Moore, a firmware security expert, CEO and founder of runZero, and
a long-time critic of Secure Boot, said in an interview. His
complaints include Microsoft being the de facto root of trust for
the entire UEFI platform, the inability of the protection to scale
sufficiently, and the ability for components to boot even after
top-level certificates expire.
<https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-secure-boot-but-theres-no-reason-to-panic-heres-why/>.<snip>
<https://arstechnica.com/security/2026/07/microsoft-secure-boot-has-been-broken-for-most-of-its-existence/><snip>
The prospect that attackers have had the means to bypass Secure
Boot for more than a decade through what amounts to
hack-by-numbers scripts isn't much of an endorsement of the
mechanism proposed by Microsoft in partnership with hardware
makers. As mentioned earlier, a key contributor to this debacle is
its complexity.
Some years ago, there was a report about a compromised boot image from Kaspersky labs; Microsoft initially issued a revocation of its Secure
Boot Certificate, but then had to withdraw that because it caused so
many problems for Windows users who couldn?t (or just wouldn?t) upgrade/replace the affected versions of Kaspersky products <https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-secure-boot-but-theres-no-reason-to-panic-heres-why/>.
Now it turns out Microsoft has been negligent in revoking other
certificates for ancient, compromised, obsolete bootloader ?shims? <https://arstechnica.com/security/2026/07/microsoft-secure-boot-has-been-broken-for-most-of-its-existence/>
-- even when the repercussions of doing so would be minor, there still
didn?t seem to be the will to promptly enforce the rules that the
company itself created.
Certificate revocation in the event of a security compromise is also a measure used in another context: with TLS/SSL certificates for
securely accessing websites. In this situation, it has long been known
to be a troublesome and unreliable mechanism. And so something called
?OCSP? was invented as a kind of workaround, only to fall victim to
its own problems.
Which is why, in the TLS/SSL world, the general consensus is that the
only reliable solution nowadays is to drastically shorten the validity interval of the certificates -- some are suggesting they should be
valid for no longer than a week -- so the problem is (mostly) solved
simply by reducing the opportunity for malicious parties to make use
of compromised certificates.
This solution doesn?t seem practical for Secure Boot keys, which have
to be stored in UEFI flash RAM on every PC ... or could something like
it be made to work?
what I don?t get is people who use it at home.
That?s just nutty.
In contrast I?m aware of platforms where the firmware directly verifies
and loads a kernel and base OS image; they have no intermediate shims or
boot loaders to contain vulnerabilities at all. Much easier to secure,
but it doesn?t make for an easily ?tinkerable? platform.
IMO I always believed this is a ploy by Microsoft to lock down PCs
similar to what is going on with Smart Phones. But so far it has
failed due to pushback by various Linux Companies. If Linux was at
the point it was in the 90s, I think M/S would have succeeded.
Oregonian Haruspex <no_email@invalid.invalid> wrote:
what I don?t get is people who use it at home.
That?s just nutty.
That is often a result of:
1) purchases a computer from retailer X -- computer comes pre-installed
with windows (because of MS predatory contract terms);
2) buyer uses what came with the computer they just purchased ....
There are a great many who simply have no idea that there is even the possibility of running an OS on their computer /other/ than what was
already installed for them when the bought it from retailer X.
John McCue wrote:
IMO I always believed this is a ploy by Microsoft to lock down PCs
similar to what is going on with Smart Phones. But so far it has
failed due to pushback by various Linux Companies. If Linux was at
the point it was in the 90s, I think M/S would have succeeded.
There is a genuine risk from attackers getting physical access to the
machine -- Secure Boot was an attempt to defend against this sort of
thing.
Rich <rich@example.invalid> wrote:
Oregonian Haruspex <no_email@invalid.invalid> wrote:
what I don?t get is people who use it at home.
That?s just nutty.
That is often a result of:
1) purchases a computer from retailer X -- computer comes pre-installed
with windows (because of MS predatory contract terms);
2) buyer uses what came with the computer they just purchased ....
There are a great many who simply have no idea that there is even the
possibility of running an OS on their computer /other/ than what was
already installed for them when the bought it from retailer X.
That?s just sad and pitiful. It?s like buying the car you saw on TV, not knowing they make more than one car. How could anybody not know basic computer stuff by now?
On Wed, 15 Jul 2026 12:20:09 -0000 (UTC), John McCue wrote:
IMO I always believed this is a ploy by Microsoft to lock down PCs
similar to what is going on with Smart Phones. But so far it has
failed due to pushback by various Linux Companies. If Linux was at
the point it was in the 90s, I think M/S would have succeeded.
There is a genuine risk from attackers getting physical access to the
machine -- Secure Boot was an attempt to defend against this sort of
thing.
But you are right in that Microsoft?s implementation has been
typically poorly managed and riddled with holes.
That?s just sad and pitiful. It?s like buying the car you saw on TV, not >knowing they make more than one car. How could anybody not know basic >computer stuff by now?
Lawrence =?iso-8859-13?q?D=FFOliveiro?= <ldo@nz.invalid> wrote:
On Wed, 15 Jul 2026 12:20:09 -0000 (UTC), John McCue wrote:
IMO I always believed this is a ploy by Microsoft to lock down PCs
similar to what is going on with Smart Phones. But so far it has
failed due to pushback by various Linux Companies. If Linux was at
the point it was in the 90s, I think M/S would have succeeded.
There is a genuine risk from attackers getting physical access to the >>machine -- Secure Boot was an attempt to defend against this sort of
thing.
I think the very idea of trying to block an attacker with physical
access is probably misguided. There are some applications for which it
may actually be useful but there are far more systems where availability
is as or more important than confidentiality.
But you are right in that Microsoftƒ??s implementation has been
typically poorly managed and riddled with holes.
I think the concept is a bad one, and I think that invariably you are going to have a single point of failure which is bad. Having it be microsoft is just worse.
--scott
One thing I find myself wondering about is whether we shouldn't try
and make the "ACPI" extensions somehow Windows specific.
If [sic] seems unfortunate if we do this work and get our partners to
do the work and the result is that Linux works great without having to
do the work.
Maybe there is no way to avoid this problem but it does bother me.
Maybe we could define the APIs so that they work well with NT and not
the others even if they are open.
Or maybe we could patent something related to this.
Oregonian Haruspex <no_email@invalid.invalid> wrote:
Thatƒ??s just sad and pitiful. Itƒ??s like buying the car you saw on TV, not >>knowing they make more than one car. How could anybody not know basic >>computer stuff by now?
Fewer computer users today know basic operational stuff than they did
twenty years ago. Making computers "easier to use" by obscuring what
happens inside the box has lead to a generation or more of users who
don't actually care.
--scott
And even without Microsoft, this appeared in an area that's not
exactly known for compliance and perfect implementation. Secure Boot
and UEFI, this time we will get PC firmware right, pinky promise!
And considering Microsoft, don't forget it'd not be the first time
they intentionally tried to break compatibility at the firmware level
to put other systems at a disadvantage:
On 2026-07-17, Scott Dorsey wrote:
Oregonian Haruspex <no_email@invalid.invalid> wrote:
That's just sad and pitiful. It's like buying the car you saw on
TV, not knowing they make more than one car. How could anybody not
know basic computer stuff by now?
Fewer computer users today know basic operational stuff than they
did twenty years ago. Making computers "easier to use" by obscuring
what happens inside the box has lead to a generation or more of
users who don't actually care.
--scott
I can't help but think that Windows 4 PCs from last century are
better than Android devices because at least you're able to do things Android installs often bar you from doing.
Google reportedly wants to require ID verification to develop for
Android.
Now maybe if they instead required manufacturers not to make
applications uninstallable or even impossible to disable... What the
shit is this.
Even if I wanted to use Windows NT, I'd usually be able to
grab drivers and do a clean install on a machine that came with a load
of questionable stuff preinstalled.
I can't help but think that Windows 4 PCs from last century are better
than Android devices because at least you're able to do things Android >installs often bar you from doing.
than leading it. The idea that UEFI was some kind of Microsoft >compatibility-breaking conspiracy is not well supported by the history.
The reality is BIOS needed to be replaced, and the entire computer
industry understood this.
What used to be a general-purpose computer has become an appliance. And that's maybe okay if you want an appliance. But some people actually want
a general-purpose computer. We seem to be in the minority though.
I blame Jobs, who in the early Mac days said a computer should be
like a toaster. Though if not Jobs, some other marketer would have
done the same.
Scott Dorsey wrote:
What used to be a general-purpose computer has become an appliance. And
that's maybe okay if you want an appliance. But some people actually want >> a general-purpose computer. We seem to be in the minority though.
I blame Jobs, who in the early Mac days said a computer should be like a >toaster. Though if not Jobs, some other marketer would have done the same.
On Sat, 18 Jul 2026 22:57:55 -0700, Dave Yeo wrote:
I blame Jobs, who in the early Mac days said a computer should beThe Apple II was a very versatile appliance. And some of the Macintosh
like a toaster. Though if not Jobs, some other marketer would have
done the same.
models that were released after Jobs was ejected (like the legendary Macintosh II) were also quite nice as far as universal machines go.
It was after Jobs came back to Apple that they dropped the ?Computer?
part of the company name, and stopped trying to offer general-purpose computation devices ...
This was before he got the boot. Other quotes I remember, roughly,
"users don't need colour" and "users don't need expandability" in
between him saying "Apple II forever"
Pretty sure he was behind crippling the //GS as well as with the
fastest 65816 available it was a better Mac then the Mac. Colour,
expandable, lots of bug fixes when MacOS was ported to it, ADB for connectivity, though Mac got that pretty quick. Not to mention a
huge catalog of software.
On Sun, 19 Jul 2026 13:36:56 -0700, Dave Yeo wrote:
This was before he got the boot. Other quotes I remember, roughly,
"users don't need colour" and "users don't need expandability" in
between him saying "Apple II forever"
But the Apple II had both colour and expandability.
Pretty sure he was behind crippling the //GS as well as with the
fastest 65816 available it was a better Mac then the Mac. Colour,
expandable, lots of bug fixes when MacOS was ported to it, ADB for
connectivity, though Mac got that pretty quick. Not to mention a
huge catalog of software.
Also more expensive than a Mac, from what I gather.
Lawrence D?Oliveiro wrote:
On Sun, 19 Jul 2026 13:36:56 -0700, Dave Yeo wrote:
This was before he got the boot. Other quotes I remember, roughly,
"users don't need colour" and "users don't need expandability" in
between him saying "Apple II forever"
But the Apple II had both colour and expandability.
Which was some of the reasons Jobs wanted to move away from the II
series.
Pretty sure he was behind crippling the //GS as well as with the
fastest 65816 available it was a better Mac then the Mac. Colour,
expandable, lots of bug fixes when MacOS was ported to it, ADB for
connectivity, though Mac got that pretty quick. Not to mention a
huge catalog of software.
Also more expensive than a Mac, from what I gather.
Only due to Apple's choice.
| Sysop: | Jacob Catayoc |
|---|---|
| Location: | Pasay City, Metro Manila, Philippines |
| Users: | 4 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 496009:04:30 |
| Calls: | 178 |
| Files: | 605 |
| D/L today: |
22 files (18,741K bytes) |
| Messages: | 70,143 |