Clouds and VPSes

Yes and no the fact is we live in an interconnected world were devices need to be protected not just at the application and OS levels, but all the way down to the firmware and hardware levels.

And now the industry is faced with deep, firmware- and hardware-level attacks and the reason for that being is there is a major firmware security gap with zero visibility in it.

In this interconnected world we (now?) live in, organazations and businesses need to be able verify that the internal components of their purchased computing devices are genuine and have not been altered with during the manufacturing and distribution processes ( for example manufactures swapped out components during the chip shortage for different ones, from different suppliers ) or otherwise modified throughout the device´s life cycles in their infrastructure or during the warranty of the device as a part of their business solution(s).

That the firmware that the every day device relies on, be it the "smart" coffee machine, corporate laptops, the network equipment, the servers or the even the personal/corporate EV's ( you dont want your Tesla's to run rampage, plowing down pedestrians like an elephant tramping over ants do you, or turn left when it should be turning right after the vehicle recieved altered firmware update over the air right? ) has not been tampered with.

All these devices have firmware on them so it's vital that organazations and businesses have their cybersecurity supply chain in check.

The unified extensible firmware interfaces is an critical components in the cybersecurity supply chain since it's an integrated part of infrastructures that runs this fairly newly founded interconnected world and I most certainly would think that the FOSS community would want to be integrated part in helping pushing, validate and securing and otherwise help strengthen the cybersecurity supply chain as well as phase out solutions like legacy bios's that are no longer being maintained and are considered obsolete in the industry since more often than not Linux is the underlying technology running this new world.

I'm not too overly concerned with cloud vendors or other buisnesses that do not have their cybersecurity supply chain in check since the free market will take care of those that wont ( they break the root of trust and will just be stuck with financially starved clients ).

For example if I was a government entity or a car manufacturer like Toyota,Volvo or Tesla I would not be doing any business with companies that dont have their cybersecurity supply chain in check and one of the things I would be checking for would be if the relevant vendor supported uefi and which hw manufacture it ran, in it's infrastructure on ( all the way down to component level ) etc. so I could validate and ensure that *my* cybersecurity supply chain was in check and *my* root of trust was secure.

I would exclude IBM/RH/Amazone from every government/business contracts since it's quite apparent based on the feedback here and on fedora-devel that they are not ready for this.

Their cybersecurity supply chain is not in order thus cannot be trusted and wont be for years ( from the looks of it ) thus I would choose a different vendor that provided me with a secure root of trust. ( There are business opportunity for those that can, to get ahead of large vendors like Amazon for example )

Fedora will not be allowed to make the required change to prepare RHEL due to the legacy trolls that come crawling out of last century, screaming ME ME ME, MY USECASE, FOREVER!!!! while riding on their roating,rusting, steam powered technology devices demanding that the technology universe remains frozen in time and be supported forever, as is ( another example is Adam trying to deprecate the legacy xorg driver ) as opposed to be thinking a bit further away from their own noses, ahead into the future, to the state that the industry is in now and evolving into.

The Fedora solutions MOAR Community Burecracy ( because that as worked so well! ) by forming a "Legacy SIG" to deal with the problem. So RHEL 10, nope propably more like RHEL 11...