mjg59

26 ms·

451.
by mjg59 3y ago
Enrolling an MOK requires physical access, so no, a root compromise isn't sufficient to change the boot security chain.
452.
by mjg59 3y ago
Red Hat are headquartered in North Carolina, with the engineering HQ in Massachusetts. There's way more workers on the east coast than the west.
453.
by mjg59 3y ago
Devices that implement the Google Cast protocol all need a trusted keypair and certificate. Reimplementations of the client protocol can just ignore that, but the official ones validate the certificate and won't talk to devices that do
454.
by mjg59 3y ago
https://elon.horse has the details (I swear this is legitimate)
455.
by mjg59 3y ago
...and was not defined by the presence or absence of a Y chromosome. Using genetics to define sex is (by historical standards) extremely new.
456.
by mjg59 3y ago
The correlation between Y chromosomes and sexual characteristics wasn't discovered until the early 20th century, so no. For the vast majority of human existence, the term "Men" has been used without reference to any underlyin
457.
by mjg59 3y ago
If they knowingly misrepresent a claim that content is infringing, they're liable for damages (17 section 512(k)(2)) but didn't commit perjury. If they are simply negligent in making a claim (eg, because a piece of software told t
458.
by mjg59 3y ago
It's more complicated than that - recordings have copyright independent of the original works, so if you make a recording of Bach now, you have copyright over that specific recording even though the music itself is out of copyright. So
459.
by mjg59 3y ago
If I say "I swear under penalty of perjury that the earth is flat" in a cease and desist letter, even if I know that the earth is not flat, I cannot be found guilty of perjury because it is not a context in which I can perjure mys
460.
by mjg59 3y ago
No, since the law is what defines whether you're actually under penalty of perjury, and the law says "A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is au
461.
by mjg59 3y ago
https://en.wikipedia.org/wiki/Mikhail_Gorbachev_Pizza_Hut_co... wasn't even screened in Russia!
462.
by mjg59 3y ago
The signature that's validated by secure boot. If you don't have secure boot turned on then there's no point in verifying PCR 7, because all PCR 7 contains is the secure boot data.
463.
by mjg59 3y ago
And now the signature doesn't match, so the system doesn't boot
464.
by mjg59 3y ago
The situation we're discussing already involves taking the machine apart to short the security eeprom during boot. Once you've accepted physical attacks as part of your threat model it seems reasonable to say that any mitigations
465.
by mjg59 3y ago
If you have secure boot enabled, how does the attacker replace the kernel or bootloader?
466.
by mjg59 3y ago
Signing with the TPM doesn't work super well, given that the TPM's inherent keys can't be used for signing as a privacy protection mechanism. You'd need to store an encrypted key in the image that could be used for signi
467.
by mjg59 3y ago
The BIOS password is a pretty meaningful protection - if it can be easily subverted it's possible to disable security features (such as IOMMU configuration for Thunderbolt devices in the boot environment) that allow an attacker to comp
468.
by mjg59 3y ago
I feel like the obvious "How can we prevent this?" solution is "Don't fail open if your SPI transactions fail"? The most straightforward implementation of this would be for the firmware to read from the security EEP
469.
by mjg59 3y ago
Using anything other than PCR 7 is going to make it very fragile, yes - I have no idea why that doc is recommending using PCR 4 as well.
470.
by mjg59 3y ago
As mentioned in another comment, this literally happens during system bringup when you don't have working RAM yet - link training involves a lot of state and you can't do it in registers alone, so the cache is configured in such a
471.
by mjg59 3y ago
The TPM isn't involved in secure boot. Could you provide some more details about what went wrong?
472.
by mjg59 3y ago
The Central Dogma of molecular biology is that DNA makes RNA, and RNA makes protein. This doesn't explicitly state that there's a 1:1 dependency between these things, but it kind of implies it. This paper describes a discovery tha
473.
by mjg59 3y ago
I don't assume that applications are inherently hostile, but I do not trust that the developer of every application I use to open untrusted input is sufficiently security conscious to prevent those applications from being subverted.
474.
by mjg59 3y ago
Humans aren't capable of emitting an electromagnetic pulse, sensing the reflection, and using the time of flight to calculate distance between themselves and an object. So, no, lidar and radar aren't equivalent to human vision eve
475.
by mjg59 3y ago
If you're in the bay area, the Bay Model in Sausalito is a surprisingly interesting visit. It's a giant scale model of the entire bay area (accurate in two dimensions, compressed in height) with water pumped in and out repeatedly
476.
by mjg59 3y ago
Source code alone can never provide proof of non-maliciousness. Reflections on Trusting Trust demonstrated that almost 40 years ago.
477.
by mjg59 3y ago
> Intel ME's basic function is to display your monitor over network, monitor some hardware temp sensors, and reset the motherboard while your main Intel CPU is running or suspended (or even powered down). No, that's AMT, which
478.
by mjg59 3y ago
In general the ME will only be listening for network traffic if you've enabled AMT functionality (which is restricted to certain enterprise SKUs and has requirements around which networking hardware is used and so on). Otherwise, the M
479.
by mjg59 3y ago
The hardware has the ability to tag packets with certain contents - this is used for more interesting Wake-on-LAN policies (eg, rather than requiring a magic packet, you could have a web server that aggressively suspends and then gets autom
480.
by mjg59 3y ago
The ME isn't in the CPU, it's in the PCH. I'd be astonished if Intel made special parts that didn't use the ME at all, it's much more likely that they just have the HAP bit set in the FIT and the ME largely shuts do

More ›