Here is a mirror for anyone else getting blocked* by dreamwidth for not using a corporate browser: https://web.archive.org/web/20240822091216/https://mjg59.dre...
* No matter how many times I do the captcha.
What is an SBAT and why does everyone suddenly care
131–140 of 276 posts
Re: What is an SBAT and why does everyone suddenly care
#132Earlier quoted context omitted.
I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…
What are the details with a custom key?
[deleted]
Re: What is an SBAT and why does everyone suddenly care
#133Earlier quoted context omitted.
I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…
> I could set it up to auto unlock using TPM2 but I would recommend using a long password. TPM2+password would be optimal. Personally, I trust LUKS with passphrases far more than I trust some random proprietary hardware implementation nobody can audit... It's also important to me to be able to recover the disk contents with the passphrase on another machine if the motherboard dies. Maybe that's what you meant (backup…
I meant:
- I'm only using a long password
- but it would be optimal to require PCR values and password
Note that in any case where you use PCR values you always should setup a secondary way to unlock the partition. Or else you will lose your data if some of your hardware measured into a PCR breaks.
Requiring both is optimal as it 1. doesn't rely on TPM/PCRs but 2. prevent certain attack vectors possible with password only but not possible with PCRs. Through you now also have to manage a backup unlock method. Which is annoying. And the security benefits are negligible/irrelevant for most people. Which is why I don't use it.
Re: What is an SBAT and why does everyone suddenly care
#134Earlier quoted context omitted.
>tweak QEMU for performance and passthrough Any guide you could link to that covers all of this? I would like to setup a very performant windows VM.
https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF Note that it requires a second graphics card to work.
Or a single GPU that supports SR-IOV, but AFAIK no consumer-grade GPU provides it.
Re: What is an SBAT and why does everyone suddenly care
#135Earlier quoted context omitted.
I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…
What are the details with a custom key?
sbctl with package manager hook for automatically signing on updates etc.
keys are just stored on the device, for the typical laptop use-case this is good enough (platform key only used by a single device, no MDA or anything like that)
Re: What is an SBAT and why does everyone suddenly care
#136> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…
People that dualboot are probably also people that run random debloat scripts that disable telemetry. So when such system broke there was no signal it happened.
Doubtful. I don't.
Re: What is an SBAT and why does everyone suddenly care
#137> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…
MS has zero vested interest in caring. If they brake booting for Linux users, how does that hurt them in any meaningful way? Sure they get some press, but is it bad press if most people are never affected by this?
Re: What is an SBAT and why does everyone suddenly care
#138I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…
Ubuntu regularly locks up and black screens when I try to sleep/hibernate. It's a very common problem that has nothing to do with Windows or Microsoft. I also have had 0 issues with dual booting for roughly 10 years now. HN wouldn't be HN without some baseless MS bashing.
I have had occasional issues with Windows and various flavors of Linux hibernating but nothing that happens with any regularity - at all - and nothing that can't be solved by simply rebooting.
Re: What is an SBAT and why does everyone suddenly care
#139Earlier quoted context omitted.
[flagged]
I think you underestimate how close big tech and telecom companies are to three letter agencies. See the "Protect America Act" of 2007 which covered everyone's asses for warrantless spying.
Even better when said companies are (secretly) owned by said three leter agencies: https://en.wikipedia.org/wiki/Crypto_AG
Re: What is an SBAT and why does everyone suddenly care
#140I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.
There's two directions that goes into. Highly specialized error codes with zero results on search engines, or overly generic errors with a billion results and underlying reasons.
Error design needs to be its own subject / specialization. Errors need to say what the problem is and how to fix it, in an ideal world, or what the user can do or should google to solve it.
And of course, any error code of any public software should be listed on a website or a locally accessible resource.