No, the specification is not against user freedom. "Always Execute" is not again... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

dawidpotocki on Jan 17, 2023 | parent | context | favorite | on: MSI's (in)Secure Boot

No, the specification is not against user freedom. "Always Execute" is not against the spec. "Query User" is partially broken, so it's not even that useful. If you use a bootloader, you will only be able to confirm booting of the bootloader, you won’t be able to confirm the OS that it starts. You will get the dialog, but the input won’t work.

MSI did not add any of these features, they are available in EDK II. https://github.com/tianocore/edk2/blob/9ce09870e721efacc41fa...

Conan_Kudo on Jan 17, 2023 | [–]

At one point, I would have agreed with you. But Microsoft and Intel have been strong-arming implementations to reduce or eliminate user freedom over the past few years.

It's been a sad state of affairs.

Randor on Jan 17, 2023 | [–]

The modes "Allow Execution" at 0x2 and "Query User" at 0x5 are both documented in the UEFI security spec.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact