|
|
Subscribe / Log in / New account

Color me shocked...

Color me shocked...

Posted Jul 12, 2022 16:11 UTC (Tue) by ermo (subscriber, #86690)
In reply to: Color me shocked... by dskoll
Parent article: Garrett: Responsible stewardship of the UEFI secure boot ecosystem

> Wasn't this always the MSFT end-game? I mean, who is really surprised by this?

It's certainly possible.

It is, however, also possible that something happened behind the scenes internally at MSFT that the rest of us aren't (yet) privy to.

Hence, it might pay to hold fire until MSFT is given a chance to respond?

"Never ascribe to malice that which is adequately be explained by incompetence" as the saying goes.


to post comments

Color me shocked...

Posted Jul 12, 2022 16:28 UTC (Tue) by khm (subscriber, #108825) [Link] (7 responses)

> It is, however, also possible that something happened behind the scenes internally at MSFT that the rest of us aren't (yet) privy to.

Does that matter? It's the same end result, the inevitable outcome of anyone engaging in good faith with a massive corporation is always betrayal, generally the moment it becomes possible. The Microsoft apologists knew it was a scorpion, and decided to cross the river with it. I'm not sure that the complicated internal politics of bad behavior are relevant to the resulting bad behavior, unless we're looking to make more excuses.

Color me shocked...

Posted Jul 14, 2022 18:25 UTC (Thu) by carenas (guest, #46541) [Link] (6 responses)

>> It is, however, also possible that something happened behind the scenes internally at MSFT that the rest of us aren't (yet) privy to.
> Does that matter?

Yes, because not giving them first an opportunity to clarify their position to this "apparent" change implies we are assuming bad faith and not willing to give the benefit of the doubt first.

It should be also obvious to anyone following recent news that this is not the biggest concern inside MSFT who just announced layoffs, so the possibility of just being a misunderstanding is more likely than usual IMHO

Color me shocked...

Posted Jul 15, 2022 3:30 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link] (3 responses)

This isn't exactly a non-story, but it's a mountain-from-molehill type situation. There's a checkbox in the BIOS to enable the third-party key if you want. All they did is disable it by default, which sort of makes sense I guess if the use case is "locked-down corporate office drone machines that we replace every three years, at great expense, even though they're still working fine, because we're morons."

Color me shocked...

Posted Jul 15, 2022 13:57 UTC (Fri) by mattdm (subscriber, #18) [Link] (2 responses)

> There's a checkbox in the BIOS to enable the third-party key if you want.

This is a huge problem. It is hard enough for people to do a Linux install (even if they're not making the problem even harder for themselves by wanting preserve and dual-boot Windows on the same system).

Adding in "change your BIOS setting" is a big hurdle.

Add in "how you get to your BIOS settings is different on every computer! you probably hit a key during startup. really fast though, before it does other stuff. And what key it is will be different".

Add in "once you are in the settings, you'll get some weird gui, or maybe a text interface which, if you are old enough, you will remember as how your parents may have used computers"

Add in "okay, look around for a section that might have the relevant settings. we don't know what that section is called. it will be different from computer to computer. something with 'boot', or 'security', or something".

Add in "now, in this security section, find, like, the most obscure sub-section you can. excellent. change this one setting, which will have some name that sounds related to what we're talking about. it will probably have a warning telling you not to change it. also, don't change other settings because they might really make your system less secure."

And now, add in "some systems might not even have this setting. hope yours does!"

Color me shocked...

Posted Jul 15, 2022 14:47 UTC (Fri) by excors (subscriber, #95769) [Link] (1 responses)

On the other hand that doesn't sound much different to upgrading from Windows 10 to 11, which requires a TPM. Many people have a firmware TPM that's disabled by default, so they have to go through the BIOS and find the PTT/fTPM option before being allowed to upgrade. Presumably Microsoft doesn't think that's an insurmountable obstacle for most Windows users.

Color me shocked...

Posted Jul 17, 2022 9:44 UTC (Sun) by geert (subscriber, #98403) [Link]

Which proves that the meme "No one ever got fire for buying ..." still applies to Microsoft?

Cfr. people "could not" switch to OpenOffice because it looked different than Microsoft Office, followed by Microsoft introducing "the ribbon"...

Color me shocked...

Posted Jul 15, 2022 23:55 UTC (Fri) by jdulaney (subscriber, #83672) [Link] (1 responses)

This is the same Microshit that bragged about helping put kids in cages.

Color me shocked...

Posted Jul 16, 2022 0:01 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link]

And Linux is used in North Korea and Russia to replace Windows.

Color me shocked...

Posted Jul 12, 2022 16:37 UTC (Tue) by bpearlmutter (subscriber, #14693) [Link] (2 responses)

How about *not* holding fire, instead going ballistic about this issue, so MS will learn a valuable lesson and be more careful next time? You know, encourage them to develop internal mechanisms to avoid making this kind of screw-up in the future.

This makes sense regardless of whether or not it was accidental.

Color me shocked...

Posted Jul 12, 2022 16:54 UTC (Tue) by donbarry (guest, #10485) [Link] (1 responses)

The community is not served by extending the slightest trust to Microsoft or any other corporate entity in holding the keys for access to widely used hardware platforms.

The only solution is to demand a public trust hold these and administer them on behalf of computer users everywhere.

This is a time when Microsoft stands exposed (again) and such a demand can be raised and escalated. To defer endlessly to Microsoft is to once again lose the moment and either lose the battle now or set up one for a future loss -- nowhere is anything other than a perpetuation of the stalemate of the status quo ante a possibility without fighting for the control to be given up by Microsoft.

Color me shocked...

Posted Jul 13, 2022 16:52 UTC (Wed) by midol (guest, #25855) [Link]

as a matter of actual real-world fact Microsoft has been convicted in open court of criminal monopolism. See here:

https://corporatefinanceinstitute.com/resources/knowledge...

In light of this, the characterization of the Linux community of Microsoft as being untrustworthy is an accurate description, no matter how heatedly presented.

Color me shocked...

Posted Jul 13, 2022 5:14 UTC (Wed) by oldtomas (guest, #72579) [Link] (2 responses)

Remember that corporations aren't people. There's something with corporations I like to call "emergent evil". It may well be that no one personally wants evil [1], but the emerging behaviour (think anthill) still results on that.

So for corporations, I prefer this bastard made of Hanlon's razor and Clarke's third law "Any sufficiently advanced malice is indistinguishable from stupidity".

CYA, plausible denial, diluted responsibility and all that.

For me, this practically means that Microsoft should get as much flak as humanly possible for this.

[1] sometimes, some people very much do, as the current Uber files thing chillingly shows.

Color me shocked...

Posted Jul 13, 2022 12:28 UTC (Wed) by atnot (subscriber, #124910) [Link] (1 responses)

> There's something with corporations I like to call "emergent evil"

I think this is the most useful framework to think about these things.

For example, imagine you are in charge of security at Microsoft. You propose to a wide array of security measures. Some of them require additional work in Windows, some of them require work from vendors and some would be easy to enable but require extra development to make work well with other operating systems.

Your boss is tasked with picking which of these things should be the companies priority this year. Which of these do you think will be at the bottom of the list? The measures start to roll out and you receive backlash. You earnestly suggested these security measures in good faith so you will of course defend them and be adamant that their purpose is security. But your good intentions were ultimately irrelevant, because filtered through bad incentives they created emergent evil.

"Is Microsoft good or bad" is a trick question, it's a blind self-feeding machine.

Color me shocked...

Posted Jul 15, 2022 19:09 UTC (Fri) by Wol (subscriber, #4433) [Link]

I dunno about "emergent evil", but there is also "responsibility to your stake holders", which is a legal obligation, and is rarely thought through by legislators.

Unfortunately, as someone caught up in the disability/benefits/advocacy mess, you very soon realise that people *want* to be helpful, but are seriously constrained in what the law allows them to do (or they're in "cover your ass" mode, because if they don't they know the law will be looking for a scapegoat :-(

It's like GDPR - I don't consider it onerous - but I absolutely insist people I deal with provide me with proof they "opted in". Otherwise I'm setting myself up for an "unfortunate" interview with the police if things turn nasty.

Cheers,
Wol


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds