>On proper UEFI implementations ...
You're going to have to qualify that.
You're going to have to qualify that.
http://i.imgur.com/YpOQXet.jpg
Work required that I restarted this machine frequently -- it would fault during boot probably 1/20 times.
It's also no secret that lots of hardware vendors are terrible at implementing software. The usual rule is that the less software they write, the better.
The result is that different vendors and OEMs have a different quality UEFI firmware implementations and different feature-set available in them. Some are clearly less proper and less complete than others.
Sure, it was a bug, but if you've read the UEFI spec, it's scary how complex the thing is. It reminds me of all of the complexity NSA employees managed to insert into the IPSEC and TLS stnadards. Complexity kills, especially when security is concerned. You really want to keep the Trusted Code Base small and simple. And UEFI is not simple. Combine that with the competence traditionally associated with BIOS programmers, and the results are very sad....
> Is there more security added by enabling UEFI, or keeping it disabled?
You're not really disabling the UEFI firmware at a technical level. You're just telling the UEFI firmware to load a UEFI BIOS compatibility shim, which then proceeds to load a unverified bootloader instead.
How much security do you expect to gain from that? I don't think there's any evidence this will help make your machine more secure against software based attack Of course there are no absolute answers, or otherwise we wouldn't be having this discussion.