mjg59

46 ms·

721.
by mjg59 4y ago
If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you're going to posit an attack scenario then please describe the entire sequence of even
722.
by mjg59 4y ago
Microsoft absolutely still sign the binaries, and do not issue certs. Everything signed with the 3rd Party UEFI CA was signed by Microsoft, not any third party.
723.
by mjg59 4y ago
Booting via Shim will result in different PCR 7 values, which mean you can ensure that the OS won't boot if an attacker has subverted a signed version of Shim to execute Windows rather than the expected OS.
724.
by mjg59 4y ago
> Disabling UEFI Secure Boot has been step 1 for installing Linux for as long as UEFI had existed, hasn't it? Many people did a lot of work to ensure that Linux could be installed on systems with UEFI Secure Boot enabled.
725.
by mjg59 4y ago
Changing the setting and booting an OS signed with the 3rd party signing key will result in a different PCR 7 measurement, which will result in the TPM refusing to release any secrets that would be required for the system to boot.
726.
by mjg59 4y ago
How are ordinary everyday users protected by this?
727.
by mjg59 4y ago
The switch doesn't disable secure boot, it merely allows files signed using the Microsoft 3rd Party UEFI CA to boot. (Context: I wrote a significant portion of the infrastructure used to support Linux booting on systems with UEFI Secur
728.
by mjg59 4y ago
Some additional context: when the system boots, the secure boot key that was used is recorded into PCR 7[1] in the TPM. This means that booting an OS signed with the Windows signing key will result in a different PCR 7 value to booting an O
729.
by mjg59 4y ago
What's the difference in security here?
730.
by mjg59 4y ago
There's a meaningful distinction between "Linux doesn't support certain firmware functionality well" (as is still, sadly, the case for s0ix) and "Linux is literally unable to boot unless firmware configuration is mo
731.
by mjg59 4y ago
There is such a firmware setting, hence "by default". That doesn't make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don't compromise
732.
by mjg59 4y ago
If your argument is "These algorithms have differing degrees of computational complexity" then that doesn't actually demonstrate that one can't be algorithmically determined
733.
by mjg59 4y ago
Former google employee, no knowledge of current situation, not involved in any of this stuff even when I worked there: different types of data get handled differently. If material is important enough then it's going to be backed up ont
734.
by mjg59 4y ago
And, indeed, going into deep processor power saving states these days will put the RAM into self refresh (which is one of the reasons that exit latency is greater for deep states)
735.
by mjg59 4y ago
This is a good overview, but even by 2014 we weren't calling hlt - there's a few problems there. Imagine the situation where you fork() a process on one CPU, and you have another CPU that recently called hlt. Ideally you'd sc
736.
by mjg59 4y ago
Snowstorms in the north-east will frequently disrupt flights far more than trains. It's about 4 hours from Boston to New York, I'd take that over being delayed 2 days.
737.
by mjg59 4y ago
Up until very recently United had codeshares with Amtrak on the north-east corridor, and could even rebook onto Amtrak in the event of flight disruption. Lufthansa still offers connections to and from Deutsche Bahn on the same ticket ( http
738.
by mjg59 4y ago
There isn't really a resource limit for TPMs in this respect (the certs are kept on disk along with encrypted key blobs that are just loaded in and out of the TPM at runtime as needed), but there's no standardised mechanism for a
739.
by mjg59 4y ago
I absolutely love Sneakers, but I think you're writing Hackers off too easily - my experience is that it's widely loved within the infosec community, not because it's accurate in any way (it is extremely obviously not) but be
740.
by mjg59 4y ago
1) This is unambiguously Good News 2) This is not upstreamable in its current form (nvidia admit this in their press release) 3) In an ideal world, nouveau (the open source driver for nvidia hardware) would be able to target this kernel cod
741.
by mjg59 4y ago
Multiple model kits of the F-19 were released in the 80s ( https://en.wikipedia.org/wiki/F-19#Notable_appearances_in_me... ) - they have a vague resemblance to the F-117, but I don't know of any releases of F-117 mo
742.
by mjg59 4y ago
That seems to be a reference to https://lwn.net/Articles/893346/ - I'll let people come to their own conclusion about whether Drew's framing matches that, but I will say that I've never written a li
743.
by mjg59 5y ago
Yeah, turns out representing EFI variables as a filesystem was a mistake (sorry, that was my fault)
744.
by mjg59 5y ago
Eep! efi=no_disable_early_pci_dma only does anything if CONFIG_EFI_DISABLE_PCI_DMA is set, and distros should not be setting that by default (it's a thing that works Just Fine in theory, and specific implementations may fail hard with
745.
by mjg59 5y ago
No, all runtime services are gone. You don't /strictly/ need them in order to boot - most Linux distributions will install a loader in the fallback path and the firmware will run it even if there are no boot entries.
746.
by mjg59 5y ago
A lot of firmware supports using CSM to do GPU init and then providing UEFI interfaces on top of that. Of course, this is incompatible with Secure Boot.
747.
by mjg59 5y ago
That's a reasonable desire, but it's also not something that's supported by traditional BIOS - UEFI isn't any worse in this respect
748.
by mjg59 5y ago
I don't think that's going to result in everyone shipping UEFI without BIOS compatibility suddenly changing their mind.
749.
by mjg59 5y ago
The UEFI runtime services provide functionality that is not generically exposed through any other OS environment. Linux could just refuse to provide those runtime features, and things would roughly work[1] - we'd still need to call som
750.
by mjg59 5y ago
This is literally not an option - systems have shipped without BIOS compatibility for a long time now, so refusing to support UEFI is just not an option.

More ›