4 ms·

> We've revoked a bunch of vulnerable Linux bootloaders, but the level of pain involved in revoking a Windows one is almost certainly way higher. Revoking oth

> We've revoked a bunch of vulnerable Linux bootloaders, but the level of pain involved in revoking a Windows one is almost certainly way higher. Revoking other OSes install media en-masse is fine, but not Windows ?

Sunspark 4y ago
Linux users tend to be their own support. Windows users are commercial support which is $.
LoganDark 4y ago
You can't exactly swap out the bootloader on Windows install media. You can on Linux because it's a modular component of the system, but on Windows the entire OS + kernel + bootloader is a single image.
- deleted 4y ago
  [deleted]
michaelt 4y ago
I wouldn't be surprised if 50% of Linux users already have Secure Boot disabled - and probably 98% of Linux users have the wherewithal to get into the BIOS and disable it if they needed to. And doing so has negligible downsides, as almost nobody on Linux has been fool enough to make use of the TPM.
- candiddevmike 4y ago
  TPM support on Linux (for drive encryption) is getting better with tools like clevis. Additionally, systemd can do a ton of cool things with TPM, and projects like dm-verity can make linux's boot process more locked down than Windows. I personally will always use a passphrase for device encryption.
  - Laaas 4y ago
    Passphrase + TPM is best.
- cryptonector 4y ago
  > [...] almost nobody on Linux has been fool enough to make use of the TPM. Can you elaborate as to what is foolish about using a TPM?
  - ghostpepper 4y ago
    Not the OP but just anecdotally, last time I looked into enabling secure boot on my X1 Carbon there was an advisory from Lenovo that enrolling your own keys made it possible to brick the machine https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(Gen_7) https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(...
    - privacyking 4y ago
      That's only if you fail to enroll the Lenovo hardware firmware images
      - ghostpepper 4y ago
        Can you link to a doc explaining how to do that? I'm not even sure what it means to enrol a firmware image. I'd love to finally get this working.
        LoganDark 4y ago
        I think they're referring to the BIOS itself, since even that needs to be signed and verified.
        mjg59 4y ago
        It does, but it's not signed with the UEFI Secure Boot keys (Boot Guard has its own mechanism that's burned into chipset fuses, you can't re-key it)
        privacyking 4y ago
        https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Microsoft_Windows https://wiki.archlinux.org/title/Unified_Extensible_Firmware... It's referring to dual booting windows but the same principles apply.
- JohnFen 4y ago
  I keep it disabled on all my machines. I can secure my machine using whole disk encryption, and secure boot is just a royal pain in the butt. I recognize that I am decreasing my security a bit, but that tradeoff is worth it to me.
  - hilbert42 4y ago
    "...secure boot is just a royal pain in the butt." Fully agree, when I first read the HN story headline my initial reaction was where can I get a copy for use on my own machines.
- throwaway742 4y ago
  Disabling it is always one of the first things I do with a new system even if it is running windows. It's probably not rational, but I hate the whole concept of a TPM.
mjg59 4y ago
Oh, I think the vulnerable Windows images should also be revoked, but pretending that the damage caused is equivalent isn't realistic. Systems have shipped with factory restore partitions that still contain old bootloaders - this revocation update would stop all of those working, which is going to be a significant support burden for all those manufacturers.
- j16sdiz 4y ago
  But it still take a first boot to apply the rovoke list update. Just apply them at the same time.
  - mjg59 4y ago
    That doesn't update the factory install image, and reinstalling that won't roll-back the revocation updates (so it just won't boot instead)
makomk 4y ago
The write-up I saw suggests that revoking the Windows bootloader would cause existing install and restore images to fail to boot even with Secure Boot disabled because it checks its own signature, which would be pretty amazing if true: https://github.com/Wack0/CVE-2022-21894 https://github.com/Wack0/CVE-2022-21894

Sunspark 4y ago

Linux users tend to be their own support. Windows users are commercial support which is $.

LoganDark 4y ago

You can't exactly swap out the bootloader on Windows install media. You can on Linux because it's a modular component of the system, but on Windows the entire OS + kernel + bootloader is a single image.

deleted 4y ago
[deleted]

michaelt 4y ago

I wouldn't be surprised if 50% of Linux users already have Secure Boot disabled - and probably 98% of Linux users have the wherewithal to get into the BIOS and disable it if they needed to. And doing so has negligible downsides, as almost nobody on Linux has been fool enough to make use of the TPM.

candiddevmike 4y ago
TPM support on Linux (for drive encryption) is getting better with tools like clevis. Additionally, systemd can do a ton of cool things with TPM, and projects like dm-verity can make linux's boot process more locked down than Windows. I personally will always use a passphrase for device encryption.
- Laaas 4y ago
  Passphrase + TPM is best.
cryptonector 4y ago
> [...] almost nobody on Linux has been fool enough to make use of the TPM. Can you elaborate as to what is foolish about using a TPM?
- ghostpepper 4y ago
  Not the OP but just anecdotally, last time I looked into enabling secure boot on my X1 Carbon there was an advisory from Lenovo that enrolling your own keys made it possible to brick the machine https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(Gen_7) https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(...
  - privacyking 4y ago
    That's only if you fail to enroll the Lenovo hardware firmware images
    - ghostpepper 4y ago
      Can you link to a doc explaining how to do that? I'm not even sure what it means to enrol a firmware image. I'd love to finally get this working.
      - LoganDark 4y ago
        I think they're referring to the BIOS itself, since even that needs to be signed and verified.
        mjg59 4y ago
        It does, but it's not signed with the UEFI Secure Boot keys (Boot Guard has its own mechanism that's burned into chipset fuses, you can't re-key it)
      - privacyking 4y ago
        https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Microsoft_Windows https://wiki.archlinux.org/title/Unified_Extensible_Firmware... It's referring to dual booting windows but the same principles apply.
JohnFen 4y ago
I keep it disabled on all my machines. I can secure my machine using whole disk encryption, and secure boot is just a royal pain in the butt. I recognize that I am decreasing my security a bit, but that tradeoff is worth it to me.
- hilbert42 4y ago
  "...secure boot is just a royal pain in the butt." Fully agree, when I first read the HN story headline my initial reaction was where can I get a copy for use on my own machines.
throwaway742 4y ago
Disabling it is always one of the first things I do with a new system even if it is running windows. It's probably not rational, but I hate the whole concept of a TPM.

mjg59 4y ago

Oh, I think the vulnerable Windows images should also be revoked, but pretending that the damage caused is equivalent isn't realistic. Systems have shipped with factory restore partitions that still contain old bootloaders - this revocation update would stop all of those working, which is going to be a significant support burden for all those manufacturers.

j16sdiz 4y ago
But it still take a first boot to apply the rovoke list update. Just apply them at the same time.
- mjg59 4y ago
  That doesn't update the factory install image, and reinstalling that won't roll-back the revocation updates (so it just won't boot instead)

makomk 4y ago

The write-up I saw suggests that revoking the Windows bootloader would cause existing install and restore images to fail to boot even with Secure Boot disabled because it checks its own signature, which would be pretty amazing if true: https://github.com/Wack0/CVE-2022-21894 https://github.com/Wack0/CVE-2022-21894