Linux and Secure Boot certificate expiration
Linux and Secure Boot certificate expiration
Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a ke [...]LWN.net
like this
Un primo sguardo alle caratteristiche del K3, carro armato all'idrogeno sudcoreano - Il blog di Jacopo Ranieri
Un primo sguardo alle caratteristiche del K3, carro armato all'idrogeno sudcoreano - Il blog di Jacopo Ranieri
Nello scenario di guerra contemporaneo, dove sono le informazioni a farla da padrone, con la possibilità di attaccare da distanze chilometriche mediante l’utilizzo di razzi ed artiglieria, piuttosto che l’impiego di semplici droni radiocomandati, le …Jacopo (Il blog di Jacopo Ranieri)
Amazon Ring Cashes in on Techno-Authoritarianism and Mass Surveillance
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to request footage directly from Ring users, it is also introducing a new feature that would allow police to request live-st
like this
Technology reshared this.
And exactly this behavior ("I have no clue about the thing I will do, but I'll do it anyway without educating myself prior") is what makes everything suck more and more because it always gets adapted to the lowest common denominator.
We're only still alive because people need licenses to drive cars or fly planes.
Yeah sure, government shall intervene. But...i can probably expect more from anyone else.
And no,I didn't imply everyone should be expert at everything. That is beyond impossible, even for fractions of fractions of things.
But. If you wanna drive a car, you're forced to learn a shitton and pay like 2k € to be allowed to do so. One of the reasons is safety for others.
If I had no clue about e.g. doorbells, I would ask a pro I know or search the net or whatever. At least the absolute basics of it. Even setting the pure curiosity aside, just to know what the heck I'm getting at.
Admitted, I might have much more spare time than the regular Jane or Joe, but I'd still do that if I had to work. Just less intensive.
But yes, this mixture of apathy and ignorance is the leading reason why the internet sucks so much nowadays then 30 or even just 20yrs ago.
The majority of absolutely clueless people not knowing how they get fucked and where to draw a line. Sure, to some it's just a tool they don't need to know shit about to use it. No judging. BUT that doesn't change the fact.
That's the thing, you correctly see the difference in available time after work. That difference stacks over time. Having read this or that makes you understand terminology, patterns, builds confidence and over time that marginal extra time I have had has made it possible for me to grok a manual in 15 minutes but my father who hasn't had that time takes 45 minutes from his shorter available time. Then there's all the modifying details around kids or no kids, how much more hours the lower parts of the working class have to do to pay rent today vs earlier and so on and so forth. Everyone really but it's just much worse for the lower sections.
And then there's the problem of availability of products without extensive research. There's few brands owned by few large corpos that spend a lot pushing them left front and center on their digital platforms. That increases significanty the amount of work anyone has to do to avoid surveillance in this case. And as you understand, increasing the amount of work, increases the amount of time, and there's hard cutoffs which lead to the work not being done, which leads to the marketing campaigns succeeding in getting dad to buy a Ring. These people study, research and know well how to get people who seemingly have choices to choose their product 8 out of 10 times. Especially when transacting via their digital platform.
Which is why we're fighting a losing game if we rely on the individual when they're standing against the corporation which acts as a large collective with collective resources aligned to achieve their goals. This is why individualism is profitable and therefore encouraged. Consumers, employees have to also act as a collective which pools their resources like time, expertise to counteract this. E.g. by having people, supported by the normies, digest, analyse and spit out the results in trivial form (when posaible) that also takes very little time for everyone else to grok, so they make the right decision. Example that come to mind is Consumer Reports.
Your arguments are all valid and fine, wouldn't argue with them. BUT understanding the underlying reasons doesn't really change the fact and my point.
I can empathise with speeders, murderers, scammers and whatever. But know why someone does something, or even truly empathizing with it, doesn't change the fact that it's bad.
I could understand a society of murderers and their reasons for murdering. But they'd still destroy their society.
And sadly I really see no way for the government (any gov anywhere) to really pull the rudder. Capitalism just won. And, as you already stated, their goals align excellently with the average Joe/Jane having no clue about the stuff that's thrown in their faces and are worked to death so that'll never change.
Yes. 😁
And in capitalism right now there's no obvious way to reverse the trend. That said, if the critical theory of capitalism (and history) holds any water, the victory is very likely to be temporary, followed by mass unrest and significant change. What kind of change is not so clear but we may have a say if we're educated enough and organized, so at least we know who to support when the time comes.
Not today anymore. Social-media and the state-of-stupid of the web inhibit that. The masses don't even know what to protest for or against. And without MASSIVE numbers you'd achieve nothing. Someone just needs to throw enough moneyz at the problem (or pay thousands to flood the net with "I love our overlords because XYZ") until it's gone.
It was hard to topple a king some 100yrs ago, but today? We don't even know our kings anymore. Besides those few media-clown-babies that so desperately crave attention to fill a bottomless void of darkness inside them.
Besides that I would trust a Chinese cloud way more than a murican one (I'm non-US), this really is a lazy excuse. This apathy paired with ignorance or being technically challenged is the main reason dystopian shit like ring even sells at all. Or all those silly "smart" assistants like Alexa.
Phrases like "renewing my subscription" in context of a fucking doorbell itself sounds so absurd to me.
E.g. A raspberry (or the likes) with some run-of-the-mill ip-cam, some wifi-doorbell and AgentDVR would do the same for even less moneyz. And just for you, not the whole world. Wouldn't take more than some hours of setup.
France wants to nuke citizens’ holidays to fund a fantasy war with Russia
France wants to nuke citizens’ holidays to fund a fantasy war with Russia
Macron’s handpicked centrist prime minister has chosen to mess with the one thing that unites the French more than anything: their time offRT
don't like this
The real reason is because France is being kicked out of Africa so they have to turn inwards and colonize their own people.
The more African countries free themselves from the shackles of French imperialism, the worse it will get for the average French. Then it would be very easy to sell them the next war for them to needlessly die in.
In China, delivery robots now ride the subway to restock 7-Eleven stores
In China, delivery robots now ride the subway to restock 7-Eleven stores
The project, reportedly the first of its kind in the world, will see robots ride subway trains to deliver goods to more than 100 stores across Shenzhen.He Huifeng (South China Morning Post)
like this
Technology reshared this.
Japan sets new internet speed world record — 4 million times faster than average US speeds
Japan sets new internet speed record — it's 4 million times faster than average US broadband speeds
A team of scientists in Japan shattered the record for the fastest internet speed by developing new fiber optics.Perri Thaler (Live Science)
like this
Author Adam Shatz on ‘The World since October 7’ (II)
Author Adam Shatz on ‘The World since October 7’ (II) - World-Outlook
In this essay, author Adam Shatz raises important issues that deserve further discussion in light of the gruesome October 7, 2023, attack led by Hamas that targeted civilians in Israel, the genocidal war Israel unleashed in retaliation on the entire …world-outlook.com (World-Outlook)
A Prominent OpenAI Investor Appears to Be Suffering a ChatGPT-Related Mental Health Crisis, His Peers Say
It's a very delicate thing to try to understand a public figure's mental health from afar. But unless Lewis is engaging in some form of highly experimental performance art that defies easy explanation — he didn't reply to our request for comment, and hasn't made further posts clarifying what he's talking about — it sounds like he may be suffering some type of crisis.If so, that's an enormously difficult situation for him and his loved ones, and we hope that he gets any help that he needs.
At the same time, it's difficult to ignore that the specific language he's using — with cryptic talk of "recursion," "mirrors," "signals" and shadowy conspiracies — sounds strikingly similar to something we've been reporting on extensively this year: a wave of people who are suffering severe breaks with reality as they spiral into the obsessive use of ChatGPT or other AI products, in alarming mental health emergencies that have led to homelessness, involuntary commitment to psychiatric facilities, and even death.
Psychiatric experts are also concerned. A recent paper by Stanford researchers found that leading chatbots being used for therapy, including ChatGPT, are prone to encouraging users' schizophrenic delusions instead of pushing back or trying to ground them in reality.
Lewis' peers in the tech industry were quick to make the same connection. Earlier this week, the hosts of popular tech industry podcast "This Week in Startups" Jason Calacanis and Alex Wilhelm expressed their concerns about Lewis' disturbing video.
A Prominent OpenAI Investor Appears to Be Suffering a ChatGPT-Related Mental Health Crisis, His Peers Say
Bedrock co-founder Geoff Lewis has posted increasingly troubling content on social media, drawing concern from friends in the industry.Joe Wilkins (Futurism)
adhocfungus likes this.
Amazon Ring Cashes in on Techno-Authoritarianism and Mass Surveillance
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to request footage directly from Ring users, it is also introducing a new feature that would allow police to request live-stream access to people’s home security devices.
‘FUCK CRIME:’ Inside Ring’s Quest to Become Law Enforcement’s Best Friend
Amazon's surveillance company has seeped into hundreds of American communities by throwing parties for police and giving them free devices.Caroline Haskins (VICE)
like this
Top House Dem Hakeem Jeffries doesn’t endorse socialist Zohran Mamdani in NYC mayoral race in lukewarm statement after highly-anticipated meeting
House Minority Leader Hakeem Jeffries and socialist mayoral hopeful Zohran Mamdani finally sat down Friday for the first time since New York City’s primary — but the Democratic nominee left without an endorsement.
In a lukewarm statement, Jeffries called the pair’s hourlong meeting in his Brooklyn stomping grounds “constructive,” but did not indicate whether he would throw his weight behind the lefty candidate.
“We don’t really know each other well,” he has said. Jeffries has said Mamdani needs to “clarify” his stance on “Globalizing the Intifada” — a controversial phrase in the Israel-Gaza conflict.
Top House Dem Hakeem Jeffries doesn't endorse socialist Zohran Mamdani in NYC mayoral race in lukewarm statement after highly-anticipated meeting
Schumer is expected to meet with Mamdani soon, but no date has yet been set.Craig McCarthy (New York Post)
like this
geneva_convenience doesn't like this.
Do you understand the difference between optics and abandoning all principles?
Martin Luther King Jr.’s Challenge to his Liberal Allies | AAIHS
Martin Luther King Jr. press conference, Atlanta GA, Southern Christian Leadership Conference office 1966. (Photo: Bob Fitch Photography Archive, Stanford U ...Jeanne Theoharis (AAIHS)
geneva_convenience doesn't like this.
geneva_convenience doesn't like this.
geneva_convenience doesn't like this.
I thought he was good
There is no food in Gaza
cross-posted from: lemmy.ml/post/33397111
Breaking | In an urgent and important press statement, Gaza Health Ministry reports and appeals to the world:⭕️Unprecedented numbers of starved civilians of all ages are arriving at emergency departments in severe exhaustion and fatigue.
⭕️We warn that hundreds of severely emaciated Palestinians are at imminent risk of death due to hunger and their bodies’ inability to endure any longer.
Gaza Update Summary (July 16th - July 19th, 2025)
🚨 The past four days have been defined by a dual crisis of escalating IOF massacres and a catastrophic, deepening famine. IOF operations systematically targeted civilians in designated "safe zones" and at aid distribution points, particularly in Khan Younis and Rafah, while the north faced relentless demolition. We saw the famine's death toll rise, sparking popular protests against aid hoarders as the humanitarian situation collapsed completely.
Wednesday, July 16th: The slaughter of civilians was marked by a horrific massacre at an American aid distribution center in Rafah, where over 20 martyrs ascended due to suffocation and gas, including those on a "pre-approved list." This pattern was repeated throughout the day, targeting the displaced and hungry in tents in Mawasi Khan Younis and Nusseirat. Shelters were not spared, as the IOF bombed the Abu Helou school in Bureij, resulting in 4 martyrs, and struck the historic Latin Church in Gaza City, resulting in 3 martyrs from the Christian community. In Jabalia, the entire Shahab famil (father, mother, and their five daughters) was annihilated under the rubble of their home. 94 martyrs ascended and over 370 were wounded. 26 aid seekers were martyred as well.
Thursday, July 17th: The crisis of starvation reached a terrifying new peak, with children like Zain Al-Dremeili ascending due to malnutrition and reports of people collapsing from hunger in the streets. The bombardment escalated on Khan Younis, with airstrikes, artillery, and demolitions. IOF drones targeted tents in Mawasi. New evacuation orders were issued in Jabalia, and a strike resulted in 8 martyrs near Tawam roundabout who were protecting an aid convoy. At least 50 martyrs ascended on Thursday.
Friday, July 18th: The deepening famine ignited a "Revolution of the Hungry", with citizens storming merchants' warehouses in search food, only to be met with IOF drone fire. The IOF's campaign of genomicde continued with the massacre of the Abu Sahloul family in Khan Younis, where at least 8 were martyred under the rubble of their home. The famine claimed another life as the infant Sanaa Al-Lahham ascended, while in Deir al-Balah, 5 more were martyred in the chaos of an aid delivery. Further, the IOF continued to bomb tents, such as in Mawasi. A strike in Jabalia Al-Nazla claimed 5 more martyrs, while a bombing of a school saw two more. Another 50 martyrs on Friday.
Saturday, July 19th: Between the famine and bombing, another day of horrific massacres against entire families. We saw the annihilation of the Aql family in Nusseirat, where a single strike resulted in 12 martyrs, mostly women and children. The slaughter of the hungry reached a new low with over 60 martyrs ascending, including 35 aid seekers killed by IOF fire near the "Netzarim" axis. The famine continued to claim children's lives, including Joad Al-Anqar and Yahya Al-Najjar, as the IOF expanded its operations to the sea, raiding the Gaza beach and abducting several fishermen. Northern Gaza saw intense bombing in Sheikh Radwan and Jabalia, as well as martyrs killed while attempting to reach their homes. Today, over 116 martyrs have ascended so far, including 38 aid seekers.
Over 310 martyrs ascended in the last four days, amidst international and global silence despite calls for escalation and action. #GazaSummary
Descendants of the survivors of the Warsaw ghetto create a new "Warsaw ghetto" 85 years later.
Their bubbes must be so proud of them!
What's happening to my post? Blurred, red flagged?
Can't make sense of it. Might be flagged remotely as AI? I'm the mod. Shouldn't I be able to see what this is about?
Just catching up, night be suspiciously too many posts back to back?
It's also getting downvoted. Somebody has an issue with it
Edit: Nevermind, he's an AI artist. I didn't realize, am taking down.
Could publicly-owned grocery stores break Canada’s grocery oligopoly?
Could publicly-owned grocery stores break Canada’s grocery oligopoly? - Ricochet
A bold proposal from New York’s Zohran Mamdani is sparking interest north of the border. Experts say a Canadian public option is not only possible — it’s long overdueJeremy Appel (Ricochet)
Please read what I actually wrote above because it addresses your question. There's no contradiction here, BoC expects inflation to rise as a result of QE, but the reason for that people who own companies decide to raise prices. Let me know if you're still having trouble understanding this, and need me to use smaller words.
The only thing weird here is that a grown ass adult would have trouble understanding something so basic.
La notte dei biplani
Metti insieme un po' di neuralink, un po' di Firefox volpe di fuoco e un buon 5% del pil e viene fuori un bel prodottino veramente utile al genere umano.
Che poi, uomini. Mica erano uomini quelli. Ragazzi? Bambini spaventati. Con il cavo del BOT che gli spenzolava dal collo e le mani che non riuscivano a star ferme per via dei tremori.
"Non bevete l'Absynx", ci dicevano," una droga, vi fa male, vi distrugge il cervello". Ah si, certo. Perché il BOT, invece? Cosa combina al cervello? Quando siamo collegati tutti insieme, noi del carro, io sento i loro pensieri, entro nei loro corpi,e vedo. Vedo. E poi a cosa vi servono i nostri cervelli in fondo?
Volete che sopravviviamo per uccidere e farci uccidere.》
Freddo.
Ci avete mandato in battaglia. Contro il nemico? No. In Irlanda. Ma che ci avevano fatto gli irlandesi? Parlano la nostra lingua, sono proprio come noi."Non importa", dicevate, "dovete fare il vostro dovere e basta". Così l'abbiamo fatto. Ci siamo trasformati in un mostro ircocervo con cento gambe, cento braccia, dita di mitragliatrice e naso di cannone. Abbia-
mo sparato. E sapete una cosa?È stato bello. Bello, si, perché quando diventi un mostro, l'orrore è meraviglia.)
Non vedeva più niente, non sentiva niente. Era scivolato in una valle d'ombra da cui non c'era ritorno.
Poi ci avete mandato al fronte, dove c'erano i nemici veri, dove ci saremmo fatti onore. Invece ho visto solo trincee fangose, uomini pieni di pidocchi, sguardi tristi, filo spinato. E il nemico? Altre trincee, pidocchi, sguardi, filo spinato. Proprio come noi, anche quelli li. E io tremavo ormai, bevevo, avevo freddo, e Faulkner ci è morto a cena, stavamo mangiando e lui ha gridato ed è piombato a faccia in giù nella scodella del brodo, stava male già da tempo, perdeva sempre sangue dal naso."Pazienza", avete detto,"ve ne manderemo un altro".
"Domani ci sarà battaglia?", ho chiesto io."Ma certo Maddox
Economy under threat this year as hundreds of thousands of people leave U.S.
Economy under threat this year as hundreds of thousands of people leave U.S.
With the U.S. expected to have a population exodus of hundreds of thousands of people, at least 500k individuals, the stability of the economy is on the line.Alexangel Ventura (The Daily Drop)
pancake likes this.
Good enough for me.
Visio mensuelle XR Auxerre
👋🏼 Bonjour à toustes,
Le groupe local d'Extinction Rébellion d'Auxerre se retrouve une fois par mois en présentiel et une fois par mois en visio pour une plus grande accessibilité à toustes sur notre territoire rural.
🖥️ Prochaine rencontre en visio : lundi 4 aout à 20h.
📧 Écrivez nous pour vous inscrire : auxerre@extinctionrebellion.fr
Au programme : Accueil, retour sur les actions passées et projets en cours.
Si vous voulez rejoindre XR dans l'Yonne, vous êtes les bienvenu·e·s à cette visio.
avec Amour & Rage ❤️🔥
'Universal cancer vaccine' trains the immune system to kill any tumor
'Universal cancer vaccine' trains the immune system to kill any tumor
Following on from a breakthrough human trial that reprogrammed the immune system to overpower an aggressive brain tumor, scientists have now used the same mRNA tech to attack any cancer. It could make chemotherapy, surgery and radiation redundant.Bronwyn Thompson (New Atlas)
pancake likes this.
Vehicle drives into Los Angeles crowd injuring 30 people
A vehicle drove into a busy crowd of people waiting to get into a nightclub in Los Angeles early Saturday, injuring 30 people, with at least five in critical condition.
The incident took place on Santa Monica Boulevard, the city’s fire department said, and people were quickly transported to local hospitals and trauma centers.
According to Cpt Adam VanGerpen, the public information officer for the LA fire department, the line of people struck by the vehicle, a Nissan Versa, were mostly female, and were waiting to get into the nightclub when the car also hit a taco truck and a nearby valet stand.
Vehicle drives into Hollywood crowd injuring more than 20
Los Angeles fire department says up to five people are in critical condition after incident on Santa Monica BoulevardGuardian staff reporter (The Guardian)
👋🏼 Bonjour à toustes,
Le groupe local d'Extinction Rébellion d'Auxerre se retrouve une fois par mois en présentiel et une fois par mois en visio pour une plus grande accessibilité à toustes sur notre territoire.
🗣️ Prochaine rencontre en présentiel : vendredi 25 juillet à 20h00.
📧 Écrivez nous pour vous inscrire : auxerre@extinctionrebellion.fr
Au programme : Accueil, retour sur actions passées et projets en cours.
Si vous voulez rejoindre XR dans l'Yonne, vous êtes les bienvenu·e·s à cette réunion.
🍻 N'hésitez pas à venir avec quelque chose à boire, à manger, à partager...
avec Amour & Rage ❤️🔥
Timelapse of Texas flooding shows the breathtaking power of nature
Timelapse of Texas flooding shows the breathtaking power of nature
Instance PeerTube généraliste francophone. General French-speaking PeerTube instance.Mes Numériques
pancake likes this.
qbittorrent has a ton of unofficial search plugins wow
Unofficial search plugins
Search plugins for the search feature. Contribute to qbittorrent/search-plugins development by creating an account on GitHub.GitHub
like this
HaraldvonBlauzahn
in reply to HaraldvonBlauzahn • • •The details are complex; it has humorously been called "security by security".
Hobby Linux users could, as far as I understand , simply disable UEFI secure boot (after weigthing carefully what secure boot provides to them, and what it does not provide). Otherwise, they'll need a firmware upgrade before any upgrade to a new OS / bootloader chain.
Small companies which use old laptops with Windows might be bitten hard by this because they can become locked out of their hardware with no way to update it, or even make a backup!
specification that defines a software interface between an operating system and platform firmware
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)HaraldvonBlauzahn
in reply to HaraldvonBlauzahn • • •operating mode of x86 central processor units
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)Technus
in reply to HaraldvonBlauzahn • • •For a home desktop that's never left unattended with anyone untrustworthy, I don't see that Secure Boot is worth the effort in setting up.
Given that you have to re-sign the boot image every time you upgrade, any malware already running with root privileges on the machine could easily slip itself into the new signed image.
The best security is not running untrusted software to begin with.
HaraldvonBlauzahn
in reply to Technus • • •Can you explain the detailed reason why you think that? Voicing opinions is nice of course but explaining the thought process and logic is, I think, almost always more interesting to other people.
To start with, what do you think is the "normal users" threath model? And, for example, if one happens to be a member of any of the various minorities that authoritarian governments of every color happen to single out and persecute in your countries case, what would you want to protect from? Or if you are, say, a lawyer, and have a professional obligation to protect sensitive data from theft?
Technus
in reply to HaraldvonBlauzahn • • •Actually, I would love for you to explain to me how Secure Boot alone would protect someone from any of that. If you want to protect files, you need full disk encryption, not Secure Boot.
Or are you seriously expecting a government-level threat actor to bother to:
That's the great thing about fascist governments, is they have no need to be that sneaky. They can just change the laws to make whatever you're doing illegal and jail you until you agree to give up your documents, or simply hit you with a $5 wrench until you tell them the password.
Security
xkcdIHawkMike
in reply to Technus • • •You need both FDE and Secure Boot, ideally with FDE using a TPM with PIN and PCR 7+15=0. FDE without SB can be trivially boot-kitted and obviously SB without FDE is mostly pointless. Maybe for a server/desktop behind locked doors you don't worry as much, but for a laptop you absolutely should. Also it's really easy in Arch to resign the UKI with sbctl via a pacman hook whenever the kernel is updated so there's no good reason not to use it.
If you're relying on a LUKS password only, it can be brute-forced. To protect against that you need a decently long password which is annoying to type every boot. A short TPM PIN sealed by SB protecting LUKS is both more convent and more secure.
Finally, if an attacker or malware gets root, FDE isn't protecting you either.
aksdb
in reply to IHawkMike • • •Even having no pre-boot PIN with SB on is nice, then you only need your user space login where you could even use fingerprint reader if you like. For servers they can already start serving without anyone having to intervene manually (which is nice after power outage, for example).
So yeah, SB, TPM and FDE are a very nice bundle that heavily secures against the most relevant attack vectors.
IHawkMike
in reply to aksdb • • •balsoft
in reply to HaraldvonBlauzahn • • •Secure Boot is a really contrived and, frankly, bad defense against an attack that is extremely difficult to execute in reality and does not happen often (are there any examples of a bootloader replacement against a home desktop in the wild?).
An actually good solution would be firmware support for LUKS-style FDE (with a password-encrypted key which then encrypts the rest of the disk), so that your bootloader is encrypted with the rest of your system and impossible to substitute without erasing the rest of the disk, until you enter the password. This way there's no need for key enrolment into firmware, and firmware manufacturers don't have to just trust MS. (the firmware of course needs to be protected too, by signing it with the manufacturer's key; if you flash something unsigned, a warning pops up Android-style before every boot).
If you are hiding something from the state (like your sexual orientation or something), your energy is much better spent encrypting your communications online and keeping your identities anonymous. If you are already suspicious enough to try and pull a bootloader replacement attack on you, any authoritarian state which would do that in the first place will just throw you in jail and fabricate evidence as needed.
aksdb
in reply to balsoft • • •balsoft
in reply to aksdb • • •SheeEttin
in reply to Technus • • •If secure boot is off, and you run malware on your pc, it can change the boot process to escalate privileges.
This probably requires root or admin in the first place, but if they can install a malware loader, they can establish persistence so that even if you remove the os-level components, they'll be reinstalled on reboot.
Technus
in reply to SheeEttin • • •Yeah, but the malware can just wait for a system upgrade where you sign a new boot image and slip itself in then.
It works for Windows because theoretically only Microsoft would have the signing key and it's not just sitting on disk somewhere. But then you're just trusting Microsoft, and also subject to vendor lock-in.
HaraldvonBlauzahn
in reply to SheeEttin • • •This is technically correct, but on a desktop system, malware executing in user space is normally already game over. It can exfiltrate and send your passwords or ssh private keys, change browser certificates or browser software, add user systemd sessions or crontab entries and can generally e.g. do everything a banking trojan would like to do.
Max-P
in reply to HaraldvonBlauzahn • • •As commenters on the LWN thread said, I doubt that many firmwares even bother to check anyway. My motherboard happens to have had a bug where you can corrupt the RTC and end up in 2031 if you overclock it wrong. I didn't use secure boot then though so I don't know if it would have still booted Windows. But I imagine it would.
That said, I've always just enrolled my own keys. I know some other distros that make you enroll their keys as well like Bazzite. At least that way you don't depend on Microsoft's keys and shim or anything, clean proper secure boot straight into UKI.
HaraldvonBlauzahn
in reply to Max-P • • •Seems it compares the expiration date of the UEFI key with the signature date of the bootloader / OS keys. (See the comments on the LWN article, some are far more knowledgeable than I am.) So, no, it does not require a working on-board clock to lock you out if you are not extremely careful and fully understand each part.
HaraldvonBlauzahn
in reply to Max-P • • •That does not help if the master key in the key chain is expired.
Sure you can disable Secure Boot. But a password-protected BIOS is secured by TPM again. High levels of security always carry a risk of locking oneself out.
don't like this
Mark doesn't like this.
exu
in reply to HaraldvonBlauzahn • • •I don't think you understand what "enrolling your own keys" means in the context of Secure Boot.
The key affected here is specifically for the Linux shim signed by Microsoft. It is used by GRUB and some distros to work with Secure Boot.
Enrolling your own key means you add a new certificate to the key store. This is completely separate from the one provided by Microsoft and controlled only by you. The common recommendation is to remove all built-in keys and only add your own, to make this system as secure as possible.
like this
Mark likes this.
HaraldvonBlauzahn
in reply to exu • • •And exactly that Linux shim signed by Microsoft is no longer valid because the Microsoft signature in the UEFI firmware is expired.
HaraldvonBlauzahn
in reply to exu • • •OK, now you are talking about something a bit different - registering own keys in the UEFI system, which is significantly more involved than updating the BIOS, and also requires firmware support, and the firmware also needs to match the motherboard. And the whole issue with ACPI support for Linux shows clearly that having reams of specufications is not enough, the implementation of the BIOS needs to match that specification which whether thsz's the case you will only learn after you bought the hardware.
Here is a description of that process:
docs.bell-sw.com/alpaquita-lin…
Moreover, for any change of the boot chain, bootloader, posdibly also kernel, this needs to be repeated.
Do you think that's accessible to normal users? Considering most have probably not even ever done a firmware update?
Using Your Own Keys in Secure Boot
docs.bell-sw.comexu
in reply to HaraldvonBlauzahn • • •From the first post in this chain
I didn't start talking about it, this was many comments above
HaraldvonBlauzahn
in reply to Max-P • • •The whole point of the article is that you do depend on their expired root key. You have produced a lot of text without even understanding the key issue. At that point I am wondering whether all that text was produced by an LLM?
don't like this
Mark doesn't like this.
Norah (pup/it/she)
in reply to HaraldvonBlauzahn • • •HaraldvonBlauzahn
in reply to Norah (pup/it/she) • • •Please don't troll and come back to the topic. GP was completely missing the topic, do you want to avoid it?
Um, given that Secure Boot prevents any modification of your computer's boot chain - including installing another boot loader or OS - that's not how it works.
don't like this
Mark doesn't like this.
IHawkMike
in reply to HaraldvonBlauzahn • • •Secure Boot does no such thing. All it does it require that everything in the boot chain is signed by a trusted cert.
Binding TPM PCR7 to FDE (or more brittle options like 0+2+4) is really what protects against boot chain modifications but that's another topic.
Disabling SB to install the distro, then re-enabling it once installed with either maintainer-signed shim or self-signed UKI/bootloader is perfectly fine.
like this
Mark likes this.
Norah (pup/it/she)
in reply to HaraldvonBlauzahn • • •like this
Mark likes this.
Max-P
in reply to HaraldvonBlauzahn • • •That's the whole point of enrolling your own keys in the firmware. You can even wipe the Microsoft keys if you want. You do that from the firmware setup, or within any OS while secure boot is off (such as
sbctl
on Linux).That's a feature that is explicitly part of the spec. The expectation is you password protect the BIOS to make sure unauthorized users can't just wipe your keys. But also most importantly that's all measured by the TPM so the OS knows the boot chain is bad and can bail, and the TPM also won't unwrap BitLocker/LUKS keys either.
Secure boot is to prevent unauthorized tampering of the boot chain. It doesn't enforce that the computer will only ever boot Microsoft-approved software, that's a massive liability for an antitrust lawsuit.
IHawkMike
in reply to Norah (pup/it/she) • • •Yeah this is an issue but not a big one. Most distro's installation media don't use shim so you have to disable SB during install anyway.
And installing the 2023 KEK and db certs can be done via firmware without much trouble or you can use
sbctl
in setup mode which I believe has both the 2011 and 2023 keys.If you dual boot Windows you'll want to update it to the new bootmgr signed with the 2023 keys and add the 2011 certs to dbx to protect against BlackLotus or let Windows do it via patches+regfixes.
Also know that any changes to PK, KEK, dB, or dbx will change the PCR 7 measurement so handle that accordingly if you use TPM unlock for FDE.
HaraldvonBlauzahn
in reply to Max-P • • •That is far more complex than a firmware update and also depends on a correct implementation of the spec in the BIOS - which, given the experiences with ACPI for Linux, is not at all something one can rely on.
Max-P
in reply to HaraldvonBlauzahn • • •HaraldvonBlauzahn
in reply to Max-P • • •ACPI modules - ArchWiki
wiki.archlinux.orgEugenia
in reply to HaraldvonBlauzahn • • •Tenderizer78
in reply to Eugenia • • •I just tried to distro-hop and found my BIOS had been locked with a password. Assuming I didn't set a password that I subsequently forgot (and that isn't one of the many I have memorized), I figured this might have something to do with the age of the laptop (I have a HP 4540s). If certificate expiration is already affecting people then this might be it.
EDIT: I just forgot I set a password, and it took me 2 days to realize that I was stupid enough to have set the password that I used for everything when I was 12 years old.
drspod
in reply to Tenderizer78 • • •Tenderizer78
in reply to drspod • • •SteveTech
in reply to drspod • • •BIOS Master Password Generator for Laptops
bios-pw.orgdeadcatbounce
in reply to HaraldvonBlauzahn • • •Being beholden to Microsoft doesn't sound like something anyone needs.
Until that ends I'm doing best to avoid secure boot. I don't want to.
data1701d (He/Him)
in reply to deadcatbounce • • •deadcatbounce
in reply to data1701d (He/Him) • • •I thought it was a Microsoft centric thing in that the certificate authority was either Microsoft or signed by Microsoft?
Maybe I need to read about it more? Can you direct me to the general area?
WhyJiffie
in reply to deadcatbounce • • •Microsoft's keys are pre-installed to all motherboards, so boot binaries signed by Microsoft are trusted by default. afaik Microsoft keys often can't be removed, but not because it's not possible, but because it can brick devices. you can create your own MOK or Machine Owner Keys and set up your linux system to sign your bootloader and kernel with it, but that is in addition to Microsoft keys.
wiki.archlinux.org/title/Unifi…
Unified Extensible Firmware Interface/Secure Boot - ArchWiki
wiki.archlinux.orgdeadcatbounce
in reply to WhyJiffie • • •Thank-you. Recently rebuilt my Arch Rescue build and saw that section in doing the UKI dance.
I don't mind the Microsoft keys being there at all. I just don't think tying myself to them is particularly clever.
From your final part. I think I need to go back and reread it. Thank-you again.
☂️-
in reply to data1701d (He/Him) • • •HaraldvonBlauzahn
in reply to ☂️- • • •Max-P
in reply to HaraldvonBlauzahn • • •That's bullshit. ARM is an architecture and by itself does not specify secure boot any more than x86 does. Raspberry Pis don't have secure boot. You can unlock the bootloader on a Pixel, install GrapheneOS, and relock the bootloader just fine. Several other manufacturers allow bootloader unlocks no problem. The main reason you can't on some popular phones is US carriers, even international Samsungs you can unlock the bootloader and flash whatever you want on it.
I'm literally typing this comment on a phone running a custom OS (LineageOS on a OnePlus 8T). I'm literally 2 versions of Android ahead of the latest supported version. I also have a Galaxy S7 running Android 15, a phone that officially tops out at Android 8 and launched with Android 6. Both you literally just toggle the bootloader unlock option in the settings, no hacks no craziness, it's literally a feature.
At this point you're just straight up making shit up.
HaraldvonBlauzahn
in reply to Max-P • • •I mean Windows PCs with ARM CPUs which have Secure Boot, not Android smart phones or embedded devices.
Max-P
in reply to HaraldvonBlauzahn • • •Nope. Even Qualcomm themselves provide what's needed to run Linux on the Windows for ARM PCs.
The only one I can't find for sure is whether there's any lockdown on the firmware for the Microsoft Surface and Copilot+ laptops, but I'm also not finding any sources pointing that it would be. But at this point you're buying Microsoft hardware, what do you expect.
Qualcomm Snapdragon X Elite Benchmarks On Ubuntu Linux vs. AMD vs. Intel
www.phoronix.comHaraldvonBlauzahn
in reply to deadcatbounce • • •Here
en.m.wikipedia.org/wiki/UEFI#S…
is a list of problems and criticism on Secure Boot.
specification that defines a software interface between an operating system and platform firmware
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)deadcatbounce
in reply to HaraldvonBlauzahn • • •xia
in reply to HaraldvonBlauzahn • • •☂️-
in reply to xia • • •HaraldvonBlauzahn
in reply to ☂️- • • •There is even a whole section in Wikipedia on issues and criticism with secure boot:
en.m.wikipedia.org/wiki/UEFI#S…
Some people argue that one can work around such locking down of PC hardware. Do this or that to avoid issues with substantial tinkering.
But that is not a bug but a feature. Sure, as a technical Linux user you can work around some nastiness. Like working around privacy invasion on Facebook or Linkedin by "adjusting" settings, or "adjust" settings in Wimdows to make it more private and so on. The thing is: working against the platform becomes quickly a losing game, because you don't control the platform - Microsoft does. And it does not help you if you manage to re-gain control of your device after some hours of tinkering if 99.9% of people around you don't have the knowledge and time and store your data, photos, Emails on OneDrive and so on. Freedom is very much a collective thing and software freedom is no exception.
And this does not mean that the thinkering and hacking is in vain - but it is not enough. We need the practical right to control our devices.
specification that defines a software interface between an operating system and platform firmware
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)☂️-
in reply to HaraldvonBlauzahn • • •Decker108
in reply to HaraldvonBlauzahn • • •