Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #14910 > unrolled thread

Let's not bluff ourselves.

Started byno.top.post@gmail.com
First post2015-06-11 17:42 +0000
Last post2015-06-14 23:12 +0000
Articles 5 on this page of 25 — 13 participants

Back to article view | Back to comp.os.linux.misc

Contents

  Let's not bluff ourselves. no.top.post@gmail.com - 2015-06-11 17:42 +0000
    Re: Let's not bluff ourselves. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-11 11:19 -0700
      Re: Let's not bluff ourselves. Harold Stevens <wookie@cindy.localdomain> - 2015-06-11 14:33 -0500
        Re: Let's not bluff ourselves. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-11 14:06 -0700
          Re: Let's not bluff ourselves. mm0fmf <none@mailinator.com> - 2015-06-15 19:09 +0100
            Re: Let's not bluff ourselves. Aragorn <thorongil@telenet.be.invalid> - 2015-06-16 01:37 +0200
              Re: Let's not bluff ourselves. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-15 18:13 -0700
                Re: Let's not bluff ourselves. Aragorn <thorongil@telenet.be.invalid> - 2015-06-16 09:14 +0200
                Re: Let's not bluff ourselves. noydb@no.way (Bruce Sinclair) - 2015-06-16 23:08 +0000
                  Re: Let's not bluff ourselves.  Off topic!! Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-16 18:40 -0700
      Re: Let's not bluff ourselves. "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2015-06-11 22:40 -0400
      Re: Let's not bluff ourselves. Johann Klammer <klammerj@NOSPAM.a1.net> - 2015-06-12 11:32 +0200
        Re: Let's not bluff ourselves. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-12 07:27 -0700
      Re: Let's not bluff ourselves. Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2015-06-14 19:37 -0700
      Re: Let's not bluff ourselves. no.top.post@gmail.com - 2015-06-19 04:48 +0000
    Re: Let's not bluff ourselves. Andreas Kohlbach <june15.6.ankman@spamgourmet.net> - 2015-06-11 17:25 -0400
      Re: Let's not bluff ourselves. Joe <joe@jretrading.com> - 2015-06-12 09:04 +0100
        Re: Let's not bluff ourselves. noydb@no.way (Bruce Sinclair) - 2015-06-14 23:14 +0000
      Re: Let's not bluff ourselves. Unknown <dog@gmail.com> - 2015-06-15 14:24 +0000
    Re: Let's not bluff ourselves. "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2015-06-11 22:32 -0400
      Re: Let's not bluff ourselves. ruben safir <ruben@mrbrklyn.com> - 2015-06-13 16:06 -0400
        Re: Let's not bluff ourselves. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-06-13 13:47 -0700
        Re: Let's not bluff ourselves. "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2015-06-13 20:14 -0400
          Re: Let's not bluff ourselves. noydb@no.way (Bruce Sinclair) - 2015-06-14 23:15 +0000
    Re: Let's not bluff ourselves. noydb@no.way (Bruce Sinclair) - 2015-06-14 23:12 +0000

Page 2 of 2 — ← Prev page 1 [2]

#14923

Fromruben safir <ruben@mrbrklyn.com>
Date2015-06-13 16:06 -0400
Message-ID<mli2ga$c1a$1@reader1.panix.com>
In reply to#14915
On 06/11/2015 10:32 PM, David W. Hodgins wrote:
> On Thu, 11 Jun 2015 13:42:33 -0400, <no.top.post@gmail.com> wrote:
> 
>> we can't be free of the crushing heel of M$.
> 
> Turn off secure boot, and don't buy a system where that cannot be done.
> 
> Regards, Dave Hodgins
> 


If you understand UEFI then you understand that on a service, this is
not a secure thing to do. The capacity of UEFI and the boot shell is too
powerful in order to run it without a signed binary.  Its a crappy
design, but that is how it is.  UEFI is an entire unvetted and insecure
OS that runs in bootspace.

Ruben

[toc] | [prev] | [next] | [standalone]

#14924

FromBobbie Sellers <bliss-sf4ever@dslextreme.com>
Date2015-06-13 13:47 -0700
Message-ID<mli4q3$ndj$1@dont-email.me>
In reply to#14923
On 06/13/2015 01:06 PM, ruben safir wrote:
> On 06/11/2015 10:32 PM, David W. Hodgins wrote:
>> On Thu, 11 Jun 2015 13:42:33 -0400, <no.top.post@gmail.com> wrote:
>>
>>> we can't be free of the crushing heel of M$.
>>
>> Turn off secure boot, and don't buy a system where that cannot be done.
>>
>> Regards, Dave Hodgins
>>
>
>
> If you understand UEFI then you understand that on a service, this is
> not a secure thing to do. The capacity of UEFI and the boot shell is too
> powerful in order to run it without a signed binary.  Its a crappy
> design, but that is how it is.  UEFI is an entire unvetted and insecure
> OS that runs in bootspace.
>
> Ruben
>

	I don't think your message is accurate except for Windows.
	UEFI is just a BIOS replacement to permit GPT. You
can put a password on it if you worry about that and I do so, I have
a password to guard against casual access to UEFI configuration.

	The boot system is as secure as any other.
	UEFI is not an OS from what I see of it requesting my input
at 2 or 3 points to let me chose between, various points of entry to the 
hardware or Linux OSes or even Live Boot disks to perform various tasks 
or merely to look at the new distributions.
	Even the loading of those systems is dependent on GRUB2 or whatever 
boot-loader is on the Live Boot disk.

	Signed binaries are as insecure as any other as you have to trust the 
binary and the signer, as well as the source of the binary.
We have an imperfect method for doing that called "checksums" and some
people go so far as to furnish public keys to demonstrate that stuff
purporting to come from an organization or site does in fact do so.

	Signed binaries are doubtless a necessity for Windows users
who have to have a IT person in to deal with the problems that
Windows seems to cause or attract.

	Of course I may be incorrect in some of my remarks and
any person who is more knowledgeable about UEFI can feel free to
correct  those remarks in detail.

	Not Rubin though as I found this:
	<http://archive.oreilly.com/cs/user/view/cs_msg/20421?page=last>

	bliss

[toc] | [prev] | [next] | [standalone]

#14925

From"David W. Hodgins" <dwhodgins@nomail.afraid.org>
Date2015-06-13 20:14 -0400
Message-ID<op.xz61mbkra3w0dxdave@hodgins.homeip.net>
In reply to#14923
On Sat, 13 Jun 2015 16:06:34 -0400, ruben safir <ruben@mrbrklyn.com> wrote:

> On 06/11/2015 10:32 PM, David W. Hodgins wrote:
>> Turn off secure boot, and don't buy a system where that cannot be done.

> If you understand UEFI then you understand that on a service, this is
> not a secure thing to do. The capacity of UEFI and the boot shell is too
> powerful in order to run it without a signed binary.  Its a crappy
> design, but that is how it is.  UEFI is an entire unvetted and insecure
> OS that runs in bootspace.

The restricted boot (aka secure boot) does not provide a secure boot
environment. It's an illusion, that prevents unskilled people from
running anything but microsoft crapware.
http://hothardware.com/news/researchers-hack-and-bypass-windows-8-uefi-secure-book

Regards, Dave Hodgins

-- 
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

[toc] | [prev] | [next] | [standalone]

#14939

Fromnoydb@no.way (Bruce Sinclair)
Date2015-06-14 23:15 +0000
Message-ID<mll5d6$bft$5@dont-email.me>
In reply to#14925
In article <op.xz61mbkra3w0dxdave@hodgins.homeip.net>, "David W. Hodgins" <dwhodgins@nomail.afraid.org> wrote:
>On Sat, 13 Jun 2015 16:06:34 -0400, ruben safir <ruben@mrbrklyn.com> wrote:
>
>> On 06/11/2015 10:32 PM, David W. Hodgins wrote:
>>> Turn off secure boot, and don't buy a system where that cannot be done.
>
>> If you understand UEFI then you understand that on a service, this is
>> not a secure thing to do. The capacity of UEFI and the boot shell is too
>> powerful in order to run it without a signed binary.  Its a crappy
>> design, but that is how it is.  UEFI is an entire unvetted and insecure
>> OS that runs in bootspace.
>
>The restricted boot (aka secure boot) does not provide a secure boot
>environment. It's an illusion, that prevents unskilled people from
>running anything but microsoft crapware.
>http://hothardware.com/news/researchers-hack-and-bypass-windows-8-uefi-secure-b
>ook

Indeed. Otherwise, the "secure boot system" would clearly not run anything MS 
at all ... were that it's real purpose. :)

[toc] | [prev] | [next] | [standalone]

#14937

Fromnoydb@no.way (Bruce Sinclair)
Date2015-06-14 23:12 +0000
Message-ID<mll562$bft$3@dont-email.me>
In reply to#14910
In article <mlcha9$5uk$1@dont-email.me>, no.top.post@gmail.com wrote:
>we can't be free of the crushing heel of M$.
>
>Government transactions which you must comply with don't follow
>*nix [open standards].
>You are forced to have an "up to date Microsoft compatible system".

Not so. :)


>So you just have a dual/multi-bootable system, with the first
>partitions given to M$.

Um, no. :)

Yes, to be fair, governments tend to be a long way behind when it comes to 
openess of document formats for the preservation of old data (ie so we can 
still read it in the future). MS is clearly not the way to achieve that in any 
way. :)

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.os.linux.misc

csiph-web