And it doesn't even work? Because the firmware authors used crappy code to display marketing images?
I want my tens of hours back.
From that point, new PC buyers would not be able to simply and directly install some other OS other than Windows 8 (or newer Windows) on the PC without four different unfamiliar workarounds, for those four obstacles, which were implemented differently on different motherboards. Even though UEFI was touted as ideal because there were published standards that traditional BIOS never had, we all know in practice that BIOS motherboards were more consistent among vendors and price points than UEFI motherboards anyway.
Linux was ominously on the brink of doubling its user share (which still wouldn't have been very significant), but especially it was Windows 7 which was the real threat to adoption of Windows 8.
Nothing more, nothing less.
As we now see, the touted improvement in "security" was a joke the whole time.
Definitely not as secure as a business-class non-UEFI late Windows 7 Professional PC's motherboard.
Not like there's any question.
Now seriously, TPM and GPT are improvements. Customizable SecureBoot along with disk and RAM encryption, are also nice.
But with GPT it was strongly recommended by Microsoft as more secure by having no unused sectors on the drive when it is partitioned according to GPT.
The unused sectors of a traditional MBR-partitioned drive had been identified as the preferred location of malicious "root-kits" that were capable of executing before the OS even had a chance to boot, were not actually on the Windows partiton and therefore difficult to scan for, and were resistant to reformatting the partition which did not delete the rootkit. To be really sure you got rid of a BIOS/MBR rootkit completely you would have to zero the entire drive, or at least the sectors containing the root kit. Full reinstallation of Windows or even zeroing the entire partition itself didn't help at all.
But using GPT there are usually way more unused sectors on the same drive compared to MBR partitioning. Always have been. That's just one of the original lies propagated by Microsoft, endorsing the migration away from a more well-proven traditional BIOS.
And here we have a defect in one of the supposedly true security improvements baked into UEFI, with ridiculous false-sense-of-security implications since day zero, now-confirmed and it's exactly a vector for a rootkit no differently than under good old-fashioned BIOS.
Except zeroing the entire physical drive still wouldn't get rid of a UEFI rootkit which can now be even more stealthy, enough to reside in the firmware itself. Even at this late date, how many users are scanning their firmware and what apps would they use for that anyway?
When truthiness is not a way of life, there can not be actual trust.
E.g. if we want to protect from a datacenter employee plugging his usb stick with ubuntu and booting it on our server. We can probably solve it with UEFI with removing default keys and adding them for our OS. (Have never tried it so might be wrong). Also we need to set a BIOS password so that the attacker doesn't simply disable secure boot.
This works, but the attacker can just remove BIOS password -- remember, he has physical access. It's for sure harder for him than plugging a usb stick. But if he anyway willing to risk and illegally mess with a customer's server while being monitored with cameras I think he would do it.
Something feels off about all of this
I get that being allowed to run the code you want on hardware you own is paramount, but let's not live in fear of hypotheticals. There are already secured platforms like the Xbox/PS5/iphone where we don't have that option and the world hasn't ended.
"it's only a few right now don't worry about it" More happen. "okay maybe I see where you're coming from but it's still avoidable!" It continues. "I still have options I don't know what your problem is." Eventually, no choice. "How did we get here!?!?!"
We need protective regulations that ensure that general computing is accessible to every citizen. Giants of industry are not entitled to control devices that they sell after they are sold.
It's not fallacious in the slightest, you're simply enjoying the slide for now.
What's the purpose of this statement? "You've already lost" anime-style bullshit? This is proof that it's gotten worse as time has gone on. That is, it's evidence that the slope is slippery.
Receding into a VM doesn't give people control; the host OS can still view everything happening in that VM. It has to in order to do its job virtualizing.
I agree that we will always have a need somewhere for machines to just run code. However, I do not trust that developers will be steadfast enough to resist the inevitable anti-features that make their way into products to take control from the user.
Smartphones and UEFI+secure boot enabled devices are a testament to this. It's possible to root and install your own ROM, on some models, but for how long? It's been a cat and mouse game between hackers and phone manufacturers.
Today's developer systems are already infected with nannyware, unless they're running OpenPOWER or a similarly open and unencumbered system. I'm on a Librem 14 with a mostly-neutered IME (so, still x86_64), and honestly I wonder if what Purism was able to do to isolate it was enough. AMD pushes PSP with their chips, and ARM is its own strange song and dance, and licensing is a bitch.
We need hardware that can be verified and trusted not by business, but by consumers. How do you think people will get developer systems if this culture of "no code is good unless it's corpo code" continues to prevail?
There's not a single example of that happening, as far as I know. What we get is "oh, you want general purpose access? here's a sandbox for you to play in", with the system itself remaining locked.
And you'll be able to, on hobby machines or VMs. But the general purpose machine where the owner controls the OS will fade.
Banks, popular sites and other choke points will demand attestation of an unmodified system for access. People will talk about internet access the way they do about driving in the US - a privilege, not a right.
Bet it.
What about Internet access deserves to be considered a privilege and not a right? What human is less entitled to accessing the wealth of knowledge and information available on the Internet? Discriminating who can and cannot access the Internet is not something that will be popular or defensible.
If the search for knowledge itself is considered dangerous, then what of all the knowledge gathered on the public against its will?
Internet access isn't remotely comparable to driving. By driving, you're exposing yourself and others to potential mortal danger. Nothing is automatic, you must be aware of, and follow, all laws concerning how it is to be operated. You have to have a license.
The Internet's spirit will die the day you need a license to access it. The body will take a lot longer.
I'm making a prediction. The unregulated internet is a risk to some very powerful interests. They cannot tolerate that. And despite what some people thought early on (me included), IT is a power-amplifier, not an equalizer.
I'm not optimistic.
That's why I think we have to go the legal route, as little as I trust society and its policies, others do. We need to consider the personal use of property as an extension of the 1st amendment, at least in the States. If I purchase a computer, I should be able to do whatever I want with it, especially if I'm not hurting anyone or violating rights. Ownership needs to mean something, or capitalism's core tenet is lost and the veil begins to slip.
Building spying nanny chips and other "safeguards" are really just obstacles to ownership. It should be considered anti-consumer and a form of military-grade espionage. The John Deere escapades are a prime example of what will happen to general computing if we don't make some sort of effort to protect and enshrine computing freedom.
Maybe it won't be an issue and we'll be 3D-printing PCBs from open or patent-expired schematics so it won't matter. Maybe e-waste will be enough of a problem that there will be enough to hobble along until something bigger coalesces.
I'd rather not go on maybes though, and would rather vote for legislation that ensures the government will punish any business that sells me something and then tries to prevent me from exerting control over it as the owner. That is such obvious fraudulent behavior, there's no good defense for it. Business already enjoys the protection of copyright, trademark, and patent. An important aspect of business is actually parting with what you are selling, and giving up control.
The control is what is being bought!
That kind of rhetoric is itself part of the dystopia. There were and still are much more rational perspectives that are deemed wrongthink and lumping them together with obvious crazies is one tactic used to suppress them.
But, you as a person will not be denied the right to access the internet. It's just that you'll need to use a device that doesn't "risk the security of the internet" to do so. Just like if you build a custom vehicle, you aren't allowed to drive it on national roads, because it risks the safety of the road system and all its participants.
> Intel® CSME supports HW DRM that helps users enjoy premium services from third-party providers, with control access to copyright material https://www.intel.com/content/dam/www/public/us/en/security-...
This is 100% supported by manufacturers own documentation. I'm not sure it's even a slippery slope argument, when it's that clear. It's more like a murderer, caught red handed and having already dictated and signed a confession, saying "That was just a joke, I didn't really kill him"
Also like a sucker I thought secure boot was doing something to help secure the boot of my computer and was worth the bother.
Which systems enforce Secure Boot out of the box and lose functionality without it? You mention something ASUS and Intel graphics being broken without UEFI which isn't the same thing.
it does, and it is. SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. it does not check the firmware for bugs or somehow sense them and skip over that code or something.
The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."
Good point. Both are important: who does the trusting and how they define trust.
The latter is the second set of concerns: remote attestation.
I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia.
But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
We don't.
Can you also re-sign the firmware and hardware checks as well? Last I knew you could not.
Of course, you can't dual boot anymore.
https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.
If you're on Windows, try launching Windows' memory test instead. That'll work both on secure boot and UEFI.
I love my thinkpad p1 g3 more than most laptops but I miss having a simple BIOS. Stupid thing can't boot off normal USB keys like I've been making for decades.
Also I remember there is a setting in UEFI to allow booting from USB.
Lenovo also recently released a CVE fix, possibly even for this vulnerability, so you may want to check for firmware updates regardless!