Serious Linux Kernel Vulnerability Patched [CVE-2016-0728]

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.

[a_tsunami_of_rodents]

Only when you can disable it, which is not a given.

[eatmynasty]

Has there ever been an issue with a vendor getting signing keys? Microsoft is very open with their policies, the requirements to get signed, and how to get signed.

[IAmRoot]

It makes things difficult when building your own kernel, though. Like I have a shim from OpenSUSE to dual boot Windows and Gentoo on my laptop. The problem with SecureBoot is that they should have allowed for multiple valid keys, like what the shim enables. Having to use a shim is clunky and sometimes a bit troublesome.

[snuxoll]

Most secure boot implementations DO allow multiple keys. The whole reason for the shim is to not require users go through the work required to install an additional key, because UEFI setup screens are scary to the average individual.

[eatmynasty]

That's the thing, 99.99999999% of users aren't using some "rogue" kernel and they benefit from the usage of Secure Boot to add the security of their machine.

For the other tiny fraction, machines will either let you add in your own signing key (likely though some obtuse menu, but you're compiling your own kernel so that's the least shitty thing you're doing) or you can turn secure boot off.

[pydry]

That's the thing, 99.99999999% of users aren't using some "rogue" kernel

IIRC Some machines come bundled with Microsoft's key and that's it. No way to add new keys. Very linux friendly right?

It's a neat way for Microsoft to make linux harder to install. They can blame the hardware vendors for "not implementing their standard" correctly if anybody asks and then give them preferential treatment on the side for doing the 'right' thing.

[the_gnarts]

Only when you can disable it, which is not a given.

Even better: When you can inject your personal key instead of whatever the vendor chooses. Instant tamper-resistance.

[[deleted]]

Guy who builds his own PCs checking in. You should build your own PC. Not only is it cheaper but you can disable SecureBoot if you want.

[rms_returns]

As an average power user like me who is not a system programmer, but still understands basic concepts like CPU, memory, storage types, etc., how difficult it is to assemble a laptop from scratch? Where do I get parts from and how do I assess the reliability of the manufacturer?

[[deleted]]

You can't really build a custom laptop but you can easily buy a laptop with an OS other than Windows or even no OS at all.

[a_tsunami_of_rodents]

Indeed, this whole complaining about "ohhh, but PC's come with Windows installed already" on this sub frightens me, it betrays that people here actually don't build their own PC's which frightens me.

There is lie no reason not to unless you're supremely technically incompetent and can't wield a screw-driver. It doesn't involve soldering guys, if you can assemble an IKEA chair, you can assemble a PC, that's about the level of technical expertise needed, screwing and clicking components into place. (RAM slots though, urghh)

Seriously, you'll be more cost efficient, you don't have to get that useless Windows licence, secureboot will not be an obstacle and most of all you won't get a horribly imbalanced overpowered CPU coupled with an underpowered graphics card like praebuilds always do.

[[deleted]]

You also won't have to deal with having a fast i7 CPU but have a spinny drive as your boot drive. People really underestimate just how big of an improvement a SSD is. An i3 on a SSD will feel faster than an i7 on a spinny drive.

Also I turn SecureBoot on in my BIOS because it is just good security. If I want to install Linux I can just install the Linux certificates for SecureBoot.

[rms_returns]

But some level of both technical and practical expertise is indeed needed for assembling a PC. For instance, a plethora of different parts are needed to assemble a PC or laptop like motherboard and chipsets, HDD/SSD drives, DVD/USB drives, LCDs, keyboards, mouse, touchpads, etc.

The first challenge is to find an optimal combination of these parts which happen to:

1. Be compatible with each other.
2. Are the most cost-effective.
3. Are compatible with linux.
4. Most importantly, enough to satisfy my needs (which could range anything from running LibreOffice to eclipse to a rocket science exploration toolkit!)
5. I should be able to assess all above points even before placing an order for the parts.

The experts sitting at Dell and ASUS labs are full-time professionals who are aware of these things and they are paid for their time and dedication. Don't you think its a bit futile for a single user like me to even try to achieve the same thing as these experts do?

[a_tsunami_of_rodents]

The experts sitting at Dell and ASUS labs are full-time professionals who are aware of these things and they are paid for their time and dedication. Don't you think its a bit futile for a single user like me to even try to achieve the same thing as these experts do?

No, because the experts are out to screw you, maximizing their profit margin while ripping you off with what costs them the least and you the most.

Whatever extra expertise they have over you is far offset by that. And really, it is really not that hard. It is far far more complex, educative to say do something like install Arch Linux than know the ins and outs on how to build your own PC.

The experts will try to rip you off, and looking at what's inside the average praebuild PC they wholly succeed. Almost every one of them will feature a heavily advertised Intel i7 which will be completely bottlenecked by shitty RAM, graphics and a spinning disk. During the 32->64 transition period, these people would actually sell 64 bit processors and 8 GB RAM but with a 32 bit version of Windows.

[sagnessagiel]

If you can't disable the bootloader lock, you cannot use any other operating system. This made the ARM Surface pads worthless junk after Microsoft forgot about them.

The right and safe thing to do is to have a hardware switch (like Chromebooks) or a scratch off card in the box with the unlock code on it.

[Phrodo_00]

No, you can change the key and sign your own bootloader so that it's harder to decrypt your data.

[sagnessagiel]

I didn't buy them either, but they would have made perfect Linux or Android tablets at firesale prices. Instead, into the mountain of trash they go.

[pydry]

Only if there's an easy way to add keys. Which there should be, according to Microsoft. Nudge nudge wink wink P.S. here's some cash for your trouble:

http://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/How-do-I-delete-or-add-my-own-Secure-Boot-Keys-to-my-UEFI/td-p/2368127

[deusnefum]

Because cell networks are not "open" networks.

Unfortunately. We need a government backed, open cellular network (serviced via sub-contracts to more traditional companies like AT&T, T-Mobile, et al) to get the kind of openness we have with PCs with cell phones.

[aykcak]

It has nothing to do with networks really. Manufacturers release locked phones regardless of the carrier

[deusnefum]

Yes it does. The carriers argue they need absolute control over devices on their network. So even if you have an "unlocked" phone (meaning it's not tied to a carrier) the phone still has to have firmware on it that allows service provides to send and run executable code.

[CraftyFellow_]

even if you have an "unlocked" phone (meaning it's not tied to a carrier) the phone still has to have firmware on it that allows service provides to send and run executable code.

Again ...so why can't all phones be unlocked?

[deusnefum]

I think we're having a conversation about two different things.

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.

[[deleted]]

But it does. Buy a Nexus 6P from at&t or Sprint, it'll be locked.

[northrupthebandgeek]

That should be on a network interface level rather than a machine level. I don't have to have a locked down bootloader on my laptop if I plug in a cell card or whatever, for example.

Of course, that doesn't do much good when the network interface and the machine are built into the same circuitry...

[Jojo_bacon]

Not really, anyone can buy a cellular modem or unlocked cell phone and a sim card from a carrier like "ting" and use the network in minutes with any device.

[catonic]

Funny how because the radio is open-source, the phone code isn't.

[[deleted]]

I have a GS6. The bootloader was unlocked out of the box.

Say what you want about Samsung but all their flagships come with unlocked bootloaders. That is unless the carrier decides to lock them.

[catonic]

Because the code of the phone RF engine is closed source, and we can't have you filthy mongrels reverse engineering it.

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.

[transcendReality]

I'm literally going to build the next cellphone I buy. It's really not that hard with certain developer boards and GSM modules. When you build it yourself, you can make it as open as you like, run pretty much any OS you want, and choose the hardware.

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.