3 ms·

I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It

I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It does not bode well for user privacy.

charcircuit 3y ago
Blame the Linux project's workflow. It's hard to reason about because that patch is Linus merging 7 other patches together and you need to go read the mailing list archives if you want to look up more context about the changes. [0] https://lore.kernel.org/linux-efi/20240308085754.476197-7-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-7-ar... [1] https://lore.kernel.org/linux-efi/20240308085754.476197-8-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-8-ar... [2] https://lore.kernel.org/linux-efi/20240308085754.476197-9-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-9-ar... [3] https://lore.kernel.org/linux-efi/20240308085754.476197-10-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-10-a... [4] https://lore.kernel.org/linux-efi/20240308085754.476197-11-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-11-a... [5] https://lore.kernel.org/linux-efi/20240308085754.476197-12-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-12-a... [6] https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48DTdMyrC98eejj8KUxwGZSHWW8Q@mail.gmail.com/T/ https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48D... [7] https://lkml.org/lkml/2023/12/26/220 https://lkml.org/lkml/2023/12/26/220 [8] https://lkml.org/lkml/2023/12/26/218 https://lkml.org/lkml/2023/12/26/218
- jauntywundrkind 3y ago
  Rather than blame the Linux patch process & iteration for obfuscating, I kind of want to throw the shade & nastiness at Microsoft for iterating security posture & requirements in a subtle way over time where it wasn't clear up front why Linux would need to leap through Gates' hoop of fire here. If it were crystal clear what the need being satisfied were, these patches would probably explain themselves.
  - charcircuit 3y ago
    Microsoft communicated the requirements openly https://techcommunity.microsoft.com/t5/hardware-dev-center/new-uefi-ca-memory-mitigation-requirements-for-signing/ba-p/3608714 https://techcommunity.microsoft.com/t5/hardware-dev-center/n...
    - rbanffy 3y ago
      We might need a competing standard for booting computers that's not invented by Microsoft for Microsoft OSs.

I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It does not bode well for user privacy.

charcircuit 3y ago

Blame the Linux project's workflow. It's hard to reason about because that patch is Linus merging 7 other patches together and you need to go read the mailing list archives if you want to look up more context about the changes. [0] https://lore.kernel.org/linux-efi/20240308085754.476197-7-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-7-ar... [1] https://lore.kernel.org/linux-efi/20240308085754.476197-8-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-8-ar... [2] https://lore.kernel.org/linux-efi/20240308085754.476197-9-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-9-ar... [3] https://lore.kernel.org/linux-efi/20240308085754.476197-10-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-10-a... [4] https://lore.kernel.org/linux-efi/20240308085754.476197-11-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-11-a... [5] https://lore.kernel.org/linux-efi/20240308085754.476197-12-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-12-a... [6] https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48DTdMyrC98eejj8KUxwGZSHWW8Q@mail.gmail.com/T/ https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48D... [7] https://lkml.org/lkml/2023/12/26/220 https://lkml.org/lkml/2023/12/26/220 [8] https://lkml.org/lkml/2023/12/26/218 https://lkml.org/lkml/2023/12/26/218

jauntywundrkind 3y ago
Rather than blame the Linux patch process & iteration for obfuscating, I kind of want to throw the shade & nastiness at Microsoft for iterating security posture & requirements in a subtle way over time where it wasn't clear up front why Linux would need to leap through Gates' hoop of fire here. If it were crystal clear what the need being satisfied were, these patches would probably explain themselves.
- charcircuit 3y ago
  Microsoft communicated the requirements openly https://techcommunity.microsoft.com/t5/hardware-dev-center/new-uefi-ca-memory-mitigation-requirements-for-signing/ba-p/3608714 https://techcommunity.microsoft.com/t5/hardware-dev-center/n...
  - rbanffy 3y ago
    We might need a competing standard for booting computers that's not invented by Microsoft for Microsoft OSs.