06.06.13

UEFI ‘Secure’ Boot is Not About Security, Insyde Software’s Business Model is Misguided and Dangerous

Posted in GNU/Linux, Kernel, Security at 9:10 am by Dr. Roy Schestowitz

Corporate insecurity for Insyde Software, corporate security for Microsoft

UEFI

Summary: Promotion of bad ideas by Insyde Software merits another discussion about what UEFI actually means to ordinary GNU/Linux users

The main problem with UEFI is its effect on freedom. It’s not just about restricted boot but also patents and other issues covered in the criticism section in Wikipedia.

A new press release from Taiwan describes UEFI as a security mechanism, but this is utter fiction. Last month I spoke for over an hour with the president of the UEFI Forum, covering in length the aspect of security. He too was led to agreeing with me that security is hardly improved by UEFI, which can have its barriers bypassed and ignored. The press release says something like this:

Insyde Software, a leading provider of Unified Extensible Firmware Interface (UEFI) BIOS, today announced the availability of new UEFI security features including Secure Boot and secure firmware update for leading Linux distributions.

No, thanks. Linux does not need UEFI for security. Even Torvalds rejects the 'security' claim (he dislikes ‘secure’ boot in general [1, 2]). So the above is a marketing gimmick, that’s all. Insyde Software will boost flawed claims of ‘security’, so we should all be prepared to rebut.

Dr. Garrett, an expert in this field and occasional apologist, demonstrated that UEFI with Linux can brick hardware [1, 2, 3]. So much for security, eh? He is supporting it, sadly enough, based on very weak grounds. He should have antagonised it instead. Earlier this week he posted an update on the bricking issue:

Meanwhile, Samsung got back to us and let us know that their systems didn’t require more than 5KB of nvram space to be available, which meant we could get rid of the 50% value and replace it with 5KB. The hope was that any system that booted with only 5KB of space available in nvram would trigger a garbage collection run. Unfortunately, it turned out that that wasn’t true – some systems will only trigger garbage collection if the OS actually makes an attempt to write a variable that won’t otherwise fit.

So the search for a solution goes on under the false pretences that buggy, experimental UEFI sometimes adds something for GNU/Linux users to enjoy. The practical benefits of UEFI are very minor to ordinary desktop users. UEFI is good for two monopolies: the Intel/x86 monopoly and the Windows monopoly. █

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.

Permalink Mail Send this to a friend

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

Governments-Connected ‘Hacking Team’ Targets UEFI, Reveal Leaks

What Else is New

Team UPC is Interjecting Itself Into the Media Ahead of Tomorrow's Lobbying Push Against the European Council and Against European Interests

A quick look at the growing bulk of UPC lobbying (by the legal firms which stand to benefit from it) ahead of tomorrow's European Council meeting which is expected to discuss a unitary patent system
IP Kat is Lobbying Heavily for the UPC, Courtesy of Team UPC

When does an IP (or patent) blog become little more than an aggregation of interest groups and self-serving patent law firms, whose agenda overlaps that of Team Battistelli?
Leaked: Conclusions of the Secretive EPO Board 28 Meeting (8th of September 2016)

The agenda and outcome of the secretive meeting of the Board of the Administrative Council of the EPO
Letter From the Dutch Institute of Patent Attorneys (Nederlandse Orde van Octrooigemachtigden) to the Administrative Council of the EPO

The Netherlands Institute of Patent Attorneys, a group representing a large number of Dutch patent practitioners, is against Benoît Battistelli and his horrible behaviour at the European Patent Office (EPO)
EPO's Board 28 Notes Battistelli's “Three Current Investigations/Disciplinary Proceedings Involving SUEPO Members in The Hague."

The attack on SUEPO (EPO staff representatives) at The Hague appears to have been silently expanded to a third person, showing an obvious increase in Battistelli's attacks on truth-tellers
Links 28/9/2016: Alpine Linux 3.4.4, Endless OS 3.0

Links for the day
Cementing Autocracy: The European Patent Office Against Democracy, Against Media, and Against the Rule of Law

The European Patent Office (EPO) actively undermines democracy in Europe, it undermines the freedom of the press (by paying it for puff pieces), and it undermines the rule of law by giving one single tyrant total power in Eponia and immunity from outside Eponia (even when he breaks his own rules)
Links 28/9/2016: New Red Hat Offices, Fedora 25 'Frozen'

Links for the day
Team Battistelli Intensifies the Attack on the Boards of Appeal Again

The lawless state of the EPO, where the rule of law is basically reducible to Battistelli's ego and insecurities, is again demonstrated with an escalation and perhaps another fake 'trial' in the making (after guilt repeatedly fails to be established)
After the EPO Paid the Financial Times to Produce Propaganda the Newspaper Continues to Produce UPC Puff Pieces, Just Ahead of EU Council Meeting

How the media, including the Financial Times, has been used (and even paid!) by the EPO in exchange for self-serving (to the EPO) messages and articles
Beware the Patent Law Firms Insinuating That Software Patents Are Back Because of McRO

By repeatedly claiming (and then generalising) that CAFC accepted a software patent the patent microcosm (meta-industry) hopes to convince us that we should continue to pursue software patents in the US, i.e. pay them a lot more money for something of little/no value
The US Supreme Court Might Soon Tighten Patent Scope in the United States Even Further, the USPTO Produces Patent Maximalism Propaganda

A struggle brewing between the patent 'industry' (profiting from irrational saturation) and the highest US court, as well as the Government Accountability Office (GAO)
Patent Trolling a Growing Problem in East Asia (Software Patents Also), Whereas in the US the Problem Goes Away Along With Software Patents

A look at two contrasting stories, one in Asia where patent litigation and hype are on the rise (same in Europe due to the EPO) and another in the US where a lot of patents face growing uncertainty and a high invalidation rate
The EPO's Continued Push for Software Patents, Marginalisation of Appeals (Reassessment), and Deviation From the EPC

A roundup of new developments at the EPO, where things further exacerbate and patent quality continues its downward spiral
The Battistelli Effect: “We Will be Gradually Forced to File Our Patent Applications Outside the EPO in the Interests of Our Clients”

While the EPO dusts off old files and grants in haste without quality control (won't be sustainable for more than a couple more years) the applicants are moving away as trust in the EPO erodes rapidly and profoundly
Links 27/9/2016: Lenovo Layoffs, OPNFV Third Software Release

Links for the day
The Moral Depravity of the European Patent Office Under Battistelli

The European Patent Office (EPO) comes under heavy criticism from its very own employees, who also seem to recognise that lobbying for the UPC is a very bad idea which discredits the European Patent Organisation
Links 26/9/2016: Linux 4.8 RC8, SuperTux 0.5

Links for the day
What Insiders Are Saying About the Sad State of the European Patent Office (EPO)

Anonymous claims made by people who are intimately familiar with the European Patent Office (from the inside) shed light on how bad things have become
The EPO Does Not Want Skilled (and 'Expensive') Staff, Layoffs a Growing Concern

A somewhat pessimistic look (albeit increasingly realistic look) at the European Patent Office, where unions are under fire for raising legitimate concerns about the direction taken by the management since a largely French team was put in charge
Patents Roundup: Accenture Software Patents, Patent Troll Against Apple, Willful Infringements, and Apple Against a Software Patent

A quick look at various new articles of interest (about software patents) and what can be deduced from them, especially now that software patents are the primary barrier to Free/Libre Open Source software adoption
Software Patents Propped Up by Patent Law Firms That Are Lying, Further Assisted by Rogue Elements Like David Kappos and Randall Rader (Revolving Doors)

The sheer dishonesty of the patent microcosm (seeking to bring back software patents by misleading the public) and those who are helping this microcosm change the system from the inside, owing to intimate connections from their dubious days inside government
Links 25/9/2016: Linux 4.7.5, 4.4.22; LXQt 0.11

Links for the day
Patent Quality and Patent Scope the Unspeakable Taboo at the EPO, as Both Are Guillotined by Benoît Battistelli for the Sake of Money

The gradual destruction of the European Patent Office (EPO), which was once unanimously regarded as the world's best, by a neo-liberal autocrat from France, Benoît Battistelli
Bristows LLP's Hatred/Disdain of UK/EU Democracy Demonstrated; Says “Not Only Will the Pressure for UK Ratification of the UPC Agreement Continue, But a Decision is Wanted Within Weeks.”

Without even consulting the British public or the European public (both of whom would be severely harmed by the UPC), the flag bearers of the UPC continue to bamboozle and then pressure politicians, public servants and nontechnical representatives
Released Late on a Friday, EPO Social 'Study' (Battistelli-Commissioned Propaganda) Attempts to Blame Staff for Everything

The longstanding propaganda campaign (framing staff as happy or framing unhappy staff as a disgruntled minority) is out and the timing of the release is suspicious to say the least
Links 23/9/2016: Latest Microsoft and Lenovo Spin (Now in ‘Damage Control’ Mode)

Links for the day
White Male-Dominated EPO Management Sinks to New Lows, Again

Benoît Battistelli continues to make the EPO look like Europe's biggest laughing stock by attempting to tackle issues with corny photo ops rather than real change (like SUEPO recognition, diverse hiring, improved patent quality, and cessation of sheer abuses)
Journalism 102: Do Not Become Like 'Managing IP' or IAM 'Magazine' (the Megaphones of the EPO’s Management)

Another look at convergence between media and the EPO, which is spending virtually millions of Euros literally buying the media and ensuring that the EPO's abuses are scarcely covered (if ever mentioned at all)
Journalism 101: Do Not Believe Anything That Benoît Battistelli and the EPO's Management Say (Also Don't Fall for the UPC Hype)

A survey/review (or an overview) of recent articles about the EPO and why they're wrong (mostly because they parrot the official lies from Battistelli's department)