According to the researcher, YellowKey appears unusual for a previously unknown security bug. Nightmare-Eclipse explained that the flaw can be reproduced by copying an attached "FsTx" folder...
Mostly the “secure boot” crap, which you can turn off (it’s more a “running your own software on the machine” risk than a privacy risk). UEFI in general isn’t too bad (way way WAY more complex than BIOS though) and managing EFI bootloaders is so much less hassle than with BIOS boot!
All I know about secure boot is that if I make a custom ISO and try booting from it, I would need to create a signature first, register it in my UEFI, and use it to sign the ISO.
Seems like a pain in the ass, but then again if I want to play with a custom ISO I can do so in a VM, and that seems kind of worth it to prevent someone from booting whateverthefuck if they somehow gain physical access to my computer…
IMO it’s better to not try to restrict them from running stuff, and instead to encrypt your disk. Like, they can also just pull your drive and stick it in their own machine (and you WANT to be able to pull your own drive if your computer gets in a physical crash or watered or something and stops working).
Good.
We always knew it was there. They sold their soul to the NSA decades ago.
https://www.smithsonianmag.com/smart-news/how-the-nsa-stopped-trying-to-prevent-the-spread-of-encryption-and-decided-to-just-break-it-instead-4569969/
I remember the day I saw the “Intel! Inside” commercial and the logo, and I thought, I don’t fucking trust this company.
Yeah no shit Intel inside, you’ve got every fucking three letter agency inside.
I knew it was over the day they introduced UEFI and TPM.
Wait what’s wrong with UEFI? My computer uses it, although I have an AMD chipset if that makes a difference…
Mostly the “secure boot” crap, which you can turn off (it’s more a “running your own software on the machine” risk than a privacy risk). UEFI in general isn’t too bad (way way WAY more complex than BIOS though) and managing EFI bootloaders is so much less hassle than with BIOS boot!
– Frost
All I know about secure boot is that if I make a custom ISO and try booting from it, I would need to create a signature first, register it in my UEFI, and use it to sign the ISO.
Seems like a pain in the ass, but then again if I want to play with a custom ISO I can do so in a VM, and that seems kind of worth it to prevent someone from booting whateverthefuck if they somehow gain physical access to my computer…
I mean, if they gain physical access to your computer, they can just boot their favorite Linux live ISO and go to town. :3
That’s true too, I guess. I suppose the only way to prevent that would be to disable USB boot, which would also make recovery impossible?
It certainly wouldn’t help recovery.
IMO it’s better to not try to restrict them from running stuff, and instead to encrypt your disk. Like, they can also just pull your drive and stick it in their own machine (and you WANT to be able to pull your own drive if your computer gets in a physical crash or watered or something and stops working).
So what are you using and recommending?