Hacker News Reader

Comment by TheChaplain | Hacker News Reader

Well, implementations of UEFI are all over the board because vendors have their own ideas, that leads to compatibility issues.

It is also a security risk, as it is essentially a huge system (compared to BIOS) under the actual OS, compromise the former and own the latter. The larger code base, the larger attack vector.

Coming back to UEFI implementations, how many of them are actually open source and do not have un-vetted code running (again under your OS)?

Yes, UEFI do have some positives but the security risk far outweighs them.

View on HN

It is increasingly rare for EDK2 (A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org: https://github.com/tianocore/edk2) to not be used as the basis for a secure boot load plus runtime firmware services stack).

Vendor veerage from vanilla upstream edk2 does occur of course but it does so also with legacy BIOS’. There’s no getting around it in the real world with very very few exceptions.

UEFI evolved to solve standardized boot and firmware at scale and the internet as it stands today would struggle without a standard like it. RISC-V taking a different approach would be swimming against the tide backwards to irrelevance.

The only thing I can imagine that's worse than having weird vendor implementations of a standard that cause unexpected chaos is not having a standard to have any expectations in the first place, to have everyone doing whatever.

The security benefits of having something that has a robust capable platform with a good test suites feels unmatched compared. Even if you don't know the code (and most are just edk2), at least there's a pretty well defined surface, whose expectations we can test.

I'm open in principle to the idea that maybe UEFI isn't the right fit, that there's other things we should try. but if that answer is BIOS, i'm going to laugh my way out of this thread. Maybe not strictly required but man, the wild incredible janky world of weird antics required to get PXE or a add-on drive card running under bios: it was a piecemeal bodge through and through. I don't know what we see we even try to consider?

Hear! Hear!!

>Well, implementations of UEFI are all over the board because vendors have their own ideas, that leads to compatibility issues.

RISC-V has specifications on how UEFI should be implemented.

It's not just "use UEFI".

Reply on news.ycombinator.com