Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Operating Systems Ubuntu Linux News Your Rights Online

FSF Criticises Ubuntu For Dropping Grub 2 For Secure Boot 296

sfcrazy writes "The Free Software Foundation (FSF) has published a whitepaper suggesting how free operating systems can deal with UEFI secure boot. In the whitepaper, the foundation has criticized the approach Canonical/Ubuntu has taken to deal with the problem. The paper reads: 'It is not too late to change. We urge Ubuntu and Canonical to reverse this decision, and we offer our help in working through any licensing concerns. We also hope that Ubuntu, like Fedora, will actively support users generating and using their own signing keys to run and share any versions of the software, and not require users to install a key from Canonical to get the full benefit of their operating system.'"
This discussion has been archived. No new comments can be posted.

FSF Criticises Ubuntu For Dropping Grub 2 For Secure Boot

Comments Filter:
  • by Viol8 ( 599362 ) on Monday July 02, 2012 @11:55AM (#40517723) Homepage

    ... for someone to hack the secure boot BIOS and provide an easy way for users to reflash theirs from Windows or whatever OS is preinstalled on the machine when bought new. No doubt this will prevent windows being reinstalled but unless you want a dual boot machine I doubt this matters much.

    On a related note, how will this affect linux being booted from within windows (if anyone still uses that approach)?

  • by GeneralTurgidson ( 2464452 ) on Monday July 02, 2012 @12:05PM (#40517797)
    Go ask Novell how well chasing that Microsoft interoperability trains works.
    • by kervin ( 64171 ) on Monday July 02, 2012 @12:38PM (#40518103)

      Novell made a killing and and was an industry powerhouse for decades. Much of their wealth came from making the Microsoft environment easier to use.

      Also many of Microsoft's biggest competitors started of by being compatible with Microsoft. Google providing Exchange protocol services, Office file format compatibility, same with Apple, OpenOffice, etc. And that hasn't worked out too bad for them.

      • by Microlith ( 54737 ) on Monday July 02, 2012 @12:54PM (#40518253)

        And it's always been on the thin edge of the razor. Microsoft has readily yanked their chains by changing the file formats and protocols, keeping them perpetually behind in terms of compatibility.

        As for Novell, compatibility providing a few years of bounty is meaningless when the source of that bounty turns around and uses their monopoly to effectively drive you from the market. All you've done is made them more powerful.

    • by Spiked_Three ( 626260 ) on Monday July 02, 2012 @01:14PM (#40518477)
      Maybe you should be asking Microsoft how well the Novell interoperability train is?

      How conveniently we forget Novell was kicking Microsofts butt (in networking). And doing everything they could to keep Microsoft out.
  • by gQuigs ( 913879 ) on Monday July 02, 2012 @12:08PM (#40517813) Homepage

    not as much, but still (for planning to use the MS key). It's a very bad position we (Free Software) are in with Restricted/Secure boot. I think it's time the Linux friendly vendors really get behind CoreBoot [http://www.coreboot.org/Welcome_to_coreboot] and let us be truly independent.

    As it is setup right now:
    Binaries can only be signed with one key. If you use Microsoft's key, you can't use your own.
    Not all vendors may support letting users add their own keys. (and even if they do it certainly complicates a fresh install).
    ARM will be completely locked down if vendors want MS to run on it.
    If you use the Microsoft key, they can revoke your access (they likely need cause, but still)

  • This is nothing new (Score:2, Interesting)

    by 101percent ( 589072 ) on Monday July 02, 2012 @12:28PM (#40517983)
    Ubuntu/Canonical has been the worst type of Karma whores since the beginning. They built a following by pimping the philosophy of freedom, only to abandon these ideals once the foundation was set. They have enouraged people to accept non-free video and wireless drivers, while companies like RedHat have tried to work with Vendors and educate folks about why this is a bad thing. Now with their app store with non-free projects; they've even undone this feat with kneeling towards Redmond (secureboot). I know not all Linux users care about freedom, but it is sad how even prominent linux users feel like they've accomplished something by getting their local school or whatever to use Ubuntu. People may complain about the free software philosophy all they want, but soon if Ubuntu continues, its going to be a much lesser degree of the early iterations of Windows with lots of propreitary-ness with bits and pieces of freedom (Windows started out using some BSD code). tl:dr Shuttleworth and Canonical are hypocrites and karmawhores.
    • by geminidomino ( 614729 ) on Monday July 02, 2012 @12:41PM (#40518123) Journal

      hey built a following by pimping the philosophy of freedom, only to abandon these ideals once the foundation was set. They have enouraged people to accept non-free video and wireless drivers

      Really now? So it wasn't defaulting to the piece of shit Nouveau driver instead of the Nvidia blobs for the past few releases, making me have to jump through hoops before I decided to just use Xubuntu in Virtualbox on Windows instead of fucking with it anymore.

      There's a lot of legitimate shit you can call Canonical on. Let's focus on the real ones instead of on the "free as in what we say it is" frothing.

      • Really now? So it wasn't defaulting to the piece of shit Nouveau driver instead of the Nvidia blobs for the past few releases, making me have to jump through hoops

        Great, Free Software proponents cry when Ubuntu starts offering nVidia drivers, and now you cry because you have to install the nvidia driver and maybe blacklist Nouveau.

        • by Junta ( 36770 ) on Monday July 02, 2012 @02:03PM (#40519091)

          No, a few purists decry the implicit endorsement of closed binary by Ubuntu working to automatically lead a user to use the nVidia binary instead of the less featureful Nouveau drivers. They appreciate Fedora's stance, hoping that one day it will topple nVidia's thinking and result in a quality open source driver, but see players like Canonical ruining that opportunity to change reality for the better.

          More pragmatic Linux users express a sentiment that they appreciate Ubuntu's efforts to more carefully consider and play in the reality of nvidia/fglrx type drivers needed for most consumers of those GPUs, since many Linux users can't realisticly sit around and hope for a miracle to use the hardware they want to buy now.

          The parent and grandparent posts aren't the same mind or anything.

    • by Junta ( 36770 ) on Monday July 02, 2012 @01:56PM (#40519023)

      RedHat have tried to work with Vendors and educate folks about why this is a bad thing

      The key word here being 'tried'. It really hasn't done anything to change the ubiquity of MP3 and h264. In that case, the momentum (mp3 is as good as the alternatives technically and has been around longer) or technical merit (h264 hs *no* unencumebered competition to acheive the same results) far offsets the ideology of 'free' for most of the world that we must live in. We aren't sufficiently better off in drivers due to RH's stance (fglrx and nvidia drivers are still pretty much required to extract value out of the respective hardware). What gains have been made have been mostly occured due to the inconvenience of the hardware makers (easier to just provide source than maintain shims) and not due to hard user demands. Practically speaking, you add rpm-fusion or download from the hardware vendor in Fedora. Ubuntu makes that easier, and while some might appreciate the purity, the common end user is simply annoyed that their hardware choices they are driven to make aren't as supported as they reasonably could be.

      they've even undone this feat with kneeling towards Redmond (secureboot)

      Actually, from a practical perspective, Ubuntu states a plan to not have signing as soon as possible, meaning user-compiled drivers are still viable. Fedora/RH plans to be signed all the way up the stack, meaning you will have more difficult time with self-compiled modules. It seems like Canonical's aversion to GRUB2 is due more to lack of due diligence on GPLv3 implications and not of some sort of MS agenda. I also wonder if MS will ultimately block Canonical's plan for lack of protection against the boot loader becoming a circumvention mechanism for Windows 'secure' boot.

      All in all, I think Canonical on a technical level is losing it, some out of what seems to be desperation in chasing a business model now (ubuntu tv, now ubuntu phone) some out of hubris (some statements around unity's lack of configurability has been met with some strong hubris), but I don't think they are trying to close up the ecosystem and I don't think that Debian free and Red Hat's stance make a meaningful difference to the freedom of the components we use.

  • a sea change (Score:5, Insightful)

    by Anonymous Coward on Monday July 02, 2012 @12:30PM (#40517997)

    This is the start of a sea change in who controls our computers. Yes, for now you can turn it off (oh, sorry, unless you're using an ARM system), but this is just the first step. They can't go the entire way all at once. They've tried before, and learned they have to go one step at a time. Each step doesn't seem so bad, until finally, all the cards fall into place.

    Already most of our mobile devices no longer belong to us, unless you manage to defeat the device's security that is meant as security against YOU, the owner of the device. Bought anything with iOS, or about 95% of the Android devices? Or WP7? Sorry, someone else owns it even after you purchased it. That's the world that many powers like Microsoft and many governments desire for the whitebox PC. A locked down device that obeys other masters, only booting "trusted" OSs that let those masters have the final say over what your computer does. Because a world where a billion individuals had control over their own computers could not be allowed to persist. It threatens too many corporations and governments.

    Of course, people will buy these increasingly locked down PCs just like they are falling all over themselves to buy tablets, so this world WILL come to pass. All we can do is figure out how to deal with it.

    • by ISoldat53 ( 977164 ) on Monday July 02, 2012 @12:47PM (#40518181)
      I don't understand how Intel supports this. They have pumped a lot of money and support into Linux in the past. Why would they now produce products that freeze it out?
      • Servers and Laptops (Score:5, Interesting)

        by betterunixthanunix ( 980855 ) on Monday July 02, 2012 @01:06PM (#40518401)
        Intel knows where they can make money from GNU/Linux: servers. That is not the target of this restricted boot system, and even if these restrictions come to servers, nobody will complain -- professional IT workers can put a $99 signing key purchase on their budget and continue to deploy whatever they want. Desktop GNU/Linux is not going to make Intel all that much money, and they know it -- Windows and Mac OS X are where all the desktop money is.

        Intel and everyone else knows that restricted boot environments for personal computers (desktops and laptops) will be hugely profitable. Entertainment companies love it -- they can deploy a new kind of DRM that won't be defeated for years (see: PS3). Software companies love it, because they can stop people from applying cracks to evade DRM. ISPs love it because they can better lock-down their networks if they can control the computers that can be connected to those networks. The potential for money-making deals is HUGE, and Intel knows that when their chips are the center of these profitable systems, they make lots of money.

        At the end of the day, Intel could not care less about hackers or computing freedom; they exist to make money, and there is no money to be made in allowing desktop and laptop users to have freedom.
  • by crow ( 16139 ) on Monday July 02, 2012 @12:41PM (#40518119) Homepage Journal

    My big concern is corporate computers. If your company is issuing you a computer, and they don't realize that some engineers want to run Linux, they may not let you install new keys or disable the secure boot. This is where it's a good idea to have one vendor using the Microsoft key, and other vendors using their own keys (and hopefully getting major PC sellers to include those keys). That way we at least have one solution that will work even on a locked-down system.

    I think Red Hat's strategy is to be the Linux distribution that will work without having to mess with any secure boot issues, which is why they're going to use the Microsoft key.

    • by betterunixthanunix ( 980855 ) on Monday July 02, 2012 @12:51PM (#40518229)

      If your company is issuing you a computer, and they don't realize that some engineers want to run Linux, they may not let you install new keys or disable the secure boot

      Sounds like a big selling point: "Make sure your employees only run approved software!" Corporate bosses are not going to complain about losing control, and if the engineers are unable to make a business case for approving another OS (see how things switch up there), they had better just deal with what was approved.

      I think Red Hat's strategy is to be the Linux distribution that will work without having to mess with any secure boot issues,

      Which is a fine strategy for making money on a GNU/Linux distro, but some of us would prefer not to have to get Microsoft's permission to run the software we want to run. If you look at what Fedora will be doing, it makes it pretty hard to run a custom kernel, it does not help in running other distros, and it basically turns Fedora into a fancy TiVO. That's fine for Red Hat's desktop strategy, but the rest of us are going to need a better approach.

  • by CrimsonAvenger ( 580665 ) on Monday July 02, 2012 @12:48PM (#40518205)

    Is there any way to get editors who know enough English to at least filter out sentences like:

    The Free Software Foundation (FSF) has published a whitepaper recommending free operating systems how to deal with UEFI secure boot.

    It's not like it would have been hard to change it to:

    BLOCKQUOTE>The Free Software Foundation (FSF) has published a whitepaper recommending ways for free operating systems to deal with UEFI secure boot.

    And yes, I know that being a grammar nazi is unfashionable. But illiteracy really does work to convince people you have nothing to say worth reading...

    • by Anonymous Coward on Monday July 02, 2012 @01:50PM (#40518941)

      Is there any way to get editors who know enough English to at least filter out sentences like:

      The Free Software Foundation (FSF) has published a whitepaper recommending free operating systems how to deal with UEFI secure boot.

      Oh, please, it's just a one-letter typo, no need to get twisted.

      The Free Software Foundation (FSF) has published a whitepaper recommending free operating systems howl to deal with UEFI secure boot.

      There, fixed it.

  • by seandiggity ( 992657 ) on Monday July 02, 2012 @01:01PM (#40518347) Homepage

    Although it was obvious the FSF would take this position, as it should, isn't it strategically wise to have multiple solutions for users to load a (mostly) free software OS on hardware with UEFI? For similar reasons, I think it's good to have Android devices running ClockworkMod so that they may boot CyanogenMod/Replicant. I understand that we (free software advocates) should always be encouraging consumers to make smart choices and purchase devices that will run free software (and a complete free software stack, when that's possible).

    However, free software would become an "oasis in a desert", rather than a large and thriving ecosystem, if binary blobs, non-free drivers, non-free BIOS's, firmware hacks, etc. weren't around. It would become increasingly difficult to bring in more users. Those who have developed free software implementations to replace proprietary ones originate from all over the free software spectrum, so the pool of developers would also shrink.

    I think you always want both: the hardcores who will run free software and free software only, and those who will make compromises on devices until (if/when) stable free software is developed for those devices. The FSFE's advice on installing CyanogenMod [fsfe.org] seems like a sensible approach that takes this into consideration. Likewise, why not help someone install as much free software as possible on a device with a non-free BIOS/bootloader?

    It seems to me that UEFI will die a quick death if we A) fight very vocally against it, B) convince powerful corporations and governments that it's bad for them, C) ignore it where/when we can, and D) help others to circumvent it when necessary. It doesn't seem much different than the DRM problem in that way.

    I would be very happy with Canonical's UEFI strategy if the following from this past /. comment [slashdot.org] can be done:

    - Canonical will get efilinux signed with microsoft keys. So GRUB2 has to be made bootable from efillinux (efilinux is rather primitive, it just loads a kernel from a set collection of blocks from the device and run it. It shouldn't be too much difficult to have efilinux load and execute a GRUB2's "stage 1.5" or "stage 2"). Thus efilinux is the part that needs to be signed with microsoft's key (and efilinux's license makes it possible. Although that also means that you won't be able to hack it).

    ...

    - GRUB2 can load coreboot (an opensource firmware) payloads, so it could also load SeaBIOS (a legacy BIOS implementation as a coreboot payload). - GRUB2 can also load windows XP's boot loader. So if any of the above is possible (either chainloading efilinux to grub2, or signing grub2 in a gplv3 compatible way). That means that grub2 could be used to boot windows XP on secure-boot hardware. (with seabios providing the legacy bios compatibility, and windows XP's ntldfr being loaded from grub2).

    That unfortunately-complex method of chaining together multiple bootloaders seems to allow for any OS, even legacy ones, to boot (or at least attempt to boot) on UEFI hardware. Such a door might be closed if Canonical decides it won't play ball with Microsoft, and that seems like a door worth having open. However, I welcome any rebuttals...I don't know nearly enough about the issue.

    • by Microlith ( 54737 ) on Monday July 02, 2012 @01:21PM (#40518583)

      It seems to me that UEFI will die a quick death

      The problem, again, is not UEFI but secure boot. The two are not inextricably linked.

      It doesn't seem much different than the DRM problem in that way.

      You'll have an uphill battle. Apple is transparently convincing people that DRM is good.

      chaining

      Can't happen. If any point has a flaw then the key gets revoked. From the UEFI platform down to the kernel needs to be "trusted" to betray the user, and the kernel must be secured against local exploits that allow bypassing of the chain.

  • by ThatsNotPudding ( 1045640 ) on Monday July 02, 2012 @01:27PM (#40518655)
    Half-joking, but I wonder if contracting out a community-speced and community-funded motherboard would be possible. It might be worthwhile if for no other reason than to possibly catch MS leaning on contract manufacturers from even considering fabbing a motherboard outside of their control.

The key elements in human thinking are not numbers but labels of fuzzy sets. -- L. Zadeh

Working...