Forgot your password?
typodupeerror
Red Hat Software Ubuntu Linux

Red Hat Clarifies Doubts Over UEFI Secure Boot Solution 437

Posted by Unknown Lamer
from the there-goes-freedom-one dept.
sfcrazy writes "Red Hat's Tim Burke has clarified Fedora/Red Hat's solution to Microsoft's secure boot implementation. He said, 'Some conspiracy theorists bristle at the thought of Red Hat and other Linux distributions using a Microsoft initiated key registration scheme. Suffice it to say that Red Hat would not have endorsed this model if we were not comfortable that it is a good-faith initiative.'" Color me unimpressed, and certainly concerned: "A healthy dynamic of the Linux open source development model is the ability to roll-your-own. For example, users take Fedora and rebuild custom variants to meet personal interest or experiment in new innovations. Such creative individuals can also participate by simply enrolling in the $99 one time fee to license UEFI. For users performing local customization, they will have the ability to self-register their own trusted keys on their own systems at no cost." From what I can tell, the worst fears of the trusted computing initiative are coming true despite any justifications from Red Hat here. Note that the ability to install your owns keys is certainly not a guaranteed right.
This discussion has been archived. No new comments can be posted.

Red Hat Clarifies Doubts Over UEFI Secure Boot Solution

Comments Filter:
  • by TheRaven64 (641858) on Wednesday June 06, 2012 @09:02AM (#40231129) Journal
    If anyone can pay $99 to get a key that lets them install malware in anyone's firmware, then there is obviously no security in the system. I'd have thought this would be excellent grounds for an antitrust investigation...
    • by gbjbaanb (229885)

      that's true, except the scammer would have to first appear legit, I wonder if the russian mafia has any fronts that can do that???

      What would be useful is if RH got themselves a key, based on the Microsoft one (and therefore effectively un-cancellable) and then allowed downstream distros (including self-rolled ones) to use it too (yes, you know where I'm going with this).

      As there's about as much security in the system as windows update, they might as well do this if they can't scrap the idea completely.

      • by drinkypoo (153816)

        I wonder if the russian mafia has any fronts that can do that???

        I don't know about that, but any government can issue a passport and fake credentials to a person, and make sure they get on the priority visa list.

      • the scammer would have to first appear legit

        Microsoft: What do you think gives you the right to install your own bootloader, Mr. Mafia Guy? Scammer: I am deploying my own Linux Distro! Microsoft: $99 please!

      • RH considered this but decided that they don't want to take on the job of vetting all those downstream distros that want to use their key.

    • by itsthebin (725864) on Wednesday June 06, 2012 @09:20AM (#40231327) Homepage
      notwithstanding that we have just had news of a major security breach that used Microsoft security certificates
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      If anyone can pay $99 to get a key that lets them install malware in anyone's firmware, then there is obviously no security in the system

      Not really. If you get a signing key, you will be registered, and any malware can be tracked back to you. So "anyone" cannot do this. Only large corporations, with no liability, and lots of money, will be able to install malware from now on. YEAH!

      • by vlm (69642) on Wednesday June 06, 2012 @09:36AM (#40231483)

        So "anyone" cannot do this. Only large corporations, with no liability, and lots of money, will be able to install malware from now on

        Luckily large corporations never have data breeches, so its not like you'll be able to go to wikileaks or pirate bay to get a copy of the MS secret key, or the Dell key, etc.

        That large integer will of course be made illegal, so only private citizens will have unsecured systems. The hard core crooks and the slightly-bent will of course have free reign over everyones system.

        I'm sure they'll be another moronic legal battle where some 256 bit or 2048 bit or whatever integer is declared persona non-grata on the internet, stupid restraining orders, blah blah blah, all over again.

        Who wants to buy a tee shirt with Microsofts UEFI secret key on it? I give it a couple months till someone releases it, maybe even before the hardware hits the shelves, and a couple hours later I'll fetch it from pirate bay or whatever, and a couple hours later I'll put up a shirt design. Just to be a complete A-hole I'll also make shirts that have equations, too, so it'll be something like 32523136136 minus 1.

        I'll go further with my prediction. Malware will be found signed with a legit "major corporate" key BEFORE legit hardware/software using "major corporate" key hits the shelves, in at least one instance. In other words your new Dell, for example, will be ownable before you can even buy it.

        • by vlm (69642) on Wednesday June 06, 2012 @09:40AM (#40231535)

          Oh genius hits milliseconds after I hit the Fing submit button... A tee shirt with a QR code of the official microsoft secret signing key with iconic 1984 or maybe animal farm styling.

          Coming soon, from VLM enterprises...

        • by Anpheus (908711) on Wednesday June 06, 2012 @09:48AM (#40231615)

          You're confusing the keys that have previously been publicly available and the private keys here. Unlike the previous keys, this isn't part of a DRM scheme where the user has to be able to decrypt content and simultaneously "not have" the key to do so. DRM is fundamentally flawed in that regard, and DRM schemes are routinely broken because they cannot both obscure the content and show it to you at the same time. At some point, your computer has to possess the ability to unlock the next frame, and smart people figured out how to copy that. Ta-da, AACS key, or HDCP master key. Those weren't failures of public key cryptography, they were leaked because the universe is at odds with DRM.

          What private keys of note have been hacked? Recently, a weak Microsoft intermediate certificate key was exploited to use to generate code signing certs, but that was a weak key with a poor algorithm (MD5 hashed thumbprint). Or Sony's private key for the PS3? Well, they implemented their crypto wrong, one of the supposed-to-be-random parameters was instead hardcoded as a constant. Oops.

          Dell, Microsoft, the big players, they all work very hard to make sure their private keys are secure. Would you care to take a wager on whether or not the Microsoft root key will be released within the next year? (By root I mean whatever key is the common root used to sign a plurality of UEFI signed bootloaders, if they use many intermediate CAs, it would have to be whatever key is for all of those CAs. If they use one intermediary that signs a majority of the bootloaders, then it must be that one - does not have to be _the_ Microsoft key.)

          • There are attacks other than mathematical or algorithmic. What do you want to bet that Microsoft's key management infrastructure is lacking, and is accessible to temps and students who only stay there for 6 months. Somebody is going to sneak away the key on an USB stick, and release it into the wild after they have long left Microsoft. And on which one of the thousands of students who passed by during that time will they pin the blame?
            • by vlm (69642) on Wednesday June 06, 2012 @11:05AM (#40232587)

              There are attacks other than mathematical or algorithmic.

              Financial? somebody@something.ru offers $100K to someone at microsoft.com who is being outsourced to India to ... plus or minus an order, or two, of magnitude.

              Religious/political? Somebody of a certain religious persuasion is contacted by a guy on line who convinces him that the only way to save *.il from a second holocaust is to provide the secret signing key to enable the stealthy deployment of stuxnet 2.0 to really shut down the iranian nuke program this time. Of course the guy doing the convincing is secretly J Random Malware Author, whoops. Or maybe he really is from *.il and he really is preventing a nuclear holocaust using the key, but his kid / coworker / ex wife / competitor / guy trying to set him up to take the fall / something else releases the key to the public. Or he just loses the thumbdrive with the key. Or the story for plausible deniability, is he loses the thumbdrive containing the key and another dude just happened to find it, although in reality it was all scripted out.

              You trust *.microsoft.com to keep it safe, well that's a little optimistic of you, but whatever. The problem is the random collection of "friends of microsoft" in the govt and govt contractors trying to write undetectable cyberwarfare software. So now you have to trust all of *.mil and quite a bit of *.com not to screw up.

              • by vlm (69642)

                Oh how about this political attack - I predict the key used for all Chinese military cyberwarfare will be the Lenovo key.

                Another "fun" thing to think about - what happens during bankruptcy, purchasing, downsizing, etc? Who owns Gateway now, or rephrased, who owns Gateway's key? If you want a legit key, the best way might be to legit buy it.

      • by betterunixthanunix (980855) on Wednesday June 06, 2012 @09:51AM (#40231653)

        If you get a signing key, you will be registered, and any malware can be tracked back to you. So "anyone" cannot do this.

        So all it really takes is a stolen credit card?

      • Yes, because it's completely impossible to fake up your registration details.

    • by Hatta (162192) on Wednesday June 06, 2012 @09:34AM (#40231469) Journal

      Microsoft learned after their last antitrust investigation, and increased their political contributions by an order of magnitude [opensecrets.org], without changing their business practices at all. Now that Microsoft has paid the appropriate protection money, they can do whatever they want.

    • Not to mention that you have one of two choices if a key is breached:

      1) The hardware is forever "untrusted" or

      2) You have to put in a way to *easily* (i.e. not some BIOS procedure magical to the user) fix breached keys, in which you necessarily create a way for malware writers to install their own key.

      BRILLIANT. Well thought out, M.S... as always.

    • by Rogerborg (306625)

      If anyone can pay $99 to get a key that lets them install malware in anyone's firmware, then there is obviously no security in the system

      Oh, tish, where would organised criminals come up with that amount of money?

  • User key management (Score:5, Interesting)

    by Junta (36770) on Wednesday June 06, 2012 @09:03AM (#40231149)

    self-register their own trusted keys on their own systems at no cost.

    How? Most reasonable mechanisms that could be envisioned would likely be considered an 'attack vector' in certain scenarios. I'm genuinely curious as to the mechanisms allowed for end-user key management in this sort of system.

    • by robmv (855035)

      Using to the UEFI settings in your firmware. there is no automated way to do it, the 'attack vector' possibility is the reason. Red Hat will use this method of signing the bootloader using Microsoft signing services to help the common user to install a Linux distribution without messing with scary UEFI screens. The real problem now is: Will hardware vendors always provide a screen to add/change the keys?. Unless it is enforced by Microsoft Windows OEM licensing rules (not know about this) or government regu

      • See my other post...

        If the signing key is breached (not out of the question with MS's track record recently) then the hardware is permanently untrusted.

        So you have to make the hardware trusted again.

        Sounds like a boon to Dell and to computer shops to me, unless you create a simple way for a user to fix the problem, at which point your purpose was defeated.

    • You, as the user, can generate a key. You can then reboot the computer, hit 'f2' or whatever to get into the bios, specifrically enable 'allow self-signed keys', and type in a given key, after acknowledging all the various warnings.

      Much like self-signed ssl certs for personal webpages.

      Anybody who gets an email that says 'screenshot of sexy babes! To view, reboot computer, enter bios, and do the following things,' and does, deserves to get whatever is coming to them at that point.

      • Not allowing a user an easy path to fix a machine based on a breached key = hardware manufacturers wet dream. Now you have to buy new hardware after a hack!

    • by WebCowboy (196209) on Wednesday June 06, 2012 @11:47AM (#40233309)

      How? Most reasonable mechanisms that could be envisioned would likely be considered an 'attack vector' in certain scenarios. I'm genuinely curious as to the mechanisms allowed for end-user key management in this sort of system.

      Secure boot specification describes three "modes" of operation:

      1) standard: Accept software signed only by keys included in the factory BIOS (ie. Microsoft-issued keys)
      2) custom: Accept software as in 1) but also allow keys signed by another authority/the user. This allows the user to flash in their own key and spin their own Linux/BSD/alternative OS and sign it so it will work with secure boot. NOTE you would also need custom mode in Windows 8 if you are employing custom or in-house drivers or other software that talks too closely to hardware.
      3) setup(?): Seems to be a special mode--I think it is a one time setting that changes back after reboot? The setup mode is so that your software installer--an alternative OS or a driver in Windows or otherwise, would be able to push its key into te system's firmware during the install process so you don't have to do that step in the UEFI setup manually. Once a key is installed from a software setup process the system would revert to custom modefor subsequent boots.

      Besides that UEFI secure boot can be disabled entirely so you can run unsigned system software and none of the above would matter.

      The deal with Red Hat and the Devil (um, the evil Microsoft one not the cute FreeBSD one) commits Microsoft to distributing keys signed by them to anyone who ponies up $99 and fills out the requisite forms. In return you get a key to sign your own OS or other privliged software (drivers/kernel modules...) issued through a Microsoft CA that will work in mode 1) above. That is, you can create a distro or driver setup disk that will work with a "factory default" UEFI setting.

      I personally have no problems with this scheme except for two critical points:

      1) Microsoft alone is the caretaker (cert. authority) for ALL standard keys. This constitutes a monopoly. Monopolies are not illegal but using them to supress potential competitors IS illegal, and this arrangement sets up Microsoft with the ability to get into amti-competitive shenanigans (again). The $99 fee is not a problem--there is no expiry on your key and you can sign all your stuff with it--I may get one for my own business should I run into issues with custom mode or disabled secure boot. A BIG problem is that nothing commits them to being honest with the CAs. There isn't going to be just one root cert form Microsoft, and nothing stops them from using a "special" certificate class for the $99 certs. That would let them revoke all of them "killswitch" style for whatever reason (the root gets compormised, or they just don't like what they keys are being used for), so anyone who does a bios update or gets a new machine would be SOL if MSFT doesn't re-issue you a new key and won't take another $99 from you.

      2) Microsoft is not being platform agnostic. There is ARM and "everything else". MSFT has decreed that ONLY standard mode is permitted on ARM devices that have Windows installed--NO custom or setup modes and NO disabling of secure boot. Furthermore I am not sure if the $99 keys will work to build software for ARM devices (anyone know that one? MSFT could issue certs that only work on x86 architecture if they wanted to). You cannot get a shiny "built for Windows 8" sticker (who cares really) and it is against the license agreement to even install on "insecure" ARM hardware (THAT is something to care about). MSFT is (currently) an inconsequential player in mobile/ARM space so there isn't a big risk yet. However, they could leverage their desktop monopoly to push Windows 8 slates and smartphones in the enterprise and even elsewhere (smart glass in the home for example) and if they are successful it would entice vendors to lock out custom OSes.

      Regulatory authorities are going to have to keep a close watch on how MSFT conducts itself as s

      • by vux984 (928602)

        Problem 2) should be addresses ASAP.

        "Problem 2" is what you ALREADY have when you buy an iThing.

        Why should Microsoft be scrutinized harder than Apple in the ARM space? Why does Apple get a free pass, but "ARM must not tolerate being treated like this" by microsoft?

        Don't get me wrong, I agree with you... but I think all computing devices should be rootable by their owners, and I think that right should be protected by law, and the mechanisms to so should be included in systems... whether its a Win8 or iOS de

  • by Wowsers (1151731) on Wednesday June 06, 2012 @09:05AM (#40231169) Journal
    Red Hat has faith in Microsoft. More fool them!
    • Watch Ubuntu & Debian continue to rise as Red Hat turns into corporate asshats, becoming the thing we were all trying to avoid.

  • by FudRucker (866063) on Wednesday June 06, 2012 @09:07AM (#40231181)
    rips Microsoft a "new one" in a class action and/or anti-trust suit

    and Fedora/Redhat are feeble minded idiots for paying Microsoft,
    • Re: (Score:3, Informative)

      by cryptizard (2629853)
      It has been stated many times, the fee is not going to Microsoft but Verisign. Essentially Red Hat is gaining the ability to run their own root of trust by having a signed "stage 0" bootloader that will in turn load any image signed by Red Hat's private key. This micro-bootloader will most likely just chain load a special version of grub that will verify the kernel is signed by a correct key (at this point, any key that Red Hat wants). I really don't see the problem with any of this. As they said in th
      • Re: (Score:3, Informative)

        by Anonymous Coward

        The problem is no one wants that kind of responsibility. The only downside to this whole mess is that not all motherboards will offer you the ability to install your own root certificates, which could impact the ability to homebrew a Linux distro, but in the end people that care about that kind of thing will only but motherboards that have that ability.

        The point of open-source is to be able to run any code you want, not just those signed by large corporations. Users, previously not belonging to your elite category, who bought a motherboard without checking, and who now realise the benefits of a custom kernel, will find that they have no option but to buy a new machine.

      • And since the proportion of people who "care about that kind of thing," even among the build-your-own computer folks, is so small, the ability to install your own root certificate will be an extra "feature" that you have to pay out the nose for. A lot of future fifteen year-olds just lost their exposure to Linux because they didn't want to pay an extra forty bucks for an equivalent motherboard with an additional feature they may or not use.

        The fact of the matter is that if you lock down a product to take
      • This micro-bootloader will most likely just chain load...

        This is the problem I see. Using words like "most likely" and then saying "I really don't see the problem with any of this" is a problem. You've constructed an ideal situation that you think will work correctly. "Most likely" this will not be the case and as such will cause issues with attempting to install any OS that is not Windows 8. Another big problem is by the time we know ALL the facts about how the UEFI and its implementation It will be too late to do anything about it and we'll be forever stuck pay

  • for the other side of the house....

    They advocated for a dual-boot system which would allow Windows for Pen Computing to co-exist along w/ Go Corporation's PenPoint OS --- then pulled the plug after the first systems were announced.

    Jerry Kaplan's _StartUp_ should be required reading for anyone considering doing business w/ Microsoft.

    It's ludicrous that one could purchase a system and then not be allowed to install arbitrary software on it --- why can't there be a mechanism for instantiating a particular key

    • They can get away with it because many normal users can't differentiate between an appliance and a general use machine. You can always bank on the ignorance of the masses.

    • by idontgno (624372) on Wednesday June 06, 2012 @11:27AM (#40232941) Journal

      It's ludicrous that one could purchase a system and then not be allowed to install arbitrary software on it

      Indeed, and yet startlingly popular (iDevices, Tivo, consoles, etc.).

      The idea of a general-purpose computer in the hands of the masses is dying. It's being killed by the mediocre middle (consumer use focusing on such simple-minded appliance-level functions as social media and entertainment consumption).

      The computer and the Internet were once Freedom Machines. Looks like that'll be gone within my lifetime.

    • But you need to boot into the bios to do it, and RedHat doesn't want to make everyone do that just to boot Linux.

      Then of course there's the conspiracy theory that says that just because UEFI supports it doesn't mean that all the vendors will actually give users the ability.

      • Then of course there's the conspiracy theory that says that just because UEFI supports it doesn't mean that all the vendors will actually give users the ability.

        Microsoft's requirements for hardware certification ("Designed for Windows 8") mandate that users have that ability on any certified x86 device.

  • by Anon-Admin (443764) on Wednesday June 06, 2012 @09:15AM (#40231275) Journal

    It will be released but not all the hardware vendors will sign on. Loads of tech people, like the ones here, will not buy it. It will flounder for a few years then eventually die off and go the way of microchannel.

    Ill toss this one up there with Divix-DVD's and there pay per view, Sony memory standards, Micro-channel, and many other crappy ideas.

    • by DarwinSurvivor (1752106) on Wednesday June 06, 2012 @09:22AM (#40231343)
      Except there's a new twist this time. Microsoft is REQUIRING secure-boot if OEM's want to put the "ceritified for windows" sticker on the machine. Believe it or not, that sticker is worth a LOT to OEM's.
      • And will secure boot not have an "off" switch? I would assume it will. Just like how I never install the drivers for the "TPM" when I rebuild an image.

        Sure, Windows will refuse to boot if secure boot is turned off, but isn't that a feature, anyway?
      • by DigiShaman (671371) on Wednesday June 06, 2012 @09:32AM (#40231449) Homepage

        And without OEMS, effectively you have no PC industry. Fact is, members of Slashdot including myself are the minority here. We are not going to change the way OEMs do business with Microsoft. Period. End of story.

      • by vlm (69642)

        Believe it or not, that sticker is worth a LOT to OEM's

        Count me as "not". The DVD and music cd standards groups thought round shiny optical media was worthless to consumers without their stamp of approval logo, the first thing all consumers do before buying shiny disks is look for the official CD/DVD logo. However, it turns out in the real world that no one cares about a stamp of approval, as long as it works.

    • by gbjbaanb (229885)

      plenty of hardware vendors will sign on - Microsoft will only let them pre-install Windows if they have it, and so Dell, HP, Asus, etc will all have this crap setup and rocking from day 1.

      • and most tech people build there own systems buying off the shelf parts. We also recommend systems to family and friends, and unlike most of the places I have worked, family and friends listen to me.

        So, Will Dell, HP, and other BIG BOX providers take it.... Sure, they also had micro-channel. That does not mean it will take off or last. It will probably last longer on the server side. However, that is where this scheme will face it's biggest challenges as the list of server OS providers is much larger than t

        • Actually is sounds like an opportunity for the small builder once again. And Linux in a much more subtle way.

    • It will be released but not all the hardware vendors will sign on

      Why would a hardware vendor turn down an opportunity to:

      1. Create the sort of DRM'ed "media center" computer that the MPAA drools over?
      2. Rake in cash from an app store?
      3. Slash their tech support department by controlling the software people are allowed to install?

      That is where this is going. We are just seeing the first step of a major attack on user freedom here.

  • GPL v3 (Score:4, Interesting)

    by M. Baranczak (726671) on Wednesday June 06, 2012 @09:17AM (#40231287)

    Doesn't this violate the "anti-Tivo" clause of GPL v3? Sure, the kernel is still on v2, but the system can't run without all the v3 stuff.

    This will not stand, man.

    • by jonwil (467024)

      Under secure boot, user-space code that talks to hardware will be banned (otherwise it could open a hole in the secure boot logic) and all kernel-mode code is GPLv2 anyway. None of the normal user-space code needs to be signed (so the clauses in GPLv3 dont matter)

    • Doesn't this violate the "anti-Tivo" clause of GPL v3?

      Not if you distribute the OS on separate signed media that the user has to install. And not (regardless whether or not the preceding condition applies) if the device is not a consumer device.

  • Red Hat needs to research and make sure they are compatible with new and changing tech and UEFI is clearly one they need to make sure RH software works with. There are valid application for signed systems like this (think stuff like ATM) so making sure Linux works and even signed and validated to boot isn't a bad idea. But as we already suspect the general desktop environment isn't a good place UEFI should be used which is what people are afraid is going to happen.

    I haven't delved deep into the details of

  • by Monkey-Man2000 (603495) on Wednesday June 06, 2012 @09:18AM (#40231305)

    For users performing local customization, they will have the ability to self-register their own trusted keys on their own systems at no cost.

    If this is possible, can't any random distribution just ask the user to self-register their own keys for their hardware at installation time? I guess it depends on when the self-registration occurs and how it's done, which is not clear to me.

    • by Lehk228 (705449)
      People are getting their knickers all twisted because 'The Man' might one day prevent self registered keys. I guess MS might do this in the future if they really wanted to have another round of antitrust proceedings. In the meantime UEFI will let you verify your boot image against rootkits and other such badness (would be nice if you could force deregister all other keys too, not sure if it can)
      • by vlm (69642)

        In the meantime UEFI will let you verify your boot image against rootkits and other such badness

        False sense of security, unless you think keys and serial numbers have never, ever, been distributed over the internet or stolen by crooks, or for some odd reason that popular activity would suddenly stop.

        UEFI will be easier to own because of the users false sense of security. "I bought me a UEFI secured system, therefore I'm unrootable so I've got nothing to worry about" "(Click on some website)" "(owned)"

        Reminds me of the discussions about "windows serial number activation key" things around/over a dec

      • Re: (Score:2, Informative)

        by Anonymous Coward

        People are getting their knickers all twisted because 'The Man' might one day prevent self registered keys. I guess MS might do this in the future if they really wanted to have another round of antitrust proceedings.

        For ARM-based systems, 'The Man' has already prevented self-registered keys for any Windows 8 certified machine. See the last link in the summary from Matthew Garrett (a Red Hat engineer).

  • Just say 'No' (Score:3, Insightful)

    by Anonymous Coward on Wednesday June 06, 2012 @09:19AM (#40231315)
    I won't buy any PC or motherboard with UEFI unless it can be disabled - and I will actively search for machines that refuse to implement UEFI at all. Frankly, this is a quisling move by RedHat. Microsoft bullied the PC manufacturers into this anti-freedom technology. Now RedHat is directly supporting Microsoft by paying into their protection racket. Before you know it, every computer will require a 'legitimate' - government/oligopoly authorized operating system. Just say 'No' to RedHat because they are giving money to a system that is sliding down that slippery slope toward removing your freedom to use your devices as you wish.
    • A lot of web severs run Linux.

    • Re:Just say 'No' (Score:5, Interesting)

      by gregthebunny (1502041) on Wednesday June 06, 2012 @09:36AM (#40231489) Journal
      Agreed! This is an opportunity for us to protest with our wallets. Not only will I be actively pursuing non-UEFI motherboards, but I will also be actively campaigning my colleagues, coworkers, friends, and family to not buy non-UEFI machines as well. Microsoft is trying to fix a system that isn't broken. They shouldn't have to rely on securities at the hardware and BIOS level to lock down their new operating systems. They should just, you know, build a more secure operating system...
      • Re:Just say 'No' (Score:5, Insightful)

        by a90Tj2P7 (1533853) on Wednesday June 06, 2012 @09:59AM (#40231743)
        Secure boot, which is what you're concerned about, is just a feature in UEFI. Which has been the BIOS replacement for years. It's not new, it's not an MS creation, and it's not limited to secure boot. Saying you won't buy any PC or mobo that has UEFI because of secure boot is like saying you won't buy any with BIOS if it doesn't have overclocking settings.
    • Re:Just say 'No' (Score:5, Insightful)

      by a90Tj2P7 (1533853) on Wednesday June 06, 2012 @09:53AM (#40231675)
      Replace "UEFI" with "BIOS" in your first sentence and see how it sounds. Because that's what it is. It's not some MS feature or add-on, not some kind of evil conspiracy, it's the new BIOS. And it's not that "new". And part of the Windows 8 certification requirements for x86_64 systems is that the secure boot feature, which also isn't an MS invention, can be disabled. So that address your concern about buying PCs and motherboards that won't let you disable the feature you actually have a problem about.
    • by AHuxley (892839)
      Welcome to the world of core boot, its going to be a very short list :)
      Oh see my brother's Digital Certificate company is overworked Colonel, and when he gets overworked he forgets things. Like say, he don't feel the distro's paying fair by him, he may start sending uncertified certificates in your name.
      Well suppose some of your encryption was to get broken and sites started getting replaced, er, hackers started breaking in during general uptime, like.
      We can guarantee you that not a single cpu will get l
  • "Good Faith" (Score:4, Insightful)

    by clonehappy (655530) on Wednesday June 06, 2012 @09:20AM (#40231323)
    I'm not going to invoke Godwin, but *lots* of things start out as being "good-faith initiatives". I know UEFI has tons of advantages over a standard BIOS, and I'm a flat-earther for wanting to stick with the old tried and true methods, but anything that takes away control over hardware I own, especially anything that takes control and gives it to a multinational corporation, I'm passing right over.

    And I assume plenty of other tech-minded people will do the same, and the system will fade off into the sunset.
  • by mjg59 (864833) on Wednesday June 06, 2012 @09:22AM (#40231341) Homepage

    As the author of the linked article, things have somewhat changed since then - the language in the hwcert docs makes it clear that the hardware can be configured into a state where keys can be added. Is it a guarantee? No, but it's as close as is possible to get in the technology world.

  • I wonder if there is an analogy to DVDs and CDs... If you want to use the Genuine DVD logo on your shiny disk you have to follow eighty bazillion rules, at least some of which suck, and at least some of which are great ideas but people who suck don't want to do the right thing.

    The logo people thought no one would ever buy round shiny disks without their holy logo of obligation inscribed upon it. Why the nerve of those barbarians to even suggest such a gauche idea as selling a shiny disk without our word of

  • by Mojo66 (1131579) on Wednesday June 06, 2012 @09:38AM (#40231507)

    ..that almost every PC comes with Windows pre-installed in conjuction with Microsoft abusing this monopoly despite all the anti-trust affairs.

    I know the M$ fanboys will point at Apple and their iOS devices, but the big difference is that Apple does not force other smartphone manufacturers to put iOS on their hardware, whereas PC manufacturers have to pay for not putting Windows on their PCs.

    Given those circumstances, the fact that I'd have to pay $99 in order to install my own private Linux distro on my own private PC is just crazy.

  • FUCKING stupid (Score:5, Insightful)

    by inode_buddha (576844) on Wednesday June 06, 2012 @09:40AM (#40231533) Journal

    "Suffice it to say that Red Hat would not have endorsed this model if we were not comfortable that it is a good-faith initiative."

    Fucking STUPID. Since when in their entire history has Microsoft ever done anything in "good faith"?? Morons! *ALL * you need to do is read a few court cases...

  • "your owns keys is certainly not a guaranteed"

    If I can't use a custom kernel and I can't load custom drivers, than there's no way anyone could convince me this UEFI/SB and the related signing misery is the way to go. I couldn't care less that some distros can sign their kernels and drivers and you can use those, because that essentially would imply a lock-in to a specific company's version - thanks but no thanks. Of course I can imagine how some companies would like it that way.
  • "From what I can tell, the worst fears of the trusted computing initiative are coming true despite any justifications from Red Hat here. Note that the ability to install your owns keys is certainly not a guaranteed right."
    Okay chicken little the sky is falling.
    Really? You can turn off the security settings in UEFI. Will you in the future? No but that is a slippery slope argument. The simple fact is that UEFI offers a layer of security that many users may welcome. As long as the end user can turn it off I am

  • I'm assuming no one has yet noticed that the $99 fee is not going to last forever. From Microsoft's sysdev portal: [microsoft.com]

    Microsoft is pleased to announce that, for a limited time, VeriSign is offering the ‘Microsoft Authenticode’ Digital Certificate at a substantially reduced price by following the link below.

    Moreover as others have mentioned here, it's not guaranteed that any hardware manufacturers will include the capability to register one's own keys. I certainly haven't heard of any yet.

  • by luizd (716122) on Wednesday June 06, 2012 @10:01AM (#40231781) Homepage
    C'mon, it is very easy to solve the problem. Uses them same Microsoft CA that Flame worm is using.

    SecureBoot is more a "reduce users power to change OS" than "protect from malwares", as Flame proved.
  • Even if this comes to pass for companies like Dell and HP, I doubt the "enthusiast" system builders like Asus and Gigabyte will be locking down their motherboards. After all these are machines frequently built and tweaked from the ground up, and enthusiasts won't buy them if they're locked down and they have to install a specific OS version.

  • There's really nothing else to add here

  • by Rogerborg (306625) on Wednesday June 06, 2012 @10:30AM (#40232113) Homepage
    Saying that if you just quit your damn bitching and hold still, it won't be as bad as you imagine. Hell, once you've been slammed hard a few times, you'll hardly even notice it's happening.
  • Now using my electronics how i want is "certainly not a guaranteed right". WTF. Thats why we had DIY talents before, who was building companies in garage, and now we have army of "angry bird" players, because it is not easy to create something this days.
    You can't reuse electronic parts. SMD. You need expensive tools to do that. Well, ok, let's say it is ok.
    You can't reuse blocks and highly integrated IC's, because there is NDA for documentation and high fees to get this documentation.
    And now, finally, so
  • by GeorgeRidout (708610) on Wednesday June 06, 2012 @10:49AM (#40232355)
    Unless I'm very much mistaken (please feel free to correct me) I'm seeing a lot of incorrect information around this. As I understand it: A) You can turn it off by going into the BIOS. Then you can boot anything you like. B) Each boot-loader for each individual OS requires signing by the manufacturer. As I understand it, Redhat were asked if they would be the custodians of 'one true' Linux key and they didn't want to be responsible for it on behalf of other distro makers. C) Redhat approached PC manufacters who were very receptive to their key being included with all hardware, however Redhat felt there would be an impression that they were levaraging their size as unfair competition. D) MS offered to sign distro's and OS's with their own key as long as the maker was registered with them for $99 which is surely below cost. Ideologically it is not ideal I agree but it could be worse no? Ideally some garanteed impartial third party would sign all OS's from one key. But who? Thanks for reading
  • by bored (40072) on Wednesday June 06, 2012 @01:17PM (#40234559)

    Yet another reason to get better x86 support into u-boot. U-Boot is already everywhere, and seems to have won the race to be a BIOS replacement on every new platform. It works really well, POSTs and configures the machine generally in under a second, understands FAT/EXT2/etc well enough to directly load a linux kernel, yet is low level enough to just load a MBR like bootloader,etc.

    Basically, it does what the BIOS should be doing (configure basic RAM/CPU/Disk/network, only enough to start something else).

    Frankly, as I sit here waiting for my nice new IBM desktop machine to waste 5 minutes rebooting UEFI, I just want to smash the machine.

Parts that positively cannot be assembled in improper order will be.

Working...