10 ms·

And we trust these people with the root CA cert in our Secure Boot?

deleted 3mo ago
[deleted]
justinclift 3mo ago
More like "forced to accept" rather than "trust". This latest event just continues Microsoft's track record of being a security problem rather than having their shit together. :(
shakna 3mo ago
You mean the company that failed their 2023 security review? [0] > Individually, any one of the failings described above might be understandable. Taken together, they point to a failure of Microsoft’s organizational controls and governance, and of its corporate culture around security. Microsoft’s products and services are ubiquitous. It is one of the most important technology companies in the world, if not the most important. This position brings with it utmost and global responsibilities. It requires a security-focused corporate culture of accountability, which starts with the CEO, to ensure that financial or other go-to-market factors do not undermine cybersecurity and the protection of Microsoft’s customers. > Unfortunately, throughout this review, the Board identified a series of operational and strategic decisions that collectively point to a corporate culture in Microsoft that deprioritized both enterprise security investments and rigorous risk management. These decisions resulted in significant costs and harm for Microsoft customers around the world. > The Board is convinced that Microsoft should address its security culture. [0] https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...
- stogot 3mo ago
  Bonkers that this wasn’t bigger news
- magicalhippo 3mo ago
  Guess that's what lead to the Secure Future Initiative[1], given it was launched late 2023[2]... [1]: https://www.microsoft.com/en-us/trust-center/security/secure-future-initiative https://www.microsoft.com/en-us/trust-center/security/secure... [2]: https://cybermagazine.com/articles/how-microsoft-is-securing-the-future-of-innovation https://cybermagazine.com/articles/how-microsoft-is-securing...
sunaookami 3mo ago
No one should be foolish enough to trust Microsoft with anything regarding security. They showed time and time again over the past 40 years that they don't care.
- trumpdong 3mo ago
  Have you bought a PC in the last 10 years? Then it came with Microsoft's secure boot keys on it. Sometimes it's not even possible to remove or disable them. Sometimes you actually need a Microsoft-signed bootloader shim to boot anything that isn't Microsoft.
  - sunaookami 3mo ago
    I haven't bought a Windows PC in the last 10 years, yes. I think the last Windows PC I bought was a used ThinkPad from 2011 that I upgraded and used until 2022.
AdamN 3mo ago
What do you mean 'we'? :-)
ZeroWidthJoiner 3mo ago
The root of trust in Secure Boot is typically an OEM certificate, not Microsoft's, which is probably even worse: https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot https://www.binarly.io/blog/pkfail-untrusted-platform-keys-u... In any case, you're free to remove Microsoft's certificates and enroll your own.
neop1x 3mo ago
And the next step will be to lock the bootloader to prevent any unsigned OSes like linux to protect children.

deleted 3mo ago

[deleted]

More like "forced to accept" rather than "trust". This latest event just continues Microsoft's track record of being a security problem rather than having their shit together. :(

shakna 3mo ago

You mean the company that failed their 2023 security review? [0] > Individually, any one of the failings described above might be understandable. Taken together, they point to a failure of Microsoft’s organizational controls and governance, and of its corporate culture around security. Microsoft’s products and services are ubiquitous. It is one of the most important technology companies in the world, if not the most important. This position brings with it utmost and global responsibilities. It requires a security-focused corporate culture of accountability, which starts with the CEO, to ensure that financial or other go-to-market factors do not undermine cybersecurity and the protection of Microsoft’s customers. > Unfortunately, throughout this review, the Board identified a series of operational and strategic decisions that collectively point to a corporate culture in Microsoft that deprioritized both enterprise security investments and rigorous risk management. These decisions resulted in significant costs and harm for Microsoft customers around the world. > The Board is convinced that Microsoft should address its security culture. [0] https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...

stogot 3mo ago
Bonkers that this wasn’t bigger news
magicalhippo 3mo ago
Guess that's what lead to the Secure Future Initiative[1], given it was launched late 2023[2]... [1]: https://www.microsoft.com/en-us/trust-center/security/secure-future-initiative https://www.microsoft.com/en-us/trust-center/security/secure... [2]: https://cybermagazine.com/articles/how-microsoft-is-securing-the-future-of-innovation https://cybermagazine.com/articles/how-microsoft-is-securing...

sunaookami 3mo ago

No one should be foolish enough to trust Microsoft with anything regarding security. They showed time and time again over the past 40 years that they don't care.

trumpdong 3mo ago
Have you bought a PC in the last 10 years? Then it came with Microsoft's secure boot keys on it. Sometimes it's not even possible to remove or disable them. Sometimes you actually need a Microsoft-signed bootloader shim to boot anything that isn't Microsoft.
- sunaookami 3mo ago
  I haven't bought a Windows PC in the last 10 years, yes. I think the last Windows PC I bought was a used ThinkPad from 2011 that I upgraded and used until 2022.

AdamN 3mo ago

What do you mean 'we'? :-)

ZeroWidthJoiner 3mo ago

The root of trust in Secure Boot is typically an OEM certificate, not Microsoft's, which is probably even worse: https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot https://www.binarly.io/blog/pkfail-untrusted-platform-keys-u... In any case, you're free to remove Microsoft's certificates and enroll your own.

neop1x 3mo ago

And the next step will be to lock the bootloader to prevent any unsigned OSes like linux to protect children.