BIOS boot vs UEFI boot

[bgavin]

Baloney.
The purpose is to boot the machine.
If it boots I’m good.
That is all I want it to do.
Simple, clean and easy to fix.
I don’t give a damn about security or the endless nannies that try (and fail) at trying to intercept every security exposure the smart bad guys devise. The more complicated the mouse trap the more ingenious ways the rats find to get around it. There is no unique machine ID stored in BIOS that gets uploaded to ?? for nefarious purposes.

 

[Espionage724]

I don’t give a damn about security or the endless nannies that try (and fail) at trying to intercept every security exposure the smart bad guys devise. The more complicated the mouse trap the more ingenious ways the rats find to get around it.

Security's a myth (fine when it works, no guarantees, but always slowing stuff down while not offering rolling-protection guarantees; protections with easy-toggles get disabled for convenience, and all it takes is a lapse of judgement during that convenience for security to fail/Vista's UAC prompt on minor tasks and getting used to Allowing everything)

I disable ASLR, CFG, DEP, run Windows with EnableLua=0 since it first came with Vista, and run openSUSE without AppArmor or SELinux by choice + mitigations=off; no problems for years and max-speed/performance everywhere (my defense is not messing with stuff like Spiderman-3-imax.mov.exe, or uploading unfamiliar stuff through VirusTotal)

SecureBoot and FDE afaik can't guarentee protection if there's physical access (YellowKey, golden key certs, weak CPU RNG, keylog/dongle, camera above keyboard, wrench); so why try and have more complexity Worst-case my pass DB is encrypted, but everything else can serve as an example to the next person on what a good set-up looks like.

What would you choose for a system on which only FreeBSD is installed?

UEFI; technically I think it's easier to update the bootloader (haven't tried that non-EFI), but realistically I like faster boots with minimal effort (haven't seen any issue on UEFI computers with FreeBSD that implied BIOS/Legacy would differ)

 

[Whattteva]

Yeah, sometimes the whole security thing just sounds like an excuse, like the way they said X11 is insecure as an excuse to write Wayland. The truth is, I've never experienced any security incidents from X11, but got a ton more from supply side breaches from some NPM library or XZ Utils backdoor 2 years ago.

 

[didal]

UEFI; technically I think it's easier to update the bootloader (haven't tried that non-EFI), but realistically I like faster boots with minimal effort (haven't seen any issue on UEFI computers with FreeBSD that implied BIOS/Legacy would differ)

I had to put this in my /etc/sysctl.conf:

# Prevent this computer to restart immediately after poweroff.
hw.efi.poweroff=0

 

[bgavin]

IMO, security is first and foremost on the user.

If they are too stupid to not avoid porn and lascivious web sites, they get what they asked for.

If they are so stupid they open emails and click links that look like a randomized password, they get what they asked for.

Lastly, if the user accepts the heavy hand of Microsoft invasiveness, spying, telemetry, marketing and AI analysis of their cloud data files and secure boot certificates, then the user gets what he asks for.

Don’t eat wild mushrooms if you don’t have the brains to choose correctly.

 

[Whattteva]

IMO, security is first and foremost on the user.

If they are too stupid to not avoid porn and lascivious web sites, they get what they asked for.

If they are so stupid they open emails and click links that look like a randomized password, they get what they asked for.

Lastly, if the user accepts the heavy hand of Microsoft invasiveness, spying, telemetry, marketing and AI analysis of their cloud data files and secure boot certificates, then the user gets what he asks for.

Don’t eat wild mushrooms if you don’t have the brains to choose correctly.

Agreed. I think the top most common security breaches are:

• Trivial passwords (ie. password123)
• Tapping random unverified links.
• Willingly granting sudo/windows elevation prompt to install/run unverified code from a random website or email.
• Willingly entering 2FA code from a phishing website made to mimic a legitimate website.

Also, not common for end-users, but quite common for developers: pulling compromised dependency library from upstream.

 

[T-Aoki]

And international laws with severe enough penalties are needed.

For example, links that the text (including images possibly read as texts) shown can be interpreted as possibly valid URL/URL SHALL 100% match the linked address. And prohibit mimic'ing addresses swown as "which URL to go" on browser / MUA to be differ (bit by bit basis, of course!).

This would be far, far and far more, uncomparabully helpful to switch from X11 to Wayland for end users. Of course, prerequisite is to mask "possibly" insecure connections from X server to external computers "by default".
Some possible security holes can be plugged by proper configurations.

 

[bgavin]

I had no idea that X Server was dirty like Windows is dirty.

I read that Win11 left idling overnight with no apps running, contacted over 100 IP outside the users LAN.

Until this dirty crap is flushed out (or abandoned in my case) it will only continue to escalate.