4 ms·

Why don't you come up with a solution to avoid boot time undetectable rootkits instead of railing against big bad MS? >they have managed to actually extract mo

Why don't you come up with a solution to avoid boot time undetectable rootkits instead of railing against big bad MS? >they have managed to actually extract money from open-source developers Yes, I am sure Microsoft is laughing all the way to the bank with the $99 that RedHat is going to pay them. I doubt that program will even cover its cost to MS.

nitrogen 14y ago
Do it the same, but place certificate signing under the control of a neutral party, and mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates.
- recoiledsnake 14y ago
  >mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates. Do you realize that Microsoft has done exactly that? There's so much hot air here that facts are getting lost in the blind raging and hating. Of course, they cannot dictate to OEMs because of the antitrust lawsuits, but it's a requirement if they want the PC to be Windows Certified and carry the Windows sticker.
  - InclinedPlane 14y ago
    I'm not a fan of the way secure boot has been playing out, but I don't see any evidence of MS villainy in it. It's crazy how much irrational ill-will is stored out there against anything MS does.
    - fpgeek 14y ago
      I'd say plenty of the ill-will isn't irrational. Microsoft did spend roughly two decades or so earning it, after all.
gioele 14y ago
> Yes, I am sure Microsoft is laughing all the way to the bank with the $99 that RedHat is going to pay them. This is probably a foot in the door towards more cumbersome and restrictive measures on servers, where security matters much more and where the big money is.
Anderkent 14y ago
Is that even a problem? Compared to how many kernel-level rootkits there are, are you really worried about getting a bios rootkit that much? If this was really about security, MS would focus on fixing their sandboxing. This is about locking people into their software once they buy the machine. You can't install another system by using something like wubi anymore - now you have to know how to disable secure boot or get new keys into it.

nitrogen 14y ago

Do it the same, but place certificate signing under the control of a neutral party, and mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates.

recoiledsnake 14y ago
>mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates. Do you realize that Microsoft has done exactly that? There's so much hot air here that facts are getting lost in the blind raging and hating. Of course, they cannot dictate to OEMs because of the antitrust lawsuits, but it's a requirement if they want the PC to be Windows Certified and carry the Windows sticker.
- InclinedPlane 14y ago
  I'm not a fan of the way secure boot has been playing out, but I don't see any evidence of MS villainy in it. It's crazy how much irrational ill-will is stored out there against anything MS does.
  - fpgeek 14y ago
    I'd say plenty of the ill-will isn't irrational. Microsoft did spend roughly two decades or so earning it, after all.

gioele 14y ago

> Yes, I am sure Microsoft is laughing all the way to the bank with the $99 that RedHat is going to pay them. This is probably a foot in the door towards more cumbersome and restrictive measures on servers, where security matters much more and where the big money is.

Anderkent 14y ago

Is that even a problem? Compared to how many kernel-level rootkits there are, are you really worried about getting a bios rootkit that much? If this was really about security, MS would focus on fixing their sandboxing. This is about locking people into their software once they buy the machine. You can't install another system by using something like wubi anymore - now you have to know how to disable secure boot or get new keys into it.