Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Torvalds clarifies Linux's Windows 8 Secure Boot position

zdnet.com

Post reply on HN
Print view View original

71–80 of 147 posts

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#71

Post by recoiledsnake »

etherealG wrote: post #27
aphexairlines wrote: post #25

How are PC vendors hoping to sell laptops to corporate buyers whose IT departments want to reimage all those machines (a lot of them with Linux images) without wasting time going into UEFI setup menus to turn off Secure Boot one machine at a time?

these cases are more easily covered by the corporation's key being included in those machines. big numbers of machines warrant that kind of effort from the manufacturer. the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model.

>the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model.

It does. You can add your own key and even remove Microsoft's if so wish. The facts are getting lost in this FUDstorm.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#72

Post by tbrownaw »

rwmj wrote: post #34
jwoah12 wrote: post #21

Earlier quoted context omitted.

> it's telling that no other operating system except Windows commonly suffers from this problem. This is an honest question, as this area isn't my specialty, but could this be for the same reason that people used to perpetuate the myth that Macs don't get viruses? Attackers simply target the platform with the largest market share.

Linux servers are far more common than Windows servers, and servers usually have loads of bandwidth making them especially valuable targets for spammers and fraudsters.

Unlike desktops, servers are mostly run by people who have at least some idea of what they're doing.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#73

Post by mauvehaus »

_ea1k wrote: post #49
recoiledsnake wrote: post #47

Earlier quoted context omitted.

In Brazil or anywhere, can you buy a car with the default sound system ripped out and get a refund for it? What about without the default tires, seats or even the engine?

The default tires and default sound system have residual value when ripped out. I am sure that the dealer would be happy to give you some fraction of their worth and then provide you the car without them. Or you could sell them yourself. Windows, OTOH, is something that you pay for, but generally comes in an OEM license. This license is non-transferable in most cases.

I'm not sure the dealer would be willing to refund you for the factory sound system because the residual value of the factory sound system is almost certainly miniscule compared to the cost of labor involved in removing it.

Why is the residual value so small? Lack of standardization. A lot of automakers use their own mounting system for the head unit, which means if I bought a Lexus and asked the dealer to take out the head unit, the dealer wouldn't be able to turn around and sell it to somebody who wanted a better unit in their Ford. It goes beyond the mounting system though.

A lot of automakers have their own plug and wiring standards too. If you buy an aftermarket head unit, you usually get a pigtail that plugs into it with unterminated wires on the other side. Then you buy a wiring harness kit specific to your car which has unterminated wires running into a plug that connects to the vehicle harness. Soldering ensues (or wire nuts or electrical tape for the lazy...). Since the aftermarket does have a strong incentive to standardize, the wires on the pigtail that come with the head unit match the colors of the wires in the harness kit, which actually make the process pretty straightforward if you're even halfway handy.

What all of that means is that the unit out of your hypothetical Lexus (which doesn't come with a pigtail with unterminated wires) is going to be hell to get working in somebody else's Ford. Between the physical and electrical incompatibility, the residual value of a head unit has to be pretty close to zero for anybody who doesn't own basically the same car.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#74

Post by micampe »

mhurron wrote: post #68
cooldeal wrote: post #44

Linus posted a NSFW rant about it a few days ago. The story mysteriously went off the HN front page and subsequent submissions of the story went [dead]. http://news.ycombinator.com/item?id=5279531 Rankings graph showing a deep dive. http://hnrankings.info/5279531/ Part of Linus' email: >Guys, this is not a dick-sucking contest. If you want to parse PE binaries, go right ahead. >If Red Hat wants to deep-throat Microso…

HN dislikes anything that shows that real people have real emotions. Humour, anger and whatnot have no place here.

HN dislikes everything, just like the rest of the internet.

Every day someone comments saying that HN is biased against their team (see your sibiling “MS astroturfers” comment), and it’s always a different team, often opposites.

Yes, it’s annoying.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#75

Post by cooldeal »

meaty wrote: post #23
UnoriginalGuy wrote: post #4

The thing about secure boot is that it is a GOOD idea done very badly indeed. What was needed was for a trusted neutral party(or two) to be the owner of the root key, and for that organisation to hand out child keys (e.g. Microsoft, Open Source Initiative, Apple, etc) who could in turn generate child keys (all of which could be revoked). Essentially we need the "internet model" of key exchanges for this too. I cannot…

No it's a shit idea from end to end. Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not. I think that is what Linus is saying. Google for "certificate authority compromised" and you'll see what utter wads of shit for brains this could be entrusted to.

>Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not

With UEFI secure boot, you can delete Microsoft's key and add you own.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#76

Post by kevinoid »

meaty wrote: post #23
UnoriginalGuy wrote: post #4

The thing about secure boot is that it is a GOOD idea done very badly indeed. What was needed was for a trusted neutral party(or two) to be the owner of the root key, and for that organisation to hand out child keys (e.g. Microsoft, Open Source Initiative, Apple, etc) who could in turn generate child keys (all of which could be revoked). Essentially we need the "internet model" of key exchanges for this too. I cannot…

No it's a shit idea from end to end. Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not. I think that is what Linus is saying. Google for "certificate authority compromised" and you'll see what utter wads of shit for brains this could be entrusted to.

You can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection?

1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi...

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#77

Post by recoiledsnake »

martinced wrote: post #67
cooldeal wrote: post #44

Linus posted a NSFW rant about it a few days ago. The story mysteriously went off the HN front page and subsequent submissions of the story went [dead]. http://news.ycombinator.com/item?id=5279531 Rankings graph showing a deep dive. http://hnrankings.info/5279531/ Part of Linus' email: >Guys, this is not a dick-sucking contest. If you want to parse PE binaries, go right ahead. >If Red Hat wants to deep-throat Microso…

MS astroturfers? (they've pretty much ruined /. by now, wouldn't be surprised if they took control of HN too)

I don't think flagging is enough to take a post from #2 to ~#200 in less than five minutes.

My guess is the voting ring detector got triggered or it was mod action. The subsequent submissions of the same story from other outlets going dead suggests that it was mod action.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#78

Post by tomjen3 »

recoiledsnake wrote: post #71
etherealG wrote: post #27

Earlier quoted context omitted.

these cases are more easily covered by the corporation's key being included in those machines. big numbers of machines warrant that kind of effort from the manufacturer. the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model.

>the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model. It does. You can add your own key and even remove Microsoft's if so wish. The facts are getting lost in this FUDstorm.

Well it wouldn't have been a fud storm if Microsoft hadn't insistet on it being turned on by default.

But if I were to remove a MS key, am I right in assuming that that would prevent anybody from running windows on that machine (at least without installing the key or turning it of)?

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#79

Post by MrScruff »

mhurron wrote: post #68
cooldeal wrote: post #44

Linus posted a NSFW rant about it a few days ago. The story mysteriously went off the HN front page and subsequent submissions of the story went [dead]. http://news.ycombinator.com/item?id=5279531 Rankings graph showing a deep dive. http://hnrankings.info/5279531/ Part of Linus' email: >Guys, this is not a dick-sucking contest. If you want to parse PE binaries, go right ahead. >If Red Hat wants to deep-throat Microso…

HN dislikes anything that shows that real people have real emotions. Humour, anger and whatnot have no place here.

Is that a problem? There are plenty of other sites filled with cat memes and incoherent ranting for those that seek that.

Re: Torvalds clarifies Linux's Windows 8 Secure Boot position

#80

Post by meaty »

kevinoid wrote: post #76
meaty wrote: post #23

Earlier quoted context omitted.

No it's a shit idea from end to end. Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not. I think that is what Linus is saying. Google for "certificate authority compromised" and you'll see what utter wads of shit for brains this could be entrusted to.

You can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection? 1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi...

Yes I know this but its more the fact that there is no CRL that a new device can import so you are not in control of the pre-seeded keys. So if you have kit on the shelf for months and MS's private key is leaked or cracked then you have a large stock of compromised machines waiting to roll. I doubt any average PC retailer will be able to deal with manual key revocation. The same goes for your average government agency or health service.

It should ship with no PKI/certificate scheme at all. We don't need it and it doesn't work and its blatantly obvious.

Secure boot is entirely worthless from end to end.

Post reply on HN