Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 8 OEM specs may block Linux booting

itworld.com

Post reply on HN
Print view View original

121–130 of 146 posts

Re: Windows 8 OEM specs may block Linux booting

#121

Post by roel_v »

rbanffy wrote: post #112
roel_v wrote: post #103

Earlier quoted context omitted.

Re: versioning, you can dump the registry in text format with regedit /e and save it to a text file. It's true that you can't keep an svn directory with config files like in Unix, you can still get the same with a few batch scripts that call svn update/regedit. However, more importantly, you hardly ever need to because you can do most of your server management centrally so that you never have to manually work with th…

> Re: versioning, you can dump the registry in text format with regedit /e and save it to a text file. The idea of diffing a registry dump fills my heart with horror. > First, all config formats are different - from the bizarre (Sendmail) to fairly sensible (Apache), but each one requires separate tools/scripts. I am quite happy editing them with vi or emacs (when available). I also like joe a lot - it reminds me of…

"I am quite happy editing them with vi or emacs"

Sure, so am I (well except for Sendmail configs). We were talking about programmatically editing here.

"And, when I wanted to parse my own config files, I always had libraries to do it ready."

Really? How do you, in bash, write a script to change, or if necessary add, an 'IndexAllowed' directive to a certain specific VirtualHost? Mind you, Apache config files can Include other files (and many distros ship with default config files that use this).

"Are you trying to build a GUI tool to edit Apache configuration files?"

I'm not building anything, I was just using this as an example of things you'd want to script, for example in the context of a web hosting provider who wants to automate the creation of new customer setups. (Yes I realize that there are many way to attack this specific problem, but most of them are very specific to Apache and would have to be re-engineered for each problem)

Re: Windows 8 OEM specs may block Linux booting

#123

Post by roel_v »

rbanffy wrote: post #111
tbrownaw wrote: post #77

Earlier quoted context omitted.

> Nobody uses Windows as a server OS Which is why my employer really doesn't use Outlook/Exchange for email, or Sharepoint for the intranet, or IIS for the public website, or ActiveDirectory to manage logins and whatever else it does, or .... Maybe you mean, "nobody uses only Windows as a server OS"? But even tho that would work for my employer (we also have Linux and AIX) and probably all large companies (including…

> Which is why my employer really doesn't use Outlook/Exchange for email, or Sharepoint for the intranet, or IIS for the public website, or ActiveDirectory to manage logins and whatever else it does, or .... If you really have to live with all that stuff, I'm deeply sorry for you. I use Exchange and AD and it's bad enough.

Oh come on, seriously? I'm not saying it's the best thing ever, but it works well enough for the majority of small businesses. There is nobody who is really inconvenienced by having to use AD (it's not like most people would even notice). At least it provides a default and standard authentication system, unlike the hacks I've seen where people use rsync to distribute /etc/passwd and /etc/shadow to all machines (and don't get me started on that piece of junk OpenLDAP, I have yet to meet the first person who could build a complete and working centralized auth environment with it.)

Re: Windows 8 OEM specs may block Linux booting

#124

Post by lvillani »

rbanffy wrote: post #107
lvillani wrote: post #91

Earlier quoted context omitted.

Foreword: I've been using various flavors of Linux for a good chunk of the last decade (since 2001) and totally ignored Windows until last year, so I am no Windows fanboy. 2. This may be true for the good old cmd.exe but.. have you tried PowerShell? I've been playing with PowerShell 2 on Windows 7 and found that it leaves little to be desired. It is self-documenting (a-la Emacs). It can be extended using .NET. You ca…

> I've been using various flavors of Linux for a good chunk of the last decade (since 2001) and totally ignored Windows until last year, so I am no Windows fanboy. You know there is a fallacy there, don't you? It's perfectly possible to ignore something for decades and still fall in love with it later. I've seen lots of Windows and Linux fanboys fall for OSX and become very annoying in the process. I can believe you…

> [...] It's perfectly possible to ignore something for decades and still fall in love with it later.

> [...] I can believe you are no Windows fanboy without you presenting credentials.

You're right. Sometimes I believe it is better to point out where I am coming from (especially when replying to the "anti-something" kind of posts) to avoid to be seen as a fanboy. I always try to be as unbiased as possible. Maybe I'm just being overly considerate.

Re: Windows 8 OEM specs may block Linux booting

#125

Post by slowpoke »

jrockway wrote: post #8

I doubt any major vendor will do this. First off, they don't want to be locked into selling Microsoft-only machines. If they can't pretend Linux is an option, Microsoft can charge them $1000 for a Windows license and there's nothing they can do about it. If they have Linux hanging over Microsoft's head, though, they'll get better pricing on Windows. (Think this won't happen? It already did with XP on netbooks. When M…

> Yup, Microsoft Word is much nicer than LibreOffice Writer or AbiWord. But you don't know that if you've never used it. Or, you don't care, because you're writing a memo, not a book. And that's $600 Microsoft loses right there.

The very last thing for which I'd consider using MS Word (or any WYSIWYG processor, for that matter) would be writing a book (or any prolonged text which concentrates on the content). Seriously, if you do this you've never even thought about the fact that there are alternatives which are vastly superior for such tasks (one of which being plaintext. Yes, plaintext). I don't get why you would even consider writing a book in a document processor - save for LyX, but that's not exactly a standard word processor.

Sorry for the rant, I mostly agree with you. The general development still scares me though.

Re: Windows 8 OEM specs may block Linux booting

#126

Post by rbanffy »

roel_v wrote: post #121
rbanffy wrote: post #112

Earlier quoted context omitted.

> Re: versioning, you can dump the registry in text format with regedit /e and save it to a text file. The idea of diffing a registry dump fills my heart with horror. > First, all config formats are different - from the bizarre (Sendmail) to fairly sensible (Apache), but each one requires separate tools/scripts. I am quite happy editing them with vi or emacs (when available). I also like joe a lot - it reminds me of…

"I am quite happy editing them with vi or emacs" Sure, so am I (well except for Sendmail configs). We were talking about programmatically editing here. "And, when I wanted to parse my own config files, I always had libraries to do it ready." Really? How do you, in bash, write a script to change, or if necessary add, an 'IndexAllowed' directive to a certain specific VirtualHost? Mind you, Apache config files can Inclu…

> We were talking about programmatically editing here.

I am not sure it's a good idea. Just generating the files from a CMDB and placing them in the servers seems the simplest approach. I do it. This way I have the nice side effect that anything a sysadmin did directly and manually on the server bypassing the config database (something that shouldn't really be done) gets wiped out as soon as possible.

> in bash

Almost every Unix out there has Python, Perl and Ruby already installed. You don't need to use bash unless you really want it.

Re: Windows 8 OEM specs may block Linux booting

#127

Post by rbanffy »

roel_v wrote: post #123
rbanffy wrote: post #111

Earlier quoted context omitted.

> Which is why my employer really doesn't use Outlook/Exchange for email, or Sharepoint for the intranet, or IIS for the public website, or ActiveDirectory to manage logins and whatever else it does, or .... If you really have to live with all that stuff, I'm deeply sorry for you. I use Exchange and AD and it's bad enough.

Oh come on, seriously? I'm not saying it's the best thing ever, but it works well enough for the majority of small businesses. There is nobody who is really inconvenienced by having to use AD (it's not like most people would even notice). At least it provides a default and standard authentication system, unlike the hacks I've seen where people use rsync to distribute /etc/passwd and /etc/shadow to all machines (and d…

> I have yet to meet the first person

If you come to Brazil, I can introduce you.

Re: Windows 8 OEM specs may block Linux booting

#128

Post by elehack »

dorian-graph wrote: post #53
bitops wrote: post #51

Agree that its a non-issue. Linux is established, would be a really dumb move to block it like this. In two weeks we'll have forgotten all about it.

It's TPM like fear-mongering again.

Could it be that the "fear-mongering" and subsequent outrage is a major reason why we didn't have this kind of lock-down 5-10 years ago?

I thing mjg's wait-and-see approach is good to do. Not panic yet. But certainly not to forget either - keep an eye out, see how it develops, and be prepared to oppose lock-down through various channels should it come (and hopefully before it is to late).

Re: Windows 8 OEM specs may block Linux booting

#129

Post by bri3d »

darklajid wrote: post #62
dpark wrote: post #30

Earlier quoted context omitted.

> If that doesn't work, the need for booting non-standard Windows images will save us. I've never worked for any company that ran a stock Windows install -- everyone rolls their own. If new machines won't boot this image, guess what, that new machine is bought from some vendor that doesn't do this to them. That's not how this works. It doesn't expect that the entire OS install is signed. It expects that the kernel is…

Where do you see the requirement that the kernel has to be signed? I only see them mentioning the boot loader, which should be something entirely different (both on Windows and Linux, as far as I'm aware. I admit that my knowledge about the Windows boot process is incomplete). If I'm correct (?) your whole reply to that point was a bit over the top, especially the 'tell me where you work so that I can ignore you' par…

I think the idea behind the signed bootloader is that the kernel that the bootloader loads will then be trusted as well. In this way the chain of trust moves up the boot stack and the risk of an early-boot / kernel rootkit can be minimized, especially if the kernel also tries to verify the authenticity of all modules it loads into kernel space (which Windows already does and has for quite some time - please note that I specified "tries").

I don't think this will affect corporate Windows installations as you'd presumably be installing a signed kernel and signed drivers - as the post above yours states, it's very rare to use a non-Microsoft-supplied kernel and unsigned drivers in the corporate environment today.

Signing a Linux bootloader could be perceived as a potential breach of this trusted boot process, as Windows could then potentially be loading in an emulated environment created by a malicious GRUB module or the like. Chances are, nobody subscribing to Trusted Boot will ruin their marketability by either a) not providing a way to disable the trust verification or b) not signing a Linux bootloader. However, that possibility is what has the rash of speculative "Linux won't run anymore!!!" articles running around the internet this week.

More solid info on the trusted boot process can be derived from:

http://lanyrd.com/2011/bldwin/shkft/

Re: Windows 8 OEM specs may block Linux booting

#130

Post by oopsdude »

darklajid wrote: post #62
dpark wrote: post #30

Earlier quoted context omitted.

> If that doesn't work, the need for booting non-standard Windows images will save us. I've never worked for any company that ran a stock Windows install -- everyone rolls their own. If new machines won't boot this image, guess what, that new machine is bought from some vendor that doesn't do this to them. That's not how this works. It doesn't expect that the entire OS install is signed. It expects that the kernel is…

Where do you see the requirement that the kernel has to be signed? I only see them mentioning the boot loader, which should be something entirely different (both on Windows and Linux, as far as I'm aware. I admit that my knowledge about the Windows boot process is incomplete). If I'm correct (?) your whole reply to that point was a bit over the top, especially the 'tell me where you work so that I can ignore you' par…

FTA, quoting Red Hat's Matthew Garrett:

Secondly, in the near future the design of the kernel will mean that the kernel itself is part of the bootloader. This means that kernels will also have to be signed.

Post reply on HN