Twitter Client for UEFI • Hacker News Board

Re: Twitter Client for UEFI

#11

Post by ______-_-______ » Sat, Mar 12, 2022, 2:41 PM UTC

lizardactivist wrote: post #5

I get the feeling UEFI can never be entirely secure with the set of functionality it offers and thus huge surface it is exposing. Call me crazy, but security means doing only what is necessary and no more, in particular in this early part of starting up a computer system.

UEFI needs ~complete access to the machine so it can initialize hardware devices and pass control to the OS (which also has ~complete control of the hardware). How do you think sandboxing it would work, practically?

Re: Twitter Client for UEFI

#12

Post by cpach » Sat, Mar 12, 2022, 2:48 PM UTC

shabier wrote: post #8

My only question is; why? Don't get me wrong, it is cool, but do people actually use it?

As for why: Probably because it’s a cool hack.

Does anyone actually use it? Probably not.

Re: Twitter Client for UEFI

#13

Post by hackettma » Sat, Mar 12, 2022, 2:48 PM UTC

This sounds like a perfect command and control setup for malware.

Re: Twitter Client for UEFI

#14

Post by profile53 » Sat, Mar 12, 2022, 2:53 PM UTC

______-_-______ wrote: post #11

lizardactivist wrote: post #5

I get the feeling UEFI can never be entirely secure with the set of functionality it offers and thus huge surface it is exposing. Call me crazy, but security means doing only what is necessary and no more, in particular in this early part of starting up a computer system.

UEFI needs ~complete access to the machine so it can initialize hardware devices and pass control to the OS (which also has ~complete control of the hardware). How do you think sandboxing it would work, practically?

What’s scary about UEFI is that it has both direct hardware access and a massive attack surface: GUI, Ethernet stack, occasionally an 802.11 stack, etc.

Re: Twitter Client for UEFI

#15

Post by jeromegv » Sat, Mar 12, 2022, 2:53 PM UTC

loloquwowndueo wrote: post #9

If this allows me to use “latest tweets” chronological view as default instead of the brain dead “home” view I’m totally setting up a laptop with this. The official twitter clients are more atrocious each day (spaces? Home by default? 95% promoted tweets in my timeline? List suggestions I don’t care about?)

There are quite a few third party client who work quite well.

Re: Twitter Client for UEFI

#16

Post by amelius » Sat, Mar 12, 2022, 2:53 PM UTC

I'm impressed when they have VirtualBox or qemu running in UEFI, sandboxing my real OS.

Re: Twitter Client for UEFI

#17

Post by xcambar » Sat, Mar 12, 2022, 2:56 PM UTC

jeromegv wrote: post #15

loloquwowndueo wrote: post #9

If this allows me to use “latest tweets” chronological view as default instead of the brain dead “home” view I’m totally setting up a laptop with this. The official twitter clients are more atrocious each day (spaces? Home by default? 95% promoted tweets in my timeline? List suggestions I don’t care about?)

There are quite a few third party client who work quite well.

Please complete your answer ;)

Re: Twitter Client for UEFI

#18

Post by khaledh » Sat, Mar 12, 2022, 3:00 PM UTC

lizardactivist wrote: post #5

I get the feeling UEFI can never be entirely secure with the set of functionality it offers and thus huge surface it is exposing. Call me crazy, but security means doing only what is necessary and no more, in particular in this early part of starting up a computer system.

As demonstrated by MoonBounce: https://securelist.com/moonbounce-the-dark-side-of-uefi-firm...

Re: Twitter Client for UEFI

#19

Post by masklinn » Sat, Mar 12, 2022, 3:02 PM UTC

amelius wrote: post #16

I'm impressed when they have VirtualBox or qemu running in UEFI, sandboxing my real OS.

Why would you want qemu running in UEFI, rather than have qemu booted from UEFI? (more specifically run qemu on xen booted from UEFI, I think is what you'd want).

Re: Twitter Client for UEFI

#20

Post by silisili » Sat, Mar 12, 2022, 3:08 PM UTC

ctxc wrote: post #10

Didn't know what UEFI was, so here it is: " UEFI and BIOS are low-level software that starts when you boot your PC before booting your operating system, but UEFI is a more modern solution, supporting larger hard drives, faster boot times, more security features, and—conveniently—graphics and mouse cursors. The UEFI/BIOS loads when your computer starts up, and the BIOS is responsible for waking up your computer’s hard…

Thanks for this. I had a generally good idea about this, but despite seeing the word for many years, never actually knew what POST stood for before this comment. I'm not even sure I knew that it was an acronym...