3 ms·
One of the many reasons I never run Windows natively any more. If for some reason I need it(rare), it's always in a VM, preferably with no internet access. Tur
by mtlmtlmtlmtl 3y ago
One of the many reasons I never run Windows natively any more. If for some reason I need it(rare), it's always in a VM, preferably with no internet access.
Turns out it was a good policy to have, because when I built a new desktop/home workstation system recently I happened to go with a gigabyte mobo, which has that firmware hole enabled by Windows essentially willy nilly downloading and installing whatever unsigned blobs you throw at it.
Had I ever installed windows directly on that machine, I would have had to assume every component with any form of non-volatile storage on it(i.e pretty much every component except maybe the CPU itself) was potentially compromised, making it useless as a workstation, at least in doing any kind of work for customers, which I prefer to do from home. Because once the firmware is compromised, all bets are off.
- dantyti 3y agoIs there a writeup of Windows enabling the firmware hole anywhere? I'd like to know more about this
- mtlmtlmtlmtl 3y agohttps://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...
- deleted 3y ago[deleted]
- phantompeace 3y agoJust curious, how often do you audit the compilers that you use? Specifically, how often have you read the compiler source code line by line and when is the last time you compiled those compilers using known, clean compilers?
- mtlmtlmtlmtl 3y agoWhy, are you trying to argue that all security concerns are trivial because I can't check everything at all times?
- PrimeMcFly 3y agoI would guess they are arguing there is a comparable likelihood of compromise in both situations.