Bonum Certa Men Certa

Another Reason to Boycott UEFI and Proprietary Software From Microsoft: Insecurity

Summary: Some blobs like Microsoft's Windows patches and the binary-level UEFI 'validation' do not and cannot provide real security, only insecurity in disguise

THE 'PROMISE' of UEFI 'secure' boot is as ludicrous as Microsoft's claims that it pursues security. UEFI does nothing real for security; in fact, it once again does the very opposite. Quoting the news:



A pair of security researchers have found a buffer overflow vulnerability within the implementation of the unified extensible firmware interface (UEFI) within the EDK1 project used in firmware development.

Bromium researcher Rafal Wojtczuk and MITRE Corp's Corey Kallenberg said the bug in the FSVariable.c source file was linked to a variable used to reclaim empty space on SPI flash chips.


According to other news, as told (spun) by a Microsoft booster.,"Microsoft's advance security notification service no longer publicly available". The booster says that "Microsoft is taking its Advance Notification Service private, claiming the change is due to changes in the way users want their advance security notifications." Microsoft sure tells the NSA about ways to hijack/wiretap Microsoft software, so it's a matter of privilege, not some company-wide policy.

How does the above serve users? It doesn't. This is about Microsoft, not users. Users will be left even more vulnerable. As Pogson correctly points out, "There are no Patch Tuesdays with Debian GNU/Linux so the bad guys are no further ahead. We can all get Debian’s patches as soon as they generate them and we can usually install the updates on running systems with no adverse consequences, like a re-re-reboot."

Moreover, in large corporations in particular, patching code internally is possible or even relying on third parties. Don't ever trust security at binary level, such as large blobs being sent that are supposedly 'patched' or some opaque board giving 'approval' before the running of a binary blob, mostly likely based on some cryptic signature approved by unknown people for unknown reasons (usually employees of companies that work with the NSA). Real security emanates from transparency, which breeds trust and provides to ability for one to study and patch one's own programs (or rely on others to do so using their specialised skills).

"Anyone wonder why the Microsoft SQL server is called the sequel server? Is that because no matter what version it's at there's always going to be a sequel needed to fix the major bugs and security flaws in the last version?"

--Unknown

Recent Techrights' Posts

An Illusion and Cult Worship of Magnitude (Ubiquity as "Victory")
GNU has been around for over 40 years and it'll likely continue to exist for another 40 (in some form)
Wall Street Does Not Care About Microsoft's Impending (August) Layoffs, It Believes Lies From Microsoft, Whose Debt Grows Rapidly
If Microsoft is doing so well and swimming in money, why so many cuts (about 29,000 layoffs so far this year)?
Riot for peace & Love: Catholic Influencers and Digital Missionaries welcome Jubilee of Youth
Reprinted with permission from Daniel Pocock
 
A Lot of Supposedly "Successful" Businesses Are Just Debt-Racking Vessels Without Any Prospects of Financial Sustainability
The probability of bankruptcy of any business is more than 0%
theregister.com: The Voice of Microsoft US?
It basically sold out
Yes, You Can Love and Adore Things Whilst Also Criticising Them
Is society being divided and groomed/primed to be resistant to constructive criticism?
Links 31/07/2025: War in Ukraine, Security News, and Cyberattacks Against Journalists on the Rise
Links for the day
Gemini Links 31/07/2025: Fake Money and Gemini Diaries
Links for the day
Google: From Pointing to Relevant Sites to Pointing to Social Control Media to Actually Parroting Social Control Media as "Facts"
Google has become a misinformation company
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, July 30, 2025
IRC logs for Wednesday, July 30, 2025
How to Report Apple Layoffs Without Saying the "L" Word
don't look for the "L" word
Wayland Considered Harmful (to GNU/Linux Adoption)
it's not limited to games
My Experience With Judges Has been Positive, But We Must Still Pursue SLAPP Reform in the United Kingdom
We believe it'll be a "feather in the cap" if we can help change laws in the UK to better protect investigative reporters
Slopwatch Makes the Web Better
Remember what happened to BetaNews?
Slopwatch: Google News is Pumping in Lots of Web Traffic Into Fake Sites That Say "Linux"
somewhere between 30% and 40% of today's "news" about "Linux", as seen by Google News, is LLM slop
Links 30/07/2025: Climate Calamities Highlighted, Kyrgyzstan Crackdown on Expression/Freedoms
Links for the day
Gemini Links 30/07/2025: Watson’s List of Limits, Lysenko 2000
Links for the day
Some People See What Others See... But Only 40 Years Later
When people deviate from "the norm" they typically get ridiculed and dismissed as "crazy"
Links 30/07/2025: Tea Class Action and Google Killing the Web With Slop
Links for the day
Last Month Our IRC Community Turned 17
Funnily enough we never missed a single day when it comes to logging
"The Unix Kernel"
Linux was inspired by MINIX
The Register Relays Microsoft Marketing, Dubs That Marketing "Research"
Hours ago they did a "Microsoft sez" piece
Dealing With Sociopaths, Liars, and Cranks
A dysfunctional society such as this would never develop
Not Owning Mobile Phones
It's not about resistance; it's common sense
Google 'Search' is Fast Becoming No Better Than Social Control Media Infested With Bots
Google emerged almost 30 years ago as a company looking to organise the Web and direct people towards informative pages. That Google is dead.
PCLinuxOS Had Functional Backups Before the House Fire, the Site Will be Restored in New Webhost
This is the direction we want for GNU/Linux, not some IBM sales strategy
Gemini Links 30/07/2025: Two Sides of Me and "Hooked on Cosmic Voyage"
Links for the day
Microsoft Will Continue Resorting to Crimes in Order to Keep GNU/Linux Usage Down
It is a real problem and we'll revisit it later this week
GAFAM 'Revolving Doors' at The Register and a "Bribe Price List"
"an analyst at Microsoft"
Microsoft Rapidly Shrinking (No, It's Not About Efficiency, It's About Unbearable Debt)
We'll soon see how much debt grew in the past quarter
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 29, 2025
IRC logs for Tuesday, July 29, 2025
Corruption is the Standard Operating Procedure at the European Patent Office (EPO)
The EPO is a dictatorship that stains Europe
Local Staff Committee Munich (LSCMN) at the European Patent Office (EPO) Requests an Urgent Meeting to Avoid Abolishing the Office
This is dictatorship led by the most corrupt
Slopwatch: Fake 'Linux' 'Articles' and Spamfarms/Slopfarms
at least 5 fake articles in one day
Gemini Links 29/07/2025: Wayland Unfit for Use and LLM Slop Faking One's Language Skills With Robot Communications
Links for the day
Before the OSI Was Bribed and Hijacked by Microsoft via GitHub and Compromised Management...
The OSI isn't even remotely "woke"
Nailing the "Hey Hi" (AI) Hype Bubble
So-called "hey hi" as they define it now is all about large companies or regimes remotely controlling the processes running on your machine and even your very own behaviour on your machine, which is in effect no longer your machine but some remotely controlled apparatus
The OSI Has Been Silent for Over 3 Weeks, It Has a Severe Trust Issue After Promoting Microsoft and Proprietary GitHub
OSI took a lot of money from Microsoft to become a Microsoft lobbyist
"Four decades; Four freedoms; For all users" Now as a T-shirt
That's shown along the sidebar
Bribery is OK If You Work for Microsoft (No Punishment Expected)
It's very troubling and a symptom of a broken society/system when particular laws or rules are applied and enforced against some people but not against others
Links 29/07/2025: Bad Climate and "Fair Software Licensing" Blasts Microsoft
Links for the day
Links 29/07/2025: Data Brokers Gone Wrong/Rogue and "Copyright Thicket"
Links for the day
Slopwatch: Linuxconfig.org, Linuxsecurity.com, Fagioli, The Register
Today's "Slopwatch" isn't the first article about LLM slop
Someone Should Remind Microsoft Lunduke That Microsoft Hires Many Sexual Criminals and Pedophiles as Well
Microsoft Lunduke on an "expedition" to find one or more perverts, then generalise to everyone in the "community"
Cash Machines (ATMs) Make Mistakes and They're Proprietary Software
Correcting mistakes is a colossal challenge
We Cover Topics Other Sites Are Too Afraid to Cover (Even When They Know the Facts)
It's not that they doubt the truth, they just realise there may be consequences for talking about it
They Try to Tell Us the Free Software Foundation Inc is Dying, But Its Revenue Doubled Since the Dot-Com Bubble Burst
Being in "Activism" is never easy; but it does positive things for society
Yes, Microsoft is the Problem
"I am no MS shill."
It's About the Cost of Workers, Not the Fictional Skills Shortage (That Does Not Exist, the Media Spreads False and Sometimes Self-Fulfilling Narratives)
This issue isn't limited to computing, some dub it "globalism"
Another Failed Use Case for Chatbots (LLM): Legal Advice and Analysis
They're just some self-discrediting toy that costs way too much to operate
Links 29/07/2025: More Pushbacks Against Slop and More Praises of Tom Lehrer
Links for the day
Gemini Links 29/07/2025: Purple Yarrow and Understanding Op Amps
Links for the day
This Monday WebProNews Absolutely Flooded the Web With Fake (LLM Slop) 'Articles' About "Linux", Google News Promoted Them as Legitimate
All of the following are fake articles attributed to pseudonyms or authors that don't exist; the images are also slop. Why does Google promote these?
Linuxiac is Not a Slopfarm, But at Least Some of Its Articles Are Machine-Generated Fakes
what we said about it was correct
Expect More Microsoft Layoffs
"Are more job cuts coming?"
Microsoft Behaving Like It's Running Out of Money to Pay Salaries
Does that seem like the behaviour expected from a company which claims it is "worth" trillions?
LWN Downtime Due to Linode, Not LLM Bots
"I’ve received an email letting me know that there is a potential for data loss."
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 28, 2025
IRC logs for Monday, July 28, 2025