'(·) on Twitter: "@stribika an attacker with write access can still edit my grub, but it requires more knowledge and has a smaller attack surface" / Twitter

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Replying to

check out GRUB_ENABLE_CRYPTODISK; in short, you can encrypt everything but grub and it's more practical than /boot-on-stick

1

Replying to

and

an attacker with write access can still edit my grub, but it requires more knowledge and has a smaller attack surface

Replying to

and

I've had trouble with boot sticks in the past because I forgot to put them in during initramfs updates, too many moving parts

1

Replying to

and

but with only grub on the stick, it only breaks if I don't take care during incompatible grub updates, of which there are few

1

Show replies

Conversation