whether to block non-MS OSes to boot, they could have put THAT as the hard-to-find option, rather than the opposite. They would not have needed to make an entire class of separate hardware whose only difference is apparently that by default it boots MS OSes only, and who knows how is being pushed behind the scenes.

raxxorraxor 4y ago

But it is untrue that these devices are particularly secure, especially compared to the average linux distribution. This is Microsoft marketing and nothing else. On the contrary, the case for security is not to use MS systems because one of the largest threats for industry is industrial espionage and a lot of Microsoft components and data retention cannot be audited. Boot sector attacks have become quite rare and a sensible threat analysis is the basis of good security. Otherwise you could sell any crap as security. Unplugging your keyboard stops a lot of attacks actually...