Slashdot Mirror
Microsoft Responds To Linux Concerns Over Windows 8 and UEFI Secure Boot
CSHARP123 writes "A few days ago, Red Hat employee Matthew Garrett speculated that OEM machines shipping with copies of Windows 8 may lock out support for Linux installations. Garrett highlighted Microsoft's new Secure Build OEM requirements for Windows 8 systems. Microsoft chose to directly respond to confusion surrounding Windows 8's use of the UEFI Secure Boot feature on Thursday. Tony Mangefeste of Microsoft's Ecosystem team said, 'Microsoft supports OEMs having the flexibility to decide who manages security certificates and how to allow customers to import and manage those certificates, and manage secured boot. We believe it is important to support this flexibility to the OEMs and to allow our customers to decide how they want to manage their systems.'"
"Consumers should run Windows, and they should not have any ability to boot up anything else. 'Enterprise' users who can afford to pay more should have more choice."
That is the only way I can see this playing out. What OEM would not jump at the opportunity to control its users and force people to pay more to do something they have been able to do at no cost all these years?
Palm trees and 8
Summary:
If the vendors don't provide a way to boot other systems its not our fault!
"Microsoft will attempt to use our gorilla status to force OEMs to lock out non-Windows operating systems, but ultimately, it's their decision as to whether they want to make it possible for you to run what you want on their computer, or whether they want us to not bomb them into the stone age and build a parking lot on the smoking ruins of their company."
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
...by confirming them. Microsoft's customers, the OEMs, will be free to decide who imports keys and how. That's what everybody has been worrying about, isn't it?
Nutshell summary after actually reading the TFA:
"You can launch any operating system you like, but if you want to benefit from UEFI secure boot protection, you can only launch Windows 8."
From their screenshots and commentary, there doesn't appear to be any opportunity to add a new "trusted" O/S images to their database. So even signing your secure Red Hat Enterprise Linux won't help you. If you want to use it, you need to turn the bootloader security checks off. The obvious implication, if you want MBR protection you must run Windows 8. Anything else opens the door.
Yup, Red Hat's take on the situation seems the most accurate.
There is still cause for concern and the concern is misdirected at Microsoft. The bigger cause for concern should be the Motherboard manufacturers. Look at the issue from their perspective. They pre-install a certain number of certificates at the factory (Windows 8...).
They then have the choice on whether or not they want you to be able to install additional certificates beyond what it came with from the factory. In order to do this they have to enable the feature to allow the certificate store to be updated or the feature to be turned off. They also have to manage additional new certificates and or supporting the user installing their own. That means that they have to provide tech support to allow you to do this. That means additional testing beyond what it comes from the factory, additional support costs for users having trouble and so on.
Their financial interest is arguably in making sure that the certificates they expect you to need are included and that you have no way to modify this as that costs them money for what they will perceive as a market that isn't worth catering to. There is also the added fact that a motherboard that is locked to a certain Operating System can't run a new Operating System when it comes out. That translates into planned obsolescence where the user /has/ to replace their motherboard when a shiny new OS comes out that they want.
There is only one thing I can think of that would prevent this issue from being widespread on most motherboards. Enterprise environments need to use tools like Altiris to deploy OS's with PXE boot. If an enterprise can't image their computer they can't use it in fleet deployments and they won't buy it. Of course this does nothing to protect home users that don't have this requirement.
Bottom line, UEFI is an issue, but not for the reasons that everyone thinks it is.
Incorrect.
This seems to be a common misunderstanding with the whole thing. Windows will boot no matter what, be it secure or unsecure. It's not Windows' decision, it's the UEFI system's decision if it should boot windows, Linux or whatever.
The whole point of the secure boot is to prevent malware that fucks with the bootloader, allowing rootkits to be inserted into the Kernel before any anti-malware gets a chance to run.
This is how a chain of trust works.
A -> B -> C -> D
A, ideally, is some hardcoded software that cannot be modified. In games consoles, it's usually a part of a ROM or in the Xbox-360's case, it's on the CPU itself. It checks that B hasn't been modified in any way, shape or form and if it passes, boots it. B then does the same for C and so on and so forth.
The principal is exactly the same here. If you disable UEFI secure, all you're doing is saying "Dear A, don't bother checking B, just boot the fucking thing". B will then happily continue on as normal, booting C which then boots D. At some point, D can look back and check that A, B and C haven't been modified but it's almost pointless because if they've already been compromised, they'll feed the next in the chain whatever the fuck the compromiser wants it to.
A = UEFI bootloader
B = Windows Bootloader
C = Windows
D = Anti-malware
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
I love the "translation" posts because I hate them all individually -- none of them stress my way of looking at the problem. Here's my translation:
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
If you are buying a PC because it has a little sticker on the device that says Windows 8, then you are almost guaranteed to be in the group that could care less whether it's enabled or not as you aren't going to be putting Linux, OpenBSD, etc on it.
How many motherboard and hardware manufacturers do you think there are who don't want to be able to put a 'Designed for Windows 8' sticker on the box?
When Microsoft says your hardware must lock out Linux to get that magic sticker, manufacturers will lock out Linux.