• 0 Posts
  • 15 Comments
Joined 2 years ago
cake
Cake day: June 26th, 2023

help-circle


  • splendoruranium@infosec.pubtolinuxmemes@lemmy.worldhehehe
    link
    fedilink
    English
    arrow-up
    0
    ·
    1 month ago

    yeah BUT some knowledge you regret learning, and oþer people’s kinks teeter dangerously on þat brink.

    While I was mainly trying to be vaguely poetic in a silly context, I can honestly not think of anything that I’ve ever regretted learning and I likewise can’t think of anything I wouldn’t want to know.
    At best I would factor opportunity costs into it, but that still leaves me with only wanting to learn some things more than other things.


  • splendoruranium@infosec.pubtolinuxmemes@lemmy.worldhehehe
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 month ago

    Learning about random internet-users’ kinks…? I guess there’s worse ways to spend a friday :D

    Never let that toddler’s joy and wonder, the joy of learning something new and then suddenly understanding one more aspect of the big and complicated world around you and all the other people living in it, fade away.



  • splendoruranium@infosec.pubtolinuxmemes@lemmy.worldhehehe
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 month ago

    when in doubt, assume it’s a sex thing. Seems to work with basically all of these “I LIED, instead of [x] we do [y]”.

    Oh, I have no doubt in my mind that it’s a sex thing, but I’m clearly lacking either the imagination, experience or cultural background to solve for [x]. It seems awfully specific, that’s why I’m asking






  • Thanks, I didn’t know most any of that stuff!

    So the bootloader also gets updated, and new versions of the bootloader need to get signed. So if the BIOS is responsible for signing the bootloader, then how does the operating system update the bootloader?

    Does that happen often? I had, apparently incorrectly, assumed those things were more or less fire and forget.

    Kinda. The problem here, IMO, is that Secure boot conflates two usecases/threat models into one.

    Huh, I think that might indeed be the central problem, good call.

    You must explicitly ask for this setup from the Linux distro installers (at least, all the one’s I’ve used). By default, /boot, where the kernel and drivers are stored, is stored unencrypted in another external partition, and not in the LUKS encrypted partition.

    Wait what, that just seems like home directory encryption with extra steps 🤦 I guess I’ll go back to Veracrypt then.


  • But this breaks automatic updates without entering the BIOS

    Maybe I’m misunderstanding a technical aspect here, but wouldn’t only the bootloader need to be signed? To my understanding a tamper-proof system already assumes full disk-encryption anyway, so any kinds of automatic updates would be happening in a black box anyway, wouldn’t it?

    and is just not feasible except for the PC on your desk at home

    That’s probably a different and more value-based discussion and I’m quite sure you didn’t intend it that way, but it’s hard for me to put into words how much this sentence structure offends me 😅
    A benefit to the users in front of their personal computers can never be an exception, it is (… ought to be) always the point of everything, the end goal. Having a solution that benefits end users and puts other entities at a disadvantage is always preferable over a solution that puts end users at a disadvantage for the benefit of other entities.


  • As almost always the answer is “it depends”.
    From a security perspective you want to make sure that what your system boots is trusted and not tampered with by a third party. If your threat model includes people with physical access or malicious software (root kits) manipulating your operating system, then secure boot can help mitigating if you set it up correctly.
    If that’s none of your concern, then you probably shouldn’t bother with it.

    It’s such a silly system. Could have just had it in a way that automatically trusts only whatever system(s) is/are installed while the BIOS is unlocked so any user benefits from secure boot as soon as they set a BIOS password.