Me neithe- I mean what does that say?

I unironically want to see this movie.

Yes! Screen capture! Standardize it! Standardize it! Then get FFMPEG and Zoom to adopt the new standard!

Also, that Simon guy sounds like a good and nice guy.

Uninstall it and make the world a slightly better place?

They don’t even have to be signed…

Yeah. My understanding is that Microsoft has signed several tools made by other companies that boot as UEFI PE executables and aren’t supposed to allow loading arbitrary (including unsigned and malicious) UEFI PE binaries, but due to security vulnerabilities in the tool, they’ll load any old UEFI PE binary you give them.

The payload/malicious UEFI PE binaries don’t have to be signed. But the third-party tools that contain the vulnerabilities have to be signed by a signer your UEFI firmware trusts. (And the tools are signed by Microsoft, which your UEFI firmware almost definitely trusts, unless you’ve already applied a fix).

(And I don’t know exactly what sort of tools they are. Maybe they’re like UEFI Shell software or something? Not sure. Not sure it matters that much for purposes of understanding the impact or remediation strategy for this vulnerability.)

The fix, I’d imagine is:

• Everyone should untrust the certificates used to sign those vulnerable tools. (And by “untrust”, I really mean they need to apply the revocations.)
• Microsoft needs to issue new certificates to replace the ones with which they signed the vulnerable tools.
• The companies who made those tools need to release new, fixed, not-vulnerable versions of the same tools.
• …and get Microsoft to sign those new versions with the replacement keys.
• And users need to migrate from the vulnerable versions to the new versions of the tools in question.

Now, I’m not 100% sure if there needs to be yet another step in there where individual users explicitly install/trust the replacement certs. Those replacement certs are signed by Microsoft’s root certificate, right? As long as all the certificates in the chain from the root certifcate down to the signature are included with the UEFI PE binary, the firmware should be able to verify the new binary? Or maybe having chains of certs is not how UEFI PE binaries work. Not sure.

Here is an example of something similar that disables Windows Platform Binary Table…(I’m not advocating that anybody actually use this).

Yuck. Thanks for letting me know of that. I’m still firmly in the “learning” phase when it comes to this UEFI stuff. It’s good to be aware of this.

The funniest part is that the laptop has been in sleep or hibernate all that time, not off.

I doubt they can hear much of anything with their heads lodged that far up Trump’s ascending colon.

As drspod said, no, Linux is not invulnerable. For Linux users using legacy BIOS boot or using UEFI but not secure boot, this vulnerability doesn’t make anything any more insecure than it was already. But any user, Linux or Windows, who is affected by this vulnerability (which is basically everyone who hasn’t revoked permissions to the Microsoft keys in question), if they’re using secure boot, no they’re not. (That is to say, they can no longer depend on any of the guarantees that secure boot provides until they close the vulnerability.)

A drug.

Whether it’s an important medicine for health and wellbeing or a hard recreational drug can depend greatly on the context.

If I’m understading what I’ve been able to glean about this just by googling, it looks like the vulnerability is in certain tools that Microsoft has decided to sign with some of its UEFI secure boot keys. It’s not a vulnerability in your UEFI firmware itself, except insofar as your UEFI firmware comes already configured to trust Microsoft’s certificates. So even though the vulnerability isn’t in your UEFI firmware per se, the fix will require revoking trust to keys that are almost definitely pre-installed in your UEFI firmware.

Yeah, ok, it works on my computer.

“Bots” wasn’t the first thing that came to mind when I considered what the Bitcoin Cash community might be full of, actually.

But, yes. I’d be not even a little surprised if it was full of bots too.

Does imgur actually work for anybody? I always get a blank gray screen on my phone. (If I’m not too lazy and I don’t forget, I might re-check this post on my typey-typey boomer computer later.)

Wait, is this an interview?

I’d be… uh… a t-rex… because, uh… I’m not afraid to… uh… take initiative?

Star Trek used to be better than Star Wars.

Main reason: weekly episodes. You had to wait years to decades for the next Star Wars. But the next Voyager was just next Wednesday, and DS9 was next Thursday. At worst, they were in reruns for the next few months at most.

Hell. Star Trek had Star Wars beat on quantity of movies too.

Now, it’s balanced out quite a bit and Star Wars probably has the edge right now on quantity and quality, but not by much, the gap is shrinking, and the situation could reverse pretty quickly.

Oh, also, Roddenberry didn’t have the George Lucas syndrome making him want to retroactively ruin the whole franchise he birthed.

I imagine sabots would do pretty well against graphics cards.

I… doubt it?

I took the liberty of looking in the developer tools as it failed, and there was a 500 response. The connection to Hulu’s servers was all over HTTPS and I didn’t get any certificate warning, so unless my ISP managed to get Hulu’s private key or got with a corrupt registrar willing to issue a valid replacement certificate, no ISP should be able to change response codes on a man-in-the-middle basis or a redirecting-traffic-to-a-hostile-server basis.

And given how many people have reported issues, I doubt it’s specific to any particular ISPs.

Net neutrality being dead is a huge bummer, but I don’t think this can be blamed on that.

What’s the minimum you’d count as strong enough evidence to justify anger at the accused?

frysuspicious.jpg

Yeah, I guess I can understand the cognitive dissonance making people want to deny everything, but it doesn’t seem like there’s much room to doubt the veracity of the case against Gaiman. Really, that article has been a long time coming. Anyone paying much attention to Amanda Palmer (Gaiman’s ex-wife) has had plenty of clues this was coming, even if the full extent of the sheer depravity of the details weren’t publicly known until now.

Also, I haven’t read the Vulture article yet, but from what I’ve heard, it makes it sound like Palmer was complicit. She has also withdrawn from public places/platforms (like from her Patreon) since its publication.