4 ms·

> microsoft: ofc, you just need a phd in software to workaround all the efi nasty blockades we did put in That's not a fair assessment. Linux used a whiteliste

by csdvrx 4y ago

> microsoft: ofc, you just need a phd in software to workaround all the efi nasty blockades we did put in That's not a fair assessment. Linux used a whitelisted shim, which only included accepted entries in an easy-to-edit/hack EFI variable. Imagine writing your secret password on a normal VFAT partition that any OS can boot/read/change. This is the equivalent. The proper way is to enroll the private keys with the bios, and sign the payloads yourself (or let your distribution handle that), which is way more secure and can be automatized if you select the custom secureboot.

account-5 4y ago
Seems fair to me when your alternatives are install a signing key (for your Linux os) yourself to the EFI, disable secure boot, or allow MS to be the gatekeeper of what software can run on your PC, including the distro getting itself OK'd by MS with their separate OS key that might or might not be included by the OEM. Happy to be corrected if things have changed since the last time I looked at things.
franga2000 4y ago
> The proper way is to enroll the private keys with the bios But a method of doing that wasn't included in the UEFI standard for obvious Microsoft reasons, so few vendors support it and those that do usually don't do it correctly, let alone in a standardised way.
matheusmoreira 4y ago
> The proper way is to enroll the private keys with the bios Not always possible. Depends on firmware support and we all know how shitty proprietary firmware can be.
- csdvrx 4y ago
  I have yet to see a firmware that doesn't allow me to enroll private keys. It's a basic UEFI features, and IIRC Microsoft requires that to be possible for intel hardware: if you don't, no Windows. When you control the keys, SecureBoot is a good thing at least as good as encryption! There are things that are fair to complain about, but on this, I don't see how Microsoft or anyone could have done any better to be playing nice with Linux while helping customers.
  - matheusmoreira 4y ago
    > I have yet to see a firmware that doesn't allow me to enroll private keys. I have computers that don't have this feature. > When you control the keys, SecureBoot is a good thing at least as good as encryption! I agree. It's all about who owns the keys to the machine. If we do, then it's all good.

by csdvrx 4y ago

account-5 4y ago

Seems fair to me when your alternatives are install a signing key (for your Linux os) yourself to the EFI, disable secure boot, or allow MS to be the gatekeeper of what software can run on your PC, including the distro getting itself OK'd by MS with their separate OS key that might or might not be included by the OEM. Happy to be corrected if things have changed since the last time I looked at things.

franga2000 4y ago

> The proper way is to enroll the private keys with the bios But a method of doing that wasn't included in the UEFI standard for obvious Microsoft reasons, so few vendors support it and those that do usually don't do it correctly, let alone in a standardised way.

matheusmoreira 4y ago

> The proper way is to enroll the private keys with the bios Not always possible. Depends on firmware support and we all know how shitty proprietary firmware can be.

csdvrx 4y ago
I have yet to see a firmware that doesn't allow me to enroll private keys. It's a basic UEFI features, and IIRC Microsoft requires that to be possible for intel hardware: if you don't, no Windows. When you control the keys, SecureBoot is a good thing at least as good as encryption! There are things that are fair to complain about, but on this, I don't see how Microsoft or anyone could have done any better to be playing nice with Linux while helping customers.
- matheusmoreira 4y ago
  > I have yet to see a firmware that doesn't allow me to enroll private keys. I have computers that don't have this feature. > When you control the keys, SecureBoot is a good thing at least as good as encryption! I agree. It's all about who owns the keys to the machine. If we do, then it's all good.