Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

81–90 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#81

Post by voxic11 »

wyldfire wrote: post #33
blueflow wrote: post #17

Earlier quoted context omitted.

> widespread rootkit level malware and they are trying to stay ahead of the curve Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.

[flagged]

Congress already granted retroactive immunity for telecoms acting in cooperation with the US government with the FISA Amendments Act of 2008. I don't see why they couldn't do the same for Microsoft (assuming the law doesn't already apply to them).

> Release from liability - No cause of action shall lie in any court against any electronic communication service provider for providing any information, facilities, or assistance in accordance with a directive issued pursuant to paragraph (1).

- Section 702, subsection h, paragraph 3;

> Release from liability - No cause of action shall lie in any court against any electronic communication service provider for providing any information, facilities, or assistance in accordance with an order or request for emergency assistance issued pursuant to subsection (c) or (d), respectively.

- Section 703, subsection e.

https://www.govtrack.us/congress/bills/110/hr6304/text

Re: What is an SBAT and why does everyone suddenly care

#82

Post by voxic11 »

hypeatei wrote: post #35
wyldfire wrote: post #33

Earlier quoted context omitted.

[flagged]

I think you underestimate how close big tech and telecom companies are to three letter agencies. See the "Protect America Act" of 2007 which covered everyone's asses for warrantless spying.

Wasn't it the FISA Amendments Act of 2008? Or did the Protect America Act of 2007 also have immunity provisions?

edit: oh I see, the immunity provisions were first introduced with the Protect America Act of 2007 but they had a sunset date under that law so they were later made permanent by the FISA Amendments Act of 2008.

Re: What is an SBAT and why does everyone suddenly care

#83

Post by bongodongobob »

notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

Ubuntu regularly locks up and black screens when I try to sleep/hibernate. It's a very common problem that has nothing to do with Windows or Microsoft. I also have had 0 issues with dual booting for roughly 10 years now. HN wouldn't be HN without some baseless MS bashing.

Re: What is an SBAT and why does everyone suddenly care

#84

Post by pohuing »

BaculumMeumEst wrote: post #18
mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

My Windows install is stuck in a boot loop like this - it spends 10 minutes trying to update and then fails, except maybe 1/3 times it then boots normally. I don't even try to do anything about it, I just marvel at it.

Do you dual boot? That's what mine did when the efi partition was too small for grub and windows' bootloader

Re: What is an SBAT and why does everyone suddenly care

#86

Post by wongarsu »

Hydrocarb0n wrote: post #41

IMO secure boot is a waste of time for most scenarios, if theres closed source EUFI code running god knows what in the background, it dosn't matter how signed and secure your OS kernel is. Ive never been sucessfully able to dual boot windows and linux on a mobo with secure boot turned on, it seems that is a feature not a bug I'm sure MS would never influence hardware vendors to make it dissadvantage a growing number…

TLAs from major powers probably have backdoors in your UEFI, mainboard or OS. But even if they do that doesn't mean they will use them on everyone, they probably keep the good stuff for the most valuable cases. Each use of an attack carries the risk of the attack vector being discovered and prevented in the future. And besides, there are threat actors besides TLAs of the USA, Russia and China.

If you use full disk encryption secure boot is pretty essential, otherwise an attacker can modify the code that asks for your credentials to also log them somewhere easily accessible, circumventing your entire encryption. If you don't do full disk encryption it's still a decent protection against some bootkits.

It can absolutely be more trouble than it's worth. It's not that useful in most desktop computers. But if you are traveling with a laptop it's probably worth some effort to keep secure boot working on that system (and make it more difficult to disable)

Re: What is an SBAT and why does everyone suddenly care

#88

Post by wongarsu »

xnzakg wrote: post #7
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

Something went wrong frowning smiley. Our engineers are probably working hard on fixing it right now.

Re: What is an SBAT and why does everyone suddenly care

#89

Post by wongarsu »

rwmj wrote: post #36
zokier wrote: post #28

Earlier quoted context omitted.

shim has an EFI variable to control its verbosity, you can set it to output all the gory details with e.g. `mokutil --set-verbosity true`, and on a glance there are some tools on Windows too to modify EFI vars

Why wouldn't that be the default?

Because most users are afraid of gory details. And the people who know enough to fix it are expected to somehow know how to turn on logging. It's the modern equivalent of "please contact your administrator"

Re: What is an SBAT and why does everyone suddenly care

#90

Post by brookst »

HideousKojima wrote: post #61
brookst wrote: post #55

Earlier quoted context omitted.

[flagged]

The Snowden leaks made it clear that so long as the government has the means and motive to perform some kind of surveillance, they'll do exactly that. It may not be through the exact methods people are suggesting, but rest assured it is happening.

That’s another foundation of conspiracy theory: one specific example can serve as evidence for universal truth. Sure, the specific claims of theory A might collapse, but it might as well be true because it could be true because of past example B that is along the same lines.

I don’t doubt there is secret government surveillance we’d all be upset about. I’m not willing to use that general belief to assert the truth of specific unsupported claims.

Post reply on HN