mjg59

47 ms·

661.
by mjg59 4y ago
Yes - the idea is that modules can be pre-built into a set of add-on images that can be independently signed, and the UKI can pick those up. That way you still only install the module images that are required into the boot partition, rather
662.
by mjg59 4y ago
It absolutely can. Fedora uses HFS+ for the ESP on Macs because it integrates more cleanly into the Apple boot menu you get when you hold down command on boot, but the firmware handles FAT just fine.
663.
by mjg59 4y ago
Corporate support of a community-led RHEL compatible OS seems like an obviously good thing, and I'm surprised that so many people are worried about Red Hat's welfare? If someone doesn't feel that the costs of RHEL licensing o
664.
by mjg59 4y ago
The primary issue is that once the ailerons were fully deflected, the control display turned green - even if they were deflected in the wrong direction. It seems that despite this test having been performed multiple times, everyone involved
665.
by mjg59 4y ago
> There are absolutely duplicated framebuffer and storage drivers in the firmware of modern PCs If you're using a desktop machine with a plug-in GPU, the driver for the GPU is carried on the card itself. That driver is implemented a
666.
by mjg59 4y ago
> The question is why would you want to? To make it as easy as possible for people to transition from x86 to arm - having a compatible firmware interface means you don't need to entirely rewrite your deployment tooling when you star
667.
by mjg59 4y ago
Assuming you mean "potential for memtest86+ on UEFI-based aarch64 systems" - memtest86+ takes over the entire system, rather than relying on firmware services. In that respect it's more like a kernel rather than an app, and s
668.
by mjg59 4y ago
The OS running inside the VM hits an external API (one you control, not the CSP), that returns a challenge, the CPU signs a response that includes that challenge and its state, you verify that the signature chains back to AMD. The CSP isn&#
669.
by mjg59 4y ago
AMD's SEV supports providing an attestation to the launch state of the VM, including information about whether the hypervisor has any visibility into the contents of the VM. If this works as described it does genuinely let you decouple
670.
by mjg59 4y ago
Microsoft won't sign EBC drivers, but even before Secure Boot made that difficult I think we'd found a total of 2 EBC UEFI drivers in the real world. It's honestly easier to just embed an x86 emulator.
671.
by mjg59 4y ago
The 240 series were very externally similar, but a bit thicker and weighed more and also had larger TFT screens.
672.
by mjg59 4y ago
The Android ISO C standard library is derived from the BSD libc, which is derived from the UNIX libc, so there's clear evidence of UNIX in Android userland.
673.
by mjg59 4y ago
It was https://www.amazon.com/gp/product/B0768WQ989 but it cost significantly less than that at the time - there's a whole bunch of compatible devices. Basically anything that has a UART at one end and a USB
674.
by mjg59 4y ago
That's https://battlebots.fandom.com/wiki/Double_Jeopardy . The design rules are https://battlebots.com/wp-content/uploads/2022/09/BattleBots... - there are some explicit rules
675.
by mjg59 4y ago
For anyone interested in building such a robot with telemetry support, https://github.com/mjg59/robot_telemetry and https://github.com/mjg59/robot_telemetry_viewer are what ran on Hijinx for part o
676.
by mjg59 4y ago
They could, but it's still limiting - the maximum number of challenges the attacker is able to satisfy is the number of times you touch the token before you realise that something's up.
677.
by mjg59 4y ago
Unfortunately without additional hardware support it's hard to tie TPM FIDO to physical user presence, which means compromising the system doesn't give you access to the secrets but does let you sign as many challenges as you want
678.
by mjg59 4y ago
Linux pays no attention to the hidden attribute. But when you create a dotfile under Linux the clear intent is that the file should be hidden. Linux tooling knows to hide dotfiles by default, but Windows doesn't. So, this patch sets th
679.
by mjg59 4y ago
Zero? Bionic is derived from BSD libc, which surely has continuity back to Unix.
680.
by mjg59 4y ago
So uh the IVI system runs a wifi network and is also on a CAN bus that allows the doors to be unlocked ( https://programmingwithstyle.com/posts/howihackedmycarpart3/ )? This seems like a situation that might have ba
681.
by mjg59 4y ago
mgarrett@chiark:~$ file /lib/libc.so.4.6.27 /lib/libc.so.4.6.27: Linux/i386 demand-paged executable (QMAGIC), stripped mgarrett@chiark:~$ dpkg -S /lib/libc.so.4.6.27 libc4:i386: /lib&#x2F
682.
by mjg59 4y ago
Windows 11 requires hardware that enables this capability. Any Windows certified client systems have required this since 2014. Pluton provides no attestation capabilities that are not present in TPMs.
683.
by mjg59 4y ago
Which would do nothing to prevent them from rolling out draconian remote attestation technologies, if they wanted to.
684.
by mjg59 4y ago
If your argument is "It's bad that all Windows systems will be guaranteed to have TPMs", then that's a reasonable argument to have! Everything that you're scared of here is 100% possible using TPMs (I have deployed
685.
by mjg59 4y ago
There's literally zero difference in how easy it is to deploy using Pluton and using existing TPMs.
686.
by mjg59 4y ago
Like I said, firmware updates for the ME and PSP are generally tied to system firmware updates, so it's not just a matter of Intel and AMD packaging stuff - they'd need to change a lot of development methodology to ensure that the
687.
by mjg59 4y ago
Given the apparent requirements around the Third Party UEFI CA, it's impossible for any device with a plug-in GPU to meet the Secured Core PC requirements. Unless Pluton is never going to be present in workstations, Pluton does not imp
688.
by mjg59 4y ago
> Pluton is de-facto a Secured Core PC implementation No, it's not. You can deploy Pluton without having to implement the Secured Core PC spec. > Microsoft Pluton does not make the mistake of repeating, No, seriously, the only r
689.
by mjg59 4y ago
This is not a good article. At a technical level it's confused about a whole bunch of things: * SMM has been part of x86 for decades . The Secured Core requirements around SMM actually reduce its power. * The claimed requirement to
690.
by mjg59 4y ago
Microcode isn't persistent - on reboot you'll be running whatever version was in the CPU at manufacturing time. That means there's a path to booting to a known-good environment and updating the firmware, which will then load

More ›