So it's a linked list
What is an SBAT and why does everyone suddenly care
141–150 of 276 posts
Re: What is an SBAT and why does everyone suddenly care
#142Earlier quoted context omitted.
I think Windows BSOD including QR code was pretty clever idea, although unfortunately it's halfbaked in that it's just a fixed generic URL instead of something specific to the error.
The problem with bootloaders is they really can’t spare a lot of storage. Storing different QR codes for all the common errors might be asking too much.
You don't need to store the whole QR code, just code to convert an URL into a QR code. Or a good, short URL that can easily be typed, e.g. "microsoft.com/errors/1234"
Re: What is an SBAT and why does everyone suddenly care
#143Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…
I have seen recommendations to not dual boot with non-obsolete Windows, because its updates would have a high risk of screwing up grub, but instead give that Windows it's own hard drive, and boot it 'manually', by selecting the boot drive at startup in the 'BIOS'. Sounds like that was good advice ?
Re: What is an SBAT and why does everyone suddenly care
#144Earlier quoted context omitted.
Do you dual boot? That's what mine did when the efi partition was too small for grub and windows' bootloader
Yeah, I dual boot. I think my efi partition is around 100mb. I forget if Arch puts just one backup kernel in there, but I feel like I saw a lot of garbage in there once that I had to clear out. Maybe that's the problem, will investigate, thanks.
Yeah, 100mb has been insufficient for some windows updates for me in the past. New windows installs create a 500mb EFI, but Windows 7/8 created a 100mb EFI and kept it if updated to Windows 10. Unfortunately resizing it is a pain, as the EFI partition is normally before your Windows partition.
Re: What is an SBAT and why does everyone suddenly care
#145Earlier quoted context omitted.
https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF Note that it requires a second graphics card to work.
Or a single GPU that supports SR-IOV, but AFAIK no consumer-grade GPU provides it.
IIRC Intel iGPUs support it and I read somewhere that their dGPUs do as well, but I might be misremembering.
Re: What is an SBAT and why does everyone suddenly care
#146I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.
Good error messages are hard. You want to tell the user what to do, but if you knew that the error could be thrown, you probably should have been gracefully handling the problem. You don't know what information is useful to a hacker and you don't know how your error will be propagated. Meaningful errors at one level ("incorrect parameters passed" when calling an API) is perfectly useless at another level ("incorrect parameters passed" when interacting with a React UI). And if you respect all of the above, at some point you'll end up with an error message that basically says "I can't tell you what, why or how something went wrong, but it did."
Re: What is an SBAT and why does everyone suddenly care
#147Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…
It was never designed to Empower the (end) User.
This is vaguely the experience that should have been present in an Empowered User centric BIOS.
First cold boot; BIOS verifies the hardware isn't broken, checks for a boot preference, finds none.
Present the User with a set of choices: Check for BIOS Updates (manufacturer), Check for OS Choices (manufacturer), Begin installing an OS (options list). Locally cached (present with the system) choices would be listed first. Microsoft Windows (installer) is probably OEM shipped (might not be). Linux / DistroName plugged in USB device, etc... 'Local Network boot (search)', and 'Install from the Internet' (shipped by manufacturer or added by local preference).
The BIOS would also support enrolling ANY signing keys of local preference with user confirmation. This should happen even at first boot for the keys known by the manufacturer; they shouldn't just be in there for free, confirming the key with the user should be part of the flow.
The BIOS _MUST_ also support multiple bootable entries, even if one is the default (without a timeout, even with only manual selection E.G. F12 / F11 / whatever... though this too should be standardized).
Re: What is an SBAT and why does everyone suddenly care
#148Earlier quoted context omitted.
I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…
> I could set it up to auto unlock using TPM2 but I would recommend using a long password. TPM2+password would be optimal. Personally, I trust LUKS with passphrases far more than I trust some random proprietary hardware implementation nobody can audit... It's also important to me to be able to recover the disk contents with the passphrase on another machine if the motherboard dies. Maybe that's what you meant (backup…
In case of systemd-cryptenroll (and other LUKS-related systemd infra, even without TPM) it's systemd that handles the passphrase to generate a key to unlock LUKS device - possibly combining with a PIN or passphrase or also a FIDO-compatible device or a smartcard.
Re: What is an SBAT and why does everyone suddenly care
#149Earlier quoted context omitted.
Ubuntu regularly locks up and black screens when I try to sleep/hibernate. It's a very common problem that has nothing to do with Windows or Microsoft. I also have had 0 issues with dual booting for roughly 10 years now. HN wouldn't be HN without some baseless MS bashing.
I have had occasional issues with Windows and various flavors of Linux hibernating but nothing that happens with any regularity - at all - and nothing that can't be solved by simply rebooting.
I shouldn't have to reboot in order to fix sleep or hibernate. Their reason for existence is to avoid the need to shut down and restart.
Re: What is an SBAT and why does everyone suddenly care
#150Earlier quoted context omitted.
[flagged]
Congress already granted retroactive immunity for telecoms acting in cooperation with the US government with the FISA Amendments Act of 2008. I don't see why they couldn't do the same for Microsoft (assuming the law doesn't already apply to them). > Release from liability - No cause of action shall lie in any court against any electronic communication service provider for providing any information, facilities, or ass…
"any information" suggests wrong information wont evoke cause of action in any court.