Slashdot Mirror
Microsoft Responds To Linux Concerns Over Windows 8 and UEFI Secure Boot
CSHARP123 writes "A few days ago, Red Hat employee Matthew Garrett speculated that OEM machines shipping with copies of Windows 8 may lock out support for Linux installations. Garrett highlighted Microsoft's new Secure Build OEM requirements for Windows 8 systems. Microsoft chose to directly respond to confusion surrounding Windows 8's use of the UEFI Secure Boot feature on Thursday. Tony Mangefeste of Microsoft's Ecosystem team said, 'Microsoft supports OEMs having the flexibility to decide who manages security certificates and how to allow customers to import and manage those certificates, and manage secured boot. We believe it is important to support this flexibility to the OEMs and to allow our customers to decide how they want to manage their systems.'"
"Consumers should run Windows, and they should not have any ability to boot up anything else. 'Enterprise' users who can afford to pay more should have more choice."
That is the only way I can see this playing out. What OEM would not jump at the opportunity to control its users and force people to pay more to do something they have been able to do at no cost all these years?
Palm trees and 8
Summary:
If the vendors don't provide a way to boot other systems its not our fault!
"Microsoft will attempt to use our gorilla status to force OEMs to lock out non-Windows operating systems, but ultimately, it's their decision as to whether they want to make it possible for you to run what you want on their computer, or whether they want us to not bomb them into the stone age and build a parking lot on the smoking ruins of their company."
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
if the computer's locked down, blame the OEM, not us.
Hail Eris, full of mischief...
E pluribus sanguinem
Let's hope that this isn't an empty promise
We're talking Microsoft here, you might as well hope that a leprechaun will bring you a pot of gold so that you can retire in never-never land and live happily ever after.
Are Microsoft's customers the OEMs, or consumers. If the former, what incentives would OEMs have to pass the decision on to consumers?
Leela: "Is all the work done by children?" Alien: "No, not the whipping."
...by confirming them. Microsoft's customers, the OEMs, will be free to decide who imports keys and how. That's what everybody has been worrying about, isn't it?
Nutshell summary after actually reading the TFA:
"You can launch any operating system you like, but if you want to benefit from UEFI secure boot protection, you can only launch Windows 8."
From their screenshots and commentary, there doesn't appear to be any opportunity to add a new "trusted" O/S images to their database. So even signing your secure Red Hat Enterprise Linux won't help you. If you want to use it, you need to turn the bootloader security checks off. The obvious implication, if you want MBR protection you must run Windows 8. Anything else opens the door.
Yup, Red Hat's take on the situation seems the most accurate.
Just take a look at this image.
That's all you need to know.
In Summation: There is a genuinely good reason for enabling secure boot (malware prevention - genuine malware prevention, not just some underhand tactic that's masquerading as malware protection) and as long as your OEM isn't a dick, you should be able to disable it much like how you can disable features in your BIOS today. The decision to remove that ability is down to the OEM, not Microsoft.
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
Building your own machines will be a bit of a problem if all the new motherboards do the same thing. Do you honestly think the DIY vendors will not march to that drum unless they're gunning for the Linux user crowd in the first place?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Linux has been able to use EFI at boot time since early 2000, using the elilo EFI boot loader or, more recently, EFI versions of GRUB.[21]
Which is from the UEFI wiki page and Linux documentation. The issue is that the boot might be locked, not that Windows 8 will find and delete Linux partitions, so really this has nothing to do with Microsoft, it has to do with OEM systems. If your concerned about this effecting you then build your own computer and it wont matter.
That's what it does right now, in the demo hardware. If you want to run anything other than Windows 8, you just have to go untick an option in the setup screen. The big fear of slashdotters is that once this is supported in hardware, it would be so, so easy for an OEM to remove that option, and they may well do so under pressure either from Microsoft or possibly as part of a data-collection/adware/network-locking subsidy deal similar to that already frequently seen in the mobile phone sector, where firmware-locking is the norm. Think Windows tablets more than desktops.
Meanwhile under the table: Psst...Hitachi... want to sell another Windows box ever again? No BEOS in our BIOS, please.
Stallman is possibly the most prescient (not best by a long shot, but most prescient) sci-fi writer ever. Everyone calls him a nut and then a couple decades later...he was totally, 100% right. Yeah it's not rocket science and he only writes near-future stuff, but still, he has a nearly flawless record.
"When information is power, privacy is freedom" - Jah-Wren Ryel
There is still cause for concern and the concern is misdirected at Microsoft. The bigger cause for concern should be the Motherboard manufacturers. Look at the issue from their perspective. They pre-install a certain number of certificates at the factory (Windows 8...).
They then have the choice on whether or not they want you to be able to install additional certificates beyond what it came with from the factory. In order to do this they have to enable the feature to allow the certificate store to be updated or the feature to be turned off. They also have to manage additional new certificates and or supporting the user installing their own. That means that they have to provide tech support to allow you to do this. That means additional testing beyond what it comes from the factory, additional support costs for users having trouble and so on.
Their financial interest is arguably in making sure that the certificates they expect you to need are included and that you have no way to modify this as that costs them money for what they will perceive as a market that isn't worth catering to. There is also the added fact that a motherboard that is locked to a certain Operating System can't run a new Operating System when it comes out. That translates into planned obsolescence where the user /has/ to replace their motherboard when a shiny new OS comes out that they want.
There is only one thing I can think of that would prevent this issue from being widespread on most motherboards. Enterprise environments need to use tools like Altiris to deploy OS's with PXE boot. If an enterprise can't image their computer they can't use it in fleet deployments and they won't buy it. Of course this does nothing to protect home users that don't have this requirement.
Bottom line, UEFI is an issue, but not for the reasons that everyone thinks it is.
I love the "translation" posts because I hate them all individually -- none of them stress my way of looking at the problem. Here's my translation:
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
How many non-technical home users install a new OS on their hardware? How many of them even bother with an upgrade to a later version of Windows? The percentage has to be so small as to be non-existant. I'm not trolling here, I think its a legitimate question.
To expand on it. Computers have become commodity devices. People buy one, use it up, buy a new one in the same way they do TVs etc. As long as it lets them do the things they want they don't really care if its got the latest software on. They certainly don't care enough to install a new operating system. Most of them wouldn't even know that this was an option. This is the general population, not the tech elite that read slashdot. So, does this stop people who want to install a different OS from installing it? Yes and no. They might find that its not worth buying systems made by X, but they could always build their own, or buy from a different OEM that provides the access they need.
TL;DR its not a problem that will affect the vast majority of users. Those that it will affect will have an understandable way around it.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
He warned us about everything years ago. Literally. By now, GPL2 should have ended the world. Occasionally, he becomes correct. But even a broke clock is correct twice a day.
I respect the man, and all he has done for software, and computing. But he is far to extreme. The truth is in the middle.
Unless you have some sort of proof that Microsoft forced the OEMs to not allow it to be disabled and did not allow for other OS's to be installed, any such cases would be immediately thrown in the trash where they belong. And no, a bunch of whining and 'what ifs' and 'it could happen' and even 'it happened before' do not count as proof.