3 ms·

>Except there are already POC UEFI level rootkits that can't be detected by the host OS. Is this more common or less common with a chain of trust built in? Ex

>Except there are already POC UEFI level rootkits that can't be detected by the host OS. Is this more common or less common with a chain of trust built in? Existence is not a useful metric - rates are.

Joel_Mckay 4y ago
"Is this more common or less common with a chain of trust built in?" False dilemma, my point was... when someone else holds the signing keys... there is no longer a real chain of trust. Thus, determining whether that someone else is intentionally evil or just grossly incompetent after detected incidents is an irrelevant thought exercise. Have a gloriously wonderful day. =)
- ChrisLomont 4y ago
  >False dilemma It's not a false dilemma. If it provides better protection to the overall set of customers, then it may be a net benefit. No one had validates every virus signature and each line of code (or reverse engineers) in their virus scanner, yet those provide immense value to everyday users. This is no different - adding a feature that protects many users that are not sophisticated enough to manage their own CA, or that don't care to. >there is no longer a real chain of trust I trust a large security focused team to keep machines safe much more than I do the average PC owner or enterprise. If you personally need the trust of your own CA, simply put on in. Many people here (and on the original blog post) point out how easy it is to do.
  - Joel_Mckay 4y ago
    It seems Lenovo just patched 70 laptop models for the exact arbitrary silliness we have seen countless times before: https://www.securityweek.com/lenovo-patches-uefi-code-execution-vulnerability-affecting-many-laptops https://www.securityweek.com/lenovo-patches-uefi-code-execut... Enhance you calm... =)
    - SideQuark 4y ago
      >exact arbitrary silliness we have seen countless times before You continue to make the same mistake: contrast this 70 to how many breaches were prevented by the feature. People with anti-virus software get viruses, both before and after getting updates. Is it therefore silliness to use anti-virus software? Or is there huge benefit to running it. Cars with locks get robbed. Is is silliness therefore to have car locks? Or is there still large benefit to having locks? Many people died after getting the COVID vaccine. Does that mean the vaccine had no benefit? You repeat this exact error over and over, even after having it pointed out. Why? "Enhance you calm" indeed. Whatever that means.
      - Joel_Mckay 4y ago
        “contrast this 70 to how many breaches were prevented by the feature.” You mean... just like how elephants may be scared by computer mice, and that's why most offices are not infested by pachyderms. Your straw-man arguments will continue to incur ridicule friend, as they are provably irrelevant to the stated facts. https://en.wikipedia.org/wiki/Simpson's_paradox https://en.wikipedia.org/wiki/Simpson's_paradox https://en.wikipedia.org/wiki/Informal_fallacy https://en.wikipedia.org/wiki/Informal_fallacy “Is it therefore silliness to use anti-virus software?” Starting another straw-man 2? let us discuss placebos that incur liabilities again… Many antivirus packages quietly collect user telemetry data, provide remote access, and break the host OS. People have documented armored-malware that utilize the antivirus program itself to bust through into kernel privileges ( https://www.zdnet.com/article/this-new-malware-exploits-bugs-in-antivirus-software-to-steal-your-data/ https://www.zdnet.com/article/this-new-malware-exploits-bugs... ). Note, people primarily run signature scans on servers to protect Windows OS users from known email worms. “ Is is silliness therefore to have car locks?” Starting another straw-man 3? If you are a 2012-2022 Honda owner, than the factory digital-locking system is already broken for thousands of users. A physical key to a lock is something you possess, where a factory fob can be broken once the third party is eventually compromised. https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-on-my-own-car-it-totally-worked https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-... “Does that mean the vaccine had no benefit?” Starting another straw-man 4? A vaccine dose only protects against known variants, but often reduces the chances of dying due to how the virus variants severity has attenuated thus far. In my country we have above 86% immunization rates, but testing shows roughly 43% of the population were still infected at some point. Knowing people that were affected before the vaccine was available, in my anecdotal opinion the vaccine likely saved a lot of people suffering. “You repeat this exact error over and over, even after having it pointed out. Why?” I am polity waiting for a valid argument to teach you something important, but so far only see petulance driven fallacious nonsense. You have failed to convince anyone an off-topic straw-man strategy is valid, and I recommend this video as an introduction on evaluating information: https://www.youtube.com/watch?v=aNSHZG9blQQ https://www.youtube.com/watch?v=aNSHZG9blQQ On a unrelated matter, I find the Yellow Feather Fund’s work with autistic children a worthy cause for donations. https://www.sesameworkshop.org/donate/other-ways-support-us https://www.sesameworkshop.org/donate/other-ways-support-us Have a gloriously wonderful day, =)

Joel_Mckay 4y ago

"Is this more common or less common with a chain of trust built in?" False dilemma, my point was... when someone else holds the signing keys... there is no longer a real chain of trust. Thus, determining whether that someone else is intentionally evil or just grossly incompetent after detected incidents is an irrelevant thought exercise. Have a gloriously wonderful day. =)

ChrisLomont 4y ago
>False dilemma It's not a false dilemma. If it provides better protection to the overall set of customers, then it may be a net benefit. No one had validates every virus signature and each line of code (or reverse engineers) in their virus scanner, yet those provide immense value to everyday users. This is no different - adding a feature that protects many users that are not sophisticated enough to manage their own CA, or that don't care to. >there is no longer a real chain of trust I trust a large security focused team to keep machines safe much more than I do the average PC owner or enterprise. If you personally need the trust of your own CA, simply put on in. Many people here (and on the original blog post) point out how easy it is to do.
- Joel_Mckay 4y ago
  It seems Lenovo just patched 70 laptop models for the exact arbitrary silliness we have seen countless times before: https://www.securityweek.com/lenovo-patches-uefi-code-execution-vulnerability-affecting-many-laptops https://www.securityweek.com/lenovo-patches-uefi-code-execut... Enhance you calm... =)
  - SideQuark 4y ago
    >exact arbitrary silliness we have seen countless times before You continue to make the same mistake: contrast this 70 to how many breaches were prevented by the feature. People with anti-virus software get viruses, both before and after getting updates. Is it therefore silliness to use anti-virus software? Or is there huge benefit to running it. Cars with locks get robbed. Is is silliness therefore to have car locks? Or is there still large benefit to having locks? Many people died after getting the COVID vaccine. Does that mean the vaccine had no benefit? You repeat this exact error over and over, even after having it pointed out. Why? "Enhance you calm" indeed. Whatever that means.
    - Joel_Mckay 4y ago
      “contrast this 70 to how many breaches were prevented by the feature.” You mean... just like how elephants may be scared by computer mice, and that's why most offices are not infested by pachyderms. Your straw-man arguments will continue to incur ridicule friend, as they are provably irrelevant to the stated facts. https://en.wikipedia.org/wiki/Simpson's_paradox https://en.wikipedia.org/wiki/Simpson's_paradox https://en.wikipedia.org/wiki/Informal_fallacy https://en.wikipedia.org/wiki/Informal_fallacy “Is it therefore silliness to use anti-virus software?” Starting another straw-man 2? let us discuss placebos that incur liabilities again… Many antivirus packages quietly collect user telemetry data, provide remote access, and break the host OS. People have documented armored-malware that utilize the antivirus program itself to bust through into kernel privileges ( https://www.zdnet.com/article/this-new-malware-exploits-bugs-in-antivirus-software-to-steal-your-data/ https://www.zdnet.com/article/this-new-malware-exploits-bugs... ). Note, people primarily run signature scans on servers to protect Windows OS users from known email worms. “ Is is silliness therefore to have car locks?” Starting another straw-man 3? If you are a 2012-2022 Honda owner, than the factory digital-locking system is already broken for thousands of users. A physical key to a lock is something you possess, where a factory fob can be broken once the third party is eventually compromised. https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-on-my-own-car-it-totally-worked https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-... “Does that mean the vaccine had no benefit?” Starting another straw-man 4? A vaccine dose only protects against known variants, but often reduces the chances of dying due to how the virus variants severity has attenuated thus far. In my country we have above 86% immunization rates, but testing shows roughly 43% of the population were still infected at some point. Knowing people that were affected before the vaccine was available, in my anecdotal opinion the vaccine likely saved a lot of people suffering. “You repeat this exact error over and over, even after having it pointed out. Why?” I am polity waiting for a valid argument to teach you something important, but so far only see petulance driven fallacious nonsense. You have failed to convince anyone an off-topic straw-man strategy is valid, and I recommend this video as an introduction on evaluating information: https://www.youtube.com/watch?v=aNSHZG9blQQ https://www.youtube.com/watch?v=aNSHZG9blQQ On a unrelated matter, I find the Yellow Feather Fund’s work with autistic children a worthy cause for donations. https://www.sesameworkshop.org/donate/other-ways-support-us https://www.sesameworkshop.org/donate/other-ways-support-us Have a gloriously wonderful day, =)