11–20 of 276 posts
I'd be also really curious to hear how MS was attempting to do dual-boot detection, I hope someone (more skilled than I) would reverse engineer that bit from the update.
This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…
The last time I had to manages windows I used Unattended to wipe and re-install to a base level. I found that diagnosing and troubleshooting was not worth the effort. https://tgup.net/
Major question for me is, are the grubs that are getting rejected completely unpatched, or were they patched by distros without updating the "security generation"? I'd be also really curious to hear how MS was attempting to do dual-boot detection, I hope someone (more skilled than I) would reverse engineer that bit from the update.
Reading into https://www.gnu.org/software/grub/manual/grub/html_node/Secu...
It's possible it's both?
> I'd be also really curious to hear how MS was attempting to do dual-boot detection
I'm in the boat that they shouldn't doing dual boot detection at all, it sounds like everyone agreed to use SBAT to stop vulnerable bootchains from being exploitable and some Linux distributions got caught slacking.
I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You know what, I'm just going to run Linux, if I really need Windows or Mac, I can run a VM or use a separate spare computer."
Since then I have successfully setup Secure Boot for my distro, learned how to tweak QEMU for performance and passthrough, got a working QEMU macOS VM (although having to update every few months to keep XCode working is a pain), and generally pretty happy with the state of affairs.
I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…
Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.
This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…
I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
Or at least include a URL to a web page explaining the error and what you can do about it
I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.
Exceptions with string messages and full stack traces might be yet another underrated Java invention.