Open Stack

On 01/07/21 18:33, Dr. David Alan Gilbert wrote:

> in some ways you're trading
> off host-guest security against guest security there.

This is a great way to put it IMO; the question is whether SB --
normally, a barrier between guest components -- buys the guest owner any
actual security in this use case. If the guest owner controls both the
guest firmware and the guest OS completely, there likely is no threat
that the guest OS might somehow undermine the guest firmware (e.g., get
hacked and install a permanent UEFI rootkit on the UEFI system
partition, or whatever).

TBH the *intersections* of these security technologies / threat models
are a bit mind-boggling, to me anyway.

Laszlo