<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 09/24/2013 07:59 PM, JD wrote:<br>
</div>
<blockquote cite="mid:5242277E.5090301@algoloma.com" type="cite">
<pre wrap="">I don't think of UEFI as a bad thing, it is just a new thing. GPT partitioning
is definitely a great thing and Windows requires UEFI to make use of it.</pre>
</blockquote>
<br>
It is definitely superior to BIOS—it gives the user a
fully-functional pre-boot environment. It's not exactly as easy as
Linux to write software for, but you can somewhat easily write
software with it once you have the appropriate SDK installed, and
that means that one can write very low-level, special-purpose
firmware drivers and diagnostic utilities to accompany them.<br>
<br>
One nifty thing is that it is possible for e.g., a business or
school to use Secure Boot plus free software to create an
environment which is essentially self-proving: any system where the
trust chain from the firmware to the operating system is broken will
not boot—the assumption being that if this invariant is violated,
the system must have been compromised. (Of course, this means that
a bug in an update that fails to update the appropriate signatures
will cause a broken system, but hopefully operating system vendors
test all of their updates before sending them out.)<br>
<br>
It would make it possible to deploy a large network of systems and
have a system that operates at the layer of firmware that helps to
extend already-existing network infrastructure (e.g., Kerberos)
right on down to the hardware layer. It also makes it possible to
enforce very fine-grained policies: "only the proved hardware with
these serial numbers are allowed to access this resource" is a
policy that becomes provably enforceable in such an environment.
This is not a bad thing.<br>
<br>
— Mike<br>
<br>
<div class="moz-signature">-- <br>
<table border="0">
<tbody>
<tr>
<td> <img src="cid:part1.03080804.03000809@naunetcorp.com"
alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <strong>Naunet Corporation</strong><br>
☎ (678) 287-0693 x130 or (855) NAUNET-1 x130<br>
FAX: (678) 783-7843<br>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>