SirNickity wrote:

IMO, more than legacy compatibility, this is the reason why nobody uses IPv6

Well, this is a very strong statement which is also not true.

According to Google, almost 30% of their users access Google services over IPv6: https://www.google.com/intl/en/ipv6/statistics.html

My home and workplace networks are IPv4 internally, but we don't even have an external IPv4 address anymore.

SirNickity wrote:

Because 128-bit hexadecimal digit strings aren't hard to remember or anything... and sure, let's go back to when every host was directly connected to the Internet, without NAT. 😖 So many misguided ideas.

It's not that the ideas are misguided, but more that people are used to one way of doing things that makes them view new ideas from old perspectives. 128-bit hex numbers are not supposed to be remembered by humans, but by machines. The idea of NAT has nothing to do with security, but it is merely a solution to the problem of address shortage / centralized allocation. The fact that it solves tons of security problems by dropping inbound connections by default is merely a fortunate by-product.

SirNickity wrote:

The only "security" it provides, is the ability for OS vendors to team up with hardware vendors to define a list of operating systems we're "allowed" to run, and under what conditions. (And this is one place where I look directly at Apple as truly being one of the worst offenders.)

One of the worst? They are the worst by an order of magnitude. They invented the damn thing.

SirNickity wrote:

The only "security" it provides, is the ability for OS vendors to team up with hardware vendors to define a list of operating systems we're "allowed" to run, and under what conditions. (And this is one place where I look directly at Apple as truly being one of the worst offenders.)

Well, that's one creative interpretation.
What Secure Boot really does (I take it this is what you're referring to), is to only boot from boot managers that have been signed with a known key.
Where 'known' means either one of the default keys installed by the hardware vendor (which is pretty much only the Microsoft key in most cases), or a key that you manually added to the keystore.

The actual security you get is basically the same as any other kind of signing, such as used with Java or SSL etc: you know who signed the software, and you know that the software has not been modified since it has been signed.
Which effectively makes rootkits virtually impossible.

So yes, there actually is a security benefit.

And before people talk about how only the Microsoft key is commonly installed: Microsoft is aware of this, and offers a service where third-parties can get their code signed by Microsoft. Various linux distributions make use of this, so that their OS can be secure-booted without end-users having to manually add their key first.
I think that's quite nice (and yes, I know there's a group of people in this world who have insurmountable issues with their linux being signed by Microsoft).

dr_st wrote:

What to do? Absolutely nothing.

Yep. Windows XP support had ended a long time ago and my Windows XP machine are working well.

I got a E5-1650 based computer with dual boot (Win7pro 64bits & Win10pro 64bits) but I don't use Win10. I keep it in case some software would not support Win7 in the future.

SirNickity wrote:

386SX wrote:

And all this together with those useless who-cares features about remote update, remote control from smartphone or whatever. I've read people talking about "it's more secure" than the old one.. 😵

Haha... no kidding. There is absolutely no way that's going to be true. With all the gee-whiz features, there's just so much code now, that you've guaranteed bugs. And with a full IP stack? Good grief....

So at the end only few positive changes for the end user (the mouse or as said above the key signature for os). Not to say that those usually worried too much about the technology becoming 'evil' as in 'The Matrix' would be right or not, but there're modern tech things that in the 90's would have made tech people thinking more about them; like for example the discussions they did for the Pentium III unique ID or the Explorer integration in Win9x like some sort of evil future coming when nowdays even the mouse itself has its UUID. Back in the past new tech were discussed with passion in the tech community and there were all kind of opinions. Nowdays everythings seems just cool because new.
Maybe I'm just old but I don't care anymore about much of the new technologies/innovations also after noticed I wasn't almost able to use a simple pen on a paper. I feel like those people that stayed to the old AM radio or the one that refused digital audio supports. 😵

ShovelKnight wrote:

Well, this is a very strong statement which is also not true.

According to Google, almost 30% of their users access Google services over IPv6: https://www.google.com/intl/en/ipv6/statistics.html

My home and workplace networks are IPv4 internally, but we don't even have an external IPv4 address anymore.

Interesting, might be something of a difference in our locales then. I have supported networks for a lot of different entities, from sports teams to hospitals to enterprises to rural ISPs. Not one has moved to IPv6. Not a single one. I'll caveat that by saying I do sometimes brush up against two larger regional ISPs, and for those guys I would indeed be surprised if neither had ANY IPv6 stacks, but I haven't seen any with my own eyes.

dr_st wrote:

It's not that the ideas are misguided, but more that people are used to one way of doing things that makes them view new ideas from old perspectives.

I disagree:

"128-bit hex numbers are not supposed to be remembered by humans, but by machines."
Yes, I'm vaguely familiar with the concept of DNS </sarcasm>. I'm also acutely aware of how many IPs I have to know despite that. This might be a "because I travel in IT admin circles" thing, but nonetheless... It's us who would be implementing the thing, and so it's us who would feel the pain of such a thing.

"The idea of NAT has nothing to do with security, but it is merely a solution to the problem of address shortage / centralized allocation. The fact that it solves tons of security problems by dropping inbound connections by default is merely a fortunate by-product."
Security is an onion. It has layers. NAT was indeed conceived as a solution to a problem of limited IPs, but it has since proven itself an invaluable tool of separating individual hosts from being the target of directed attack. You're right, "misguided" was probably not the right term. To overlook that advantage is actually criminally stupid. And so, various forms of NAT for IPv6 were created to solve that problem. Just because it's an "old" solution doesn't mean it isn't a good one.

Also, I'm not enthusiastic about taking security cues from the fathers of IPv6 when there were so many existing protocols and behaviors that were obsoleted in favor of IPv6 built-ins (like router discovery, or how every interface has an address by default, and how one of those addresses was derived from the MAC address by default) that have since been proven to be quite problematic from a security perspective. IPv4, ARP, et.al., are not perfect. Throwing out the entire thing in favor of a slew of brand new oversights (combined with considerably more complexity) was probably not the best idea, though.

dr_st wrote:

One [/i]of the worst? They are the worst by an order of magnitude. They invented the damn thing.

If you're looking for an argument, you won't find it from me. I have and use and love a lot of Apple products. Doesn't mean they are immune to my criticism.

Scali wrote:

What Secure Boot really does...

... is provide a mechanism that can (and, let's be honest, probably will eventually) be used to ensure we can't do silly things like boot an OS that has known vulnerabilities that can be exploited to do things like rip Blu-ray 2 discs, some day in the future. And if you're on some kind of "legacy" platform that still allows you to override the boot security, then maybe you aren't allowed to stream Netflix.. since, you know, your environment can't be trusted.

I'm totally aware we're a long way from that kind of tin-foil hat scenario. But... are we, though? 'Cause this is exactly the scenario that several other platforms have already taken. And I'm not 100% against having an iPad that exists in a walled garden, but mostly because I can still do whatever I want on a PC. When you have a nanny BIOS, an OS veering toward mandatory updates, a major stakeholder with God rights to the boot process, said stakeholder led the game console industry in preventing firmware downgrading and hardware swapping, and is in danger of losing their place of dominance? Yeah, forgive my skepticism.

I mean, aside from all that, do you really think it's a good idea that some commercial entity out there (regardless who) is a de-facto key-signing gate-keeper? That's exactly the reason we have consortiums and organizations like InterNIC, the USB forum, etc. Because somebody knew that maybe Intel (for e.g.) shouldn't be the single source of passage. Even if (e.g.) Intel is a contributing member with a majority of clout, there still needs to be a safety hatch.

I'm probably making some assumptions that aren't entirely accurate - I don't have quite the level of in-depth experience with PC hardware that some of you have, and I've kept my distance from EFI just because it has never actually made anything I want to do any easier than the legacy BIOS. Still, when I first learned about this for the first time, it seemed like a solution to a problem that could have been solved in an equally secure way that kept authority in the user's hands instead. That's just unsettling. Historically, "don't worry your pretty head about this -- we'll take care of you" has never led to good things.

SirNickity wrote:

... is provide a mechanism that can (and, let's be honest, probably will eventually) be used to ensure we can't do silly things like boot an OS that has known vulnerabilities that can be exploited to do things like rip Blu-ray 2 discs, some day in the future. And if you're on some kind of "legacy" platform that still allows you to override the boot security, then maybe you aren't allowed to stream Netflix.. since, you know, your environment can't be trusted.

I think there are plenty other reasons why BD2 or future Netflix won't work on older OSes anymore.
No drivers, no codecs, missing the right APIs etc.
I mean, Vista doesn't have Secure Boot, but it's pretty much useless for everyday use, because hardly any software (or hardware) installs on it anymore.
You can't even install an up-to-date browser on it, which means a lot of browser-based stuff is out.
Want to watch 4k videos on YouTube? Not a chance.
Play your Steam games? Nope.

SirNickity wrote:

I mean, aside from all that, do you really think it's a good idea that some commercial entity out there (regardless who) is a de-facto key-signing gate-keeper? That's exactly the reason we have consortiums and organizations like InterNIC, the USB forum, etc. Because somebody knew that maybe Intel (for e.g.) shouldn't be the single source of passage. Even if (e.g.) Intel is a contributing member with a majority of clout, there still needs to be a safety hatch.

What's your point? UEFI *is* developed by a consortium (the "United EFI Forum": https://en.wikipedia.org/wiki/Unified_EFI_Forum). Microsoft just happens to be the only one who actually bothered to support it, while all the linux distros were too busy arguing about the GPL.
That's what led to the situation where Microsoft is the only one with an actual key out in the wild, and the linux people now have to go to Microsoft to get their stuff signed.
If they'd just registered their own key, and started using it, then chances are that most vendors would have included it.

How anyone can be cool with the idea of Secure Boot being forced down our throats by hardware manufacturers just because Microsoft implemented it in their software and now have the check on what to provide keys for is beyond me. It is some EVIl, DYSTOPIAN SHIT in its purest form.

So, is 'Secure Boot' really being forced down our throats?

Is there any mid-range or better (not entry level crap) laptop / desktop motherboard out there where Secure Boot cannot be disabled?

SirNickity wrote:

I'm probably making some assumptions that aren't entirely accurate - I don't have quite the level of in-depth experience with PC hardware that some of you have, and I've kept my distance from EFI just because it has never actually made anything I want to do any easier than the legacy BIOS. Still, when I first learned about this for the first time, it seemed like a solution to a problem that could have been solved in an equally secure way that kept authority in the user's hands instead. That's just unsettling. Historically, "don't worry your pretty head about this -- we'll take care of you" has never led to good things.

I don't have and I'd like to have the knowledges to discuss the uefi "features" and about how much the users are now "safer" thank to that, but after their introduction I think I remember reading quite soon some big security problems were found times ago when instead I always thought the old bioses security risks (for itself) were more myths than reality. But even without those knowledges, there're online features inside some modern mainboards bioses that are simply incredible when not comic to find, IF the main goal was to get closer to a never ending "safer" enviroment.

appiah4 wrote:

How anyone can be cool with the idea of Secure Boot being forced down our throats by hardware manufacturers just because Microsoft implemented it in their software and now have the check on what to provide keys for is beyond me. It is some EVIl, DYSTOPIAN SHIT in its purest form.

I think it's in the same category as x86 and the PC architecture being 'forced down our throats' just because Microsoft chose that as their main platform for Windows.
That's just what happens. There are varying competing standards and eventually the biggest one 'wins' and the whole market adapts to that one standard (some people want to portray Secure Boot as a Microsoft standard, but it obviously isn't. It was part of the UEFI standard for years before Microsoft started adopting it).

It's not Microsoft's fault. They can't help being so successful that they have 90+% of the market.
But for all hardware vendors those numbers are pretty simple: If 90+% of the market runs Windows on it, that's where the money is, we will focus our attention on supporting whatever Windows needs. Hence x86 machines with PC architecture and UEFI + Secure Boot.
Supporting anything else just isn't very economically interesting to hardware vendors, so they may or may not bother to support that.

Personally I think it's a non-issue. Namely, Secure Boot only goes as far as loading the initial boot manager. You can find signed shims for Grub or whatever, so you can Secure Boot into that, and then use Grub to boot any unsigned/legacy/whatever OS you want.

And on smartphones, tablets etc, locked bootloaders are par for the course, and often even proprietary, unlike Microsoft's UEFI-standard option. So if you want to argue, argue about those.

Scali wrote:

And on smartphones, tablets etc, locked bootloaders are par for the course, and often even proprietary

Well after all that was the point, at the end it seems like every technologies are going in the "same direction" beside which is the less worse. Mobile devices are probably the top of the mountain in terms of user ability to not decide anything of it, basically living of their own ads-centric life with the user being more like a passenger than the owner.
I'm sure that's because the whole industry changes and as said the stronger in the industry decide but some people should "feel" how bad official reasons sounds when new things are created and sold as necessary "to improve the user experience, safety, create better future products etc etc..press agree or you can't use the device/sw you (already) payed for".

SirNickity wrote:

Scali wrote:

What Secure Boot really does...

... is provide a mechanism that can (and, let's be honest, probably will eventually) be used to ensure we can't do silly things like boot an OS that has known vulnerabilities that can be exploited to do things like rip Blu-ray 2 discs, some day in the future.

The third industrial revolution is all about information, and if you are a power user you are an independent competitor to any number of agencies public and private. Where all is divided into media production and media consumption, anyone who stands outside that dichotomy must be attempting to insert themselves between it. And so for Barry Shitpeas streaming on his iPad, it seems the ghost of Jack Valenti is entirely correct to say that only pirates are using PCs so they can copy UHD Blu-rays. You can bet as physical media is phased out in favour of streaming (not even downloading) that the hardware it'll reside on will have to be under their lock and key.

For four decades every corporate player in the PC platform has with one face profited from compatability, and with the other tried to shove the genie back in the bottle (eg. IBM and MCA, or Dell and their bloody proprietary connectors). The forces that kept those opposing tendencies in check are gone, and the technological and media environment that the PC existed within is pretty much gone too. It might not be completely locked down now, but I do not see an open future as the old concept of what a home computer is disappears from public consciousness. The original Xbox (oh hi, Microsoft) was the dark reflection of the PC - consoles are the future (for worse).

Big Pink wrote:

SirNickity wrote:

Scali wrote:

What Secure Boot really does...

... is provide a mechanism that can (and, let's be honest, probably will eventually) be used to ensure we can't do silly things like boot an OS that has known vulnerabilities that can be exploited to do things like rip Blu-ray 2 discs, some day in the future.

The third industrial revolution is all about information, and if you are a power user you are an independent competitor to any number of agencies public and private. Where all is divided into media production and media consumption, anyone who stands outside that dichotomy must be attempting to insert themselves between it. And so for Barry Shitpeas streaming on his iPad, it seems the ghost of Jack Valenti is entirely correct to say that only pirates are using PCs so they can copy UHD Blu-rays. You can bet as physical media is phased out in favour of streaming (not even downloading) that the hardware it'll reside on will have to be under their lock and key.

For four decades every corporate player in the PC platform has with one face profited from compatability, and with the other tried to shove the genie back in the bottle (eg. IBM and MCA, or Dell and their bloody proprietary connectors). The forces that kept those opposing tendencies in check are gone, and the technological and media environment that the PC existed within is pretty much gone too. It might not be completely locked down now, but I do not see an open future as the old concept of what a home computer is disappears from public consciousness. The original Xbox (oh hi, Microsoft) was the dark reflection of the PC - consoles are the future (for worse).

Sometimes I think to the people faces when/if you sit down somewhere in a bar or a store, reading a simple paper book or studying/writing on a paper notebook with a pen and not a tablet or smartphone, like you're an alien from another planet. Those objects still exists/resist so the only benefit of tech people lived the last three decades of tech "evolutions" should be compare and assume what they benefit from the changes. I'd imagine the bios ones were already the turn point of the concept above at hw level. Phones changes probably opened the road to what will happens/already happened to pc as virtualized client, closed console themself or simply disappearing as home devices. The home itself also probably is becoming a big interest when you think to smart meters, virtual assistant, devices automation.

If you want to discuss the downfall of computing and/or society then best to start another thread as for the original topic as a wise man once wrote:

Don't Panic

Well... why? I think the original question has long since been addressed in every conceivable way. The topic has shifted a few times. So what? Why is the natural flow of conversation an issue for forum posts, where it's just ... the natural flow of conversation everywhere else?

Scali wrote:

I think there are plenty other reasons why BD2 or future Netflix won't work on older OSes anymore.

I wasn't talking about older OSes. I just mean that, e.g., Linux is left out of the streaming video, and official BD player club because the OS just can't be trusted. (Which, I mean... it really can't. I have the source code to everything that runs on it, except for the bits and bobs that need firmware packages that I'm not authorized to know about.) So I fear we're heading down a path where even "trusted" OSes can't be trusted unless it's a recent, updated, and known "safe" revision which was Secure Booted and has verified untouched signatures of all executable code, and there are no "rogue" applications installed. Like a phone is today, to the extent it can be detected by the software. As 386SX and others have said, the days of the open platform are numbered, if not already dead.

Sometimes I feel the only solution to this is to stand up a parallel industry, where the software AND hardware is open. It wouldn't be without its problems, but it sure would be nice to have the freedom. Maybe some day, with all the hobby FPGA designs, such a platform could exist, and eventually become prolific enough that it could not be ignored. Probably a dream, but it's nice to have something to aspire to.

Scali wrote:

What's your point? UEFI *is* developed by a consortium (the "United EFI Forum": https://en.wikipedia.org/wiki/Unified_EFI_Forum). Microsoft just happens to be the only one who actually bothered to support it, while all the linux distros were too busy arguing about the GPL.
That's what led to the situation where Microsoft is the only one with an actual key out in the wild, and the linux people now have to go to Microsoft to get their stuff signed.

I don't think this is coincidence. Like I said in the last post, and this is my point: This solution, of "signed code," is at its core an anti-consumer move. It can be disabled today, it is not mandatory today, and I can (in theory) either have my code signed or provide my own signing key.... today. But that architecture of this system is such that, tomorrow is not a guarantee.

There's zero reason, in the name of security, that it has to use a certificate framework with trusted key holders. Think of SSH. The first time you log in to a new system, the client says, "hey.. this is the fingerprint of the host that answered. Is this hash authentic?" I don't need Microsoft, or anyone else, to bless my SSH connection. I'm given the chance to authorize the trust relationship, and then the system handles authenticating that relationship every time thereafter. It's still secure, and the authority is entirely with me. That would have been a suitable alternative to Secure Boot.

Why do you think that solution wasn't chosen? I have my suspicions.

SirNickity wrote:

I wasn't talking about older OSes.
...
So I fear we're heading down a path where even "trusted" OSes can't be trusted unless it's a recent, updated, and known "safe" revision which was Secure Booted and has verified untouched signatures of all executable code, and there are no "rogue" applications installed.

Sounds like you are...

SirNickity wrote:

the days of the open platform are numbered, if not already dead.

... for certain applications, yet.

SirNickity wrote:

Sometimes I feel the only solution to this is to stand up a parallel industry, where the software AND hardware is open.

It's already (mostly?) there: linux. Problem is, not enough people care about it, so it never really gets anywhere, aside from server and embedded applications.

It wouldn't be without its problems, but it sure would be nice to have the freedom. Maybe some day, with all the hobby FPGA designs, such a platform could exist, and eventually become prolific enough that it could not be ignored. Probably a dream, but it's nice to have something to aspire to.

SirNickity wrote:

This solution, of "signed code," is at its core an anti-consumer move.

I don't think it is.
For most consumers, a computer, with all its hard- and software is just a black box. They just want stuff to work. They aren't interested in modifying any code or installing any unsigned OSes, drivers, applications or whatever.
And for these people, signed code is actually a good thing, as it reduces the chance of malware tampering with their systems.

SirNickity wrote:

But that architecture of this system is such that, tomorrow is not a guarantee.

How is that different from... oh, every other piece of hardware and software ever?
You never get any guarantees. Heck, I grew up with a ZX81, C64 and then an Amiga. Apparently none of them made it.
Likewise, my first PC used DOS. While I can technically still run DOS, it hasn't been supported by any modern hardware or software in decades.
There just are no guarantees.
No vendor is going to care about anything other than what makes them money. That gives you only the guarantee that whatever you buy now, will be supported by the OS/software 'du jour' for a few years, until it's time to upgrade again.

SirNickity wrote:

That would have been a suitable alternative to Secure Boot.

Well no, because there's no way of knowing that your initial installation of the OS has not been tampered with, unless it was signed by a proper authority.
And before you say "That won't happen", it has. There are various cases of hardware that came with infected firmware from the factory, including phones and HDDs.
So basically as soon as you turned them on, you were infected, and it started infecting anything it came into contact with.

SirNickity wrote:

Why do you think that solution wasn't chosen? I have my suspicions.

I think an analogy with something like MD5 hashes is better:
You download something, and you can check the MD5 hash from the site that you downloaded from, to verify that your download is correct.
Obviously that wouldn't work with the SSH analogy you presented: You download something, then generate an MD5 hash and 'assume' it's correct. You have no way of knowing.
The whole point is that you already know the MD5 hash before you downloaded it.
That's how Secure Boot works as well.

Jesus, how a discussion about Windows 7 became a discussion about the pitfalls of Secure Boot?

The discussion was about UEFI (brought to you by the producers of ACPI). I don't think there's much argument that UEFI is overly complex which often results in problems with manufacturer UEFI images, as with manufacturer provided ACPI tables. OFW, for instance, does the same job (I would argue it does it better) much more efficiently and much safer.

As for Safeboot, we already have two digital signature paradigms that could have been implemented in lieu of the design that's been adopted. The SSL web of trust and PGP keyserver architecture both offer security with decentralization without being dependent on the blessings of one player.

Instead of validating an SSL transport session or an email account, a kernel could be matched against a project UID using a public certificate registered with the keyserver or signed by an upstream certificate authority. An upstream CA would have the virtue of not requiring network access to boot. Easy peasy, lemon squeezy.