Linux Group Files Complaint With EU Over SecureBoot

[mjg59]

So what prevents a malware author from using an existing key? (Or having a list of known keys for that matter)

Where would the malware author get that key?

[nomadewolf]

Where would the malware author get that key?

Microsoft distributes and manages all the keys.

[mjg59]

What this leads to is the thought: Why force the hardware-vendors to implement a "security"-mechanism when the actual problem is the OS it is bound to? Isn't it Microsoft which should fundamentally change the security-model of their still-based-on-NT-OS to fullfil contemporary security-demands?

If you believe that Linux is somehow immune to the types of attacks used against Windows, you're wrong. http://cve.mitre.org/cgi-bin/cvename...=CVE-2013-1848 was last month, for instance.

[mjg59]

Microsoft distributes and manages all the keys.

What does that have to do with the question?

[frign]

If you believe that Linux is somehow immune to the types of attacks used against Windows, you're wrong. http://cve.mitre.org/cgi-bin/cvename...=CVE-2013-1848 was last month, for instance.

Yes, but this requires the user to run malicious code in the first place. And most common sense prevents this from happening, even if you ignored the fact that OpenSource is generally safer and faster in regards to fixing security issues.

[juanrga]

(anecdotal example: in my country, more and more people are asking for touchscreen enabled notebooks even though they plan to wipe Windows 8 and replace it with Windows 7)

Therefore do they want touch-enabled devices for using with a touch-unfriendly OS?

and Office 2013 will finally use the OOXML Strict specification which they pushed to be recognized as a standard some time back.

Do you mean that defective specification approved in that broken standardisation process involving the most controversial and unusual ballots ever convened, vote buying, policiy violations, Microsoft submitted misinformation, and other very unusual behaviour in standards bodies?

http://en.wikipedia.org/wiki/Standardization_of_Office_Open_XML

I only can say WOW!

[nomadewolf]

What does that have to do with the question?

Q: Where would the malware author get that key?
A: Microsoft distributes and manages all the keys.


Am I missing something?

[mjg59]

Yes, but this requires the user to run malicious code in the first place. And most common sense prevents this from happening, even if you ignored the fact that OpenSource is generally safer and faster in regards to fixing security issues.

We're not talking about who's better. We're talking about whether Linux is vulnerable to the kinds of attacks that Secure Boot protects against. The answer is yes, it is.

[yogi_berra]

even if you ignored the fact that OpenSource is generally safer and faster in regards to fixing security issues.

http://www.networkworld.com/news/2013/031313-opensource-security-267636.html

[mjg59]

Q: Where would the malware author get that key?
A: Microsoft distributes and manages all the keys.


Am I missing something?

Yes. Microsoft don't distribute keys.