Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

linuxveda.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#61

Post by pgeorgi »

tbrownaw wrote: post #44

https://technet.microsoft.com/en-us/windows/dn168167.aspx "All Certified For Windows 8 PCs allow you to trust a noncertified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems." That's listed separately from disabling secure boot, which is what this article (and the previous Ars Technica article) are about. Is there any reason to think…

There are two ways to edit the key databases:

1. Without Secure Boot they're open to whatever you want to write.

2. With Secure Boot, they're open to whatever you want to write, as long as it's signed with a key that's trusted by the current database.

So if you can't disable Secure Boot, you need to ask Microsoft to sign your key data, before you can add it. Might as well request a directly signed key (within the MS trust chain) then - from there, you can also overwrite things to honor a new trust chain, and Microsoft is probably more used to requests of this kind than to the other.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#63

Post by jacquesm »

This whole discussion is misguided. It's not about Linux on 'windows machines', there are no such things as 'windows machines', there are only computers. Giving microsoft the ability to lock out their future competition (emphatically not linux) is where it goes wrong. Computers are universal machines, this idiocy makes all this hardware an extension of a single (software!) corporation that gets to decide after you buy the hardware what you can do with it. If I decide to roll my own operating system I'm chanceless to get the kind of support I need in order to get off the ground in the first place.

Imagine Microsoft had had this capability in the early 90's, it would have been a complete disaster. That server you're running linux/FreeBSD/OpenBSD on today would have been running Microsoft software instead.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#64

Post by pgeorgi »

kedean wrote: post #59

Honest question: what's the defense that makes this not monopolistic behavior? This is MS going around trying to get all of the vendors for hardware to switch over to a system for which they are both the client AND the gatekeeper. The end goal is clearly to prevent anyone from entering the consumer operating system space without their express permission, giving them full monopoly over the consumer OS space. This woul…

The defense is that other vendors can get their key signed for $99, and Microsoft promises to only retract it in case of security issues.

Redhat made Linux compliant to this scheme (through Shim), so there's an example for the concept, and "choice".

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#65

Post by hurin »

For some reason I thought it would be interesting to keep Windows 8 on my laptop to a dual boot with linux. Three hours of blank screen boots later I realized it was the microsoft boot-loader's fault (which absolutely refused to load Linux correctly or to link to a different bootloader, even with secure boot disabled) - and deleted it's entry in the EFI shell.

For the average user installing an OS is hard enough, without the gotchas of figuring out how to correctly adjust BIOS, UEFI and switch bootloaders.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#66

Post by powertower »

nightcracker wrote: post #31
powertower wrote: post #5

It costs $99 to sign the software. I'm sure most of the distros can afford that (unless they take a die-hard stand, in which case, just don't buy a Windows pre-loaded PC from the OEM that disables the option to run Linux with).

While the price is disgusting, the price is not what matters most. The reason this is absolutely outrageous is that Microsoft gets to say what OS's you're allowed to install, because they control what they sign.

Unless I'm mistaken, I think it's the OEM that decides whether to allow the option of turning off secure boot... Not Microsoft.

It's whoever implements and controls the BIOS.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#67

Post by pgeorgi »

wantab wrote: post #17

While some are saying it's only optional and up to the hardware vendors, isn't Microsoft giving Windows7 users a free upgrade? Is this the reason? A potential lock in?

That might accelerate the switch over.

While there is no real reason given why Microsoft decided to change their policy on Windows 8 / x86 (originally they requested Secure Boot enabled and enforced), I suspect it was due to their large corporate customers. They feared that after the Win8 release they couldn't buy machines without Win8 Logo (probably right) and thus can't image the Windows 7 (or even older) they still used internally onto new machines.

So Microsoft gave them some more time to make the switch, and with pushing Windows 10 like this, they want to purge old Windows versions from the market, and quickly. In terms of Secure Boot this means that there's no business case (for Microsoft) anymore to keep non-Secure Boot around.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#68

Post by pgeorgi »

pbz wrote: post #54
stonogo wrote: post #23

Earlier quoted context omitted.

My organization provides the disk images to the manufacturer for the computers we buy. This isn't about "paying a fee for software." It's about the fact that Microsoft has used its industry influence (and cozy relationship with Intel) to attach itself like a parasite to the process of bootloading in UEFI. We currently pay our manufacturers to install our signing keys into UEFI; this is fantastically expensive. It's a…

How much are we talking about?

$99 (not sure for which time period) and the risk of losing your cert whenever Microsoft thinks you compromised their platform.

Canonical uses kernels without signature checking, where you can just load new kernel modules. In principle this allows to hack into a "Secure Boot" Windows in a day or so (rough draft: have a kernel module, eg. kexec, that runs Tianocore, which can load and run Windows, and pretend the system is "secure" while there's random crap running in the background).

I think Microsoft is silent about Canonical's use of Secure Boot for now, but they might change their tune (and once there's a PoC, they certainly will).

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#69

Post by Perseids »

mark_l_watson wrote: post #2

Ubuntu, Redhat, and other distros are compatible with secure boot. I understand the concern, but the flip side is that if secure boot makes my future Ubuntu laptops more secure that could be a good thing. Linux is here to stay. Relax.

Remember that `SecureBoot`ed Kernels only load signed kernel modules, because otherwise you could still run arbitrary kernel code. Thus with locked secured boot you cannot ever use self-compiled kernel modules, e.g. Nvidia driver and ZFS.

Re: Machines shipping with Windows 10 may see OEMs enforcing Secure Boot

#70

Post by everyone »

BinaryIdiot wrote: post #30
everyone wrote: post #21

That is really shitty. Though its only an OEM thing? If you build your own machine your still ok I guess.

> That is really shitty. They're simply easing restrictions on their hardware partners especially since many enterprise customers only want signed software running on their machines. This is really not a big deal.

Yeah I've been reading some more of the informed comments here. The uefi thing turned out to not be that big of a deal. I certainly dont know much about how the hardware sector works. I am just a consumer. I guess I will not panic until I hear more about this. Though I will now been checking any laptops or mobos I buy for this.
Post reply on HN