Hacker News Reader

Comment by CaptSpify | Hacker News Reader

Although you are correct, I don't feel it's bad to blame the vendor who was running code that they didn't know the source of, nor the reasoning behind it's existence.

View on HN

So, literally every vendor? Can you think of a single example of a vendor not running UEFI code from others, not running either Qualcomm's kernels for ARM chips, nor distributing Intel's ME firmaware, nor distributing AMD's TPM firmware?

I don't think there's a single OEM that knows what they're actually running – if there is, SAMSUNG would likely be it, because they have a chance at actually doing everything in-house.

Probably Apple, too - they prefer to implement things in-house wherever possible.

Apple now ships UEFI updates with every version of OS X.

Does Apple use UEFI now? Everything I've read suggests Apple forked at EFI 1.10 and never looked back.

They would have to in order to boot later versions of Windows using UEFI.

I thought that Chromebooks, at least, run coreboot rather than UEFI, and so should be immune from this.

I wonder what command and control systems that ship with Russian and Chinese military equipment use.

Correct. Just because everyone does it, doesn't mean it's OK to do. "If everyone jumped off of a bridge..."

https://xkcd.com/1170/

It's only been a few days since disclosure. No PC manufacturers these days knows every single line of code they get from their vendors - if they did, there wouldn't need to outsource it in the first place.

You are correct, but that still doesn't make it right.

Reply on news.ycombinator.com