Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack
UEFIs booting Windows and Linux devices can be hacked by malicious logo images.
You're viewing a single thread.
Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea? Or having them be accessible to the proper OS? Was there really no pushback, when UEFI was being standardized, to say "images that an OS can write to are not critical to initializing hardware functionality, don't include that"? Was that question not asked for every single piece of functionality in the standard?
Did anyone really think that making UEFI systems the equivalent of a mini OS was a good idea
UEFI and Secure Boot were pushed forcibly by MS. That's why FAT32 is the ESP filesystem.
If I had to guess, a brief was drafted at MS to improve on BIOS, which is pretty shit, it has to be said. It was probably engineering led and not an embrace, extinguish thing. A budget and dev team and a crack team of lawyers would have been whistled up and given a couple of years to deliver. The other usual suspects (Intel and co) would be strong armed in to take whatever was produced and off we trot. No doubt the best and brightest would have been employed but they only had a couple of years and they were only a few people.
UEFI and its flaws are testament to the sheer arrogance of a huge company that thinks it can put a man on the moon with a Clapham omnibus style budget and approach. Management identify a snag and say "fiat" (let it be). Well it was and is and it has a few problems.
The fundamental problem with UEFI is it was largely designed by one team. The wikipedia page: https://en.wikipedia.org/wiki/UEFI is hilarious in describing it as open. Yes it is open ... per se ... provided you decide that FAT32 (patent encumbered) is a suitable file system for the foundations of an open standard.
I love open, me.
UEFI is flawed for sure, but there's no way that any remaining patents on FAT32 haven't expired by now.
You may be surprised to learn that they didn't all run out until 2013. UEFI had been around for 7 years by this time, and Microsoft was doing patent enforcement actions against Tom Tom during this time period.
Sure, they're expired now, but not at the time. It was supposed to be an open standard at the time.
Why software patents are a leech on software development: exhibit number 4,294,967,295.
Less is more. I feel we've forgotten that so worthless designers can justify their useless existences.
Yeah, the designers were lobbying to force showing hardware ads during boot...
Less is more.
Listen to your own maxim.
It breaks the cardinal rule of executing privileged code: Only code that absolutely needs to be privilaged should be privileged.
If they really wanted to have their logo in the boot screen, why can't they just provide the image to the OS and request through some API that they display it? The UEFI and OS do a ton of back and fourth communication at boot so why can't this be apart of that? (It's not because then the OS and by extension the user can much more easily refuse to display what is essentially an ad for the hardware vendor right? They'd never put "features" in privileged code just to stop the user from doing anything about it... right?)
Yes.