2 ms·

> Except there are already POC UEFI level rootkits that can't be detected by the host OS. I don't see how that changes anything? There are also HDD firmware ha

> Except there are already POC UEFI level rootkits that can't be detected by the host OS. I don't see how that changes anything? There are also HDD firmware hacks which can't be detected by the OS. Does that mean we should do away with filesystem security and permissions? You still have to hack the UEFI to get a rootkit in there. And yes, everything can get hacked. But that's not an excuse not to have security, is it? > Thus, such systems would appear to function normally to the common users, Secure boot changes nothing in that scenario. You can also hack the UEFI and install a root kit without the UEFI even supporting secure boot. > Again, one wrongly assumes a supplier hardware comes into a facility clean in the first place, If you find supply chain security important, then you should choose your supplier accordingly. That has nothing to do with secure boot.

Joel_Mckay 4y ago
"then you should choose your supplier accordingly" Yes, choose the refurbished, quietly restocked, and or disgruntled worker malware for your CEO. If you sell out, than don't go halfway dude... but buy a SSD/HDD retail like a sane person. ;) "I don't see how that changes anything?" Well... Lenovo just patched 70 models for UEFI security issues, so some people see this a little differently. While I respect you opinion, it is irresponsible to frame blatant illegal product tying as a security feature. "Secure boot changes nothing in that scenario" We can agree it does nothing for security in most scenarios, and it is really weird some are so emotionally invested in convincing people otherwise. "we should do away with filesystem security and permissions?" While I appreciate the off-topic rhetoric, one needs to recognize the main issue I see is who holds the signing keys. Would you buy a car someone in the next town needs to unlock for you everyday, well apparently some people are that lame. I think we will have to agree to disagree on this issue =)

Joel_Mckay 4y ago

"then you should choose your supplier accordingly" Yes, choose the refurbished, quietly restocked, and or disgruntled worker malware for your CEO. If you sell out, than don't go halfway dude... but buy a SSD/HDD retail like a sane person. ;) "I don't see how that changes anything?" Well... Lenovo just patched 70 models for UEFI security issues, so some people see this a little differently. While I respect you opinion, it is irresponsible to frame blatant illegal product tying as a security feature. "Secure boot changes nothing in that scenario" We can agree it does nothing for security in most scenarios, and it is really weird some are so emotionally invested in convincing people otherwise. "we should do away with filesystem security and permissions?" While I appreciate the off-topic rhetoric, one needs to recognize the main issue I see is who holds the signing keys. Would you buy a car someone in the next town needs to unlock for you everyday, well apparently some people are that lame. I think we will have to agree to disagree on this issue =)