<story><title>Lenovo shipping new laptops that only boot Windows by default</title><url>https://mjg59.dreamwidth.org/59931.html</url></story><parent_chain><item><author>Jenk</author><text>Because now a random fob jammed into your laptop won&amp;#x27;t be loaded on boot without the explicit choice to load it.&lt;p&gt;This is defense-in-depth level stuff.</text></item><item><author>mjg59</author><text>How are ordinary everyday users protected by this?</text></item><item><author>Stratoscope</author><text>So they are protecting your ordinary everyday users, while still giving any of us who need to boot from a USB stick or another partition the ability to do that with a simple BIOS setting.&lt;p&gt;It doesn&amp;#x27;t seem much different from the F12 menu that lets you select an alternate boot device.&lt;p&gt;How exactly does this mean they &amp;quot;prevent booting alternative operating systems&amp;quot;?</text></item><item><author>mjg59</author><text>There is such a firmware setting, hence &amp;quot;by default&amp;quot;. That doesn&amp;#x27;t make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don&amp;#x27;t compromise the security model.</text></item><item><author>Stratoscope</author><text>&amp;gt; &amp;quot;by default&amp;quot;&lt;p&gt;Hit Enter or F1 at the red Lenovo boot screen, go into the BIOS settings and find the setting and change it.&lt;p&gt;Until someone confirms that there is no such BIOS setting, there is no story here.</text></item></parent_chain><comment><author>mjg59</author><text>If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you&amp;#x27;re going to posit an attack scenario then please describe the entire sequence of events and where the attack would be prevented by this configuration.</text></comment>
<story><title>Lenovo shipping new laptops that only boot Windows by default</title><url>https://mjg59.dreamwidth.org/59931.html</url></story><parent_chain><item><author>Jenk</author><text>Because now a random fob jammed into your laptop won&amp;#x27;t be loaded on boot without the explicit choice to load it.&lt;p&gt;This is defense-in-depth level stuff.</text></item><item><author>mjg59</author><text>How are ordinary everyday users protected by this?</text></item><item><author>Stratoscope</author><text>So they are protecting your ordinary everyday users, while still giving any of us who need to boot from a USB stick or another partition the ability to do that with a simple BIOS setting.&lt;p&gt;It doesn&amp;#x27;t seem much different from the F12 menu that lets you select an alternate boot device.&lt;p&gt;How exactly does this mean they &amp;quot;prevent booting alternative operating systems&amp;quot;?</text></item><item><author>mjg59</author><text>There is such a firmware setting, hence &amp;quot;by default&amp;quot;. That doesn&amp;#x27;t make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don&amp;#x27;t compromise the security model.</text></item><item><author>Stratoscope</author><text>&amp;gt; &amp;quot;by default&amp;quot;&lt;p&gt;Hit Enter or F1 at the red Lenovo boot screen, go into the BIOS settings and find the setting and change it.&lt;p&gt;Until someone confirms that there is no such BIOS setting, there is no story here.</text></item></parent_chain><comment><author>Cthulhu_</author><text>&amp;gt; This is defense-in-depth level stuff.&lt;p&gt;Wouldn&amp;#x27;t even call it &amp;quot;in depth&amp;quot;, disallowing an alternative boot should be one of the first things any decent IT staff should do on any company machines, and therefore so should direct-to-consumer pre-installed tech like this.&lt;p&gt;99% of computer users are just consumers, nobody should have to think about security when they first get a new system beyond setting a password.</text></comment>