Ubuntu Isn't Yet Onboard With GNOME's "Device Security" Screen

[ll1025]

https://www.microsoft.com/security/b...ss-of-threats/

This forum drives me absolutely crazy some times. You'll see people arguing about how Windows is inherently less secure than Linux, in the same breath they argue "but I don't need security because who will ever target mom and pop watching youtube on Ubuntu?"

Its like everyone here completely forgot the story arc of malware in the early 2000s. Yes, these attacks are real, yes, you need to care, they don't need you to be a CIA operative to want to pwn your laptop and join you to the botnet.

Major tech consultancies around the world are getting ulcers around cybersecurity threats and trying to plug the holes, and the OSS community has this demeanor of "lol who cares it's all academic". I feel like these are the same people who say "setenforce 0", and who argued against the IBRS patchline.

Well, ignore them, and thanks for your work on this, hughsie.

[Brook-trout]

Switch Ubuntu to KDE 5.24.6. PROBLEM SOLVED.

[erniv2]

P.S. Why is suspend-to-idle supposedly any better than proper S3 suspend-to-RAM? Either way, if the contents of DRAM are unencrypted, an attacker who can remove DIMMs will probably be able to read a lot of your RAM.

Huh when you remove a DIMM from it´s slot the content in it is lost within a second, i dont know the refresh rate for Suspend to RAM but i bet it´s somewhere in the 100ms range.

Suspend to ram shuts down your CPU and GPU/USB/Fans basically everything but it keeps the RAM refresh alive, people just dont know how RAM works you have to send a pulse to it every few miliseconds in normal usage to keep the contend intact or the data in it will degrade and fade away, so i want to see that hudini that pulls a DIMM from one PC put´s it in another PC and can extract Data that makes any sense at all from it. You all have to look in this Crystal ball to save this world wooohooo.

And suspend to idle is a intel made up stupid shit that doesnt know what it is, am i S1 am i S3, no wait 3-1 is 2, but my mom left me early so now i´m S2.1 with a fancy depression so i overheat your laptop if you dont hug me.

[ssokolow]

Windows 11 doesn’t prevent you from disabling VBS. You can go to Core Integrity and disable it even on prebuilt

Well, that's what the "last I heard" was for, I guess. The last Windows I used even intermittently was Windows 7 and that was on a video from one of Linus Sebastian's channels over a year ago.

[hughsie]

when you remove a DIMM from it´s slot the content in it is lost within a second

Bzzt. https://www.inderscience.com/info/in...hp?artid=48411

[kpedersen]

Sure, I've been working on this stuff for over five years. I'm not going to, as I think it's probably a waste of my time. If you don't like the panel, or the idea, or the implementation -- just don't use the panel. Just ignore it, it's not going to stop you doing anything you want to do.

To be frank (and I certainly respect the effort you are putting into your work), this has been the case with the entirety of Gnome 3 since inception. I don't use it, I do ignore it all so it can't stop me doing anything I want to do. However, nonetheless I do still find these discussions interesting in case there is anything useful to pick out of the project and use with my own setups.

[Paradigm Shifter]

I don't really understand why people wouldn't want improved security - but I understand very well why people do not wish to put their trust in multinational corporations with proven records of being evil bastards when it suits them. I do what I can to make security as tight as possible (and the limits that imposes on other users occasionally makes me a bit unpopular) but I tailor what I set to the purpose of the system.

Bzzt. https://www.inderscience.com/info/in...hp?artid=48411

Don't have access to the full article, but the brief abstract sounds like data is still memory resident after power off if the system is still connected to mains power. The abstract mentions nothing about physical removal of a DIMM from a slot.

So, without being able to read the full article, seems like pulling mains power from a desktop, or disconnecting the battery (...which is impossible to do quickly on modern laptops...) would be "data gone" certainly before someone could jam a power cable back in.

[yump]

Huh when you remove a DIMM from it´s slot the content in it is lost within a second, i dont know the refresh rate for Suspend to RAM but i bet it´s somewhere in the 100ms range.

Suspend to ram shuts down your CPU and GPU/USB/Fans basically everything but it keeps the RAM refresh alive, people just dont know how RAM works you have to send a pulse to it every few miliseconds in normal usage to keep the contend intact or the data in it will degrade and fade away, so i want to see that hudini that pulls a DIMM from one PC put´s it in another PC and can extract Data that makes any sense at all from it. You all have to look in this Crystal ball to save this world wooohooo.

And suspend to idle is a intel made up stupid shit that doesnt know what it is, am i S1 am i S3, no wait 3-1 is 2, but my mom left me early so now i´m S2.1 with a fancy depression so i overheat your laptop if you dont hug me.

Paradigm Shifter

https://sci-hub.st/10.1109/IMW.2018.8388826

*Some* content is lost within a second. DRAM refresh timing is specified so that every single bit is perfect, even on the worst cells of the worst chips at the highest temperature, after years of service. But an attacker doesn't need every bit perfect. They just need enough bits of your disk encryption key to make brute-forcing the other bits feasible. And the way some ciphers work there are likely to be data structures resident in memory that contain multiple redundant copies of the key.

[Paradigm Shifter]

https://sci-hub.st/10.1109/IMW.2018.8388826

*Some* content is lost within a second. DRAM refresh timing is specified so that every single bit is perfect, even on the worst cells of the worst chips at the highest temperature, after years of service. But an attacker doesn't need every bit perfect. They just need enough bits of your disk encryption key to make brute-forcing the other bits feasible. And the way some ciphers work there are likely to be data structures resident in memory that contain multiple redundant copies of the key.

Cheers for the different paper!

[You-]

Switch Ubuntu to KDE 5.24.6. PROBLEM SOLVED.

AFAIK, KDE has the same details somewhere in its settings app. You are just unlikely to find that page.