5 ms·
It's a shame that Coreboot is being actively killed by Intel and others. For example the new Thinkpads (and other laptops/desktops) with the Broadwell U/Y seri
by sandGorgon 11y ago
It's a shame that Coreboot is being actively killed by Intel and others.
For example the new Thinkpads (and other laptops/desktops) with the Broadwell U/Y series have "Intel Boot Guard" which cryptographically prevents a replacement BIOS from being flashed onto the hardware [1]
I truly wonder what is the long term strategic benefit from doing this ? Isnt the only way to compete against Apple is to open up more ?
[1] http://www.coreboot.org/pipermail/coreboot/2015-February/079208.html http://www.coreboot.org/pipermail/coreboot/2015-February/079...
- wmf 11y agoNumber of bad guys who want to flash malware into your BIOS [1] >> number of freedom fighters who want to flash Coreboot. IMO the solution is economic. If a PC vendor wanted to ship Coreboot I'm sure they would find a way to do it. But people buying Windows PCs and installing Linux are keeping the "native" Linux PC market unsustainably small. [1] http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-systems/ http://blog.trendmicro.com/trendlabs-security-intelligence/h...
- hajile 11y agoWhat are the number of reasons not to add a physical switch so you can if you want?
- CHY872 11y agoThis already exists for desktops (frequently a jumper to enable/disable BIOS flashing). For laptops this is bad by nature of their portability; they're too easy to tamper with.
- jsnell 11y agoIt'd add to the design, QA and manufacturing costs while only increasing the sales by a tiny amount. Given the miniscule margins of PC manufacturers, any increase in the cost would be a hard sell. An increase in the manufacturing cost of say $0.1 might seem totally insignificant when a laptop sells for $500. But when the profit margin on the laptop is $10, that extra widget just cut the profits down by 1%.
- sandGorgon 11y agoThere are already these kind of switches - for example the Chromebook's Coreboot flashing procedure details [1] how to set the jumpers to enable coreboot flashing [1] http://www.coreboot.org/Chromebooks#Firmware_Chips http://www.coreboot.org/Chromebooks#Firmware_Chips
- sandGorgon 11y agoisnt the link about Hacking Team using a UEFI exploit, an argument FOR having an opensource boot system that can be fixed/patched by the community. I mean Intel is one of the biggest contributors to Linux - it cannot be blind to adopting an opensource alternative to insecure BIOS.
- bcg1 11y agoI doubt that Intel is blind to the desires of Microsoft and system manufacturers either.
- sandGorgon 11y agotouche! but there's a new Microsoft in town! I hardly think after being the biggest contributor to OpenBSD [1], they would build a underhanded way of trying to kill Linux. I'm trying to understand if there is an attack vector that is prevented by not allowing coreboot. [1] http://www.theregister.co.uk/2015/07/08/microsoft_donates_to_openbsd_foundation/ http://www.theregister.co.uk/2015/07/08/microsoft_donates_to...
- aaronem 11y agoIt's a lot easier to escalate a binary drop into a persistent threat if it can reflash the BIOS with compromised firmware. Requiring firmware be signed prevents this, at the cost of also preventing the use of coreboot, libreboot et al. In theory, it should be possible to support user flashing of unsigned firmware, perhaps in some sort of OS-less boot mode that malware couldn't use. But offering that capability without it being a backdoor is costly and effortful enough that I don't really blame motherboard manufacturers for declining to do so on behalf of a rather niche use case.
- baghira 11y agoSee http://mjg59.dreamwidth.org/33981.html http://mjg59.dreamwidth.org/33981.html. It does increase security, since for instance in spite of its complexity Secure Boot has proven to be reasonably secure, and thus it is simpler to attack the firmware. However I agree with Garrett and disagree with aaronem: just as shown by Secure Boot on x86, you can have a reasonable choice between security and user's choice i.e. you can give freedom and security. A similar mechanism, in which a user could enroll its keys and install its signed coreboot payload, is possible. The same applies to TPM. Given that Intel had 55 bilions in revenues last year, I see no reason to cut them any slack (same goes for Apple, Qualcomm, etc). As far as the "new Microsoft" goes, the policy on Windows phone is the same on Windows 10 as it was on Windows RT and Windows 8: Secure Boot on ARM is locked down in such a way that the user cannot add its own keys, or send a binary to Microsoft to have its signed for 99$ (i.e. the result is functionally equivalent to Apple policy with ios). If you sell devices on which the users can't even decide which kernel to boot, you probably don't have a problem with devices in which the users can't decide which firmware to use.