Linux Foundation's Secure Boot Pre-Bootloader Released 178
hypnosec writes "The Linux Foundation's UEFI Secure Boot pre-bootloader for independent Linux distros and software developers has finally been released. Announcing the release of the secure boot system James Bottomley noted that the signed pre-bootloader was delivered by Microsoft on February 6th. Bottomley has released two validated files: PreLoader.efi and HashTool.efi. Bottomley has also created a bootable mini-USB image that provides 'an EFI shell where the kernel should be and uses Gummiboot to boot.' Just last week the pre-bootloader had to be rewritten to accommodate booting of all versions of Linux."
What about *BSD? (Score:5, Insightful)
This is great news for Linux distributions, and a small victory in the losing battle for openness.
But in the spirit of openness, hopefully bootloaders for NetBSD, OpenBSD, and FreeBSD will also be eventually signed.
Everyone should be able to install and run whatever they want on their own computers.
Re:What about *BSD? (Score:4, Informative)
the losing battle for openness
What losing battle? Open source software hasn't been as prevalent as it is now since proprietary software first arose. Linux, in particular, is in the strongest position it's ever been in, and it looks like 2013 will be a very big year for Linux. Sure, there are always setbacks like this, but look: it's been just over 3 months since Windows 8 began to be sold, and the problem is already almost completely solved.
But in the spirit of openness, hopefully bootloaders for NetBSD, OpenBSD, and FreeBSD will also be eventually signed.
So you have time to whinge, but none to RTFA:
A signed pre-bootloader will allow for chain-loading of boot-loader of any other operating system thereby enabling users to install non-signed Linux distros on Windows 8 UEFI hardware.
Everyone should be able to install and run whatever they want on their own computers.
Yes, but not everyone should be able to install or run whatever they want on your computer. In fairness, UEFI goes some way towards securing your PC. Microsoft did well for the consumer in that respect. They're also a fairly ruthless company, and they're not going to go out of their way to make sure you can install rival operating systems from day 1. But today, at about day 100, the problem is a long way towards being solved. Get over it.
Re: (Score:3)
But today, at about day 100, the problem is a long way towards being solved. Get over it.
I interpreted it a little differently. Today at about day 100, Microsoft has won it's war against Linux.
Microsoft started by saying you don't want to use Linux because it's inferior, but they were easily shown to be wrong.
Then Microsoft turned to saying it was illegal to use Linux because it's a mess of copyrights and patents, as well as infected with a viral license that destroys businesses. It took a lawsuit a decade long with one of this countries top companies (at the time) to finally prove otherwise.
Re: (Score:2)
Now, today, Microsoft has finished by saying Linux can and will only exist at Microsoft's whim. They hold the keys to the kingdom, and can lock and unlock any OS as they see fit. [...] now we are humbly begging for permission to be allowed to use non-windows on our own computers, while also praying the check clears to buy that capability which should be a natural right. [...] If Microsoft officially claims they have revoked the certificate and thus permission for the Linux preboot loader, then instantly every desktop and server in this country running Linux is in violation of the law. Booting it is a felony.
I emphasized the bits in your post that were sensational nonsense.
Microsoft could never revoke the keys for Linux, because it is actually too popular for them to get away with it.
Signed booting absolutely MUST be controlled at the highest level by the owner of the computer. No one else!
Agreed.
This means there should be ZERO keys or certs installed by default, and it should be a very serious crime to try and sneak one in, similar to any other mass scale computer intrusion laws.
One should be required to learn how it works, why it works, what the advantages of signing your own boot loader would be, and then using that knowledge to enable it and upload your keys.
If someone can't do that, then clearly they don't need this feature.
Now I think you're being ridiculous. You can't expect regular end-users to understand the workings of something just to get to use it. It's not the way most people want technology to work, and it doesn't have to be.
Re: (Score:3)
It's all sensationalistic nonsense until it actually happens. Which seems to be just a matter of time and judicial incompetence. If you want to be optimistic about it, that's your own business, but I am NOT.
Yes, it makes it more difficult for the end user. But I'm sure somebody has made a quote about convenience and liberty at some point (Ben Franklin?). That's a wholly different argument.
Re: (Score:2)
Now, today, Microsoft has finished by saying Linux can and will only exist at Microsoft's whim. They hold the keys to the kingdom, and can lock and unlock any OS as they see fit. [...] now we are humbly begging for permission to be allowed to use non-windows on our own computers, while also praying the check clears to buy that capability which should be a natural right. [...] If Microsoft officially claims they have revoked the certificate and thus permission for the Linux preboot loader, then instantly every desktop and server in this country running Linux is in violation of the law. Booting it is a felony.
I emphasized the bits in your post that were sensational nonsense.
Microsoft could never revoke the keys for Linux, because it is actually too popular for them to get away with it.
Apologies in advance if I miss-copied any emphasized parts above. The editor does not want to cooperate with that.
But it will be easier to address each, as I do not agree with your assessment. Sensational perhaps, but that doesn't mean I am incorrect or exaggerating the truth.
Microsoft has finished by saying Linux can and will only exist at Microsoft's whim
And the past 100-ish days prove that to be correct, as Linux was not yet bootable on these new systems without first blanking the certificates out of
Re: (Score:2)
Microsoft's power on the matter is strictly economical. It cannot mandate that all PCs, or even all PCs sold with Win8, have UEFI Secure Boot. The requirement comes from Win8 hardware certification program, so it's only necessary if the OEMs want that "Designed for Windows 8" sticker on their hardware.
Now, Windows having the lion's share of desktop OS market, most OEMs do want the sticker, and so they have to follow the certification guidelines. However, this does not mean that Microsoft is free to put what
Re: (Score:2)
we are humbly begging for permission to be allowed to use non-windows on our own computers
You're doing it wrong, just turn secureboot off.
If Microsoft officially claims they have revoked the certificate and thus permission for the Linux preboot loader, then instantly every desktop and server in this country running Linux is in violation of the law. Booting it is a felony.
That's an interesting take, how would one revoke a UEFI key? And how would revocation - assuming such a thing exists and is possible - of a key result in permission to load the pre-bootloader being denied? Permission to load the bootloader is granted/denied by the UEFI firmware, which makes the decision based on whether the installed key matches that of the signed bootloader, so what you're saying makes absolutely no sense, it just demonstrates a fundamental m
Re: (Score:2)
That's an interesting take, how would one revoke a UEFI key?
Dunno, doesn't seem possible to me with the current state of hardware. Why do you ask? Seems a bit off topic, since I was discussing permission and not certificates or keys.
And how would revocation - assuming such a thing exists and is possible - of a key result in permission to load the pre-bootloader being denied?
Dunno, I never said anything about revoking a key.
However one revokes permission by using the words "you no longer have permission"
Permission to load the bootloader is granted/denied by the UEFI firmware, which makes the decision based on whether the installed key matches that of the signed bootloader, so what you're saying makes absolutely no sense, it just demonstrates a fundamental misunderstanding of how secureboot works.
No, the boot loader only knows if the software being booted was signed by a key that is paired to a key stored in UEFI. It can't possibly know about a legal construct such as permission or about copyright
Re: (Score:2)
Dunno, doesn't seem possible to me with the current state of hardware. Why do you ask?
Because the only way to remove permission for the bootloader to boot the OS is to revoke a key, you can tell me i don't have permission all you want, ain't gonna make a shit of difference though, you - like Microsoft - don't have any authority over that.
Seems a bit off topic, since I was discussing permission and not certificates or keys.
Seems you fail at reading comprehension on your own post, try reading it again then you won't look so foolish:
If Microsoft officially claims they have revoked the certificate and thus permission for the Linux preboot loader [slashdot.org]
Dunno, I never said anything about revoking a key.
You said 'certificate' as opposed
Re: (Score:2)
Well now that you've decided to be all insulting for no good reason, I will too.
Because the only way to remove permission for the bootloader to boot the OS is to revoke a key, you can tell me i don't have permission all you want, ain't gonna make a shit of difference though, you - like Microsoft - don't have any authority over that.
Thank you for finally admitting I am right.
You do as you say, and don't give a shit like you say, then you are violating copyright and the DMCA. You're now a felon. Congrats!
I'll let You argue with the judges that have ruled and set precident that copyright holders can't dictate who can make a copy of their work, as well as argue with the judge that declared loading a program into ram is copying.
You are now openly stating you
Re: (Score:2)
You do as you say, and don't give a shit like you say, then you are violating copyright and the DMCA. You're now a felon. Congrats!
But the fact is in doing so you are not violating the DMCA. There is no law against booting Linux, and Microsoft telling you that you don't have permission doesn't change that, even if you so desperately want to bend yourself to Microsoft's will.
Re:What about *BSD? (Score:4, Insightful)
One issue that never seems to be mentioned but could be potentially huge is that the signed bootloader requires user interaction to boot. It was designed that way to prevent malware using the bootloader to silently root the OS, the very thing SecureBoot was designed to prevent.
It won't boot until you press a key to continue. Many Linux machines don't have any facility for that, either because they are a tablet with no physical keyboard or because they are a headless server with no-one around to operate them locally.
Re: (Score:2)
It won't boot until you press a key to continue. Many Linux machines don't have any facility for that, either because they are a tablet with no physical keyboard or because they are a headless server with no-one around to operate them locally.
Why would you want secureboot on such devices?
Re: (Score:2)
"UEFI goes some way towards securing your PC."
How? What the UEFI does to "secure my PC"? I claim the positive effect is infinitesimal and hugely shadowed by negative effects.
What UEFI secures is the pre-booloader. Nothing more, it has nothing to do with bootloader, kernel, drivers, system programs or set-up data, user programs or user data. The likely palce for trojan is perhaps the system programs and their settings - as long as a trojan can change your sshd_config you really do not care whether pre-bootlo
Re: (Score:2)
the losing battle for openness
What losing battle? Open source software hasn't been as prevalent as it is now since proprietary software first arose. Linux, in particular, is in the strongest position it's ever been in, and it looks like 2013 will be a very big year for Linux. Sure, there are always setbacks like this, but look: it's been just over 3 months since Windows 8 began to be sold, and the problem is already almost completely solved.
But in the spirit of openness, hopefully bootloaders for NetBSD, OpenBSD, and FreeBSD will also be eventually signed.
So you have time to whinge, but none to RTFA:
A signed pre-bootloader will allow for chain-loading of boot-loader of any other operating system thereby enabling users to install non-signed Linux distros on Windows 8 UEFI hardware.
Everyone should be able to install and run whatever they want on their own computers.
Yes, but not everyone should be able to install or run whatever they want on your computer. In fairness, UEFI goes some way towards securing your PC. Microsoft did well for the consumer in that respect. They're also a fairly ruthless company, and they're not going to go out of their way to make sure you can install rival operating systems from day 1. But today, at about day 100, the problem is a long way towards being solved. Get over it.
===
Perhaps Linux distributions are lucky because retail sales of W8 are far below expectations. I visited several big box stores, and the space previously allocated to computers is now shared with Tablets (Mainly Android) and Big screen TVs. If W8 end-user sales were significant, we could experience accidental tricks by MS to block all other OSs. And those accidents would happen as a means of protecting market share. Who is to say what MS would not do.
Re: (Score:2)
Why do the majority (it seems) of Slashdotters use the british spelling of 'whine'?
You mean 'whinge'? A synonym of the word 'whine' which is both spelled and pronounced differently?
Re: (Score:3)
No. In the spirit of openness, hopefully this bullshit will get eaten by the anti-monopoly regulation.
Giving in to this bullshit was the most stupid thing the Linux guys could do.
Re: (Score:2)
Why would anti-monopoly guys get involved, seeing as Linux (and other competing OSes) are working on MS-certified hardware with the present arrangement? What's the anti-competition angle here?
Re: (Score:2)
I dunno, maybe that the Linux guys have to report to MS to have their stuff working? Duh?
Re: (Score:2)
For one thing, they don't, since the switch to disable Secure Boot is always there on Intel machines, and can be turned off by any user. This whole thing was about making it so that the users don't even need to do that (but I'd bet that the switch alone is sufficient to alleviate any anti-trust concerns).
And beyond that, having to "report to MS" is not an issue since it results in a solution that works for everyone. If that were to change - if MS was ever to revoke the keys - then, yes, I'd imagine there wo
Re: (Score:2)
MS paid something on the order of $2 billion in various fines and non-compliance fees in EU last time an anti-trust issue came up (with IE). And EU anti-trust fines usually grow significantly for repeat offenses.
Re: (Score:2)
You still can.
You see, in order to get that "Windows" logo, a PC (x86/x64) MUST have an option to disable secure boot. In which case, the UEFI will perform a "legacy boot" using the MBR/partition loaders as has b
Re:What about *BSD? (Score:5, Interesting)
Incidentally.. Microsoft will have two keys. One for Windows, and another for "third party" stuff.
So they can revoke everyone's software and leave theirs working.
BTW: Anyone interested in the abuses that UEFI allows should read both the UEFI guidelines and the Microsoft Mandate (the rules they apply to OEMs for Win8 certs, and anyone wanting to have their software signed).
Microsoft's rules violate several of the guidelines - unsurprisingly those to do with who actually controls the PC.
Re: (Score:2)
Re: (Score:2)
Can MS really revoke the third party key though? Can they remove it from the UEFI BIOS via a software update? One of the key features of Secure Boot is that random viruses can't install their own keys, or more generally that any code, signed or otherwise, can't install keys. Only the user or manufacturer assembling the BIOS image can do that.
They could block third party keys on new hardware, but not revoke them on old hardware.
Re: (Score:2)
Re: (Score:2)
yay! (Score:1)
Yay! Now I can finally ask Microsoft for permission to boot my Linux machine! I've been eagerly awaiting this for years and years.
Oh, I can just disable in the EUFI, you say? Yes, I'm fully confident that situation will persist going into the future. Because that's how these things go.
Re: (Score:2)
You didn't need Microsoft's permission in the first place, and not because you could just disable secure boot.
This is bollocks (Score:4, Interesting)
All the time Microsoft have control, they will always have control.
Why don't people LEARN from history from how they operate?
This will all go horribly wrong, mark my words.
And I still do not understand how Microsoft get to control this.
Re:This is bollocks (Score:5, Informative)
And I still do not understand how Microsoft get to control this.
For anything x86 based; they don't. They expressly require OEMs (and onyone else producing motherboards with a little Windows 8 sticker on the box) to allow the end user to add their own Secure Boot keys, as well as insert Microsoft's key. No end-user modification, no certification.
So what are various Linux distros getting bootloaders signed by Microsoft? Because they assume users are not competent enough to enter keys manually. Thus, they ask Microsoft (or take advantage of the service Microsoft offers) to sign their bootloader with Microsoft's preloaded key.
Re:This is bollocks (Score:5, Informative)
It's not an issue of "competent". It's an issue of "willing".
A major source of Linux's desktop growth is the use of live CDs. Just drop in a disk at boot, and you've got yourself a working Linux desktop to play with and perhaps even like. You can see the filesystem's different layout, you can see each application's settings saved to plain old files, and you can see the package manager's simple installation of useful software. Perhaps you can even like it and decide to install. If not, there's no changes to your computer.
That's all changed now. Now, either you your computer must be prepared for Linux first, through some means of adding a new key. While not really beyond the average user's level of competence, it is beyond their level of ambition just to try "that Linux thing". The longstanding promise of "try it without changing anything" that has fueled trials isn't wholly true any more. Supposedly Windows' bootloader will let you boot unsigned CDs, but I've tried that three times with three failures on known-good disks, so I expect there's something screwey hidden in that route, and that doesn't really solve the problem of booting once the installation's complete.
To make matters worse, there's no standard mechanism for adding the boot key. One option is an BIOS-based tool, which with come with the typical polish [rodsbooks.com] of a motherboard manufacturer we've had on BIOS setups for years. Expect a keyboard-based menu with unique brand-specific names. Another option that might be viable in the future is a Windows tool to add a key, which will inspire Windows to raise scary warnings about compromising security and never starting again, which will do wonders for the user's confidence.
Microsoft surely knows that Secure Boot won't affect savvy nerds from converting to Linux. They also surely know that Linux is still growing organically, relying on word-of-mouth and firsthand try-before-you-buy experience. By requiring Secure Boot to be user-modifiable, they've thrown a roadblock in the path for Linux's growth, without looking like they're being blatantly nasty. They can keep exaggerating the threat of bootloader rootkits to justify locking everybody out, then point to the key-adding ability to dispel accusations of abusing their monopoly.
Enough is enough (Score:4, Insightful)
Microsoft surely knows that Secure Boot won't affect savvy nerds from converting to Linux. They also surely know that Linux is still growing organically, relying on word-of-mouth and firsthand try-before-you-buy experience.
You are seriously delusional. "Converting" to Linux is not, has never been and will never become a threat to Microsoft. Right now Microsoft is pressured on other fronts, such as desktop PC losing relevance, not being on the boat on mobile and not competing effectively in the tablet game.
You are trying to wage last decades battle. Microsoft does not feel threatened by Linux on the desktop *at* *all*. Get real. The threats to Microsoft do not come from conversions in the x86 space, the come from vertical players and mobile, like Chromebooks, tablets, smartphones.
Note how *all* of these emerging platforms have more restricted app models, and especially *boot* models. Microsoft is simply evolving their primary platform to match the features and security (from closed and semi-closed gardens) of the threatening platforms.
The threat to Microsofts desktop business is *not* Linux. Even though Linux has evolved in that space and on the surface appears to be able to go head-to-head, Microsoft Windows is still *much* more mature than any desktop Linux. Consider for instance group policies, restart manager, volume shadow service, various troubleshooting guides, shims for both application and device compatibility etc. The real threat is that the desktop become irrelevant.
If the desktop is perceived as less secure than an online counterpart, Microsoft will be losing. They *need* to ensure secure boot. It is not a anti-Linux move at all. You are flattering yourself. And being stupid.
Re: (Score:3, Insightful)
Re: (Score:2)
Re:Enough is enough (Score:4, Informative)
I agree with most of your points, however I feel Microsoft is its own biggest threat. Them fucking around with all sorts of shit in Windows is going to drive people away. I number of changes since WinXP have irritated me, but I have stuck with Windows until now.
I recently bought a new laptop (Lenovo x230). I upgraded the storage myself - to use an mSATA SSD for the operating systems. After spending hours trying to get Win8 installed (no OS DVD provided) I gave up, it was the last straw. The UEFI stuff was a pain in the ass, but managed to get Arch Linux up and running comapartively easily.
I have been tinkering with Linux for a number of years, but it finally took Windows 8 to drive me to Linux full time & I couldn't be happier. This is the first computer I have owned without Windows installed on any partition - it was nerve-wracking at first, but now wish I had made the move sooner.
Re:Enough is enough (Score:5, Informative)
Consider for instance group policies, restart manager, volume shadow service, various troubleshooting guides, shims for both application and device compatibility
I don't think Linux has a nice "clicky" interface to any of these things but to suggest that it does not have solid equivalents to the first 3 (the rest appear to assume Linux has the same problems as Windows).
Group polices are probably difficult to fully replicate on Linux but its due to flaws in windows that it even needs a restart manager. Maybe SSV is more permission friendly than LVM also.
You are just another windows user who assumes that a proper OS should function the same Windows. There are better lists than this for things Linux is missing on the desktop but the one is the lack of third party applications.
Re: (Score:2)
What are these group policies that Linux can't replicate? I'm curious: I looked it up on google, but the descriptions are fairly high level and seems like they'd translate reasonably well.
Also, a restart manager?
Re: (Score:2)
What are these group policies that Linux can't replicate? I'm curious: I looked it up on google, but the descriptions are fairly high level and seems like they'd translate reasonably well.
I said difficult, not that you could not. There's probably some context based permissions that benjy is referring to.
Restart Manager is and installer api for restarting services while updating files to prevent restarting the whole OS. Linux deb/rpm installers can just call syscontrol and restart the service using the same call as the user.
Re: (Score:3)
Note how *all* of these emerging platforms have more restricted app models, and especially *boot* models.
Chromebooks will boot anything you like, including Linux and Windows. Android devices from Google have unlocked bootloaders that will boot anything, including Ubuntu for phones, and the OS itself allows installation of apps from any source without any signing requirement at all.
Android is also the most popular mobile OS. Google learned the lessons from history that others did not: the most open platform usually wins. Betamax vs. VHS. MiniDisc vs. CD-R. MemoryStick vs. SD card. Amiga/Atari/Sinclair/Amstrad v
and everything old is new again (Score:2)
I noticed you mentioned Chromebooks...
Those are x86 systems based on Linux (though not really a "Linux distro" thank goodness). ChromeOS is really starting to gain traction now, and it could reinvent the PC the way iOS/Android reinvented the smartphone and tablet.
The important thing about ChromeOS and Android and the moribund Linux desktop distro class is not that they use Linux or FOSS but that they are things that MS doesn't own, yet they can run on standard x86 hardware. The issue is whether any non-MS O
Re: (Score:2)
ChromeOS is really starting to gain traction now, and it could reinvent the PC the way iOS/Android reinvented the smartphone and tablet.
Yeah just what users who need desktops want: a system where all the software is a remote connection away from failure/locked in upgrade treadmills, and whose functionality can change any time.
If the choice becomes chromeOS or a tablet, I'm done with computing.
Re: (Score:2)
Sounds like to me you're just using windows as an 'objective' barometer to measure capability.
1. restart manager? proper business systems only need to be restarted when absolutely necessary.. needing a 'manager' to handle it suggests inferior design, not superior. It's truly amazing what a process microsoft has made out of copying files from an archive to directories on the system drive.
2. group policies? Ever heard of LDAP? I believe microsoft's embrace/extend name for that is called active directory.
Re: (Score:2)
Too bad I don't have mod points to +1 you - or -1 the bollocks you got as a result. Anyone claiming total UEFI lockdown on ARM is for security and has nada to do with blocking OtherOS is deluded - and anyone thinking MS wouldn't love to do just that with x86 but took slightly more moderate route because they are a monopoly at x86 desktop, and it would just be nasty for them if they had gone that way, is deluded.
What you describe is what's happening with the plan they had to settle with.
Re: (Score:2)
Re: (Score:2)
Would you check the details on that? As I understood it, and I might be wrong, the Microsoft standard doesn't require OEMs provide the ability for the end user to add their own keys - that's up to the OEM. What it does do is require the OEMs provide the user with the option to disable secure boot entirely, and that this can only by done by someone physically present at the machine (The 'press F1 to enter setup' program).
Re:This is bollocks (Score:5, Informative)
Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following: It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx), which puts the system into setup mode.
Separately (Para.18):
Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv.
Re: (Score:2)
"Setup mode" is part of the UEFI specification. You can add any keys you want to while you're in it.
Re: (Score:3, Informative)
And I still do not understand how Microsoft get to control this.
They talk directly to manufacturers, since windows is still installed by default. So the swing they have on the whole laptop market just became a bit more visible, it's always been there, however.
Re:This is bollocks (Score:4, Informative)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Are you a moron or a shill? Sure, Secure Boot is required to have a method of disabling for Windows 8... but what about Windows 9? Windows 10? Is your righteous indignation going to allow everyone to turn off Secure Boot then?
Re: (Score:2)
And who cares about ARM devices running Windows? They're a minuscule part of the market, likely to remain that way - and people who bought them hardly did so to install Linux on them. If you want to have a large number of ARM devices with unlocked bootloaders, the logical place to start would be bringing up the issue with Apple and Samsung.
Re: (Score:2)
No, MS owns it. You should be paying them your monthly fee.
Re:This is bollocks (Score:4, Informative)
The margin on most PCs is razor-thin. If they were required to buy a full Windows license, the cost of the machine to manufacture would shoot up by a hundred dollars. Microsoft provides heavily-discounted OEM edition licenses to OEMs, which they simply cannot do without: No OEM licenses, no business. So when Microsoft sets standards for that 'designed for Windows 8' sticker and the license discount that comes with it, OEMs have no option but to meet those standards. This gives MS the power to dictate a sweeping change. Sometimes something major, others something trivial like mandating an extra button on the keyboard.
Its NOT Microsoft (Score:4, Interesting)
Nobody ever brings this up but me. Guess who else is in the UEFI group?
AMD, American Megatrends, Apple, Dell, HP, IBM, Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies
Re: (Score:2)
And I still do not understand how Microsoft get to control this.
It seems like MS took the initiative on this, while the Linux camp assumed their users would expertly guard their systems and wouldn't have a need for runtime code signing. But most computer users aren't experts, and even many experts would rather have the code they run automatically verified by signatures, too, if its available.
But I don't understand why the Linux Foundation expects their OS to be an exception to secure boot (or something like it)... and that's what this signed pre-bootloader is, an except
Re: (Score:3)
And I still do not understand how Microsoft get to control this.
Secure Boot became part of the UEFI spec in 2008-2009. (Rev 2.2)
The spec is managed by the UEFI Forum --- representing AMD, American Megatrends, Apple, Dell, HP, IBM, Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies. Unified EFI Forum [wikipedia.org]
The Linux Foundation posted a "Power Point" presentation in October 2011: Making UEFI Secure Boot Work With Open Platforms [linuxfoundation.org]
It comes down to this:
To successfully implement hardware level security in a mass market consumer product, it has to be enabled by d
Will dell systems be able to use this or will MS t (Score:2)
Will dell systems be able to use this or will MS try to block this on dell that they now own a part of?
Re: (Score:3)
In a sense, they do not own a piece of Dell. From what I understand, they contributed some dough as a loan and I have not heard they will have anyone on the board. Dell cannot live on the desktop market, in the server market they cannot ignore Linux.
This doesn't stop MS from using its usual bag of dirty tricks, but if Dell has any sense and balls, he'll keep MS away from actually running the business.
Hopefully this one is/can be promptless (Score:2)
Requiring a prompt does cripple the bootloader when compared to others that are somehow exempt from it.
Re: (Score:2)
It can't be promptless. The only ones that can be promptless are ones that assert a check on the kernel being loaded.
Great! Now let's boycott it. (Score:5, Insightful)
Seriously, when Microsoft is paid for the key and they own the key into our computers, we've lost. Simple solution: Avoid ARM-based machines as long as Microsoft requires that no way exists to disable Secure Boot. By buying into this shit, we're just setting ourselves up to be fucked in the ass by Microsoft. I can't say anything good about the Linux Foundation for playing ball with these assholes either. Pre-bootloader, my ass--more like pre-pre-boot-extra-complexity-nightmare, thanks to Microsoft. Having to use this would be a disgrace; that alone should be enough to get people to buy more compatible hardware (but won't be).
Re: (Score:3)
This does nothing for ARM machines. Microsoft won't sign anything other than their own software to boot on certified Windows RT devices.
Re:Great! Now let's boycott it. (Score:4, Insightful)
Seriously, when Microsoft is paid for the key and they own the key into our computers, we've lost. Simple solution: Avoid ARM-based machines as long as Microsoft requires that no way exists to disable Secure Boot.
Uhh this isn't about ARM, Microsoft doesn't allow any third party OS on their ARM machines period. This is if you want any x86 machine shipping with Windows 8 and the "Designed for Windows 8" label to boot any other OS without finding the obscure and non-standard way to disable Secure Boot in UEFI (the new BIOS). At least in this incarnation you can always disable it yourself (again, only on x86), but I smell a Darth Vader quote coming as in "I'm altering the deal. Pray that I do not alter it further." But there's really no way to boycott Secure Boot without boycotting all machines with Win8 preinstalled, which has a snowball's chance in hell of working. What you'd really want is Linux preinstalled laptops, but they're still very few and far between. Desktops are less of an issue because you can always build from parts, or have one built for you.
Re: (Score:2)
Clarification: Windows plus ARM. I could have sworn that after all the times I typed Microsoft the point would be clear, but apparently not. I did not intend to point all the blame on ARM, which again leads back to why my wording was focused so much on Microsoft. People still seem to fail to get the point.
As it is, the most we can do is not buy computers that meet both of these specifications: Windows RT running on an ARM processor. By doing so we are effectively surrendering and increasing their (again
Re: (Score:2)
As it is, the most we can do is not buy computers that meet both of these specifications: Windows RT running on an ARM processor. By doing so we are effectively surrendering and increasing their (again, Microsoft's) power to further destroy our freedom in the future
It's the same deal with iOS isn't it? Even with Android phones you need to work to root them. Same thing for Tivos, TVs, consumer linux routers, etc; the device and software are sold as a single package. Hardly a new evil Microsoft thing, and not even controversial outside of the FSF.
But I agree 100% that if you don't like it don't buy it.
Re: (Score:2)
It's somewhat "new" for Microsoft and the main line of Windows though. DOS and the original Windows line for x86 has traditionally never been this locked down. Microsoft makes it big with an open architecture, then locks down heavily the first chance they get of getting on a new processor. What good is a processor if it will only run code that the OS' author says it can?
I'm still wondering... (Score:3, Interesting)
*sigh* (Score:3)
To quote Wikipedia "The board of directors includes representatives from eleven "Promoter" companies: AMD, American Megatrends, Apple, Dell, HP, IBM, Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies."
No its not just Microsoft.
Re: (Score:2)
In order to get a motherboard certified it is required that the user be able to enter their own keys.
Except on ARM devices certified for Win8. At which time they are the single gatekeeper.
Fuck Microsoft.
--
BMO
Re: (Score:2)
Re: (Score:2)
Currently Apple have alternative suppliers for the components that go into the iPhones, but they are the ones who ultimately do the packaging and shipping. Are you saying that if Microsoft did the packaging and shipping it would be okay for them to ban dual-booting? Are you sayin
Re: (Score:2)
You softies are fucking ridiculous.
Honestly.
--
BMO
So, other than anticompetition... (Score:2)
Whatever was the problem with the standard BIOS that we've had for decades? Having the PC's most "hardware-near" firmware locked down only to run code permitted by a third party seems like an extremely bad idea. The whole point of a computer is that it obeys MY instructions blindly and perfectly.
I know, I've heard the argument for security, but has anyone ever even seen real, actual BIOS malware? As far as I'm concerned, that only exists in theory.
Re: (Score:2)
As I understood it, the reason for uefi was being able to boot from big harddisks, having prettier hardware-setting-screens, having a builtin network stack for remote maintenance, and so on. It is questionable whether it was necessary to specify pretty much a complete operating system including cli, just to run another OS, and the recent samsung brick fun, is a good hint that manufacturers will need a few years to iron even the bigger kinks out of their implementation, but uefi itself is in theory not witho
Re: (Score:2)
Personally I don't think that was a bug. But a feature that was released a 'bit' too early.
If you have the money, i say stockpile some non uefi motherboards, either to sell later at many times the price you bought them when their value goes up to those who use non window's os's. or for you to use when stuff dies.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Try google...
Re:only (Score:5, Interesting)
True. Except that it can be used to bypass secure boot:
1. Boot secure OS.
2. Hack it, get root.
3. Write hibernate image to the drive containing your hacked kernel, which includes disabling of the code to delete the image after use.
4. Trigger reboot.
5. Pwnage.
It'd take some very impressive skill to do that - it isn't something you could just make a script-kiddie toolbox for. The only way to prevent this is for the kernel to use TPM hardware to sign the boot image. As this isn't yet an option, it's debated if Secure Boot linux should also disable hibernation, in order to be strictly compliant, even though it introduces much user annoyance to provide protection against an attack that would be near-impossible for even the best hacker to pull off.
Re: (Score:2)
True. Except that it can be used to bypass secure boot:
1. Boot secure OS.
Easy, assuming Microsoft operating systems are defined as a "secure OS", which they are for purposes of secure boot, despite all evidence to the contrary.
2. Hack it, get root.
Easy, assuming a Microsoft OS again...
3. Write hibernate image to the drive containing your hacked kernel, which includes disabling of the code to delete the image after use.
No need to disable such. Once you're at the stage of "waking" into a hacked kernel to boot, you can just write a new image each reboot, becoming how you always boot from then on. In any case, the only real trick here, regardless of which way you decide to handle reboots, is writing a hibernate image and hacking the o
Re: (Score:2)
True. Except that it can be used to bypass secure boot: 1. Boot secure OS. 2. Hack it, get root.
Why exactly have you included steps 3 and 4? The way I see it, you can jump from 2 straight to 5!
Re: (Score:2)
Why exactly have you included steps 3 and 4? The way I see it, you can jump from 2 straight to 5!
rootkit.
Re: (Score:3)
True. Except that it can be used to bypass secure boot: 1. Boot secure OS. 2. Hack it, get root. 3. Write hibernate image to the drive containing your hacked kernel, which includes disabling of the code to delete the image after use. 4. Trigger reboot. 5. Pwnage.
OK, I get where you're coming from, but you fail to see that Secure Boot and TPM are completely pointless endeavors, and they're FULL of holes because the OSes are FULL of holes. If there's a mistake in the kernel code that allows a root level exploit to happen then it can simply be re-exploited each time you boot your system, see? No need to mess with the boot-up files. Even if your CPU is running encrypted instructions of signed programs once you find some data that triggers a buffer overflow, you can
Re: (Score:2)
Install Ubuntu and run Windows under VirtualBox, or vice versa if you're a gamer.
I honestly don't understand why anyone dual boots anymore. I just seems inconvenient, in my opinion.
Re: (Score:2)
You've never used a Hypervisor, have you?
Re: (Score:2)
2-3 days a week, actually. Gentoo/Funtoo host and various guests.
Having to reboot my system to use another OS is inconvenient.
Re: (Score:2)
Some things need low-level hardware access to work that a VM can't do. Try running a triple-headed accelerated monitor setup from a VM. No easy thing. There's also a substantial memory overhead in virtualisation - if you've only got a laptop with a gig or two of ram, then you can't afford to throw 500MB of that away holding Windows in memory to host your Linux VM or vice versa.
Re: (Score:2)
In what situation would you need hardware accelerated access to two operating systems? Choose a host OS you use most and boot up your Guest OS on ome of those displays. Honestly I've never seen the value in multiple monitors. On linux we have Virtual Desktops for a reason.
Also I don't know anyone who would ever need to dual boot on a system with only 1GB of RAM. And if they did it was for gaming, and they wouldn't be limited by RAM as thry would have adequate hardware. And again, if they are gamers on a lap
Re: (Score:2)
Honestly I've never seen the value in multiple monitors.
Everyone stopped reading right here. Seriously.
More pixels for less money than single monitor solutions. You were talking about value, right? Then why is it that you didnt even try the value calculation?
Re: (Score:2)
One monitor with 8 virtual desktops has more screen real estate than 3 physical monitors for the cost of one monitor.
You can only focus on one screen at a time anyway, so what is the purpose of cocking your head over to look at something when you could simply switch virtual desktops?
I keep 8 available on my desktop workstations and 6 on my laptop.
Re: (Score:2)
Wubi doesn't support UEFI. Once it does, it can use the same signed bootloader that Ubuntu currently uses.
Re: (Score:2)
That's how you learn not to have sex on top of your PC tower, with router next to it, and with no additional furniture for support in the end game.
Re: (Score:2)
Because then you have to convince every motherboard manufacturer to install your key too.
Re: (Score:3)
The issue is, what keys come with the motherboard. for now, Microsoft guaranteed. So, the obvious short term solution (although problems like everyone h