Linux Foundation Releases Document On UEFI Secure Boot

mvar writes "The Linux Foundation today released technical guidance to PC makers on how to implement secure UEFI without locking Linux or other free software off of new Windows 8 machines. The guidance included a subtle tisk-tisk at Microsoft's Steven Sinofsky for suggesting that PC owners won't want to mess with control of their hardware and would happily concede it to operating system makers and hardware manufacturers." Canonical and Red Hat have also published a white paper (PDF) suggesting that all OEMs "allow secure boot to be easily disabled and enabled through a firmware configuration interface," among other things.

Comments

Let me guess

[0123456]

As I look into my crystal skull through the mists of time I see Microsoft release a white paper saying that OEMs will get $10 off the cost of Windows if they don't allow users to turn off 'Windows boot'?

Re:Let me guess

[Anon-Admin]

$10??? Try a 50% discount. Need to lock them in early then they are always on windows. This would be a major plus for Microsoft, Guaranteeing there market share.

Re:Let me guess

[Bengie]

That would break Win7 and WinPE boot discs.

Re:Let me guess

[robmv]

Consumer devices do not use WinPE disk and many consumer devices manufacturers do not care if you can't go back to a previous Windows version, they will say: "Unsupported", better yet for them if they find a way to lock you and disable upgrade to Windows 9

Re:Let me guess

[brainzach]

Windows will lose money if they give $10 discounts for OEMs to lock out other OS's.

Windows is so successful that Microsoft doesn't need to lock out the competitors. You really think Microsoft fears Linux with its 2% of the desktop market share? Not worth the loss in revenue.

Re:Let me guess

[0123456]

Windows is so successful that Microsoft doesn't need to lock out the competitors. You really think Microsoft fears Linux with its 2% of the desktop market share? Not worth the loss in revenue.

There used to be Linux netbooks. Then Microsoft started offering Windows for free or very low cost to netbook manufacturers. You really think Microsoft feared Linux with its miniscule mobile PC market share?

Re:Let me guess

[brainzach]

There used to be Linux netbooks. Then Microsoft started offering Windows for free or very low cost to netbook manufacturers. You really think Microsoft feared Linux with its miniscule mobile PC market share?

Microsoft was concerned about its product being too expensive to put on low costs netbooks and missing out on the market. They know that once they created the product, that 95% of the users will prefer it to Linux without the need to locking them out. There is no need to anti competitive practices.

Re:Let me guess

[Ahnteis]

The way I heard it, the Linux netbooks just weren't selling.

Re:Let me guess

[tommy8]

In the internet age you can go from monopoly to a lot lower market share in no time. Look at Internet Explorer. It went from 90 percent plus to the 40 percent range in a matter of a few years.

Re:Let me guess

[Rob Y.]

The sold well until Windows netbooks became available. If they hadn't, Windows netbooks wouldn't have come into existence. XP was at end of life at the time, remember?

The thing is, to run Windows, netbooks had to go with hard drives instead of SSD and more memory. And Microsoft mandated maximum screen size and resolution. Today's netbook is just a slightly cheaper cheap laptop - not a whole new device category, and barely worth considering. And in the meantime, tablets have taken off. So the netbook is essentially a dead category. Yeah, they still exist, but they've lost most of their reason for existing.

Re:Let me guess

[Bengie]

The multi-billion dollar Enterprise customers do use both WinPE and previous versions of Windows. It costs an OEM to have separate hardware lines, so they're better off doing the same for both business customers and residential, which means both will support any OS.

Unless you think Dell/Gateway/etc expect corps to stop purchasing hundred of millions in computers for the next decade because many of IT's tools will break with secure boot and they don't want to upgrade from XP/Vista.

That's not including all of the server lines because I'm sure quite a few people purchase server to run Linux/etc. OEMs are suddenly going to cut off those customers because they don't want to include an option to disable it?

Re:Let me guess

[robmv]

ha, don't you think they will not be happy to force enterprise customer to pay extra 100$ more for the same hardware with a firmware setting to disable Secure boot? If they can get away with it, they will do it, and then, when Windows 7 is not supported anymore by MS, just disable that setting on all versions of their new hardware. Consumer oriented devices will be locked down, as I already said, if they can get away with it. Consumer oriented devices != Enterprise oriented device

I'd say that's "mostly" true.

[Petersko]

"...PC owners won't want to mess with control of their hardware and would happily concede that to operating system makers and hardware manufacturers."

Put the word "most" in front of that and I'm on board. The PC as appliance that just works is really is what "most" PC owners want.

Re:I'd say that's "mostly" true.

[tepples]

Because people want certain must-have applications more than they want an appliance. "Secure boot" is advertised as capable of giving them both.

Re:I'd say that's "mostly" true.

[Anonymous Coward]

Because for most people, Windows does just work. (Hate to burst your bubble.) I know where you're coming from, but for a lot of people, Linux just doesn't work. It's a lot better than it used to be, but if that Wifi adapter isn't recognized, they have no idea where to go from there.

Re:I'd say that's "mostly" true.

[SuricouRaven]

Most users have no idea what a wifi adaptor is. They just buy the PC from one OEM or another, and are happy to find it works out the box. They'd be very happy that they don't have to worry about drivers, if they knew what drivers were.

Re:I'd say that's "mostly" true.

[Bert64]

Most users would be just as stuck if faced with a windows install which failed to recognise their wifi adapter...
Stock out of the box windows often fails to recognise hardware, xp was especially bad because it got so dated but 7 is going that way too now...

Users don't install their computers, they buy them preinstalled... There's no reason why a machine preinstalled with linux wouldn't have everything already configured and working, and come with a recovery disc to return it to the factory state... Same as currently happens with windows.

Re:I'd say that's "mostly" true.

[Code Yanker]

If that were true, these multinational tech giants wouldn't have such valuable brands. As it stands now slapping the MSFT logo on something adds perceived value and credibility to it. Like it or not, people think locked-down platforms are great! http://www.forbes.com/2010/07/28/apple-google-microsoft-ibm-nike-disney-bmw-forbes-cmo-network-most-valuable-brands.html

Re:I'd say that's "mostly" true.

[future assassin]

>The PC as appliance that just works is really is what "most" PC owners want.

Actually people just want to own what they bought with out being told what it can and cannot be used for by the manufacturer.

Re:I'd say that's "mostly" true.

[justforgetme]

unfortunately geeks like the avg /. visitor are a dying breed vastly outnumbered by the hordes of the - now hip - undead, media mass consumers.

Re:I'd say that's "mostly" true.

[neokushan]

I've installed windows countless times, I'm a software developer, I build computers, I have made custom (legal) windows installation disks that have drivers and updates slip streamed on them. I've hex edited DVD ROM firmware updates, rooted plenty of Android devices. I'm also pretty good with regular expressions and can use vim in a pinch. Suffice to say, I'm pretty technically inclined and when Linux doesn't recognise my wireless adapter out of the box, I haven't a fucking clue what to do, either.

Re:I'd say that's "mostly" true.

[oakgrove]

As it stands now slapping the MSFT logo on something adds perceived value and credibility

I find that hard to believe. A Dell is going to sell whether it has a Windows logo on it or not. Same with Lenovo, HP, Acer, etc. I don't think that sticker is really that valuable as people expect windows on it and would be shocked if it didn't come with it. What do they need to see a sticker for?

Re:I'd say that's "mostly" true.

[webheaded]

Yeah, I think that if you really sit down and think about it...we all started with Windows (or at least a hell of a lot of us) or are at least absurdly familiar with it to the point that we don't need help with that stuff at all. I don't google for how to make wifi work in Windows...I know what I need. Windows is so common that even some of the normies can figure out some of this stuff because of the vast array of information that even a simpleton can follow out there on the internet. We don't think of it as hard to understand because we are SO used to it. Linux is somewhat more complicated sometimes but the fact remains that either of these things could be done with a little effort and it in either case, a full install of the OS for either would scare the shit out of any normal user if everything did not automatically install itself.

Re:I'd say that's "mostly" true.

[sjames]

That same MOST, however will want their little brother, nephew, kid next door, etc to be able to fix the machine from time to time. They, in turn, may want to boot a live cd as part of the repair process.

Re:I'd say that's "mostly" true.

[therealslartybardfas]

I created an account just to say this. You weren't born with the ability to create windows installation disks that have been slip streamed and other drivers on it. You took the time to learn how to do this. The fact that you didn't take the time to learn how linux wireless adapters work isn't a fault of Linux.

Re:I'd say that's "mostly" true.

[Bucky24]

Most users generally don't have to worry about drivers even if they are on windows. Windows 7 supported my plug-in wireless adapter right out of the box. And even for other things, generally they come with a software CD that you just pop in, run the installer, and everything works.

Re:I'd say that's "mostly" true.

[Bucky24]

I think the vast number of people who own iPhones prove you wrong on that point.

Re:I'd say that's "mostly" true.

[oakgrove]

As it stands now slapping the MSFT logo on something adds perceived value and credibility

is what I replied to. What does that have to do with discounts from MS? Please log in with your answer so I will know who the reading comprehension challenged idiot I am replying to is.

Re:I'd say that's "mostly" true.

[bongey]

sudo lshw -html > hw.html
firefox hw.html
Final step :
http://www.google.com/

Re:I'd say that's "mostly" true.

[Anonymous Coward]

What you've said implies that you have spent a lot of time learning a number of new skills. Learning these skills requires lots of reading and likely trial and error. Why would you have the patience to learn all these new skills, yet not have the patience to figure out how to install the driver for your wireless adapter?

(My background is probably fairly similar to yours (in terms of computing ability). I've used Windows my whole life, tried various Linux based distros, dual-booted with FreeBSD for 6 months, then finally dove right in. One year later, I'm all FreeBSD and now the idea of using Windows seems foreign to me.)

I agree with the statement in the post above yours.

"Users don't install their computers, they buy them preinstalled... There's no reason why a machine preinstalled with linux wouldn't have everything already configured and working, and come with a recovery disc to return it to the factory state... Same as currently happens with windows"

A complete novice would have issues no matter which OS was installed.

Re:I'd say that's "mostly" true.

[FictionPimp]

Which is countered by the huge number of non-tech users who beg me to jailbreak their iphones.

Re:I'd say that's "mostly" true.

[peppepz]

In large part this is driven by people's desire to HAVE locked down hardware where it is perceived as a safer alternative than the crapware infested desktop PC.

The average buyer doesn't even know what crapware is, let alone desire to buy a locked down hardware that is perceived as a safer alternative.
The above average buyer knows that locked down hardware doesn't prevent malware, as spyware applications sold on app stores clearly demonstrate.

Re:I'd say that's "mostly" true.

[shibashaba]

Easy.

Buy one that has drivers for linux.

Re:I'd say that's "mostly" true.

[idontgno]

Unless by "countered" you mean "feebly opposed by inferior number and singular anecdotes", I think you're mistaken.

Random purported fact off teh Intarwebs: 7% of all iPhones are jailbroken. The rest are still in their bright plastic chains.

BTW, this is the result of a single google search. I still trust it more than a wikipedia article, and I would trust that far more than I'd trust your unsupported anecdotal assertion.

I'm just sayin'.

Re:I'd say that's "mostly" true.

[maugle]

Most users generally don't have to worry about drivers even if they are on windows. Windows 7 supported my plug-in wireless adapter right out of the box. And even for other things, generally they come with a software CD that you just pop in, run the installer, and everything works.

...and puts another half-dozen programs in your system tray and sucks away another few percentage points of your computer's performance.

Re:I'd say that's "mostly" true.

[BuildMonkey]

My first programming on a 286 was using DEBUG to create .COM files. I've written AIX device drivers and have used Linux since 1992 and compiled plenty of kernels as well as kernel modules. I work heavily with embedded software.

Despite this I find setting up WIFI under Linux a huge PITA. I normally end up using NDISwrapper. The whole thing reminds me of Winmodems, only I could readily purchase a hardware modem that I knew would do the job. With WIFI vendors continually changing chipsets and firmware versions without changing the model number, buying a "known good" WIFI card is a crapshoot.

Re:I'd say that's "mostly" true.

[Jonner]

Because for most people, Windows does just work. (Hate to burst your bubble.) I know where you're coming from, but for a lot of people, Linux just doesn't work. It's a lot better than it used to be, but if that Wifi adapter isn't recognized, they have no idea where to go from there.

Of course the operating system that is pre-installed on a PC has a huge advantage because the OEM has made sure all of the included hardware works with it. If you buy from one of the few vendors that supports an operating system other than Windows, the other operating system will enjoy the same advantage. For example, I'm using a MacBookPro. All of the hardware works well with OSX, but not all of it works with Linux because Apple's firmware doesn't set up the hardware completely correctly in PC BIOS mode and some of the Linux drivers are missing for the new devices (I'm looking at you Broadcom). Apple does provide some drivers for Windows, but not all of the hardware is fully functional, including the Intel GPU. When I buy a laptop from one of the Linux-supporting vendors like zareason or System76 all of the hardware will work fine with Linux. The reason far more people have trouble getting hardware to work with Linux than Windows is simply that they've bought PCs intended to run Windows and ones designed to run Linux are rare.

For most people, Windows just works until it doesn't. Quite often, that's because they were careless and got malware. I've seen and had to clean up many such machines. Very little of that malware relies on modifying bootloaders or Windows kernel, so UEFI secure boot won't do a lick of good against it. No machine running a desktop operating system can seriously be called an appliance like a fridge or car, least of all Windows. Phones and tablets can be appliances as long as no third-party apps are installed, but there's only so much complexity a machine can have before it ceases to be an appliance.

Re:I'd say that's "mostly" true.

[FictionPimp]

It doesn't change the fact that more and more normal people are wanting more control. When my mom is asking me to jailbreak her phone so she can do X with it, I know the trend is changing. My mom is almost incapable of using an iphone out of the box.

Re:I'd say that's "mostly" true.

[betterunixthanunix]

Then put a jumper on the motherboard to enable those modifications. The problem here is that they are only seeking to cater to users who want an appliance, and the people who want to be able to actually modify their system will be left out in the cold. This is the sort of situation that the PC was supposed to free everyone from.

Re:I'd say that's "mostly" true.

[Hatta]

Plug in the ethernet and google it.

Re:I'd say that's "mostly" true.

[Rich0]

I'd go a step further. While most people don't mess with their PC, they indirectly benefit from the fact that it can be done.

The openness of the PC has resulted in OS competition. Now, MS does dominate the landscape with what is probably 99% of the non-Apple PC OS market share. However, the fact that alternatives exist forces them to compete to some extent on price. In the server world they have far less market share - I imagine that in the typical datacenter relatively few servers directly boot windows, and are more likely to boot some hypervisor instead.

You don't actually have to hack your system to benefit from it being open. I also don't have to subscribe to Sprint to benefit from the fact that their existence helps to keep prices down.

Re:I'd say that's "mostly" true.

[shutdown -p now]

A year ago, I had interesting time trying to do just that - I needed a USB wireless adapter in this case, and I spent about 30 minutes in front of the shelf with them in the store, looking up each one on my smartphone to check its Linux compatibility.

And you know what? Not a single one said "it just works". Most had numerous "not working" user reports, some required ndiswrapper, some required patching the kernel driver and manually rebuilding it.

Re:I'd say that's "mostly" true.

[awshidahak]

Yes, when I installed Windows 7 on my box, my wifi did work right away. That was very fortunate because I needed some way to get on the internet to get drivers for my ethernet card which worked out of the box (along with my wifi) on linux.

Re:I'd say that's "mostly" true.

[westlake]

As it stands now slapping the MSFT logo on something adds perceived value and credibility.

I find that hard to believe.

I don't.

Walmart.com stocks 400 Windows PCs.

108 printers. 98 webcams.
900 flavors of the Windows keyboad, mouse, and joystick controller.

It won't be difficult to find a printer that supports the Google Cloud or AirPrint. But you have to be realistic. Product that doesn't support Windows doesn't get shelf space.

It will have a sticker.

Re:I'd say that's "mostly" true.

[lsatenstein]

I believe in the end that UEFI will bite Microsoft in the most vulnerable place. Simply because addon software will bring in hacker code that will result in a certified virtual operating bios that will boot any operating system.

Re:I'd say that's "mostly" true.

[Bert64]

To play devil's advocate...

I didn't start on windows, i started with a C64, later moved to AmigaOS and then migrated on to various unix systems (and at some point have used most unix variants that were around in the 90s). I absolutely cannot stand windows, it is ridiculously arcane compared to the systems i am used to, it does pretty much everything in a different way for no apparent reason and is a source of constant frustration whenever i'm forced to use it. And when things don't go exactly the way they're supposed to, troubleshooting is a horrendous process wether it be poor logging, useless error messages or just the fact that the registry is one big mess with no inline comments and needs specialist tools to edit. I also find that the system gets in your way constantly, patronises you and assumes that the user is a complete idiot...

I actually find configuring wifi by hand on Gentoo linux much easier than trying to get it working on windows,

Re:I'd say that's "mostly" true.

[shibashaba]

Yeah, usb wireless adapters can be a pain. I'm luck enough to have a computer store nearby that has an Ubuntu setup inside, and they don't mind hooking it up for you to see if it'll work. Unfortunately though, I realize most areas don't have anyone like that.

Antitrust but verify

[tepples]

I see Microsoft release a white paper saying that OEMs will get $10 off the cost of Windows if they don't allow users to turn off 'Windows boot'

Then I see US v. Microsoft II.

Re:Antitrust but verify

[TheGratefulNet]

the US does not bite the hand that feeds it.

corporations feed the US. people don't matter anymore.

there are only going to be lawsuits in your dreams, my friend. big business is 'too big to fail' - no matter how large they actually are.

the OWS guys are complaining about this very kind of thing, in fact. but it won't change. the system is already in the hands of the 1% and that's that until the next bloody revolution comes.

Re:Antitrust but verify

[SuricouRaven]

I imagine it'll go like the last one. Microsoft will be fined tens of millions of dollars... after making billions.

Re:Antitrust but verify

[Hatta]

Not going to happen. Microsoft lobbies heavily now.

Microsoft didn't always seek support in Washington. For years, the software giant prided itself on steering clear of national politics and lobbying. But when their legal troubles started, that attitude quickly changed.

"Microsoft, before their anti-trust case, had almost no presence in Washington," Arizona Sen. John McCain told The Chronicle editorial board earlier this year. "Now, I almost don't know a lobbyist who's not on their payroll."

That was in 2001. After a decade of increasing corporate influence in Washington I doubt we'll ever see antitrust action against Microsoft again.

Re:Antitrust but verify

[tepples]

Red Hat and Google are corporations too, as is Free Software Foundation.

Re:Antitrust but verify

[SharkLaser]

Ah yes, lets ignore the fact that rootkits have become a problem and Microsoft wants to secure computers running Windows. No, it is obviously a plan to destroy competing operating systems like Linux. Then we can go on to another article and bash Microsoft for not securing their OS. Because that makes total sense!

Seriously. Even Red Hat and other Linux vendors sound like reasonable here, working to make it compatible. Slashdot comments about MS seem like ones made by lunatics and conspiracy theorists.

Re:Antitrust but verify

[sjames]

Because Microsoft like totally couldn't have suggested a more acceptable approach like requiring that the root key be given to the owner of the PC.

Re:Antitrust but verify

[Riceballsan]

I believe that should be rephrased to "Justice is provided to the highest bidder" FSF and Redhat are both corporations, but unless their pockets are deep enough and ethics low enough to pay equal contributions. Their odds of success are low.

Re:Antitrust but verify

[Forbman]

That may be, but not even all the pigs in the barnyard are equal. The big corps that the OWS people are worried about are the proverbial 700 lb boars and sows that rule the feed trough and shit wherever they damn well please.

Re:Antitrust but verify

[Bucky24]

Well in a way this makes sense. Imagine the people who respond to spam emails and get viruses anyway despite all the protection. If they had the master key, any rootkit could just ask "Please enter your BIOS root key. This is required in order to run this software for some made up reason". And a lot of people would do it. You and I certainly wouldn't, we'd know what it meant. But grandma down the street who already ignores the UAC when installing something she got off the internet wouldn't know the difference. Personally I think that we should be able to GET the root key if we really want it, but it shouldn't come with the machine. That way you have to know what it is in order to get ahold of it. But that assumes customer service at the manufactures (or Microsoft) is actually up to par.

Re:Antitrust but verify

[ddxexex]

The one I'd be worrying about would be IBM.
Google just recently got their so-so patents; Red hat might have patents, but I don't think its enough to scare Microsoft too much. But IBM is quite pro-linux and probably have a patent portfolio large enough to engage in thermonuclear patent warfare with MS if they really wanted to.

Re:Antitrust but verify

[cavreader]

I seem to recall MS faced a few lawsuits from the Federal government a few years back that resulted in them paying some substantial financial penalties and agree to operation changes monitored my the court. Corporations deserve the spotlight to highlight and address their questionable practices. There are several really important changes I would like to see in regards to the corporate use of offshore tax havens and I think some corporations based in the US should be required to employee a certain percentage of US citizens before they offshore their labor force. I don't propose they should be prevented from using offshore labor but there should be some limits set if they would like to keep all the goodies the US provides to corporations in the form off tax breaks.

Re:Antitrust but verify

[0123456]

Ah yes, lets ignore the fact that rootkits have become a problem and Microsoft wants to secure computers running Windows. No, it is obviously a plan to destroy competing operating systems like Linux.

You're right. Microsoft would never set out to lock down the PC platform so it could only run Windows. Why the very idea!

Re:Antitrust but verify

[dpilot]

Other responses to this have replied that RedHat and Google don't spend the campaign contribution $$$ that Microsoft does, and therefore Microsoft can buy Ju$tice here.

The other side of reality is that the server space is heavily Linux, much of that on workstation-class machines, but also many farms are based on commodity-class machines, too. So in this case, it's not just RedHat and Google complaining, it's also IBM, Oracle, Disney/Pixar, Dreamworks, atmospheric modeling people, the petrochemical industry, etc.

My prediction is that the workstation-class market will have the switch from the get-go. Almost all of the commodity-class market will not have the switch, per Microsoft's wishes. But not all - because a few of those commodity-class manufacturers will have special boxes, probably at a slight, but tolerable premium, for the above-mentioned companies. Those few manufacturers will pick up the Linux business, lock, stock, and barrel. After a few quarters of that, some other commodity-class manufacturers will introduce their "Linux-capable" boxes in order to grab that same premium. It'll "race to the bottom" after that.

The real question will then be how do the rest of us get our fingers on those "special Linux machines." At that point, we may not, but some motherboard vendor will realize that he can sell the "Linux-capable motherboard" at a slight premium to those who know that they will get crappy non-Windows support, and also let them shave the Windows support cost into their profit margin, too.

Plus I need to write my Congress-critters. This Microsoft move is curiously soon after they've been released from Antitrust oversight. Maybe it's innocent and in the name of security and all of that, but the timing really stinks. Of course my Congress-critters don't give a hoot that I can't build and boot my own kernel. But I'd hope that they understand that we're shoving yet another piece of science and technology overseas, away from the US, reducing our competitiveness. The tinkerers who become future scientists and engineers will be on foreign shores, as well as those new ideas, products and business opportunities that my not fit into Microsoft's business plans. THAT's what I'll emphasize in my letters.

Re:Antitrust but verify

[cavreader]

One additional item. Corporations are vulnerable to citizen protests but the protests would be a lot more effective if the protesters targeted all their energy on individual corporations one at a time instead of going after an entire industry. CEOs and Board members really don't like being constantly hounded by protesters, cameras, and ambush interviews. Public corporations are required by law to publish a great deal of their business information and finding disgruntled employees or ex-employees can provide even more ammunition to use in the protests. Forensic accountants can review P/L and overall earning documents to identify misleading information. Most citizens have a hard enough time balancing their checking account let alone deciphering complex corporate finance reports. Most Corporate lobbying groups are also required by law to publish documents related to their operations and a little investigating you can even uncover the politicians who interact with the lobby groups affiliated with the corporation and in today's political environment politicians stand to lose a substantial amount of support if they are identified as being in the pocket of a lobbying group and the proof needed to make these connections are readily available. President Obama made a promise to refuse lobbyist money in his re-election campaign but he has used non-registered lobbying groups and 3rd parties to evade the spirit of his promise.

Re:Antitrust but verify

[hairyfeet]

Shit they'd be the easiest to buy off as well. Big blue LIKES teh monies. I can imagine how that conversation would go: "Hey IBM? Yeah its MSFT, have you SEEN the sales figures for the X360? Sweet huh? And you remember how some corps used PS3s as HPCs? yeah we're planning on slaughtering that segment too...picture this, an X720 that can be BOTH a game machine and rack mountable blade! Cool huh? Now imagine it saying in giant letters "The MSFT X720...powered by IBM" doesn't that sound nice? You could have the big blue logo in front of every kid in America! And of course your Lenovo division would have special code provided by us so YOU WOULD BE THE ONLY ONE that could provide dual boot workstations. Oh and we'd need you guys to be the official workstation for the X720, I'm sure you can make an awesome developer box right? Of course you'd have to have a price floor, don't want big blue associated with cheap crap ya know. Sounds good, lets do lunch"

and THAT would be the end of that friend. If it comes down to making big monies or being a friend of FOSS they'll happily throw RMS under a bus while wearing "FOSS is socialist!" t-shirts...provided by MSFT of course. I hear they're nice, 100% cotton.

Re:Antitrust but verify

[dpilot]

Being able to shut off "secure boot" doesn't do a thing to make Windows 8 less secure. In order to boot Windows 8, secure boot has to be turned on. If being able to run the computer with secure boot turned off somehow compromises the integrity of the Windows 8 installation, then the entire concept is broken before it started. (Hint... You can always remove the hard drive and put it in a non-UEFI computer as a secondary drive. That's essentially equivalent to booting another OS on the same machine.)

At this point, I'd have to say that the first screwup is that from what I've heard, Microsoft messed up the kernel signing process and hasn't signed their kernels the "correct" way supported by general tools. One piece of correct solution is to allow RedHat and others to sign their kernels and LiveCDs. For this reason, Microsoft should NOT be the signing authority - they should just be another company submitting their software for signing.

I suspect that the real/better solution to this problem would be a little more smarts in the UEFI itself. I get a signed Gentoo LiveCD image which, because it's properly signed, will boot. I then install my Gentoo onto the hard drive and tell the UEFI-aware GRUB about the kernel I just compiled.

Then I restart the machine back to BIOS and tell it to talk to GRUB, find my new kernel, and "approve" it - I guess a local signing. After that, I can boot my kernel. It's more pain than it is today, but probably less pain than the old days of lilo and forgetting to run lilo after building a new kernel. When that happened I had to boot a LiveCD to fix it. With this the fix involves at most booting my old kernel and using UEFI BIOS.

Re:Antitrust but verify

[w_dragon]

So you think the richest 3.5 million or so people in the country control everything? That's not so bad, it only takes something like $380k annual income to make the top 1%, specialist doctors and lawyers can make that much. I have a hard time believing that the pediatric neurosurgeon I know, who certainly makes in the top 1%, would screw up the country.

Re:Antitrust but verify

[Jiro]

Microsoft faced those lawsuits because they were not yet politically savvy enough to buy off politicians. Now that they are, it's not happening again.

Re:Antitrust but verify

[KhazadDum]

That's because, like the Tea Partiers, OWS are "angry". Unfortunately, due to their increasingly well known suspicion of authority (sending the cops to beat them kinda does that), they are less likely to accept someone or some group focusing them on the corporations. What is more likely is that said group will take it over and bastardize it into a caricature of itself, leading to the moderate OWS that suddenly focuses on women's wombs or something. Hate always sells. And it's easier to hate those groups than the ones in power who might give you another crumb. After all, that one more crumb might make a difference in your survival, which conveniently sets one against the very groups and social networks that would change that. Economics is power. And the 1% know that very, very well.

Re:Antitrust but verify

[sjames]

It wauld probably be fairly safe since grandma wouldn't likely know which of those disks, papers and 'doo-dads' that came in the box with the computer was the BIOS key. None of them look like a key.

Best bet, put it on a small USB drive and tape it to the case lid on the inside.

Re:Antitrust but verify

[peppepz]

People will still be able to install malware by clicking "yes" at the UAC prompts. Exactly as they do today. In fact, they might not even need that, because the users' most precious information is found in the "Documents" folder and not in C:\WINDOWS\System32.

I've never seen a boot virus since BloodyWarrior in 1994. Most viruses today come either through browser plugins or are installed by the user themselves in good faith.

Suppose you're the vendor of a non-Microsoft operating system. You can't assure your customers that they'll be able to install your OS, because Microsoft doesn't give this warranty. Even if your customer is lucky and has an "open" PC, you can't explain to him how to install your own keys, because this procedure is not standardised and Microsoft doesn't specify anything about it (apart from mandating it to be as hard as possible). Therefore, you have (I'm using an euphemism here) a severe competitive disadvantage against Microsoft. I don't know in the USA, but in the EU this probably won't be tolerated.

Re:Antitrust but verify

[Anomalyst]

How would it ask or push the key into the system when it doesn't have permission to execute?

Re:Antitrust but verify

[Anomalyst]

Windows ... integrity
One of these things is not like the other.

Re:Antitrust but verify

[cavreader]

The OWS protests are practically useless when it comes to actually getting something concrete done. Complaining about something is one thing but unless you focus on offering viable solutions all you get is tear gas and busted heads. The Tea Party movement focused on specific and straightforward issues that didn't take a genius to understand. Basically lowering the amount of government interference in business (ie deregulation) and eliminating government involvement in foreign adventures. They kept their message simple where as the OWS protesters are all over the place. (I am not saying I agree with the Tea Party I just think the way they went about organizing themselves produced concrete results in the last elections) As the OWS protests continue more and more disruptive elements will start getting involved and start using tactics to goad law enforcement into taking aggressive actions and that will do nothing but obscure the real issues being protested. The protest focus will turn from criticizing income equality and overall corporate behavior to focusing on the police response.

Re:Antitrust but verify

[datavirtue]

The US government and municipalities are the biggest owners of Microsoft through their pension funds.

Re:Antitrust but verify

[datavirtue]

Your suggestion is one of the best ideas I have heard for long time. It should have been obvious to anyone that this is a good strategy for driving change, but it is just one of those things that barely elude us. In some form this is going on. The OWS movement is ineffective because of broad demands lobbed at an entire industry. The leaders of the 1% can afford to sit back and wait it out. Did you think of this, or was it developed from another source?

Re:Antitrust but verify

[datavirtue]

OWS is a train wreck. Leaderless is not a feature, it is a bug.

Re:Antitrust but verify

[shutdown -p now]

Why should it be up to Microsoft to dictate? What's there is the minimum technical requirements for Win8, but the requirement to give user control over the key is not technical - it's strictly legal/ethical.

If enough people want unlocked devices, why not make it a law that all hardware must be user unlockable?

Re:Antitrust but verify

[shutdown -p now]

In order to boot Windows 8, secure boot has to be turned on. If being able to run the computer with secure boot turned off somehow compromises the integrity of the Windows 8 installation, then the entire concept is broken before it started. (Hint... You can always remove the hard drive and put it in a non-UEFI computer as a secondary drive. That's essentially equivalent to booting another OS on the same machine.)

It's not intended to be a defense against the kind of attack that you describe. It's intended to cover the most common case, which is a person buying a PC with preinstalled Win8, and running just that OS. Specifically, it is intended to make it hard to exploit application vulnerabilities or social engineering to trick the clueless user into installing a rootkit that can not be easily removed or detected by built-in OS measures.

At this point, I'd have to say that the first screwup is that from what I've heard, Microsoft messed up the kernel signing process and hasn't signed their kernels the "correct" way supported by general tools. One piece of correct solution is to allow RedHat and others to sign their kernels and LiveCDs. For this reason, Microsoft should NOT be the signing authority - they should just be another company submitting their software for signing.

The authority in this case is the OEM, which decides whose keys to trust as secure (and whether to provide the ability to extend that list). So Microsoft signs their boot loader with their key, RedHat signes theirs with their key, and the OEM with which they both have agreements puts both keys in as trusted.

Re:Antitrust but verify

[Kjella]

Assuming secure boot would work like UAC, which it wouldn't. That you'd have to reboot your machine, enter the BIOS (or well, UEFI), find whatever "enable/disable" switch is there and read a scary warning would be more than enough to stop 99.99% of the people that shouldn't disable it.

I don't even think Microsoft has to be evil here, I think the OEMs will do it all on their own. When have they ever liked people messing with their system config? The short answer is never. As long as they can all do it at once, so that in a few years you won't have a choice about being dragged along they'll do it.

Re:Antitrust but verify

[Bucky24]

Heh if it doesn't have perms to execute then why do we need a locked bootloader in the first place?

Re:Antitrust but verify

[amliebsch]

You could wire a physical keyswitch on the case to a motherboard jumper and include a literal key for unlocking the boot process.

Re:Antitrust but verify

[monkyyy]

or even just a sticker on the motherboard

Re:Antitrust but verify

[sjames]

They have taken it upon themselves to dictate the use of secure boot, they would be wise not to let it look like a blatant anti-competitive move.

Re:Antitrust but verify

[cavreader]

No, I didn't come to my opinion by reading it some where else. I just thought it was a better strategy to obtain real changes.

Re:Antitrust but verify

[anomaly256]

The solution is pretty simple, for both fighting Secure Boot mandates AND the 1%:
DON'T BUY IT IF IT'S NOT WHAT YOU WANT.

Vote with your dollar, it's mightier than the pen by far. Sure the masses will buy their secure boot locked-to-win8 pcs but vendors WILL still provide options for you and I. Microsoft subsidies and kickbacks aren't going to cover the loss they'd make if they culled our end of the market. Can you imagine someone buying a windows 8 secure-boot-locked pc to use as a router/firewall? Or as a Xen host for a medium-sized office? Or for driving a SAN?? Those 'OS market share' stats really *REALLY* do not highlight the true penetration of linux and bsd in the real world. Vendors know this too otherwise they wouldn't waste their time.

Protesting and complaining online isn't going to do squat. Moving all your business away from your usual vendor and towards a 'friendly' one sure as hell will, and faster than you could ever imagine too. :)

Re:Antitrust but verify

[drinkypoo]

You recall wrong if you're talking about the USA. MS did face those lawsuits, and was found by the USDoJ to have illegally abused its monopoly position under the direct control of Bill Gates, but during the trial there was a change of regime and to make a long story short, Bush's dog Ashcroft gave Microsoft a shake of the finger and a "don't do that again". Oh yes, the EU got some money out of them, and they ended up with a browser selection screen.

Re:Antitrust but verify

[Glarimore]

You seem to think that writing your congressmen will effect their opinion, but your letter doesn't include a promise of campaign contributions.

Something tells me your letter wont do much.

Re:Antitrust but verify

[rust627]

but he will vote to protect the money he has invested in Microsoft, Apple, IBM, or whatever, and these companies will lobby the government (and privately 'financially reward' senators, public servants and/or anyone else who can advance their cause) to protect and expand their profits at all costs.
Who do you think he will support when the police are called in (as they were in Australia), Wall st ?, or Occupy Wall St. ?

Re:Antitrust but verify

[jonwil]

I see "EU v. Microsoft II"
The EU is more likely to care (especially if pressured by those companies in the EU that make or sell open source software and OSs) than the US is.

Re:Antitrust but verify

[swalve]

You expect us to believe your rantings when you don't even know that IBM doesn't own Lenovo?

Re:Antitrust but verify

[swalve]

The letters make more difference than you think.

Re:Antitrust but verify

[swalve]

If you think the 1% have leaders, I have a bridge to sell you.

Re:Antitrust but verify

[nukenerd]

Anomaly256 wrote :- The solution is pretty simple, for both fighting Secure Boot mandates AND the 1%: DON'T BUY IT IF IT'S NOT WHAT YOU WANT. Vote with your dollar

Yes, no doubt it will be possible to buy PCs with unlocked BIOS, and I will make sure I do so as a longtime Linux user. Thanks for that advice.

HOWEVER, and this is the point, a typical PC bought from the high street or PCWorld etc by Joe Windowsuser WILL have a locked BIOS. This means that Joe will not be able to put in a Live Linux DVD one day to give Linux a try, find that he likes it, and then sticks with it. Because MS hates people like Joe doing that because that's the route by which most people migrate from Windows to Linux.

In other words, the Linux-using community will be frozen as it now is.

You wrote :- Microsoft subsidies and kickbacks aren't going to cover the loss they'd make if they culled our end of the market

Think again. Very few PC makers could afford the hit of losing the Windows volume discount they get - which is currently on the condition that ALL their PCs have Windows pre-installed. It is likely that locking the BIOS to Windows will also become a condition of MS's discount.

Re:Antitrust but verify

[hplus]

If you look at individual Tea Party protesters, their messages are just as incoherent and jumbled as OWSers. The TP didin't organize *themselves* into a mob with a message, rather, the same interests that always push for less government provided the organization, and the TPers just showed up.

Re:Antitrust but verify

[nukenerd]

Secure boot is outside the Windows scenario already. As I understand it, it is a BIOS matter. During booting, the BIOS will interrogate whatever is in the HDD Master Boot Record (or its new equivalent) for a password and will only hand over control to whatever is there if the correct password is given. That response could be from Windows 8, or, equally, some future Linux, BSD, Solaris or whatever. So it is not just a Windows matter.

So by requiring Secure Boot for Windows 8 certification, MS are already "dictat[ing] what OEMs do or don't with their PCs outside a Windows scenario" as you put it, because it does affect other OS's if MS do not also require that the end user also has the power to disable it to allow another OS to be installed or booted . But in the Windows 8 certification there is no such requirement - that is the concern.

As for voting with your vallet [sic], forget it; with respect, your wallet is puny, even if added to mine. We will be drowned under a wave of Coolaid being swallowed by ordinary Windows users who will believe this is for their own good, and that we should think so too. They would not understand this issue even if you spent a thousand years explaining it to them.

Re:Antitrust but verify

[cavreader]

Have you being paying attention to the OWS protests at all? Their protests have targeted Wall Street, foreign wars of any type, police brutality while trying to keep the protests as civil as possible, and anyone considered rich. The Tea Party targeted limiting government involvement and foreign adventurism in easy to understand language. In a very short time they ended up influencing the political landscape in record time. I don't happen to agree with the Tea Party positions because they are ridiculously vague and don't even pretend to be willing to negotiate with others. The OWS protesters have not made any tangible progress. A few politicians have voiced some vague support but there are too many issues involved for them to promise full support. There is also a sizable number of regular citizens who have no idea what is actually being protested. Protest of any kind should be used to identify problems but once that is done someone needs to stand up and offer some viable solutions. The OWS movement has not did this.

Re:Antitrust but verify

[uninformedLuddite]

The letters make more difference than you think.

Writing letters to your congresscritter actually saves money on toilet paper for congressional bathrooms.

Re:Antitrust but verify

[anomaly256]

Think again. Very few PC makers could afford the hit of losing the Windows volume discount they get - which is currently on the condition that ALL their PCs have Windows pre-installed.

If to you a computer simply means a desktop or workstation, then maybe. I still don't think it'll be that big an issue because the kind of people who even CARE that there is an OS besides windows, the ones who end up migrating away when they realize there's something else, are the kinds of people who will likely be building their own rigs anyway (either as gamer tweakers or just general nerds). No 'ma and pa' I've ever known who tried linux on a whim ever migrated away from windows. Why would they? Then their Word for Windows wouldn't run and lets be honest, libre/open office is still a few yards behind Word and will be for the near future.
And then, there's that whole anti-competitive practices thing. Sure it might swing in the US of A but I doubt the EU won't be rubbing their hands together thinking 'Oh boy! They walked right into another expensive lawsuit with ample fines to line our coffers!'

I do still think it's a horrendous precedent and a general fucktard thing for them to do, but I doubt it'll have the impact everyone is thinking. It never has! Remember the whole 'omg TPM is going to lock us to a specific vendor!' crisis a couple years back? How did that pan out? :P

So as I follow it...

[SuricouRaven]

Intel: We've invented a new technology that can be used to prevent low-level malware from being loaded during the pre-kernel boot process, when conventional antimalware techniques are ineffective. It could also be used by a manufacturer to prevent the user from installing any unapproved OS, as from a technological standpoint this functionality is identical to blocking malware, but that isn't what we designed it for.
Microsoft: Oh, that sounds fun. Ok, all OEMs: If you want to ship with the 'windows 8' logo which everyone is going to want soon, you need to include support for this and it must be enabled by default. You will have to include Windows 8 on the trust list, but anything else you need to block as it may be malware. You can give the user the ability to turn this feature off and install non-Windows OSs if you want, but we don't really care.
Linux supporters: But that means that unless an OEM has explicitly taken the trouble to install a feature that few users will even know of, it'll be impossible for us to use any OS except Windows - most seriously on laptops, where we can't build our own.
Microsoft: Not our problem! Take it up with the OEMs. We're only mandating that they install linux-blocking capability, we're not asking them to actually use it.

Throughout this, the OEMs have remained silent on the issue.

Re:So as I follow it...

[0123456]

You must not have been paying much attention, but UEFI capable motherboards have been shipping for some time now. I don't hear anyone whining about not being able to run linux on them.

Duh. That's because they don't currently require 'Windows boot' to get a Windows 8 logo on the box.

Re:So as I follow it...

[fuzzyfuzzyfungus]

"UEFI" doesn't mean just one thing. It is a sprawling specification with a wide variety of possible capabilities(architecturally, it should really be thought of as an entire OS, plus OEM preload apps and drivers, lurking in your motherboard, it's at a pretty similar level of complexity and potential power).

To the best of my knowledge, none of the present UEFI boards implement the feature being discussed.

Re:So as I follow it...

[Todd Knarr]

I think the big driver for OEMs telling Microsoft to rethink this will be Windows 7 and XP. A lot of major companies won't be ready to deploy Windows 8, especially with money tight. And they'll need to deploy, not stock Windows 7, but the specific image with the specific patches that they've certified compatible with all the other software they need to run. Fail to do that and IT's going to come back with a big requirement to re-certify everything that'll cost a lot of money and take a lot of time, and management'll buy off on it because it'll be phrased as "If we don't verify everything, we're risking another company-wide outage for some unknown number of weeks until the vendors get us a fix. Remember how much pain that caused last time it happened?".

The big vendors like HP and Dell aren't going to go for something that'll cost them their biggest corporate customers. And the motherboard OEMs won't go for something that'll cost them both their big vendor contracts and their boutique component sales to gamers and the like.

Re:So as I follow it...

[Bucky24]

I concur. Especially if Windows 8 is going to require this new hardware, I think a lot of companies will take a very long time to upgrade. A new OS is a lot cheaper to buy (especially if you buy a volume license) than a whole fleet of new desktops.

Re:So as I follow it...

[FictionPimp]

Exactly, it took a lot of teeth pulling but we are just now looking at a windows 7 migration.

Re:So as I follow it...

[peppepz]

You can give the user the ability to turn this feature off and install non-Windows OSs if you want, but we don't really care.

They do require the OEMs not to support the easier way of disabling secure boot after the first failure, that is present in the UEFI specification. So they do care, somehow, about making the deactivation of this "feature" as hard as possible. For some reason.

Re:So as I follow it...

[amliebsch]

It's only required for the OEM sticker. Windows 8 will continue to support legacy BIOS.

Re:So as I follow it...

[jimicus]

You're not thinking longterm. Microsoft can be patient, and Linux on the desktop is not growing at a rate that merits rapid, drastic measures.

I can see two paths:

1. Microsoft provide a mechanism to sign deployment images which is extended backwards to Win7. This makes sense anyway; it's common for larger businesses to deploy standardised images. Will be interesting to see how third-party deployment product vendors deal with this.
2. OEMs will indeed make sure it's switchable for Windows 8 PCs. But Windows 9 or 10......

Re:So as I follow it...

[SuricouRaven]

Windows 8 certainly won't require it, that much has already been made clear - and MS wouldn't want to make it impossible for existing users to upgrades. The only thing that requires it is the Designed for Windows 8 sticker, which all windows-selling OEMs need because it entitles them to OEM price for preinstalled windows and looks great in advertising. It's possible that a future version of Windows could require it, but that's quite a few years ahead.

Re:So as I follow it...

[Jonner]

I think that sums it up pretty well. I am very happy to see this well-written document from the Linux Foundation which OEMs who are serious about interoperability can use. When an OEM says "we can't make our Windows 8 Logo machine boot Linux or anything other than Windows 8" this document can be used to easily refute such laziness.

Re:So as I follow it...

[peppepz]

And will all of Windows 8's features be enabled when it's not booted through the secure mechanism? Have we got an official Microsoft statement about this?

Re:So as I follow it...

[osiaq]

Apple: Hey slashdot dudes! You can still install Arch on MacBook Air, buy one!

Re:So as I follow it...

[amliebsch]

Sinfosky said:

Windows 8 will also enter the market in a time when the industry is shifting to the Unified Extensible Firmware Interface (UEFI) for BIOS on all new client systems. We will continue to support the legacy BIOS interface, but machines using the UEFI interface will have significantly richer capabilities. For instance, UEFI systems can render rich graphical experiences in native resolution via the Graphic Output Protocol (GOP) driver. With UEFI, the OS can finally communicate with boot firmware in a standard way; this work is strongly supported by standards work in UEFI and the TCG (Trusted Computing Group). This enables such features as secure boot, where the OS and firmware cooperate in creating a secure handoff mechanism. It also enables a seamless visual experience from the time you hit the power button – one experience owned by two distinct components.

So make of that what you will.

Re:So as I follow it...

[shutdown -p now]

You will have to include Windows 8 on the trust list, but anything else you need to block as it may be malware.

You follow it wrong. There's no requirement that "everything else must be blocked", only that Win8 must be able to boot, and unsigned stuff must not be able to boot by default. However, an OEM can have an agreement with, say, RedHat to allow anything signed by their key to boot.

The switch (which is not a requirement on the OEMs) is for booting any random, unsigned code, same as it is today.

Re:So as I follow it...

[Dr_Barnowl]

render rich graphical experiences in native resolution via the Graphic Output Protocol (GOP) driver

No HD content without Secure Boot. Your Blu-Ray will be Blur-Ray because it will be downscaled without Secure Boot enabled.

Re:So as I follow it...

[SuricouRaven]

Seamless visual experience I would guess means an Apple-style boot: You press the button, the screen goes white, Windows logo appears, desktop loads. Clean, tidy, reassuring for the non-technical user without a screen of intimidating text they can't interpret. But often a real headache for the techies, who need to see those pages of white-on-black the BIOS shows to diagnose startup issues. I can only speculate, but that does seem to be the way MS is heading, with their revamped less-informative BSOD in Windows 8.

Re:So as I follow it...

[SuricouRaven]

So all the OEM need to do is achieve an agreement with every single non-microsoft OS vendor around, including the teams developing all the obscure ones like Plan 9 and specialised linux distros, and we'll finally be back to where we are today.

Re:So as I follow it...

[shutdown -p now]

No, it doesn't. To get status quo, all that's needed is a switch to disable signing completely, which is known to be provided by at least some OEMs.

Ideally, the OEM would provide the user with a way to manage keys, so that you could use secure boot to similarly secure any OS that supports the process or can be modded into doing so against rootkits.

Re:So as I follow it...

[makomk]

None of them support the feature in question - the final specification details for it were only ironed out recently, and if any motherboard implemented it before then they'll have got it wrong.

Re:So as I follow it...

[SuricouRaven]

I was refering to your suggestion that OEMs could have agreements with, say, RedHat. To get status quo would be a simple matter of a switch to disable signing, and that is what all the fuss is about: There is no requirement this switch be included. It's a move away from the current situation where a user may install whatever OS they wish and towards a situation where OEMs may generously choose to grant this privilege if they decide it's in their best interests.

Re:So as I follow it...

[shutdown -p now]

There's no requirement from Microsoft to have the switch included, because it's not Microsoft's place to make such a requirement - since it bears no relation to what Win8 needs. It may be a requirement placed on the OEM by its users (which, obviously, would require a significant number of users to actually care), or it may be a requirement placed on the OEM by the law (something that I'd support - and also for locked Android and iOS devices!) - but either way, it is completely orthogonal to Win8 hardware requirements.

Watch out!

[Anonymous Coward]

If we don't implement secure boot, the viruses will getcha (like the terrorists and the pedophiles)! We must try to save stupid users from their own stupidity at the cost of freedom.

Re:Watch out!

[Bucky24]

Hasn't that been the motto of the government/corporations for some time now?

OEM can use this to lock in to there video, hdd an

[Joe_Dragon]

OEM can use this to lock in to there video cards that can cost $100+ the price of other on line stores, hdd that cost the full price of a 1TB disk to just upgrade from 500gb to 1TB. Maybe even ram lock in so you can pay $60 to go from 2gb to 4gb. But for about $50 you can get good 8GB ram kits.

Re:Users don't want a "toy OS" like Linux

[0123456]

Note that I didn't say anything about Linux in my post.

Every non-tech user I know who wants a PC that 'just works' bought a Mac.

Re:Users don't want a "toy OS" like Linux

[faedle]

Given the ratio of "professional users" to "toy users" of any technology (from cars to hammers), I'd say that the 7.6% figure is about right. The professional users don't want a toy OS like Windows.

spoiler

[nimbius]

mainstream vendors will completely ignore this. guys like Dell and HP have been testing the technology extensively to make sure it works on their products. it will be proprietary, guarded, and hard to manage, and probably bloated just like every other standard theyve championed.

small players will either choose to ignore the technology entirely, or develop their own convoluted undocumented implementation that manages to lock out anything except what was imaged on the device to begin with. Expect the usual BSD and Linux hackers to rise from the shadows to fix another broken mess of industry detritus.

i expect this to be one more thing i either loathe or disable as a sysadmin. UEFI, welcome to the hallowed esteems of DRAC, BMC, IPMI, ACPI, and APMI.

Re:spoiler

[Microlith]

Expect the usual BSD and Linux hackers to rise from the shadows to fix another broken mess of industry detritus.

Just like how they fixed Motorola's secure boot process, right? Oh, wait. Those are still locked and the kernel can't be replaced.

Re:spoiler

[jimicus]

If you're disabling all the IPMI features as a sysadmin, you're seriously missing out. Remote serial access at a BIOS level, what's not to like?

Re:spoiler

[Jonner]

i expect this to be one more thing i either loathe or disable as a sysadmin. UEFI, welcome to the hallowed esteems of DRAC, BMC, IPMI, ACPI, and APMI.

Thankfully, those can mostly be ignored except ACPI. EFI in general certainly seems similar to ACPI in that it attempts to solve shortcomings of older systems in an unnecessarily complex way and is therefore doomed to be implemented incompletely and incorrectly. We certainly need something to replace the PC BIOS, but I'm not sure we need EFI. It would be awesome if all motherboard manufacturers and OEMs made Coreboot work on their systems. It can have payloads of Free and Open implementations of UEFI and PC BIOS as well as being able to boot Linux, Grub, and many other things directly. A board running Coreboot can boot just about anything much faster and more flexibly than any of the industry standard approaches.

Someone missed the point.

[sgt scrub]

I don't want to disable the functionality to use Linux or any other operating system. I want it to be customizable so I can use it with any other operating system. Having it locked down for existing OEM's is what makes it evil.

Re:Someone missed the point.

[justforgetme]

Well, I guess that if you get a device with this functionality (and it isn't locked down to only run win8) you will have the ability to install custom OS signatures to secure your linux boot

Re:Someone missed the point.

[Riceballsan]

I believe the fear is, you might have the ability to. So far I haven't heard any manufacturer stand up and say "Don't worry we absolutely will give the ability to control this feature to our customers", and with hardware manufacturers getting more and more power over what they can limit on the hardware they sell (look at intel, they've got password locks to prevent you from using all the cores on a CPU they sell you, so that they can sell you an "upgrade" to unlock the features). I admit this fear isn't by definition justified, but it is possibly justified. There are 2 possible ways it can be done.

1. A setup is enabled in the bios, the user can set what boot loaders to allow

2. A default setup is set, Windows 8 by default is allowed, all other OS's are blocked without a code that the manufacturer does not provide, or perhaps they don't even have an option available.

Re:Someone missed the point.

[sgt scrub]

that the manufacturer does not provide

Or worse, the manufacturer forces you to pay for it. I'm expecting it will start out with OEM's forcing people through EULA hoops to buy license kits.

Re:OEM can use this to lock in to there video, hdd

[SuricouRaven]

They could... or, more realistically, they might just not *bother* to include an option to disable the windows-eight-only lock. After all, somewhere around 1% of their customers are going to want to run non-Microsoft OSs, hardly a thriving market. Scarcely worth the cost of having someone program, test and document another option in the setup program.

Or maybe when Windows Ten comes out, Microsoft will demand that the windows-only-lock will be fixed on... as a security feature, of course, to prevent future supermalware from disabling it.

so what happens when the app store does not have

[Joe_Dragon]

The game / app you want and secure boot can't be turned off on your dell?

Say you want to play Leisure Suit Larry 2012 but sorry windows app store does not have adult games.

So you try to install a steam game and a box comes saying that Steam Client Service does not work with Secure boot.

White list of compatible hardware...

[sapgau]

Could we start a white list of compatible hardware manufacturers or a black list of offending hardware (which ever is easier to maintain) so it would help us users that are planning for our next PC build?

Re:White list of compatible hardware...

[ifrag]

I really hope the black list is easier to maintain.

Re:White list of compatible hardware...

[zoward]

Could we start a white list of compatible hardware manufacturers or a black list of offending hardware (which ever is easier to maintain) so it would help us users that are planning for our next PC build?

Here you go:

http://www.h-node.com/hardware/catalogue/en

Re:White list of compatible hardware...

[Yvan256]

Considering that laptops are now the majority of sales, it's becoming more and more pointless.

Re:White list of compatible hardware...

[jez9999]

Erm, why doesn't that site have regular motherboards? What if I don't want to go with a laptop/netbook (I don't)?

Re:so what happens when the app store does not hav

[0123456]

The game / app you want and secure boot can't be turned off on your dell?

You bend over and pay $1000 for a motherboard with a switch that lets you turn it off. This whole thing is about destroying the open PC architecture and replacing it with vendor lock-in so they can rake in the cash.

Re:apple efi

[Jeng]

Only because it allows it's users to dual boot, but Apple could just as easily lock down the product.

enterprise use will drive booting older windows +

[Joe_Dragon]

enterprise use will drive booting older windows + linux but I seeing systems / software needed windows XP being a point that force this to be off on at least some systems.

Windows 7 that most enterprise is now moving to will HAVE TO WORK WITH Secure boot as I don't see windows 8 fitting into enterprise use the way that is now being planed.

Re:OEM can use this to lock in to there video, hdd

[adonoman]

OEMs don't need this to lock in hardware, they can do this just fine with regular BIOS.

Re:Users don't want a "toy OS" like Linux

[justforgetme]

That is the site that says iDevices overpower Android devices 4 to 1, right?
Well then all their other statistics must be right as well!

What about windows 7?

[Joe_Dragon]

I think lot's of people may not like that new UI and other stuff in windows 7 that is being taken out in windows 8.

Re:apple efi

[msclrhd]

I don't want to dual boot my machine, or run Linux in a virtualised environment. I want a system where I can run the Linux distribution of my choosing on it without having a Windows install sitting there (including at the boot sequence). I want to tinker with, customise, upgrade, fix, modify and install custom software of my choosing on it.

Re:enterprise use will drive booting older windows

[NJRoadfan]

UEFI systems without any sort of BIOS compatibility module won't be able to boot 32-bit versions of Windows XP. Of course that doesn't stop anyone from developing one (see efforts to boot Windows on x86 Macs pre-Boot Camp).

Desktops...

[Questy]

I think this'll only affect the desktop market. (why I run my desktop OSes - Linux, Windows, OSX - on a Mac instead of a PC). In the server space, though, that's big freaking money, and I think the manufacturers will be extremely reluctant to cause this trouble in that space. One of two things could happen here, I think... this will be enough of a political black eye that MS will give in and suggest allowances for other OSes or there will be pressure coming back from the server side toward desktops that can effect change. In any event, this will be interesting to watch.

Re:Unpatched security vulnerabilities anyone?

[oakgrove]

APK unpatched psychological disturbances: over 9000!

"Windows Only" PCs should require a label

[PolygamousRanchKid]

Like, "Unleaded Gas Only" just to make it visible to the idiot consumer what he or she is buying. "Runs Anything!" or "Runs Linux!" are optional, of course.

I know, silly idea, but sometimes I feel that this world is rather silly as well. Forcing a machine in hardware to only run Windows, for example.

Re:"Windows Only" PCs should require a label

[laffer1]

That's what the Designed for Windows 8 sticker will tell us.

Re:"Windows Only" PCs should require a label

[drinkypoo]

That's what the Designed for Windows 8 sticker will tell us.

Only if Microsoft's specifications require a PC on which Secure Boot can not be disabled.

Re:OEM can use this to lock in to there video, hdd

[fuzzyfuzzyfungus]

It does still have the potential to pretty substantially change the game, though:

Goofy hacks like custom SPD fields and PCI-ID checks are effective enough to spoil the day of Joe User; but most of the implementations in the wild are pitifully weak: SPD data, for instance, are stored on a totally normal little SMBUS eeprom chip. Cloning a vendor-lockout SPD field onto a generic chip of similar capability is not terribly demanding. The proposed cryptographic mechanisms, designed from the ground up for the purpose and given considerably more resources to work with, should be a great deal tougher.

Also, since the objective of this "secure boot" is to establish a 'trusted' chain of execution from power-on to porn browsing, properly rigorous applications will likely require verification by default, rather than having verification be a hacky special case for wifi or RAM. After all, most modern peripherals contain pretty substantial onboard processing power, some amount of onboard flash and firmware, and quite possibly DMA, kernel drivers, or other potentially threatening abilities to make a nuisance of themselves elsewhere in the system...

Re:Incentive?

[Bobakitoo]

The 1% of Linux desktop users make the purchase decision for the 91% of supercomputers and 60% of servers on the Internet.

Do not fuck with us.

This is a sample, not an exhaustive list

[tepples]

My list was intended to be a representative sample, not an exhaustive list.

PS how many people watch netflix? It's not even available in the EU

First: The United States is relevant because the Linux Foundation, mentioned in the article, is headquartered in the United States. Second: Yet. Third: By "Netflix" I meant "Netflix and foreign counterparts", and LoveFilm operates in several countries where Netflix does not.

How many users need 16 bit CMYK press print in their camera snaps (especially since most camera users will use the 8bit RGB Jpeg format)? None.

Professionals do.

Who HAS to create flash apps? Nobody.

What's the alternative to Flash for creating a vector animation?

TurboTax doesn't do the tax returns for 99% of the world's taxpayers.

First: The United States is relevant because the Linux Foundation, mentioned in the article, is headquartered in the United States. Second: By "TurboTax" I meant "software like TurboTax, such as its closest competitor H&R Block At Home, or foreign counterparts".

I've NEVER heard of Stone Edge.

Neither did I until I ended up at my last job. Just because you don't know anybody who runs a particular package doesn't mean nobody runs it.

Sonic 3 is run by, oh, nobody.

Then what well-known platform game is played by a lot of people? I bet a lot more people play Sonic 3 than SuperTux.

Diablo II is niche.

All individual video games are niche, just as all individual books are niche. But again, this is a sample, not an exhaustive list. The odds are greater that you'll find a game you like if you start with Windows than if you start with desktop Linux, especially when online multiplayer requires all players to have the same title.

Netflix: DVD

DVD watching software does not come with Linux because of U.S. patents and U.S. anticircumvention restrictions. VLC is technically illegal in the United States. The United States is relevant because the Linux Foundation, mentioned in the article, is headquartered in the United States.

Photoshop: GIMP

GIMP does not have 100 percent of the features of Photoshop. Professionals who rely on those features cannot rely on GIMP.

TurboTax: Online banking , GNUCash, etc

Those are counterparts to Quicken, not TurboTax. TurboTax has specific programming for a country's most recent income tax laws and for those of its political subdivisions.

StoneEdge: SCO's POS suite

Don't you remember the SCO $699 scam? That was a P.O.S.

All your Games: Games on Linux

Which popular video games, other than first-person shooters rated M for Mature (or foreign counterparts), are ported to Linux?

Re:OEM can use this to lock in to there video, hdd

[brainzach]

You really think it is that hard to program? There are many features in the bios that less than 1% of the population uses.

Enterprise customers are going to provide enough demand to support that feature. There are also a significant portion of the population who will want to run Linux or another version of Windows to justify the costs. It would be stupid if manufacturers don't support it.

Re:Incentive?

[Forbman]

And yet Website developers will bend over backwards to make their websites work with users still using IE6 (if it's at 1.5% or so).

Re:so what happens when the app store does not hav

[Bucky24]

Why on earth wouldn't Steam work with secure boot? Secure boot has to do with the boot up process. Steam is an application that runs AFTER the boot process is complete. Unless you're saying that Microsoft would modify Windows so that no unapproved software could run.

Would you buy something that said it was crippled?

[bussdriver]

Yeah, the consumer will want to buy the one labeled "runs microsoft only" and the other one "runs everything"

Re:Why do nearly 93% of users use Windows then?

[0123456]

Exactly. Users don't want a 'PC that just works' or most of them wouldn't be running Windows.

Re:Illogical off topic adhominem attacks?

[oakgrove]

You have a PHD in being a complete and utter moronic caricature of yourself.

EU

[ThatsNotPudding]

I just hope they sent a copy to the EU Competition Committee, as jack-shit will be done by USFedGov.

Re:Tell us about ANDROID "security", lol!

[justforgetme]

what the hell are you on about?
Seriously, how far away is the thread you were trying to reply to?
LoL

Re:Incentive?

[FictionPimp]

Yea he makes the decisions, from a list of products I've selected.......

It is my job to evaluate and write-up reports on what technology we should be using.  I guess my ego is overinflated to think that my boss reads them. I guess he just really likes me and pays me for a service he finds useless.

Re:"Rinse, Lather, & Repeat"

[oakgrove]

You're wasting your talent trolling slashdot.

Here's the bottom line: it's not your PC anymore

[Catbeller]

The bottom line is simple: a motherboard will not boot unless a third party permits. You will have no control over this. The computer is not yours.

Re:Here's the bottom line: it's not your PC anymor

[Arlet]

Just buy one where the vendor didn't implement any restriction.

Re:OEM can use this to lock in to there video, hdd

[idontgno]

Yeah, but "support" will be restricted to two major product line categories: "enterprise" hardware (i.e., "servers" and "workstations"); and "enthusiast" hardware.

Do you see another common factor in those two market segments? Let me give a hint: it's spelled with currency marks, not alphanumerics.

So, the beige-boxes sold to Mom, Pop, and the average kid going to school will be locked into Windows in ways that would make the ghost of Steve Jobs return from the Beyond seething with envy. Motherboards with "turn off the secure boot" capability will be the stuff of hackers, gamerz, and corporate big-hardware types. Period. At least, until some government decides it needs to regulate those devices and restrict them to properly licensed "tame" hackers and approved corporates. At which point, owning an unlicensed unlockable system will rank right up there with combat firearms and explosives.

My guess..

[Junta]

Secure boot will be enabled by the likes of Dell, IBM, and HP, *but* their respective service processors would allow install of new platform keys given authentication. It's the only way they could get Windows 8 logo (which *will* continue to matter greatly) and the *only* way they can sell into half the market (large-scale, auto-deployed non-Windows systems). They would have to be careful not to do something like allow keys to be manipulated via in-band IPMI.

Re:apple efi

[peppepz]

Apple allow you to boot other OSes. They do the opposite of what Microsoft are attempting to do here.

Re:OEM can use this to lock in to there video, hdd

[Jonner]

OEM can use this to lock in to there video cards that can cost $100+ the price of other on line stores, hdd that cost the full price of a 1TB disk to just upgrade from 500gb to 1TB. Maybe even ram lock in so you can pay $60 to go from 2gb to 4gb. But for about $50 you can get good 8GB ram kits.

Yes, UEFI Secure Boot can be used for such anti-competitive tactics. I hope somebody tries something like that, since it will demonstrate to those who don't care about alternative operating systems how evil it is to lock users out of decisions about what to use with their own computers.

Re:Users don't want a "toy OS" like Linux

[Kjella]

Given the ratio of "professional users" to "toy users" of any technology (from cars to hammers), I'd say that the 7.6% figure is about right. The professional users don't want a toy OS like Windows.

Yeah, that's why no business whose livelihood depend on people getting work done would ever use Windows on the desktop, right? Because that's pretty much the definition of "professional user" from cars to hammers, using it in a profession. Until then you're just a enthusiast or prosumer, no matter how many hours you spend tinkering with your car. I'll leave it up to you to choose who of the people at car shows and taxi drivers are the toy users and who are the professionals...

really?

[Chirs]

How about:
1) look for a driver on the manufacturer's site (works great for intel adapters, they're all on sourceforge)
2) google for a prebuilt package made available by another user
3) build the driver as an external module
4) try a newer distro version

Of course, if you have a crappy wifi card with no linux support whatsoever then you're screwed...but I haven't run into that in a long time, at least for retail network adapters.

Re:OEM can use this to lock in to there video, hdd

[brainzach]

Remove you tinfoil. There are enough market forces to ensure that most computers systems will have the option to unlock.

The worst case is that manufacturers are going to try to charge extra for an unlockable dual boot computer. The greed will be with the manufacturers and not Microsoft. It will likely backfire because the PC industry is a commodity business and their will be plenty of competitors who will sell an unlockable computer of the same specs without the extra charge.

Re:Wow

[bmo]

It's really sad when people don't recognize one of the best movies of all time.

http://www.youtube.com/watch?v=_4e8iAofnrw

--
BMO

Re:Wow

[Anomalyst]

Its like pissing up a rope, except in reverse and with a gravity assist.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Truth in labeling legislation needed ...

[Anomalyst]

All UEFI based equipment that do not provide the user an ability to maintain the PK must have a URF'D florescent orange sticker 110% of the size of any MS sticker.

Re:Here's the bottom line: it's not your PC anymor

[Hatta]

At what markup?

Re:I merely posted facts

[bill_mcgonigle]

You don't have any credibility here, 'APK'. Post your real name, your occupation, and your employer, and perhaps people will be willing to discuss your issue.

The alerts I get from US-CERT paint a different picture than you're trying to portray, so you have a long uphill struggle ahead of you. Many won't get past your confrontational style, though. If you aim to convince people, you had better brush up on your persuasion tactics.

Re:Here's the bottom line: it's not your PC anymor

[Arlet]

Probably none. There's no more reason for a vendor to make these boards more expensive than boards they're selling right now.

Adding a BIOS option to disable the secure boot feature doesn't cost anything, and it only increases the number of potential customers, so any sane vendor would include something like that.

Will this actually happen?

[aztektum]

I have a hard time believing someone like Dell would offer locked down machines.

I worked at a uni for a spell with Linux labs on our standard Dell build. If they suddenly start saying "Windows only." they will be buying their 500-1,000 machines a year from whoever is selling unlocked boxes.

I mean look at places like Google, they have a "Zero Windows unless you have permission from the CIO." policy. I would think vendors would not be dumb enough to lock themselves out of that potential revenue.

Not saying I agree and that this doesn't need attention, but I get the feeling vendors are not that stupid. And MS themselves would draw the ire of the EU if not the US.

Re:Here's the bottom line: it's not your PC anymor

[Hatta]

There's no reason for an OEM to refuse to sell PCs without Windows either. Still, they do it all the time. Whether it's a deal with microsoft, or just the hassle of tracking an extra SKU, it's hard to buy a PC without Windows on it. It will probably be even harder to buy a PC that's not locked to Windows.

Re:so what happens when the app store does not hav

[Bucky24]

Well TG Steam runs on a Mac.... Oh wait nm mac might do this too.... Dammit why won't they come out with a *nix platform?

Re:First.

[zoloto]

Wow, I've had enough of the internet for today.

Re:Incentive?

[Todd Knarr]

Just bear in mind this: I'm one of those 1% of Linux users. But I'm also the guy the other 99% come to when they want a recommendation on what to buy. And I'm the guy they come to when their system's having a problem and they need it fixed. They've experienced the migraines having the manufacturer service it (all their precious files gone, all their software wiped and of course the product keys (if there were any) were in their e-mail which went with their data so they have to buy the software all over again), that's why they come to me.

Now, what do you think's going to happen when all those "normal" people come to me and I point them at vendors who don't lock down the BIOS? And when they ask me about a major vendor who does lock it down so it'll only run windows and I say "Sorry, their machines won't let any of my tools run so if you buy one I won't be able to help you with it."? They're going to go with my recommendation if only because they want their friendly neighborhood geek to be willing to fix their systems when they break.

It's like the large corporate world. The CEO's only one person in a company of tens of thousands. He probably doesn't even have any contact with any of the departments that actually buy and use the equipment. But get him mad at you and you're going to lose a lot more than just one person's purchases.

Re:I've got more "cred" than you do on 2 levels

[Antisyzygy]

Anonymous coward, please don't refer to the Bible as your "tech manual for life", it only discredits you. http://wiki.ironchariots.org/index.php?title=Main_Page

When nobody else can provide what I want

[tepples]

DON'T BUY IT IF IT'S NOT WHAT YOU WANT.

The problem comes when the large corporations A. do not provide what I want and B. have manipulated the market and the law such that nobody else can provide what I want.

Can you imagine someone buying a windows 8 secure-boot-locked pc to use as a router/firewall?

No, one is supposed to buy a secure-boot-locked ARM device to use as a home router/firewall, and one is supposed to buy business-priced computer to use as a business firewall. It commands a business price solely because it isn't secure-boot-locked, much as game console devkits are one to two orders of magnitude more expensive than retail consoles.

Or for driving a SAN

I'm not terribly familiar with how a SAN works; every environment I've seen uses NAS instead. NAS is available on dedicated appliances.

Moving all your business away from your usual vendor and towards a 'friendly' one sure as hell will

The lockdown proponents use market and law manipulation to make sure the 'friendly' ones can't do business.

Re:When nobody else can provide what I want

[anomaly256]

Rubbish. If *any* of these points were true, HP would be the ONLY vendor, and you couldn't get anything but a windows7 phone and a winCE router/firewall/nas/tv/stereo/modem/access point. And everything would be x86. And everything would be leased instead of bought. And linux would effectively be stone cold dead in the grave for many years now.

Can UEFI boot a virtual BIOS

[lsatenstein]

Suppose one writes a BIOS that is compatible with UEFI. Can we use that virtual bios to load any operating system compatible with it?
Who says that the operating system must talk directly to the hardware bios.
   

Re:Can UEFI boot a virtual BIOS

[harryjohnston]

Only if the "virtual BIOS" is signed. Chicken and egg, I'm afraid.

Re:so what happens when the app store does not hav

[nukenerd]

Bucky24 wrote : Unless you're saying that Microsoft would modify Windows so that no unapproved software could run.

Wow, we are getting the message through at last!!!

Re:Would you buy something that said it was crippl

[badkarmadayaccount]

See iPad sales.

PC Domination in Five Easy Steps

[Crayon Kid]

Unless you're saying that Microsoft would modify Windows so that no unapproved software could run.

That's probably in the works. In the end it's all about DRM. They tried to drop it straight at the top of the software stack (media players) and it didn't work out so well, so now they're going from the bottom up.

Here's how it will work:

1) Control the boot-up procedure and make sure no other OS can run on the machine.
2) Tie-in with Windows Update and driver signatures, after all, nobody can argue that having hardware-authenticated updates and drivers is a good thing, right?
3) Next come the security apps -- 'cause nobody wants malware messing with or disabling their firewall and antivirus.
4) Then it's a very short step to application whitelists, which follows naturally from the security step before.
5) Finally, you can really control the app content, since the entire stack is locked tight.