Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter Client for UEFI

github.com

Post reply on HN
Print view View original

31–40 of 108 posts

Re: Twitter Client for UEFI

#31

Post by bayindirh »

blibble wrote: post #27
bayindirh wrote: post #26

Earlier quoted context omitted.

> this would be difficult without a network stack This was possible with Ethernet cards with boot ROMs for more than two decades. Network booting via UEFI is nothing new, nothing revolutionary. I've been installing fleets of servers with PCI ethernet cards w/ boot ROMs a decade before. Token ring systems were booting from network two decades before.

what's the difference between having the code running in ring0 in a ROM vs the code running in ring0 from UEFI?

When a boot ROM fires (it was via INT19 IIRC), the boot ROM runs, terminates and leaves the system. The size is smaller, it's not persistent, and it can't communicate with anything on the OS.

When booted from the ROM, it just downloads pxelinux.0 binary in most cases, and transfers control to it, and just vanishes.

The UEFI is persistently running at the background, has communication pipes with the OS (some of it is visible via /sys/firmware/efi), and has much larger surface like direct access to disks and network stack via drivers (it can directly read your files and work on them via proper FS driver modules).

There's also at least one open source sound driver too (https://github.com/Goldfish64/AudioPkg), so it can listen to your environment if it wants, at least in theory.

Re: Twitter Client for UEFI

#32

Post by kube-system »

shrimp_emoji wrote: post #30
ctxc wrote: post #10

Didn't know what UEFI was, so here it is: " UEFI and BIOS are low-level software that starts when you boot your PC before booting your operating system, but UEFI is a more modern solution, supporting larger hard drives, faster boot times, more security features, and—conveniently—graphics and mouse cursors. The UEFI/BIOS loads when your computer starts up, and the BIOS is responsible for waking up your computer’s hard…

Quoted post unavailable.

Apple was using the precursor to UEFI (EFI) back when most windows boxes were still booting using BIOS derived from a rip off of a 1980s IBM.

Re: Twitter Client for UEFI

#33

Post by blibble »

bayindirh wrote: post #31
blibble wrote: post #27

Earlier quoted context omitted.

what's the difference between having the code running in ring0 in a ROM vs the code running in ring0 from UEFI?

When a boot ROM fires (it was via INT19 IIRC), the boot ROM runs, terminates and leaves the system. The size is smaller, it's not persistent, and it can't communicate with anything on the OS. When booted from the ROM, it just downloads pxelinux.0 binary in most cases, and transfers control to it, and just vanishes. The UEFI is persistently running at the background, has communication pipes with the OS (some of it is…

> The UEFI is persistently running at the background, has communication pipes with the OS

this isn't true, it ceases running once it transfers execution

you're thinking of the SMM, which is something else entirely

Re: Twitter Client for UEFI

#34

Post by [deleted] »

loloquwowndueo wrote: post #9

If this allows me to use “latest tweets” chronological view as default instead of the brain dead “home” view I’m totally setting up a laptop with this. The official twitter clients are more atrocious each day (spaces? Home by default? 95% promoted tweets in my timeline? List suggestions I don’t care about?)

[deleted]

Re: Twitter Client for UEFI

#35

Post by dijit »

blibble wrote: post #22
profile53 wrote: post #14

Earlier quoted context omitted.

What’s scary about UEFI is that it has both direct hardware access and a massive attack surface: GUI, Ethernet stack, occasionally an 802.11 stack, etc.

customers want to be able to boot their machines off the network this would be difficult without a network stack if you're so inclined: you can remove unneeded modules from your UEFI firmware

> if you're so inclined: you can remove unneeded modules from your UEFI firmware

this is so disingenuous as to be offensive.

I'm not saying you're wrong, but the practical options for replacing a UEFI BIOS are vanishingly small.

Also: booting over the network is a feature of a smaller ROM on a network card, that ROM usually had a much smaller surface area and had to be explicitly called as a boot option.

Given the people who care most about network boot are people running servers: IPMI/iDRAC/iLO are much stronger options for initiating network boot.

Re: Twitter Client for UEFI

#36

Post by dmix »

khaledh wrote: post #18
lizardactivist wrote: post #5

I get the feeling UEFI can never be entirely secure with the set of functionality it offers and thus huge surface it is exposing. Call me crazy, but security means doing only what is necessary and no more, in particular in this early part of starting up a computer system.

As demonstrated by MoonBounce: https://securelist.com/moonbounce-the-dark-side-of-uefi-firm...

> Due to its emplacement on SPI flash which is located on the motherboard instead of the hard disk, the implant is capable of persisting in the system across disk formatting or replacement

Lovely, so you’d have to reflash the firmware to fix it.

Re: Twitter Client for UEFI

#37

Post by rvz »

shrimp_emoji wrote: post #30
ctxc wrote: post #10

Didn't know what UEFI was, so here it is: " UEFI and BIOS are low-level software that starts when you boot your PC before booting your operating system, but UEFI is a more modern solution, supporting larger hard drives, faster boot times, more security features, and—conveniently—graphics and mouse cursors. The UEFI/BIOS loads when your computer starts up, and the BIOS is responsible for waking up your computer’s hard…

Quoted post unavailable.

It's because 95% of people do not care or don't like playing around with their computers or accessing the UEFI menu for sys-admin, netbooting, recovery, ransomware development or building their PCs.

Apple does the same thing without the spooky UEFI menus on PCs, called 'Internet Recovery' which is still using EFI and is just like how netbooting works; and that 'just works'.

Re: Twitter Client for UEFI

#38

Post by dheera »

secondcoming wrote: post #4

TIL: It's possible for UEFI code to access the internet. What could possibly go wrong?

Wasn't it always possible? If it can boot a full-blown OS that can access the internet, it has to be able to access the internet on its own.

Re: Twitter Client for UEFI

#39

Post by bonzini »

blibble wrote: post #33
bayindirh wrote: post #31

Earlier quoted context omitted.

When a boot ROM fires (it was via INT19 IIRC), the boot ROM runs, terminates and leaves the system. The size is smaller, it's not persistent, and it can't communicate with anything on the OS. When booted from the ROM, it just downloads pxelinux.0 binary in most cases, and transfers control to it, and just vanishes. The UEFI is persistently running at the background, has communication pipes with the OS (some of it is…

> The UEFI is persistently running at the background, has communication pipes with the OS this isn't true, it ceases running once it transfers execution you're thinking of the SMM, which is something else entirely

SMM is also part of the firmware, it is set up by UEFI.

Re: Twitter Client for UEFI

#40

Post by blibble »

dijit wrote: post #35
blibble wrote: post #22

Earlier quoted context omitted.

customers want to be able to boot their machines off the network this would be difficult without a network stack if you're so inclined: you can remove unneeded modules from your UEFI firmware

> if you're so inclined: you can remove unneeded modules from your UEFI firmware this is so disingenuous as to be offensive. I'm not saying you're wrong, but the practical options for replacing a UEFI BIOS are vanishingly small. Also: booting over the network is a feature of a smaller ROM on a network card, that ROM usually had a much smaller surface area and had to be explicitly called as a boot option. Given the pe…

> this is so disingenuous as to be offensive.

> I'm not saying you're wrong, but the practical options for replacing a UEFI BIOS are vanishingly small.

what? you can download a GUI editor, click remove on the modules you don't want and then save it

https://www.trishtech.com/2017/12/uefitool-view-and-edit-uef...

I've done it

Post reply on HN