Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

21–30 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#21

Post by Yoofie »

fmajid wrote: post #15
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

Or at least include a URL to a web page explaining the error and what you can do about it

No please don't do this. I have lost count how many times I tried to follow a link only to get a 404 page. If there is an issue where the app gives the user an error, show the error details & context directly and list the possible mitigation steps right then and there.

A URL with specific content is just another thing that now needs to be maintained along with the code and failure modes.

Re: What is an SBAT and why does everyone suddenly care

#22

Post by ab71e5 »

> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself.

I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the user would use the firmware menu to select linux or windows?

Anyway this comes at a time when I want to install linux on my work PC, since it has two nvme slots I think I'll go with installing it on a completely separate drive. Would have not prevented this issue though, which seems a legitimate fix from microsoft, just bad communication.

Re: What is an SBAT and why does everyone suddenly care

#23

Post by ab71e5 »

mjg59 wrote: post #8
zokier wrote: post #6

Earlier quoted context omitted.

I don't see why you couldn't update grub from Windows, its just EFI binary in ESP after all.

Distro grub is signed by the distro rather than Microsoft, so coordinating that would be extremely difficult

Why? You could just copy the binary and signature to your EFI partition from Windows? What am I missing here?

Re: What is an SBAT and why does everyone suddenly care

#24

Post by ben_w »

xnzakg wrote: post #7
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

I grew up with "System Error Type 11" (or whatever the exact quote was, hard to find on google).

I think the only button on the dialog box was "Restart".

Re: What is an SBAT and why does everyone suddenly care

#25

Post by qludes »

BaculumMeumEst wrote: post #18
mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

My Windows install is stuck in a boot loop like this - it spends 10 minutes trying to update and then fails, except maybe 1/3 times it then boots normally. I don't even try to do anything about it, I just marvel at it.

I have a Thinkpad that did something like this, it would try to install updates, fail and eventually boot into some kind of recovery wizard that demanded the bitlocker key. That wizard wasn't able to actually fix anything either but after failing a few times the system finally would uninstall the update. The whole process took over an hour with zero feedback.

I had to switch to Linux just to get a machine I could rely on.

Re: What is an SBAT and why does everyone suddenly care

#27

Post by cesarb »

mjg59 wrote: post #8
zokier wrote: post #6

Earlier quoted context omitted.

I don't see why you couldn't update grub from Windows, its just EFI binary in ESP after all.

Distro grub is signed by the distro rather than Microsoft, so coordinating that would be extremely difficult

From what I understood, the parent's question is not about Microsoft updating grub; it's about a person hit by the bug, and thus in a situation where Windows boots but Linux doesn't, using Windows to copy the correct file (probably extracted from an updated package from the Linux distribution they're using) to the correct place in the EFI partition by hand.

(The first obstacle would be that AFAIK the EFI isn't mounted by default on Windows, but I believe it should not be hard to tell Windows to mount it and give it a drive letter.)

Re: What is an SBAT and why does everyone suddenly care

#28

Post by zokier »

rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

shim has an EFI variable to control its verbosity, you can set it to output all the gory details with e.g. `mokutil --set-verbosity true`, and on a glance there are some tools on Windows too to modify EFI vars

Re: What is an SBAT and why does everyone suddenly care

#30

Post by moffkalast »

mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

[flagged]
Post reply on HN