5 ms·

>I can’t see any reason why this message should be displayed so prominently. Because an important security feature (in their eyes, DUH) is disabled. > If a me

by ksk 13y ago

>I can’t see any reason why this message should be displayed so prominently. Because an important security feature (in their eyes, DUH) is disabled. > If a message is needed, at all, then why not display it on the System “View Basic Information about your computer” control panel item. lol.

AaronFriel 13y ago
The above user's incredulous response probably warranted some downvote or two, but ksk is correct in the spirit of his response. What portion of users ever go to the control panel, let alone desire to view basic information about their computer? That's a dark pattern itself, hiding important settings in places where users can't see it.
- ksk 13y ago
  Well, there was nothing incredulous about my response. I found the article devoid of any substance. Its one of those articles that shows up on HN just to spark a few circle-jerks.
- pgeorgi 13y ago
  And what user that never goes to the control panel is able to enable Secure Boot (firmware menu?!?), and to debug issues like mentioned in the article (VGA card with an option ROM that comes without Microsoft signature) if they follow Microsoft's advice? And the douchey part is that Microsoft doesn't even acknowledge issues such as the unsigned option ROM thing.
appleflaxen 13y ago
A prominent warning message makes complete sense. Being unable to disable it does not.
- ksk 13y ago
  >Being unable to disable it does not. Microsoft used an existing UEFI feature to guard against attacks even when your Admin account is compromised. I consider it to be a good thing. I'd want as many clueless people to enable secure boot as possible.
  - jdjb 13y ago
    The parent is referring to the ability to disable the messaging, not the ability to disable secure boot. The only time the messaging is useful is when someone has unintentionally disabled secure boot. In this case they can go enable it again (or bring it to geek squad, etc). If the user intentionally disabled it, then the it should be possible to suppress any warning messages about it. If malicious software somehow disabled it, it can probably also make the registry settings tweaks required to hide the messaging so the user won't know anyway.
    - ksk 13y ago
      SecureBoot is a UEFI setting. There is no way for the OS to determine whether it was intentional or not.
      - vetinari 13y ago
        OK, so it is UEFI setting. That does not mean that the OS has to bug the user about this permanently. What about providing button "OK, got it, now get dismissed"?
        ksk 13y ago
        >What about providing button "OK, got it, now get dismissed"? I don't know the answer to that question, but if I was a malware writer, disabling that warning would be the very first thing I would do.
Tomdarkness 13y ago
There are plenty of other security features, that I'd argue are more important than secure boot, which don't result in a watermark being displayed when disabled. In any case the most likely group of people who will see this message are people who know what they are doing. Off the shelf Windows 8 certified computers will have secure boot as default therefore the message won't be displayed. People who are likely to see this message are: - Those who manually disabled secure boot - Those who purchased components individually and built their PC as most individually purchased motherboards come with secure boot in setup mode (disabled). I'd say people in those two groups are highly likely to know what secure boot is and don't need a reminder about it. Also, let's say your average user somehow sees this message. They are not going to be able to solve the problem themselves. They've most likely never heard of secure boot let alone know how to enter the BIOS and enable it.
- ksk 13y ago
  >There are plenty of other security features, that I'd argue are more important than secure boot, which don't result in a watermark being displayed when disabled. Um.. Okay, Name 5? >I'd say people in those two groups are highly likely to know what secure boot is and don't need a reminder about it. >Also, let's say your average user somehow sees this message. They are not going to be able to solve the problem themselves. They've most likely never heard of secure boot let alone know how to enter the BIOS and enable it. Okay, good, your arguments are valid - BUT - only if your premises is valid. I see - "likely" , "most likely" , "highly likely". How have you established this to be the case?
  - Tomdarkness 13y ago
    DEP, UAC, Security related updates not installed, using built in administrator (technically enabling rather than disabling), or even having your anti-virus disabled. All those help prevent a situation where the boot up sequence is somehow compromised. Whereas secure boot is only reactive - it won't do anything to prevent the malicious software from installing itself in the first place. Also, no, I have not gone out and done a survey to find out how many people understand secure boot. However, if you just use common sense and apply your experiences with interacting with an average user (might be your parents, co-workers, relatives, friends, etc.) then how likely do you think the majority of average users will have even heard of secure boot? I'd be willing to bet money on the answer to that.

by ksk 13y ago

AaronFriel 13y ago

The above user's incredulous response probably warranted some downvote or two, but ksk is correct in the spirit of his response. What portion of users ever go to the control panel, let alone desire to view basic information about their computer? That's a dark pattern itself, hiding important settings in places where users can't see it.

ksk 13y ago
Well, there was nothing incredulous about my response. I found the article devoid of any substance. Its one of those articles that shows up on HN just to spark a few circle-jerks.
pgeorgi 13y ago
And what user that never goes to the control panel is able to enable Secure Boot (firmware menu?!?), and to debug issues like mentioned in the article (VGA card with an option ROM that comes without Microsoft signature) if they follow Microsoft's advice? And the douchey part is that Microsoft doesn't even acknowledge issues such as the unsigned option ROM thing.

appleflaxen 13y ago

A prominent warning message makes complete sense. Being unable to disable it does not.

ksk 13y ago
>Being unable to disable it does not. Microsoft used an existing UEFI feature to guard against attacks even when your Admin account is compromised. I consider it to be a good thing. I'd want as many clueless people to enable secure boot as possible.
- jdjb 13y ago
  The parent is referring to the ability to disable the messaging, not the ability to disable secure boot. The only time the messaging is useful is when someone has unintentionally disabled secure boot. In this case they can go enable it again (or bring it to geek squad, etc). If the user intentionally disabled it, then the it should be possible to suppress any warning messages about it. If malicious software somehow disabled it, it can probably also make the registry settings tweaks required to hide the messaging so the user won't know anyway.
  - ksk 13y ago
    SecureBoot is a UEFI setting. There is no way for the OS to determine whether it was intentional or not.
    - vetinari 13y ago
      OK, so it is UEFI setting. That does not mean that the OS has to bug the user about this permanently. What about providing button "OK, got it, now get dismissed"?
      - ksk 13y ago
        >What about providing button "OK, got it, now get dismissed"? I don't know the answer to that question, but if I was a malware writer, disabling that warning would be the very first thing I would do.

Tomdarkness 13y ago

There are plenty of other security features, that I'd argue are more important than secure boot, which don't result in a watermark being displayed when disabled. In any case the most likely group of people who will see this message are people who know what they are doing. Off the shelf Windows 8 certified computers will have secure boot as default therefore the message won't be displayed. People who are likely to see this message are: - Those who manually disabled secure boot - Those who purchased components individually and built their PC as most individually purchased motherboards come with secure boot in setup mode (disabled). I'd say people in those two groups are highly likely to know what secure boot is and don't need a reminder about it. Also, let's say your average user somehow sees this message. They are not going to be able to solve the problem themselves. They've most likely never heard of secure boot let alone know how to enter the BIOS and enable it.

ksk 13y ago
>There are plenty of other security features, that I'd argue are more important than secure boot, which don't result in a watermark being displayed when disabled. Um.. Okay, Name 5? >I'd say people in those two groups are highly likely to know what secure boot is and don't need a reminder about it. >Also, let's say your average user somehow sees this message. They are not going to be able to solve the problem themselves. They've most likely never heard of secure boot let alone know how to enter the BIOS and enable it. Okay, good, your arguments are valid - BUT - only if your premises is valid. I see - "likely" , "most likely" , "highly likely". How have you established this to be the case?
- Tomdarkness 13y ago
  DEP, UAC, Security related updates not installed, using built in administrator (technically enabling rather than disabling), or even having your anti-virus disabled. All those help prevent a situation where the boot up sequence is somehow compromised. Whereas secure boot is only reactive - it won't do anything to prevent the malicious software from installing itself in the first place. Also, no, I have not gone out and done a survey to find out how many people understand secure boot. However, if you just use common sense and apply your experiences with interacting with an average user (might be your parents, co-workers, relatives, friends, etc.) then how likely do you think the majority of average users will have even heard of secure boot? I'd be willing to bet money on the answer to that.