Hacker News Reader

Comment by qingcharles | Hacker News Reader

I understand their caution. They can't test on all the millions of combinations of PC hardware out there, and some of them are inevitably going to have their boot records toasted by this update, bricking the machines.

This is a lose/lose situation for Microsoft.

View on HN

If MSFT were acting carefully to avoid bugs, they wouldn't be abolishing the QA department and replacing it with Windows Insiders and Telemetry and Virtualization, and they wouldn't be releasing a bug every time they release a monthly patch.

Isn't it stupid that when MSFT sold Windows 11, they urged people to buy PCs with TPM 2.0 for improved security, but Windows 11 has vulnerabilities that cannot be easily addressed?

It's sad, because they did some cool things with SecureBoot on X64: you can install your own keys and sign your Linux payloads to prevent an evil maid attack using a default Windows thumbdrive signed with Microsoft keys

And I don't mean just the old/BlackLotus affected ones: you have full control of what you allow your system to run.

Compare that with BootGuard which doesn't let you patch your Bios, like you'd want to do to fix PE32 modules :(

For systems where there's a real fear of physical compromise, you'd think there would be more physical mitigations.

The crypto stuff is nice, but I feel like it's difficult to package in a way that non-technical audiences will understand it and not shoot their foot off somehow.

I feel like PCs where the storage can be pulled like a video game cartridge would reduce the threat surface, while avoiding a lot of the crypto risk (lost keys, broken TPMs)

Do you also understand the ripple effects of having a known zero day exploit open for a year? Lose/lose situation for the customers and their related networks, ie almost everyone in the world

Not all "zero day" is created equally.

The vast majority of home users have never heard of secure boot, which defaults to off. Every corporate network I've walked into I have been the one to push it, as most have never heard of it. Both Microsoft and aws only recently introduced support in the cloud environments, so the majority of cloud hosted environments have not turned it on (which requires replacing the vm). It is far from almost everyone in the world who is even in a position to be impacted by a secure boot bypass.

Secure Boot is required to run Windows 11.

I think that’s inaccurate. Secure Boot capability is an install ‘requirement,’ but you definitely don’t have to switch it on.

I believe it defaults to on, at least on most systems designed to run Windows

There is literally no such thing as a "known zero-day". That is a contradiction in terms. Either it is unknown, and exploited as a zero-day, or it is known, and therefore no longer a zero-day at all.

What would you do instead, if you were MS?

He would brick the Windows install and install Arch instead.

This particular exploit requires either physical or admin access to the target computer, which takes a lot of the edge off.

Reply on news.ycombinator.com