Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

51–60 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#51

Post by chuckadams »

immibis wrote: post #20
xnzakg wrote: post #7

Earlier quoted context omitted.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

It's not a new trend - error-code based software would propagate that ERROR_INVALID_PARAMETER all the way from the function with the invalid parameter back out to the return value of the user operation, then helpfully tell the user "Invalid parameter!" Exceptions with string messages and full stack traces might be yet another underrated Java invention.

Dr Watson is still a thing for getting tracebacks. Doesn’t work for kernel mode of course, but most things don’t.

Re: What is an SBAT and why does everyone suddenly care

#52

Post by ParetoOptimal »

moffkalast wrote: post #30
mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

[flagged]

> The result is a rock solid reliable experience that even an LTS linux can't match.

NixOS because of its generations has been extremely stable for me for years.

Have an issue? Reboot, select yesterdays generation (similar to but better than restore point), and keep working.

Re: What is an SBAT and why does everyone suddenly care

#53

Post by 1oooqooq »

gcr wrote: post #12
detourdog wrote: post #10

Earlier quoted context omitted.

The last time I had to manages windows I used Unattended to wipe and re-install to a base level. I found that diagnosing and troubleshooting was not worth the effort. https://tgup.net/

How does tgup compare to ninite? The latter seems more polished and older/stable, with more software available. https://ninite.com/

if you're at a point you need either of them, just hire someone too work on the oem scripts.

for personal use, not really worth it imo

if you're installing the right version of windows (Enterprise ltsc) it's already one click install. and your applications will change every week anyway.

Re: What is an SBAT and why does everyone suddenly care

#54

Post by 9dev »

moffkalast wrote: post #30
mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

[flagged]

This is really bad advice—don't follow it. Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly. Running critical software without updating may have been possible in some distant past, but it isn't any longer: You will catch an exploit or crypto locker at some point.

Microsoft abusing its update mechanism to pushing crap is nothing new, but downright refusing updates ins't the answer either.

Re: What is an SBAT and why does everyone suddenly care

#57

Post by moffkalast »

9dev wrote: post #54
moffkalast wrote: post #30

Earlier quoted context omitted.

[flagged]

This is really bad advice—don't follow it. Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly. Running critical software without updating may have been possible in some distant past, but it isn't any longer: You will catch an exploit or crypto locker at some point. Microsoft abusing its update mechanism to pushing crap is nothing new, but downright refusing u…

When a windows update destroys your install, is it really any different from actual malware? I consider it one and protect myself accordingly.

At least you can be careful about the rest with adblocking, sandboxing and being irrelevant enough to not make your machine a target for anyone competent, which gives you a pretty great chance at avoiding them. If you keep built-in malware (and in recent versions, also spyware) running, then getting screwed by it is a certainty. Personally, I'll take my chances and I think the average HN user would not have any problems doing this, but I wouldn't really recommend this approach to someone that's not tech savvy. I'd give them a Chromebook instead.

Re: What is an SBAT and why does everyone suddenly care

#58

Post by teekert »

A recent Linux Unplugged episode went into how one can use the TPM to set up a secure and trusted chain of trust for the booting process on Linux [0] using Clevis [1], very interesting!

[0] https://linuxunplugged.com/572

[1] https://fedoramagazine.org/automatically-decrypt-your-disk-u...

Re: What is an SBAT and why does everyone suddenly care

#59

Post by eightysixfour »

pjc50 wrote: post #49

Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows?

Exactly how would you propose starting software securely from an unknown environment?

> Back when all this was being introduced I felt that (a) secure boot increases the risk of locking you out of your machine and/or data loss

So does a password and encryption.

Re: What is an SBAT and why does everyone suddenly care

#60

Post by zx8080 »

mjg59 wrote: post #8
zokier wrote: post #6

Earlier quoted context omitted.

I don't see why you couldn't update grub from Windows, its just EFI binary in ESP after all.

Distro grub is signed by the distro rather than Microsoft, so coordinating that would be extremely difficult

MS could just sign it with whatever three-letter agency certificate they usually cooperate with. /s
Post reply on HN