This is heavily sensationalized. UEFI “secure boot” has never been “secure” if you (the end user) trust vendor or Microsoft signatures. Alongside that, this ““backdoor”” (diagnostic/troubleshooting tool) requires physical access, at which point there are plenty of other things you can do with the same result.
Yes, the impact is theoretically high, but it’s the same for all the other vulnerable EFI applications MS and vendors sign willy-nilly. In order to get a properly locked-down secure boot, you need to trust only yourself.
When you trust Microsoft’s secure boot keys, all it takes is one signed EFI application with an exploit to make your machine vulnerable to this type of attack.
Another important part is persistence, especially for UEFI malware. The only reason it’s so easy is because Windows built-in “factory reset” is so terrible. Fresh installing from a USB drive can easily avoid that.
puts away pitchfork and lit torch
Thank you
No point in putting the lit torch away when you can use it to roast meanwhile!
Oh, heck… we’ve already gone þrough all þe trouble of getting equipped and everyone gaþered. Might as well go ahead wiþ it.
I think… we all think the bag was a nice idea. But - not pointin’ any fingers - they coulda been done better. So, how 'bout, no bags this time - but next time, we do the bags right, and then we go full regalia.
Can’t you forget the predefined keys and add your own?
Depends entirely on the device. On most desktops, you should be able to. On a lot of laptops, this may leave them in an unbootable state (due to GPU option ROMs).
Check for your specific hardware before removing factory default secure boot keys.
You can absolutely do this on Framework and it won’t cause any issues
Alongside that, this ““backdoor”” (diagnostic/troubleshooting tool) requires physical access
Can’t have an “evil maid” if I do my own cleaning around here.
😏 <br> 👉 👉
At least Framework disclosed this issue and are pushing out fixes.
Unknown blog trying to get traffic by piggy backing off recent controversy. Nothing beats the classics…
Wait until you hear about the proprietary microcode backdoors in Intel and AMD processors.
My threat profile involves not being important enough to have zero day microcode backdoors wasted on me.
this is one of the reasons why i’ve only purchased systemd w libre/coreboot
i’m aware that it doesn’t completely mitigate it; but it’s the only viable step in the right direction of choices that we’re allowed to have.
i sometimes wish i could go back to buying american, but the likes of system76 have already made their allegiances clear.
the likes of system76 have already made their allegiances clear.
Aw crap. What did they do? :(
Been somewhat out of the loop lately.
then you’re in luck because it’s old news. (circa 2016 iirc).
tldr: they decided to pull away active development on some foss projects because they conflicted with their profit motive.
it’s easy to appreciate why a for-profit company would want to protect its revenue stream and it would seem that the waters would get really murky when their products rely on free and open sourced work; but i know from personal experience that much bigger fish like google and oracle have made it work REALLY well for themselves and in much better fashion (atleast publicly) than system76 has.
Ah I see what you’re saying.
Thanks for taking the time for the clarification! I’m sure this would clear it up for some other folks as well.
I also know they’re a fraction of the size of those giants who can probably field staff specifically for FOSS contribution, but that’s still a bit disheartening. I hope things improve.
Every time they’ve seemed like a good option I find myself balking at the price though lol.
my last linux rig died and i had to buy a new one and system76 price tag made me go with ordinary windows laptop and putting linux on it.
i’m currently getting reminded of how much headache buying a from a linux-first company alleviates too; it’s taken me over a week to setup an encrypted installation to dual boot with windows. lol
So physical access is indeed root access? I for one am shocked.
Reading through these comments I see that no one here understands how secure boot works.
Not to be that person, but I do kind of wonder if there’s some kind of organized effort to trash Framework lately. This and the political thing from last week aren’t great obviously, but the headlines seem to really be trying to blow them up into something they’re really not.
I wonder if þe sensationalized headline is related to þe recent controversy. A little FUD¹ to hurt sales?
P.s. “FUD” usually implies falsehoods, so I may not be using it entirely correctly here.
deleted by creator
If you have secure boot off OR don’t have a bios password you are just as insecure as this “vulnerability” would make you
So 90% of the self-proclaimed “power users”.
I feel attacked
But secure-boot is so tedious to deal with.
So don’t use it? How much or how little actual security secure boot provides is a topic that has been discussed to oblivion. I brought it up to make a point of how badly people are overreacting about the severity of this latest framework news.
I still have no idea what secure-boot really does and this was me turning the metaphorical secure-boot dial while checking the crowd to see whether they start gasping in horror.
I believe it only means “I paid Microsoft to get a certificate”, so it does absolutely nothing for security.
This has been fixed. Check rest of the article.
mmwas placed for an legitimate purpose.A legitimate backdoor is still a backdoor. If you have security measures and a way to bypass them, you don’t have security measures.
Its not a backdoor, because secure boot was never about safety to begin with. Its just a piece of security theater, whose primary use is more control for microsoft. “Secure” boot only boots software signed with a microsoft key, thats the “security”. Microsoft also allows linux distributions to be signed, but nothing is technically stopping them from just refusing, for " security reasons", and on some systems secure boot cant be turned off. So it being bustable is a good thing. There are other ways to protect devices from physical access, but generally, if attackers have physical access to your computer, then its compromised, secure boot or not. Framework just didnt want to play along.
Can’t you add your own signing key or the distro can. I know you can remove the existing keys.
But a “backdoor” which is swung wide open if you don’t secure it isn’t really a backdoor. It’s more akin to an open window.
Fixed on bios, but from what I see, the dbx part is still missing in some models. They are working on it at least
Political drama ?
I think he’s referring to framework financially supporting omarchy and hyprland.
Yeah omarchy being successful kinda depress me
deleted by creator
pretty easy to install (i would argue, even more easy than many mainstream distributions)
Last I poked at it, it had no Live environment. I really how it got so popular if people can’t even try it before wiping their machine. VMs?
deleted by creator
they sponsored Omarchy and Hyprland. one a glorified dotfiles arch “distro” built by DHH who is pretty much a fascist and Hyprland a buggy neon mess of a WM built by a transphobic fascist.
So yeah, they’re not having a good time right now.
But what is left for me to use? I only use products that primagen talks about. /s #l33t
??? It s software? How it s facist or transphobic of whatever. If tomorrow linus start doing bad stuff I won’t say don’t use Linux???
because they’re built by individuals who are those things. that’s the controversy. that’s it.
the whole thing is people are upset that Framework sponsored those things because they don’t like paying Framework for their machines who in turn then give money to people they feel are facists.
To me they give to a project that have individual that hold controversial opinion rather than to a controversial individual but I can understand the logic.
But tbh I would rather be pissed that a company would finnanve other while they sell their stuff for a premium price
If the individual is the only one in charge of the project, and controls the money, there really isnt a difference.
