This is a security failing that is hard to overlook for projects with far-flung participants. Any time data is downloaded it could be subjected to MITM attack.

Core git coders appear oblivious to the problem. Even so, how hard can it be to replace SHA1 with SHA256?

Have a nice day, mods! :)

Cases in point:

1. The ridiculous FAT long-filename patent
2. The subpixel rendering patent (despite prior art being shown)
3. Outright patent-troll behavior: Refusing to disclose a stack of patents its using to extort for-profit Linux distributors behind closed doors.

If MS comes out of the closet and enumerates #3 and opens a dialoge with the community about them, THEN I will believe their hype about being open-source friendly. Otherwise, they are in the business of growing their Android-derived revenue using submarine tactics.

Also, explain to us why MS shuts out FOSS AV and document formats (the consumer-oriented ones); Not only from their products but from standards-making processes.

And don't forget there are billions of Android devices that can understand Ext* disk formats.

So only MS gets to embrace and extend; Who would have guessed? Break a single rule in Microsoft's .NET standards and they can come at us with both barrels.

The irony here is MS are using licenses that are thought to be the most libre as a cover to keep the developer community fenced-in to their platform with patent threats. Re-purpose any of the patented code and.....

Also, I'd like to remind you that MS still enforces at least two very silly patents against FOSS distributors: The FAT filename-length patent and the subpixel-rendering patent (which has prior art). And IIRC there is a raft of patents they are using to threaten Linux distributors which they still won't reveal, so they are still in the business of wielding shadowy threats which I'm told is actually illegal.

MS needs to make good on their past and current patent trolling. If they don't then we have no reason to believe they are doing "open source" in good faith.

Its trivial to get Windows to recognize a Linux partition and refrain from telling people to format those volumes.

No kidding. MS still pursues violators of that silly long-filename patent. And they STILL demand a cut from Android distributors for other patents they refuse to disclose to the community!

And that makes them hostile to open software in my book. They insist on treating Linux-formatted disks as essentially blank and have Windows tell the user the volume must be formatted to be used; fixing this would be simple in the extreme and would not even require an ability to read an Ext* volume. They stonewall AV formats like Vorbis when they could be added easily to existing apps. Really, the list goes on. The place where they have capitulated is formats that are intrinsic to the web (while parading their proprietary stuff as "open" hoping enough people will take the bait).

MS still promotes lock-in. And from what I gather even their new .NET licensing terms are designed to leave you on the hook.

Vorbis made it into a lot of products that were not Apple or MS, from Sandisk to Samsung.

Daala is shaping up to be excellent as well, but its biggest competition may be VPx in the long run... Google announced they would start 18-month release cycles for major VPx codec revisions after 10. That creates a Chrome-like effect on the mindshare of early adopters, so it should be interesting. Of course, who is backing Daala? Mozilla... who may get dragged into release-cycle competition with Google on another product. :)

http://www.nojitter.com/post/2...

That stat about VP9 meeting 60% of Youtube delivery is interesting.

Honestly, I don't think anyone has raised the question with them. They have responded very well to the concerns of Qubes users, developers and other communities. Something tells me they would love to emulate the Apple of the 1970s and supply schematics.

I don't get this part. You're against closed design for motherboards but not for firmware?

The hypocrisy charge doesn't hold. Purism is a tiny startup and they are not going to be able to deliver the whole kit and kaboodle down to the last transistor to you immediately. In the meantime, we can have hardware whose documentation is thorough and therefore FOSS-friendly with no mystery drivers; We can have all open software and firmware on a powerful system if Intel is willing.

Also if an alternative to SecureBoot were offered by a small security firm or FOSS project, how would they get their boot code signed??

I think you mean its better for MS and vendor bank accounts, not ours.

There should be a permanent sh!tlist pinned to the top of Slashdot with any vendor that promotes this scheme for "PCs".

Microsoft's long-time disruptive technology shark in the water was that they promoted a platform that was just open enough to let techies (and 3rd party vendors) on a budget customize the systems however they need. This is the essence of a "personal computer", for the MS camp at least. Now MS has jumped their own shark.

Their tepid claims of being FOSS-friendly are being shown as ultimately false. Like Apple, they still won't incorporate open A/V formats into their products and their OSes will tell you an inserted Linux-formatted volume "must be formatted before use". Heaven forbid if I ever give an EXT3 formatted flash drive to an Android user, and they decide someday to look at it with Windows. They are similarly hostile when it comes to Linux multiboot setups. Its wilful negligence that still reigns in Redmond and must be fought with tooth and nail to gain any concession.

And how necessary for security are these firmware-level lockouts?? They are not! Qubes OS employs a scheme that, in combination with a TPM, prevents a computer from being able to reproduce a chosen passphrase if its been tampered-with. No doubt, the MS excuse will be that the consumer or administrator can't be bothered to remember a sentence to verify system integrity.

I suggest rallying around vendors like this: https://www.crowdsupply.com/pu...
Eventually, we should pressure the market to open up the whole damn stack; We will probably be forced to.

I'm not a developer, but I don't mind being called a fanboy for something like this.

And no, there's no reason why another OS couldn't use a TPM in the same way. Qubes seems to be the only one so far with this interesting feature.

Anti Evil Maid was designed initially for physical attacks, as the name implies. It does eliminate the 'Evil Maid' scenario if its assumed the attacker is unskilled and/or only has time to plug a USB or similar device into the computer. So it greatly reduces the opportunity for successful physical attacks.

For remote attacks against motherboard firmware, AEM ought to work 100% of the time. This is especially true if you have disabled booting from internal drives, in which case your HD firmware could become compromised and still not be able to obtain any unencrypted keys or data.

Qubes R3 will have an unprivileged storage domain which should protect you even if the HD firmware is *already* infected or indeterminate at install time.