Microsoft will take nearly a year to finish patching new 0-day Secure Boot bug

Re:Microsoft will take nearly a year to finish patching new ... by csdvrx on Saturday May 13, 2023 @04:56PM (#35932627)

It's sad, because they did some cool things with SecureBoot on X64: you can install your own keys and sign your Linux payloads to prevent an evil maid attack using a default Windows thumbdrive signed with Microsoft keys

And I don't mean just the old/BlackLotus affected ones: you have full control of what you allow your system to run.

Compare that with BootGuard which doesn't let you patch your Bios, like you'd want to do to fix PE32 modules :(

[ Parent | on HN ]

Re:Microsoft will take nearly a year to finish patching new ... by hakfoo on Sunday May 14, 2023 @03:46PM (#35940802)

For systems where there's a real fear of physical compromise, you'd think there would be more physical mitigations.

The crypto stuff is nice, but I feel like it's difficult to package in a way that non-technical audiences will understand it and not shoot their foot off somehow.

I feel like PCs where the storage can be pulled like a video game cartridge would reduce the threat surface, while avoiding a lot of the crypto risk (lost keys, broken TPMs)

[ Parent | on HN ]