Please create an account to participate in the Slashdot moderation system


Forgot your password?
Microsoft Operating Systems Windows Linux

Microsoft Responds To Linux Concerns Over Windows 8 and UEFI Secure Boot 389

CSHARP123 writes "A few days ago, Red Hat employee Matthew Garrett speculated that OEM machines shipping with copies of Windows 8 may lock out support for Linux installations. Garrett highlighted Microsoft's new Secure Build OEM requirements for Windows 8 systems. Microsoft chose to directly respond to confusion surrounding Windows 8's use of the UEFI Secure Boot feature on Thursday. Tony Mangefeste of Microsoft's Ecosystem team said, 'Microsoft supports OEMs having the flexibility to decide who manages security certificates and how to allow customers to import and manage those certificates, and manage secured boot. We believe it is important to support this flexibility to the OEMs and to allow our customers to decide how they want to manage their systems.'"
This discussion has been archived. No new comments can be posted.

Microsoft Responds To Linux Concerns Over Windows 8 and UEFI Secure Boot

Comments Filter:
  • Translation (Score:5, Insightful)

    by betterunixthanunix ( 980855 ) on Friday September 23, 2011 @08:53AM (#37490080)
    "Consumers should run Windows, and they should not have any ability to boot up anything else. 'Enterprise' users who can afford to pay more should have more choice."

    That is the only way I can see this playing out. What OEM would not jump at the opportunity to control its users and force people to pay more to do something they have been able to do at no cost all these years?
    • by Rich0 ( 548339 )

      Well, more like:

      "Vendors should provide a simple and standard way that lets us get our OS on any PC out there. Others are welcome to come up with vendor-specific hacks or negotiate with every vendor out there as they wish. You see, we're a monopoly so they come to us and we tell them what to do, and good luck competing with that..."

      • Re:Translation (Score:5, Insightful)

        by JamesP ( 688957 ) on Friday September 23, 2011 @09:03AM (#37490198)

        No, the problem is:

        BIOS vendors are complete idiots

        "EFI" vendors are the same guys

        It's a crapfest of proprietary extensions, NIH syndrome and a million ways to change monitor brightness. And of course it's only tested on the latest Windows version, well, because...

        Of course, Intel is to blame with the whole ACPI mess and looseness. Typical engineer mentality a standard that standardizes nothing.

        Really, Intel and AMD should join forces in this: Make 'to change monitor brightness write a value from 0 (darker) to 0xff (brighter) to register 0xABC PERIOD'. "but but but", "I SAID PERIOD".

        • Re:Translation (Score:5, Interesting)

          by TheRaven64 ( 641858 ) on Friday September 23, 2011 @09:22AM (#37490404) Journal

          NIH syndrome

          NIH is the reason why UEFI exists at all. OpenFirmware already existed, had several independent implementation (including some open source ones), and was a free standard that anyone could implement. So Intel made a new 'standard' that is a crappy copy of OpenFirmware.

          • by JamesP ( 688957 )


            This is a mixture of corporate greed and engineering mentality of NIH syndrome

            And of course, vendors took ages to implement UEFI, MS took ages to boot from UEFI, etc, etc

        • Re:Translation (Score:5, Informative)

          by diegocg ( 1680514 ) on Friday September 23, 2011 @09:42AM (#37490644)

          ACPI was not designed by Intel alone, Microsoft was also there. And let's remember what Microsoft tried to do []:

          From: Bill Gates
          Sent: Sunday, January 24, 1999 8:41 AM
          To: Jeff Westorinon; Ben Fathi
          Cc: Carl Stork; Nathan Myhrvold; Eric Rudder
          Subject: ACPI extensions

          One thing I find myself wondering about is whether we shouldn't try and make the "ACPI" extensions somehow Windows specific.

          It seems unfortunate if we do this work and get our partners to do the work and the result is that Linux works great without having to do the work.

          Maybe there is no way to avoid this problem but it does bother me.

          Maybe we could define the APIs so that they work well with NT and not the others even if they are open.

          Or maybe we could patent something related to this.

          • Re: (Score:3, Insightful)

            by makomk ( 752139 )

            Entirely coincidentally, most of the really buggy ACPI implementations out there - the ones that cause the most headaches for Linux and other OSes - are generated by a Microsoft tool that's carefully crafted to generate code that breaks under other OSes. It's probably also a coincidence that Microsoft encourages vendors to use WMI, a way of extending ACPI which means that every single laptop in existence needs its own drivers for stuff like hotkeys, backlight control etc, and these drivers are for some odd

      • by HJED ( 1304957 )
        This would also damage backwards compatibility with older versions of Windows, more likely you will have to change a BIOS setting to turn it off or get annoying messages (such as when you access a website with a self signed SSL cert.) when you try to boot anything other then Windows 8. So it's bad, but not that bad.
        • This appears to be strictly feature driven by UEFI, and Win 8 supports this secure 'feature'. This functionality was apparently in UEFI all the time but not supported in Windows. What this appears to saying is that your motherboard (or PC manufacturer as the case may be) will be able to decide just how locked down your EFI is in regards to 'allowed' boot loaders. Windows doesn't have much to do with it other than opting in to that additional security. I'm guessing this was done to try and avoid rootkits?


          • by HJED ( 1304957 )
            They appear to be adding SSL style authentication of boot loaders, however many OEMs will distribute with only the equivalent of a root certificate for Windows meaning they would not boot linux (or any other OS) without disabling this feature .
            The article is saying that to sell Win 8 logo branded products manufactures will have to support this feature, but there will be an option for OEMs to add more certificates and a setting to turn it off.
    • If there's a demand for it some OEMs will satisfy the demand.This is pretty obvious actually.
      • Re:Translation (Score:4, Insightful)

        by LWATCDR ( 28044 ) on Friday September 23, 2011 @09:52AM (#37490792) Homepage Journal

        The OEMs for the most part will make it a user option for a simple reason.
        A lot of people when Windows 8 comes out will want to keep Windows 7. If they have an install disk and it doesn't work their will be hell to pay.
        Right now the UEFI folks are all going to be putting in an option to turn it off. Intel will without a doubt have that option in all of their reference motherboards which is what a lot of the OEMs use.
        ASUS will put in that option as well.

        The problem will be when at some point in the future someone has an old crappy Ultra book made by Ikkkiianu and wants to put Linux on it because Windows 9 doesn't work well on it and Windows 8 is too insecure.

      • Re:Translation (Score:4, Insightful)

        by Hatta ( 162192 ) on Friday September 23, 2011 @10:02AM (#37490900) Journal

        But only some. Today you can throw Linux on any old hardware, and do something useful with it. 5-10 years from now, you'll have to specifically hunt down unlocked hardware. This has a rather drastic effect on the utility of Linux, which is Microsoft's intention.

    • What OEM would not jump at the opportunity to control its users and force people to pay more to do something they have been able to do at no cost all these years?

      Those who don't want to lose business to the ones who don't charge more?

    • Re: (Score:2, Flamebait)

      by MrHanky ( 141717 )

      Is that so? Practically all OEMs force a Windows license on you, and have done so since forever (1995), as that's more profitable for them. None of them cares whether you actually use it, and I see no reason why they should start now.

      I say you're a shit translator.

      • by daid303 ( 843777 ) [] has been selling machines without OS for years. They have a whole range of machines, just just 1 for the linux guys. They'll assume you pirate windows or install Linux. And they'll happily sell you windows if you ask for it. They also have shops in all parts of the Netherlands, so they are not just some small single location store.

        • Re:Translation (Score:5, Insightful)

          by MrHanky ( 141717 ) on Friday September 23, 2011 @09:54AM (#37490820) Homepage Journal

          I'm well aware of how to buy computers, thank you very much. I'm just pointing out that forcing people to pay for Windows isn't new, and has fuck all to do with control. betterunixthanunix's "translation" is just a bunch of hyperbolic nonsense based on the theory that Microsoft will always be more evil than Satan himself, despite whatever the people at Microsoft claim themselves.

          Of course, since this is Slashdot, facts are flamebait and paranoid fantasies are insightful.

          • Re: (Score:3, Insightful)

            by jedidiah ( 1196 )

            You're an idiot to base any argument on what Microsoft SAYS they will do.

            They only thing that is remotely relevant is what they have actually done.

            Do they have that well established history of not being totally evil yet? Can you point to it as a counterexample to everyone else's paranoid?

            If not then you really have nothing to add to this conversation.

    • I'd honestly be more worried about the combination of pressure from Team DRM(sure, we'd be happy to make our "Inspired by Inspiron" new release film collection available for the right price; but look at all the vagabonds on your trusted keys list...) and the general OEM tendency toward a "least effort" model of firmware development, especially; but not exclusively, in consumer hardware.

      There is a long, sordid, history of BIOSes being released that don't even work well enough to keep the spec sheet from b
      • by jedidiah ( 1196 )

        Yeah but Microsoft is head cheerleader for Team DRM. This is a big part of the problem.

        If the AACS cartel tells Gates to get on all fours and bark, he'll do it. Microsoft has gone there and done that already. They just might dictate draconian UEFI lockdown to keep special DRM stuff that they've already got and no one else does (BluRay, CableCard).

    • I saw it as "We're going to leave it up to the OEMs on what to do, just as we leave the choice of what OSes they sell up to them right now. They'll be completely free to choose whether to maintain exclusivity agreements with us which may require UEFI bootloader signing. See, it's not us, it's the OEMs. ^_^ "

    • Read up on rootkits. Some rootkits inject themselves into the boot process and get loaded before the operating system starts, and thus make it effectively impossible for the operating system to detect their presence. This UEFI secure boot process is an attempt to prevent that kind of rootkit from working. They describe it right there in the page, look at the Figure 2 diagram for current boot processes and the Figure 3 diagram for what UEFI secure boot does.

      Google's Chromebook devices use the exact same
      • Re: (Score:2, Insightful)

        by Hatta ( 162192 )

        The technology is clearly intended to block adoption of Linux (and other operating systems), or they'd provide a way for the owner of a device to whitelist new operating systems. BIOS rootkits are a convenient excuse.

      • Re:Translation (Score:5, Insightful)

        by betterunixthanunix ( 980855 ) on Friday September 23, 2011 @10:51AM (#37491606)
        As if I have never heard of a rootkit?

        In all seriousness, here is another method of solving the problem, which would be just as effective at preventing rootkits from hiding in the bootloader: make the boot medium a flash device on the motherboard, and have a jumper that enables writes to that device. This would not rob users of control over their system (although it may force people to get over their fear of opening their computer's case and changing a jumper), and would be just as effective at stopping the overwhelming majority of rootkits.

        The real motive here is the same as it ever was with the TPM: they want to market Windows as a "media platform" and their "media partners" do not like the idea of users being able to control their own computers -- they want to enforce restriction technologies. GNU/Linux is an operating system that its users control, and so these "media partners" do not want to see it installed on anyone's computer. Likewise, they do not want to see people modifying Windows in a way that circumvents DRM. They want computers to be like cell phones and cable TV boxes, herding the users in ways that are convenient for various copyright-based corporations.

        That this will block certain classes of rootkits is entirely incidental, despite the heavy marketing.
        • In all seriousness, here is another method of solving the problem, which would be just as effective at preventing rootkits from hiding in the bootloader: make the boot medium a flash device on the motherboard, and have a jumper that enables writes to that device.

          Heck, a $0.10 switch on the back of the case...

  • Useless response (Score:4, Insightful)

    by Chrisq ( 894406 ) on Friday September 23, 2011 @08:53AM (#37490084)
    If the vendors don't provide a way to boot other systems its not our fault!
    • Agreed, little more than shifting blame to the OEMs.

      They'll be free to maintain exclusivity agreements with MS which may require bootloader locking, or they can not sell any Windows PCs. If Klupendorf Computers in Switzerland is the last company on earth selling unlocked PCs at Alienware prices, well, tough luck, that's capitalism.

      I warned you fucking Apple fanboys this would happen. Thanks a lot, douchebags.

    • by tixxit ( 1107127 )

      It's a real shame too. Even if most higher end PCs add the "flexibility" to let linux boot no problem, I'd hate to be the kid that wants to experiment with his computer, but whose parent's didn't consider what BIOS came w/ it and whether it could boot Linux when they bought it. When I was a kid, my sound didn't work and my video card was barely supported, but at least I could boot and play around in Linux.

    • Been saying it for a while now. People laugh.

      Just keep laughing.

  • translation (Score:5, Insightful)

    by drinkypoo ( 153816 ) <> on Friday September 23, 2011 @08:55AM (#37490100) Homepage Journal

    "Microsoft will attempt to use our gorilla status to force OEMs to lock out non-Windows operating systems, but ultimately, it's their decision as to whether they want to make it possible for you to run what you want on their computer, or whether they want us to not bomb them into the stone age and build a parking lot on the smoking ruins of their company."

    • "Microsoft will attempt to use our gorilla status to force OEMs to lock out non-Windows operating systems, but ultimately, it's their decision as to whether they want to make it possible for you to run what you want on their computer, or whether they want us to not bomb them into the stone age and build a parking lot on the smoking ruins of their company."

      The open source community is no longer a fringe and it grows as the years go by. If the OEMs want to engage in this behavior, members of the open source community (and I include myself as I run OpenBSD) could always just do an end run around the problem. In fact, with coreboot, the open source BIOS, it already makes easier. Also, there is nothing stopping us from building our own PCs and just voting with our wallets.

    • Best translation yet.

  • by Nimey ( 114278 ) on Friday September 23, 2011 @08:58AM (#37490136) Homepage Journal

    if the computer's locked down, blame the OEM, not us.

    • I think the general problem is the concept that the organizations with the ability to lock (and unlock) the resources are not the end-users, but the manufacturers.

      It's the old tradeoff between responsibility and freedom: if computer users want "security" in their systems but don't want to be responsible for achieving that security (and instead give that responsibility to the hardware and software OEMs) then those users must by necessity give up some freedoms.

      I think the issue here is that moves like this do

      • by maxume ( 22995 )

        What are you talking about?

        A motherboard or uefi vendor can a have a system giving the user the full ability to control the feature (a hardware switch, the ability to install new keys, etc), or they can only install Microsoft's keys and lock the user out. So it really matters what the actual practice ends up being, and it isn't at all clear what is going to happen.

        It doesn't seem that likely to me that the various hardware vendors will shoot themselves in the feet by locking to Microsoft here (Microsoft won

    • Please also ignore the fact that our contract with the OEM required them to lock down their systems.

  • by jaminJay ( 1198469 ) on Friday September 23, 2011 @09:00AM (#37490164) Homepage

    Are Microsoft's customers the OEMs, or consumers. If the former, what incentives would OEMs have to pass the decision on to consumers?

    • "Consumers" are just cattle. Enterprise licensees, though, carry some clout.

      This doesn't help much with cheap consumer systems, or all the various no-you-can't-just-build-one-from-newegg-parts tablets and laptops and other consumer gear; but it does largely ensure that "Enterprise" desktops, laptops, and servers will have some sort of keyfill mechanism, quite possibly offered at an additional cost...
  • by Anonymous Coward on Friday September 23, 2011 @09:00AM (#37490170) confirming them. Microsoft's customers, the OEMs, will be free to decide who imports keys and how. That's what everybody has been worrying about, isn't it?

  • by DontBlameCanada ( 1325547 ) on Friday September 23, 2011 @09:01AM (#37490182)

    Nutshell summary after actually reading the TFA:
            "You can launch any operating system you like, but if you want to benefit from UEFI secure boot protection, you can only launch Windows 8."

    From their screenshots and commentary, there doesn't appear to be any opportunity to add a new "trusted" O/S images to their database. So even signing your secure Red Hat Enterprise Linux won't help you. If you want to use it, you need to turn the bootloader security checks off. The obvious implication, if you want MBR protection you must run Windows 8. Anything else opens the door.

    Yup, Red Hat's take on the situation seems the most accurate.

    • I think the definition of "trusted" is being stretched here.

      The only thing I trust about Windows is that it's going to somehow line Microsoft's wallet with good old-fashioned dollars, directly or indirectly.

      They can't even say the name honestly. Windows 8? Hello? It's an earlier version than Windows 95? It's an upgrade to Windows 3.11? What the hell is wrong with "Windows NT version 6.3" ???

  • by neokushan ( 932374 ) on Friday September 23, 2011 @09:05AM (#37490224)

    Just take a look at this image [].

    That's all you need to know.

    In Summation: There is a genuinely good reason for enabling secure boot (malware prevention - genuine malware prevention, not just some underhand tactic that's masquerading as malware protection) and as long as your OEM isn't a dick, you should be able to disable it much like how you can disable features in your BIOS today. The decision to remove that ability is down to the OEM, not Microsoft.

    • by samjam ( 256347 ) on Friday September 23, 2011 @09:10AM (#37490270) Homepage Journal

      yes. Well put.

      And I want secure TPM booting for my linux/GNU machines too.

      I want a way to install my key, enabled by a physical key & mechanic switch to electrically enable to update operation to write my signing key.

    • Yes, just like BEOS (Score:3, Interesting)

      by Anonymous Coward
      Meanwhile under the table: Psst...Hitachi... want to sell another Windows box ever again? No BEOS in our BIOS, please. []
    • The image shows a computer that allows you to switch UEFI secure boot off and on.

      And that's great, as long as every computer offers this option. The danger is that in the not too distant future, OEM's may start building computers that don't have that option. It may be attractive for them to build computers that are "locked" in the same way that many phones are locked. It is up to us in the free world to continue to raise a big stink to make sure that doesn't happen, at least not without a fight.
      • Re: (Score:3, Informative)

        by neokushan ( 932374 )

        You know something? I completely, utterly and wholeheartedly agree with this.

        What I'm trying to get at is that everyone is jumping on Microsoft for this, when really it has little to do with them (aside from mandating that UEFI secure boot be enabled by default). Microsoft could turn around tomorrow and say "no actually it's fine, we don't want secure boot by default" and the situation wouldn't be any different at all - OEMs could still enable it and remove the option to disable it.
        Using your phone example

        • by cdrudge ( 68377 )

          What I'm trying to get at is that everyone is jumping on Microsoft for this, when really it has little to do with them (aside from mandating that UEFI secure boot be enabled by default). Microsoft

          And they aren't mandating UEFI secure boot be enabled by default. They are only mandating it if you want to put a little sticker on the device that says "Designed for Windows 8".

          If you are buying a PC because it has a little sticker on the device that says Windows 8, then you are almost guaranteed to be in the gr

          • by 0123456 ( 636235 ) on Friday September 23, 2011 @11:52AM (#37492592)

            If you are buying a PC because it has a little sticker on the device that says Windows 8, then you are almost guaranteed to be in the group that could care less whether it's enabled or not as you aren't going to be putting Linux, OpenBSD, etc on it.

            How many motherboard and hardware manufacturers do you think there are who don't want to be able to put a 'Designed for Windows 8' sticker on the box?

            When Microsoft says your hardware must lock out Linux to get that magic sticker, manufacturers will lock out Linux.

        • by http ( 589131 )

          Why? Some of us have working memories.
          Microsoft would love nothing more than to lock out other operating systems at the hardware level, and the bootloader is the critical first step. Why isn't 55% of the computing world using BeOS? Because MS controlled the bootloader via OEM contracts, possible only because of their monopoly position.

          "I once preached peaceful coexistence with Windows. You may laugh at my expense -- I deserve it."
          --Jean-Louis Gassée, CEO of Be

          I believe the reason we will ha

        • Well, Microsoft tends to have a bad history of passive-aggressively fucking people. I am not particularly knowledgeable when it comes to low-level computing stuff like this, but here is what I think a lot of folks are worried about:

          1) Microsoft says Windows 8 will need secure boot to boot.
          2) Microsoft says OEMs are responsible for allowing the end-user to enable or disable secure boot.
          3) Microsoft, behind closed doors, tells numerous OEM vendors, "Yeah, you're welcome to offer hardware that allows the
      • Maybe you should only buy computers that allow you to disable secure boot then. Or is that too obvious and uncontroversial?

        • The problem is that the number of Best Buy computer purchasers outnumber the number of us. There's little incentive for HP/Dell/etc. to continue supplying non-locked systems. Eventually, it'll be build it yourself expecting to put non-Windows in it or you'll never put anything but Windows in it. What would encourage a person going off to college to investigate if their PC could load Linux beforehand? When said student finds out about Linux... are you saying they should also be required to build a new PC

    • If you disable it then it is not genuine prevention any longer? If you disable it then win8 no longer boots. Microsoft get governments to consider it as part of the bid process and gets the governments to put it in the contracts. Certification takes significantly longer for non Microsoft products thus giving Microsoft the competitive advantage. If a contractor seems to be close they can slow down certification till they get the bid.

      This is rife with abuse potential.

      • by neokushan ( 932374 ) on Friday September 23, 2011 @10:25AM (#37491192)

        If you disable it then it is not genuine prevention any longer? If you disable it then win8 no longer boots.


        This seems to be a common misunderstanding with the whole thing. Windows will boot no matter what, be it secure or unsecure. It's not Windows' decision, it's the UEFI system's decision if it should boot windows, Linux or whatever.

        The whole point of the secure boot is to prevent malware that fucks with the bootloader, allowing rootkits to be inserted into the Kernel before any anti-malware gets a chance to run.

        This is how a chain of trust works.

        A -> B -> C -> D

        A, ideally, is some hardcoded software that cannot be modified. In games consoles, it's usually a part of a ROM or in the Xbox-360's case, it's on the CPU itself. It checks that B hasn't been modified in any way, shape or form and if it passes, boots it. B then does the same for C and so on and so forth.

        The principal is exactly the same here. If you disable UEFI secure, all you're doing is saying "Dear A, don't bother checking B, just boot the fucking thing". B will then happily continue on as normal, booting C which then boots D. At some point, D can look back and check that A, B and C haven't been modified but it's almost pointless because if they've already been compromised, they'll feed the next in the chain whatever the fuck the compromiser wants it to.

        A = UEFI bootloader
        B = Windows Bootloader
        C = Windows
        D = Anti-malware

    • as long as your OEM isn't a dick

      That's a pretty big assumption right there.

      And I should point out, this isn't just Dell or HP or Lenovo or something, it's also motherboard manufacturers who can get in on this game.

  • If they modified the standard so that the system would give a confirmation popup saying

    "You are about to load an unsigned operating system, do you want to do so? To continue may compromise the security of your system.

    This way people could load Linux if they wanted but the "joe average" would know something is wrong if he was compromised by a boot virus. This would actually be more sensible than preventing other systems, otherwise they will have literally thousands of hackers trying to discover the boot sig

    • That's what it does right now, in the demo hardware. If you want to run anything other than Windows 8, you just have to go untick an option in the setup screen. The big fear of slashdotters is that once this is supported in hardware, it would be so, so easy for an OEM to remove that option, and they may well do so under pressure either from Microsoft or possibly as part of a data-collection/adware/network-locking subsidy deal similar to that already frequently seen in the mobile phone sector, where firmware
  • This has nothing to do with Microsoft, the fact that Windows 8 will use UEFI is a choice just like any other choice. Linux supports UEFI,

    Linux has been able to use EFI at boot time since early 2000, using the elilo EFI boot loader or, more recently, EFI versions of GRUB.[21]

    Which is from the UEFI wiki page and Linux documentation. The issue is that the boot might be locked, not that Windows 8 will find and delete Linux partitions, so really this has nothing to do with Microsoft, it has to do with OEM systems. If your concerned about this effecting you then build your own computer and it wont matter.

  • "Microsoft wrote an article about how they weren't making it harder to install Linux which described, in detail, how they're making it harder to install Linux. Here's my response" - []

  • The problem with the secure boot system is that it won't work. It will fail for the same reason that DRM encryption on DVD's and BD disks failed. They were eventually 'cracked'. As soon as a third party OS (Linux, BSD, Mac, etc) is available for installation on systems with secure boot the 'secret' will be out to the malware writers and they will find ways to get in via subterfuge.

  • by onyxruby ( 118189 ) <<ten.tsacmoc> <ta> <yburxyno>> on Friday September 23, 2011 @10:21AM (#37491146)

    There is still cause for concern and the concern is misdirected at Microsoft. The bigger cause for concern should be the Motherboard manufacturers. Look at the issue from their perspective. They pre-install a certain number of certificates at the factory (Windows 8...).

    They then have the choice on whether or not they want you to be able to install additional certificates beyond what it came with from the factory. In order to do this they have to enable the feature to allow the certificate store to be updated or the feature to be turned off. They also have to manage additional new certificates and or supporting the user installing their own. That means that they have to provide tech support to allow you to do this. That means additional testing beyond what it comes from the factory, additional support costs for users having trouble and so on.

    Their financial interest is arguably in making sure that the certificates they expect you to need are included and that you have no way to modify this as that costs them money for what they will perceive as a market that isn't worth catering to. There is also the added fact that a motherboard that is locked to a certain Operating System can't run a new Operating System when it comes out. That translates into planned obsolescence where the user /has/ to replace their motherboard when a shiny new OS comes out that they want.

    There is only one thing I can think of that would prevent this issue from being widespread on most motherboards. Enterprise environments need to use tools like Altiris to deploy OS's with PXE boot. If an enterprise can't image their computer they can't use it in fleet deployments and they won't buy it. Of course this does nothing to protect home users that don't have this requirement.

    Bottom line, UEFI is an issue, but not for the reasons that everyone thinks it is.

  • by Sloppy ( 14984 ) on Friday September 23, 2011 @10:39AM (#37491412) Homepage Journal

    I love the "translation" posts because I hate them all individually -- none of them stress my way of looking at the problem. Here's my translation:

    Microsoft supports OEMs having the flexibility to decide who manages security certificates, because they are our customers, not the users. Fuck the users, why should they have any decision making power in what their computers are allowed to do? We didn't get to be the marketshare leader by leaving decisions to users. Those aren't the people who sign per-processor licensing deals in the millions.

  • by MrMickS ( 568778 ) on Friday September 23, 2011 @11:01AM (#37491820) Homepage Journal

    How many non-technical home users install a new OS on their hardware? How many of them even bother with an upgrade to a later version of Windows? The percentage has to be so small as to be non-existant. I'm not trolling here, I think its a legitimate question.

    To expand on it. Computers have become commodity devices. People buy one, use it up, buy a new one in the same way they do TVs etc. As long as it lets them do the things they want they don't really care if its got the latest software on. They certainly don't care enough to install a new operating system. Most of them wouldn't even know that this was an option. This is the general population, not the tech elite that read slashdot. So, does this stop people who want to install a different OS from installing it? Yes and no. They might find that its not worth buying systems made by X, but they could always build their own, or buy from a different OEM that provides the access they need.

    TL;DR its not a problem that will affect the vast majority of users. Those that it will affect will have an understandable way around it.

Always leave room to add an explanation if it doesn't work out.