Posts by vathpela@infosec.exchange
(DIR) Post #B5AO5fg3ontIarwmgK by vathpela@infosec.exchange
0 likes, 0 repeats
@ariadne I'm reminded of the exhibit at the Udvar Hazy center: two items next to each other. One looks like molded plywood, the other is a hunk of charcoal in the same shape but quite a bit thinner. "Mercury heat shield; ablated."
(DIR) Post #B5PHQPm2MFQv2i5N4K by vathpela@infosec.exchange
0 likes, 0 repeats
@azonenberg @lcamtuf @tubetime couple of socket adapters and it could really help in Japan...
(DIR) Post #B6ENSQP7UfHMMbfFUu by vathpela@infosec.exchange
0 likes, 0 repeats
@ariadne If I wanted to be a driver of simulated slaves that cost a lot, ... well, I don't know what I'd do but I really don't want any part of that.
(DIR) Post #B6STHxAKfNd6ixZo0W by vathpela@infosec.exchange
0 likes, 0 repeats
@azonenberg @penguin42 You're probably going to need to service it with some cleaner and some oil pretty often.
(DIR) Post #B6iv74nuJOP5pynZaa by vathpela@infosec.exchange
0 likes, 1 repeats
RE: https://mastodon.social/@pid_eins/116645701863256672Despite what Lennart is saying, OS installers do do this. I added support in Fedora and RHEL in 2013 here: https://github.com/rhinstaller/anaconda/commit/20ff394448e96dddc37831ef0619d006d5083cd3RT: https://mastodon.social/users/pid_eins/statuses/116645701863256672
(DIR) Post #B7rehrd7IdtvBIFGue by vathpela@infosec.exchange
0 likes, 0 repeats
@ariadne the validity period actually doesn't matter at all - everything on devices has checking them completely disabled, because a) all it can do is brick boxes (especially because of option rom signatures) and b) the attacker controls the clock.The only thing that cares about the validity period is SignTool.exe. So basically now we can't get new bootloaders signed with the old cert, and generally distro's current bootloaders are dual-signed with the 2023 certs.The hard part is getting the 2023 certs enrolled before we need to revoke the current shims.