2 ms·

Computers should abide by their owners. Any computer not doing that is broken.

by tosti 7mo ago

cferry 7mo ago
I make the analogy with a company, because on that front, ownership seems to matter a lot in the Western world. It's like it had to have unfaithful management appointed by another company they're a customer of, as a condition to use their products. Worse, said provider is also a provider for every other business, and their products are not interoperable. How long before courts jump in to prevent this and give back control to the business owner?
wat10000 7mo ago
This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.
- ghighi7878 7mo ago
  We dont need to get philosophical here. You(the admin) can require you (the user) to input a password to signify to you(the admin) to install a ransomware when a link is clicked. That way no control is lost.
  - wat10000 7mo ago
    What if the cat pictures are an app too? The computer can't require a password specifically for ransomware, just for software in general. The UI flow for cat pictures apps and ransomware will be identical.
    - Zak 7mo ago
      A computer that can run arbitrary programs can necessarily run malicious ones. Useful operations are often dangerous, and a completely safe computer isn't very useful. Some sandboxing and a little friction to reduce mistakes is usually wise, but a general-purpose computer that can't be broken through sufficiently determined misuse by its owner is broken as designed.
- tosti 7mo ago
  If you connect your computer to the Internet, it can get hacked. If you leave it logged in unattended or don't use authentication, someone else can use it without your permission. This isn't rocket science and it has nothing to do with artificially locking down a computer to serve the vendor instead of the owner. Edit: I'd like to add that no amount of extra warranty from the vendors are going to cover the risk of a malware infection.
- account42 7mo ago
  The ransomware can encrypt the files in your home directory just as well with secure boot enabled. This is just another example of how secure boot provides zero additional security for the threat modes normal users face.
  - tosti 7mo ago
    https://xkcd.com/1200/ https://xkcd.com/1200/
ghighi7878 7mo ago
Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl
- PunchyHamster 7mo ago
  > Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. ...it's already allowed. The problem is that this isn't the default, but opt in that you need quite a lot of knowledge to set up
  - ghighi7878 7mo ago
    I have set it up on worst laptops. There are laptops like hp x360 which doesn't allow modification at all.
- miki123211 7mo ago
  But that's how it already works. If you install Windows first, Microsoft takes control (but it graciously allows Linux distros to use their key). If you install Linux first, you take control. It's perfectly possible for you to maintain your own fully-secure trust chain, including a TPM setup which E.G. lets you keep a 4-digit pin while keeping your system secure against brute force attacks. You can't do that with the 1990s "encryption is all you need" style of system security.
  - ray_v 7mo ago
    It's funny, but I just encountered this for the first time the other day - feels like I had to do a lot of digging to find out how to do this so that I could add my LUKS key to my TPM... really felt like it took some doing on the HP all-in-one that I was trying to put debian on... maybe because it was debian being debian
  - ghighi7878 7mo ago
    Not really. There are many laptops where you cannot rrally get rid of Microsoft key and also cannot put your own key.

Computers should abide by their owners. Any computer not doing that is broken.

by tosti 7mo ago

Computers should abide by their owners. Any computer not doing that is broken.

I make the analogy with a company, because on that front, ownership seems to matter a lot in the Western world. It's like it had to have unfaithful management appointed by another company they're a customer of, as a condition to use their products. Worse, said provider is also a provider for every other business, and their products are not interoperable. How long before courts jump in to prevent this and give back control to the business owner?

wat10000 7mo ago

This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.

ghighi7878 7mo ago
We dont need to get philosophical here. You(the admin) can require you (the user) to input a password to signify to you(the admin) to install a ransomware when a link is clicked. That way no control is lost.
- wat10000 7mo ago
  What if the cat pictures are an app too? The computer can't require a password specifically for ransomware, just for software in general. The UI flow for cat pictures apps and ransomware will be identical.
  - Zak 7mo ago
    A computer that can run arbitrary programs can necessarily run malicious ones. Useful operations are often dangerous, and a completely safe computer isn't very useful. Some sandboxing and a little friction to reduce mistakes is usually wise, but a general-purpose computer that can't be broken through sufficiently determined misuse by its owner is broken as designed.
tosti 7mo ago
If you connect your computer to the Internet, it can get hacked. If you leave it logged in unattended or don't use authentication, someone else can use it without your permission. This isn't rocket science and it has nothing to do with artificially locking down a computer to serve the vendor instead of the owner. Edit: I'd like to add that no amount of extra warranty from the vendors are going to cover the risk of a malware infection.
account42 7mo ago
The ransomware can encrypt the files in your home directory just as well with secure boot enabled. This is just another example of how secure boot provides zero additional security for the threat modes normal users face.
- tosti 7mo ago
  https://xkcd.com/1200/ https://xkcd.com/1200/

ghighi7878 7mo ago

Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl

PunchyHamster 7mo ago
> Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. ...it's already allowed. The problem is that this isn't the default, but opt in that you need quite a lot of knowledge to set up
- ghighi7878 7mo ago
  I have set it up on worst laptops. There are laptops like hp x360 which doesn't allow modification at all.
miki123211 7mo ago
But that's how it already works. If you install Windows first, Microsoft takes control (but it graciously allows Linux distros to use their key). If you install Linux first, you take control. It's perfectly possible for you to maintain your own fully-secure trust chain, including a TPM setup which E.G. lets you keep a 4-digit pin while keeping your system secure against brute force attacks. You can't do that with the 1990s "encryption is all you need" style of system security.
- ray_v 7mo ago
  It's funny, but I just encountered this for the first time the other day - feels like I had to do a lot of digging to find out how to do this so that I could add my LUKS key to my TPM... really felt like it took some doing on the HP all-in-one that I was trying to put debian on... maybe because it was debian being debian
- ghighi7878 7mo ago
  Not really. There are many laptops where you cannot rrally get rid of Microsoft key and also cannot put your own key.