Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

161–170 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#161

Post by systemBuilder »

HumblyTossed wrote: post #137
ab71e5 wrote: post #22

> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…

MS has zero vested interest in caring. If they brake booting for Linux users, how does that hurt them in any meaningful way? Sure they get some press, but is it bad press if most people are never affected by this?

It makes Linux more robust. Since Microsoft is the king of vulnerability, making Linux more robust is NOT in their best interest. I actually think Microsoft did a GOOD THING. This should create a mad scramble to tighten up security at all those lackadaisical distros!

Re: What is an SBAT and why does everyone suddenly care

#162

Post by rolph »

monocasa wrote: post #159
rolph wrote: post #150

Earlier quoted context omitted.

"any information" suggests wrong information wont evoke cause of action in any court.

I would be shocked if a judge interpreted that to include essentially willful perjury (or at least false statements) to a national security agency.

id be shocked as well, but the small paragraph doesnt seem to preclude it.

people make mistakes, equipment can have unexpected behaviour, and people lie. im curious, about if this would be considered compelled speech if someone said no you cant MITM my service unless there is an extant activity of concern.

its gotta be addressed in other section or paragraph.

Re: What is an SBAT and why does everyone suddenly care

#164

Post by ack_complete »

immibis wrote: post #20
xnzakg wrote: post #7

Earlier quoted context omitted.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

It's not a new trend - error-code based software would propagate that ERROR_INVALID_PARAMETER all the way from the function with the invalid parameter back out to the return value of the user operation, then helpfully tell the user "Invalid parameter!" Exceptions with string messages and full stack traces might be yet another underrated Java invention.

Even that at least helps rule out the most common issues, and is less frustrating than an update pooping out 0x80070070 and making you manually translate it to ERROR_DISK_FULL.

Re: What is an SBAT and why does everyone suddenly care

#165

Post by cesarb »

Animats wrote: post #163

Does this interfere with wiping Windows from a system and installing Linux? Or does installing Windows contaminate the TPM module permanently?

> Or does installing Windows contaminate the TPM module permanently?

It's not the TPM, it's a simple UEFI variable. AFAIK, there's a way in the BIOS to reset all these variables to their original default value, though you might have to use the "clear CMOS" jumper to do it.

Re: What is an SBAT and why does everyone suddenly care

#166

Post by moffkalast »

coldpie wrote: post #123
moffkalast wrote: post #118

Earlier quoted context omitted.

Yeah alright but people want to like, do things.

If you want to use proprietary software, yeah, you should use Windows. It's built for that. For better or worse, Linux really isn't. Edit: Or use Windows binaries with your distro-provided Wine. Win32 is the only stable user-level Linux API.

Going for a windows build with wine instead of the Linux build sounds completely crazy, but then again Proton works exceptionally well on Steam so this might genuinely be the more long term stable option. I'll have to try that out lmao.

Re: What is an SBAT and why does everyone suddenly care

#167

Post by Animats »

cesarb wrote: post #165
Animats wrote: post #163

Does this interfere with wiping Windows from a system and installing Linux? Or does installing Windows contaminate the TPM module permanently?

> Or does installing Windows contaminate the TPM module permanently? It's not the TPM, it's a simple UEFI variable. AFAIK, there's a way in the BIOS to reset all these variables to their original default value, though you might have to use the "clear CMOS" jumper to do it.

> though you might have to use the "clear CMOS" jumper to do it.

So installing Windows can break a computer for Linux.

That's a great antitrust issue. Microsoft should be fined for that.

Re: What is an SBAT and why does everyone suddenly care

#168

Post by thomastjeffery »

ab71e5 wrote: post #22

> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…

Microsoft's bootloader is clearly intended to be a pain in the ass. There is nothing new about this situation. They have been doing it since the 90s when any windows update would write over your MBR without a care in the world. We all hoped that UEFI boot menus would resolve the situation. They would have, if only Microsoft were willing to stop intentionally polluting everyone's partitions. Instead, it is not only the default, but the only option, for the windows installer to squat in the first EFI System Partition it sees. That means that if you install linux first and windows second, windows will install its bootloader to your ESP. Even if it's too small. There is no way to disable this behavior. It's asinine.

P.S. The ultimate irony of this situation is that it actually ends up breaking concurrent windows installs more often than anything else.

Re: What is an SBAT and why does everyone suddenly care

#169

Post by spathi_fwiffo »

stonethrowaway wrote: post #85

> Short version: Secure Boot Advanced Targeting and if that's enough for you you can skip the rest you're welcome. Based. Unfathomably based.

agree; defined long acronym immediately in article.

i'll probably read the test, but that's some high quality posting from the get-go!

Re: What is an SBAT and why does everyone suddenly care

#170

Post by akira2501 »

Cthulhu_ wrote: post #140
xnzakg wrote: post #7

Earlier quoted context omitted.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

There's two directions that goes into. Highly specialized error codes with zero results on search engines, or overly generic errors with a billion results and underlying reasons. Error design needs to be its own subject / specialization. Errors need to say what the problem is and how to fix it, in an ideal world, or what the user can do or should google to solve it. And of course, any error code of any public softwar…

This is where I really love mainframes. The errors all contain a consistent code and a description. The codes are all published, are easy to find nowadays, and have generally good documentation attached to them.

Here's an IBM example, for just a single OS facility: https://www.ibm.com/docs/en/SSLTBW_2.4.0/pdf/hasa100_v2r4.pd...

Post reply on HN