I really dislike this headline. A vulnerability was found, responsibly disclosed, and the vendor was responsive and is planning/pushing a fix. The headline drowns a successful mitigation in flowery language of controversy. The article also shows how this can happen on other vendor devices, but the headline here looks like just Framework messed up, when they're the only vulnerable vendor with a fix in the pipeline (based on the info in the article). I really hate headline-bait journalism.

I have still yet to see a good argument for why anyone needs secure boot, I went to a talk about it at a conference this summer and if anything it made me like it less

Joke's on them, I have Secure Boot OFF so I can use hibernate! 😂

This is heavily sensationalized. UEFI "secure boot" has never been "secure" if you (the end user) trust vendor or Microsoft signatures. Alongside that, this ""backdoor"" (diagnostic/troubleshooting tool) requires physical access, at which point there are plenty of other things you can do with the same result.

Yes, the impact is theoretically high, but it's the same for all the other vulnerable EFI applications MS and vendors sign willy-nilly. In order to get a properly locked-down secure boot, you need to trust only yourself.

When you trust Microsoft's secure boot keys, all it takes is one signed EFI application with an exploit to make your machine vulnerable to this type of attack.

Another important part is persistence, especially for UEFI malware. The only reason it's so easy is because Windows built-in "factory reset" is so terrible. Fresh installing from a USB drive can easily avoid that.

Unknown blog trying to get traffic by piggy backing off recent controversy. Nothing beats the classics..

Wait until you hear about the proprietary microcode backdoors in Intel and AMD processors.

At least Framework disclosed this issue and are pushing out fixes.

So physical access is indeed root access? I for one am shocked.

Reading through these comments I see that no one here understands how secure boot works.

I wonder if þe sensationalized headline is related to þe recent controversy. A little FUD¹ to hurt sales?

P.s. "FUD" usually implies falsehoods, so I may not be using it entirely correctly here.