It's just a silly experiment; the real endgame is to make a bootloader that is customisable using HTML/CSS/JS
replySince PDFs can contain JS, presumably that should be the preferred way of modifying your boot loader.
replyYeah that's the natural next step, I'll work on that next
replyWhy not?
replyBecause this can end very badly. It is a new surface to attack
replyExactly! It's actually great! More ways to jailbreak stuff.
replyWhy is it a new surface? Either you can run UEFI code, or you can't. Attacking the JS interpreter itself is unrealistic IMHO, it's the poorly written JavaScript running on top of this that might open new surfaces of attack. But other UEFI code is mostly written in C or C++, so let's call that a wash?
replyMaybe? What's your threat model?
reply