mjg59

29 ms·

391.
by mjg59 3y ago
In theory you could potentially decap the enclave and read data out of it but you would need extremely high end equipment to do that and it would be obviously destructive so it's not in most people's threat model
392.
by mjg59 3y ago
If you trust the hardware then it's entirely possible to tie the release of an encryption key to a fingerprint validated by that hardware. Hardware-backed keys are widely used (the entire WebAuthn ecosystem is predicated upon them bein
393.
by mjg59 3y ago
Yes. It also provides access to the copyrightable elements of the code. In this respect the decompiled code is identical to the object code, which is also made up of a mixture of copyrightable and non-copyrightable elements. Combining copyr
394.
by mjg59 3y ago
Where's the disagreement there? The court concluded that reverse engineering to gain access to the non-copyrightable elements the object code contained was legitimate. It didn't assert that decompiled code wasn't subject to c
395.
by mjg59 3y ago
They took the distributed game binary and ran it through a tool that produced an approximation of source code. At this point the decompiled code is clearly a mechanical transformation of the game binary, and so holds the same copyright stat
396.
by mjg59 3y ago
You need to pump air into a plane to provide oxygen. That implies that you need to let air out. The pressurisation system in planes is able to deal with a moderate amount of air exiting the aircraft without losing pressure, and the lower th
397.
by mjg59 3y ago
Windows 11 was the first release to enforce anything at the OS level, but Windows client sticker certification has required them since 8.1, released in 2013. As a result almost all Windows client systems in the wild have some form of TPM by
398.
by mjg59 3y ago
Microsoft has signed drivers that allow you to modify arbitrary kernel code, so.
399.
by mjg59 3y ago
fTPMs are invulnerable to interposing attacks, but if you add a second TPM and program it as Windows (eg) would and redirect all remote attestation requests to that, the remote site has no way to know that this has happened.
400.
by mjg59 3y ago
TPMs have been widely deployed for around a decade. Widevine doesn't use them - it makes use of the protected video path hardware built into the GPU or motherboard chipset.
401.
by mjg59 3y ago
Such as plugging in a TPM after boot and programming the PCRs however you want
402.
by mjg59 3y ago
Eh no that's not true. If a device uses a discrete TPM and isn't using authenticated sessions it's trivial to sniff the bus and extract the encryption key. If it is then it's less trivial because you need to interpose
403.
by mjg59 3y ago
Preventing your storage from being put in another device is what it's meant to be protecting you against. If it's still in the original device then an attacker is still blocked by your login password.
404.
by mjg59 3y ago
Why is a Yubikey more trustworthy? You don't have the source code, you don't have the hardware design. In addition, a Yubikey is given no information about the system boot state, so is in no position to identify that the system ha
405.
by mjg59 3y ago
In an abstract sense, yes, but were anyone to do that in a widely deployed manner there are fairly easy and cheap ways to circumvent it.
406.
by mjg59 3y ago
If it's that simple, can you point at a single example of Hollywood using the TPM for access control?
407.
by mjg59 3y ago
Netflix doesn't make use of the TPM.
408.
by mjg59 3y ago
How would an end user simply check them for backdoors if they were open source? Security auditing is a skilled job, and the people best capable of identifying security flaws or backdoors are generally able to do that given a binary blob as
409.
by mjg59 3y ago
Yes, the world would be better with better documentation. But that doesn't solve the "How do I ship a new platform that works with existing operating systems" problem. ACPI provides an abstraction that allows some amount of d
410.
by mjg59 3y ago
_OS is basically irrelevant, _OSI has been used for over 20 years now. The right way to think about the values the OS presents to the firmware is in terms of a contract between the OS and the firmware in terms of mutual expectations. Window
411.
by mjg59 3y ago
My point is that focusing on tight integration between OS teams and the underlying platform is a great way to develop a device that only runs one operating system and a terrible way to develop a device that's supposed to be part of an
412.
by mjg59 3y ago
These days most of these failures are bugs in the Linux drivers, not bugs in the firmware. The Lenovo case I mention in the article is actually unusual in that respect.
413.
by mjg59 3y ago
The problem with the PC world is that the firmware and OS teams are not only working for different companies, they're working on different timescales and release cadences. Android devices and Macs are in an entirely different situation
414.
by mjg59 3y ago
This is actually how things are meant to work! Many ACPI features are gated behind a _DSM call that allows the OS to indicate that it has native support for functionality and the firmware should stop touching it itself. It, uh, basically wo
415.
by mjg59 3y ago
And slows boot down by a couple of seconds. As long as the firmware sets a native mode, modern OSes can just inherit that rather than performing a modeset and we just ignore the entire problem anyway.
416.
by mjg59 3y ago
"Fade to black, turn off screen, turn on screen, fade to image" is just slower flicker.
417.
by mjg59 3y ago
Enabling power on after power loss is "just" writing a register value to the chipset, so it's viable to have Linux do that during boot.
418.
by mjg59 3y ago
I don't think any operator has a 1:1 correspondence between vehicles and remote operators. Remote operation is intended to be used when a vehicle has realised it can't handle the current situation it's in and needs external a
419.
by mjg59 3y ago
There are numerous references to increased congestion as a result of the reduced speed limits in built-up areas, but the UK has a fairly strong "You should always be 2 seconds behind the car in front" element to driving rules, and
420.
by mjg59 3y ago
Yes, Coreboot does the hardware bringup and then hands off to SeaBIOS. SeaBIOS can't do that on its own.

More ›