mjg59

53 ms·

751.
by mjg59 5y ago
My short summary of this: pretty much every x86 client system since 2012 has shipped with working UEFI support (because Microsoft required it for new Windows 8 systems), and from a compatibility perspective Linux works Just Fine with basica
752.
by mjg59 5y ago
I'm responsible for a great deal of the UEFI support on x86 Linux systems. You're absolutely free to have concerns about a lot of the political and social positions I hold, but this is a topic where I am literally a domain expert.
753.
by mjg59 5y ago
- previously, x86 MBR-style partition tables (which were the only thing really supported in Linux) gave you no strong semantic information about what a partition was[1]. GPT may involve GUIDs, but in the grand scheme of things that's a
754.
by mjg59 5y ago
> solutions to company assessments Sorry, are you asserting that you hold copyright over solutions that other people write?
755.
by mjg59 5y ago
> But I was questioning the premise that having blob in ROM is somehow better than needing same blob in firmware, simply because that one doesn’t need/want to distribute non-free firmware on media. Oh right! I absolutely believe tha
756.
by mjg59 5y ago
> Is hardware becoming more complicated without being more capable? I don't think so. Every component on my system that runs firmware is significantly more complicated than the iterations that didn't. 802.11ax is much harder th
757.
by mjg59 5y ago
> Is that a function of Linux Desktop simply being more capable nowadays? I don't think so - it's more a function of hardware becoming more complicated, and vendors choosing to put a lot of the logic in firmware rather than put
758.
by mjg59 5y ago
That's still where we are for a lot of modern Broadcom wifi, which was also the biggest issue in the ndiswrapper days.
759.
by mjg59 5y ago
Just going to say that this is the kind of scenario I was discussing in https://mjg59.dreamwidth.org/59353.html . RFC 8705 actually provides a mechanism for dealing with this, so I guess I'm going to be trying to imple
760.
by mjg59 5y ago
https://www.railmaponline.com/USWestMap.php only covers the western US, but has more detailed mapping in most cases.
761.
by mjg59 5y ago
Article is from 2010 so not going to quibble about there having been a lot of history since then, but from the end: > especially since floating point operations are generally compiled to use the x87 fpu (so the floats will be moved back
762.
by mjg59 5y ago
Having spent time in biology, being CEO of Google is a way more realistic goal than curing cancer. As far as the moon, I grew up on Star Trek and the idea of spending my life in space and seeing new things was absolutely what I wanted. Bu
763.
by mjg59 5y ago
That means a lot, thank you!
764.
by mjg59 5y ago
Aspiring to overly high standards risks viewing yourself as a failure. There's an extent to which being ambitious drives you to achieve more, but there's also an extent to which it just leaves you feeling depressed about your fail
765.
by mjg59 5y ago
Growing up, the idea of a career in computing was implausible. The only computing course my school offered was scheduled against doing a full science course, and they had nothing for the 16-18 range. The local night school programming class
766.
by mjg59 5y ago
You're the one who claimed this approach required remote attestation, not me?
767.
by mjg59 5y ago
If a metal key that could be duplicated was sufficient for someone to gain access to my company's entire source repository, then yes, I'd say that I shouldn't trust a metal key to be sufficient access control. If that was the
768.
by mjg59 5y ago
The absence of support for a stronger solution is an argument for improving support for a stronger solution, not an argument against criticising the existing solution.
769.
by mjg59 5y ago
> Cant have Your cake and eat it too Or we could just use credentials that can be tied to the hardware, and then we have stronger security assertions than tying to IP, and without any degraded user experience.
770.
by mjg59 5y ago
I'm not the service owner. I care about credentials on my clients being hardware backed, and I have enough control over the platform to have reasonable confidence that they'll make a truthful assertion. Clients managed by other
771.
by mjg59 5y ago
> If you issue a long lived bearer token, bad things will happen. I can issue a short lived bearer token, and another service I don't control can then decide based on that to issue a long lived one and I have no generic way to gain
772.
by mjg59 5y ago
IP fingerprinting is unhelpful - the user experience for mobile devices becomes terrible. Any other client fingerprinting is easily duplicated.
773.
by mjg59 5y ago
That is, in fact, what I'm trying to do - this is the explanation for why I'm doing so.
774.
by mjg59 5y ago
https://github.com/google/go-attestation is a free implementation of remote attestation that's not associated with any CPU type and will work on anything that has a TPM. But what we want here isn't really rem
775.
by mjg59 5y ago
The credential issuer is (in general) not in a position to make a determination whether the device is trustworthy or not. In an ideal world, I (the person responsible for the security of the device) would be able to ask the issuer to delega
776.
by mjg59 5y ago
What trade-off in usability? We don't have standardised mechanisms for sites to provision their own certificates, but if we did then this would be entirely transparent to users in a way that PGP isn't.
777.
by mjg59 5y ago
Approaches that use asymmetric crypto have the advantage that you can use keys that can't be copied - if only the TPM or secure enclave has access to the key, I know that the only copy of the key is on the device.
778.
by mjg59 5y ago
Hardware-backed client certificates.
779.
by mjg59 5y ago
No, I'd like applications to check with me whether I was ok with the state of my user and their device.
780.
by mjg59 5y ago
You don't verify the hardware directly. You provide a mechanism for client certificate validation (I issue the certs, I can assert that they're tied to hardware), and you provide a callback for validating device state (I define th

More ›