Slashdot Mirror
Will Secure Boot Cripple Linux Compatibility?
MojoMax writes "The advent of Windows 8 is drawing ever nearer and recently we have learned that ARM devices installed with Windows 8 will not be able to disable the UEFI secure boot feature that many of us are deeply concerned about. However, UEFI is still a very real danger to Linux and the freedom to use whichever OS you chose. Regardless of information for OEMs to enable customers to install their own keys, such as that published by the Linux Foundation, there are still very serious and as yet unresolved issues with using secure boot and Linux. These issues are best summarized quoting Matthew Garrett: 'Signing the kernel isn't enough. Signed Linux kernels must refuse to load any unsigned kernel modules. Virtualbox on Linux? Dead. Nvidia binary driver on Linux? Dead. All out of tree kernel modules? Utterly, utterly dead. Building an updated driver locally? Not going to happen. That's going to make some people fairly unhappy.'"
Would someone interested in Linux on these particular tablets be able to order one from a vendor with Linux (or no operating system) pre-installed? I couldn't find information on whether or not OEMs are restricted from selling pre-installed Linux versions of the tablet. The SoftwareFreedom website says "any ARM device that ships with Windows 8 will never run another operating system, unless it is signed with a preloaded key or a security exploit is found that enables users to circumvent secure boot." The phrase there is "ships with Windows 8," which suggests to me that Custom Boot-enabled versions could ship without Windows. Admittedly, I have a hard time seeing it as a freedom issue, as these are just tech gadgets at the end of the day. I'd rather it was framed as an inconvenience argument, not a freedom one.
Don't purchase any of these ARM powered devices which run Windows 8.
When Wikipedia's blackout is over, look up timezones.
Ummm. It was posted at 6:14 PM EST.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
When the incompatible hardware doesn't sell, the OEMs will hear you loud and clear.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
It seems to me this only affects a subset of devices that don't even yet exist. If what you want to do is run linux with virtual box and other assorted unsigned kernel modules then why would you be buying a 'Designed for Windows 8' ARM device? You wouldn't, just like you wouldn't buy an iPad to do those things. You would buy an x86 device, or an Android device, or an ARM device that is not 'Designed for Windows 8'.
The user is, primarily, the problem, security-wise. Giving the user the ability to opt out of the security defeats it, because had they not been a problem to start with, the security would not likely be necessary.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Oh fuck off.
Right now, the ARM architecture equates to tablets and phones for many, maybe most people.
However, a number of companies (Qualcomm, NVIDIA, and others) have announced that they are developing ARM processors to challenge Intel in laptops and desktop systems. Probably they are going with ARM because Intel is being somewhat uncooperative (and maybe anticompetitive) by not letting them have licenses that would allow them to produce x86 compatible systems.
For these companies, having Windows on their ARM systems is vital. However, we shouldn't be short-sighted - restricting the ability for ARM systems to boot anything but Windows will (in the long run) benefit Intel, AMD, Via, etc. as much as it will benefit Microsoft by restricting which operating systems the upcoming ARM based systems can boot. They will either run Windows or they will run everything else, depending on the boot ROM in the system. Guess which most will chose.
Which has precisely nothing to do with the issue being discussed.
Unfortunately, most complete hardware systems tend to come paired with software (i.e. the OS). The only people who get to choose their OS are people who build their own PCs. If this becomes too common, the only way will be if it's possible to build your own (much as people do with x86 PCs today). Of course, that still sucks for anyone who wants a mobile device, or who has old (eventually) equipment, doesn't want to build them selves, etc.
Excuse for why is your room always messy?
Then the solution is simple. Eliminate all the users. I suggest hiring the daleks for that one, they seem enthused with the idea.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
You are comparing Apples(tm) and Windows(tm). What OS does Apple sell? What computer models does Microsoft sell? See the difference?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
knoppix and other testing / recovery tools also need secure boot.
Does networking booting work with secure boot?
Ghost?
Hard Drive Diagnostics tools (self booting ones)
Dell Diagnostics tools (self booting ones)?
Acronis True Image
clonezilla?
Memtest86+ (better and more to the hardware then the windows memory test tool)
There is alot of stuff some still dos based that is need out side of windows.
You buy a screwdriver and use the handle to pound in nails when they stop making hammers because Microsoft uses their monopoly to drive hammer makers out of the market.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Don't feel bad bonch, I got accused of shilling for saying IE is shit. I still haven't figured out how saying something is shit is a positive endorsement for it, maybe its rapper lingo or something, hell if I know.
As for TFA watch how quickly i get modded down by FOSS zealots and their giant perceptual bubble, ready? Hey FOSSies, its just MSFT copying Apple again, so quit getting your panties in a wad, okay? you can't put anything on an iPad but iOS and this is THE EXACT SAME DEAL. There will be NO CHANGE when it comes to X86, in fact part of the "designed for Windows 8" specs state that they MUST allow the secure boot to be disabled, the only place its different is the ARM chips which as many have pointed out will probably be heavily subsidized by MSFT who don't want "Hey turn that $299 Windows 8 tablet into a $500 Android tablet!" posts all over the net 3 weeks after it comes out.
And I know this will piss you off, get ready for it....DON'T BUY IT...is that REALLY so hard? why the hell is it any business of yours what MSFT does with chips they contracted out for, or with OEMs they are paying to build their designs? it isn't like you don't have more choices than EVER before, you've got Apple, Google, RIM,, there is X86/64, ARM,MIPS, hell you got choices coming out your asses, so WTF are you bitching for? Vote with your wallet okay? But just because YOU don't like doesn't mean you get to tell ME or anyone else what device we should buy or what features it should have. If I was gonna buy one of these things, which I'm not BTW, I wanna try one of those $70 Android Indian pads the net has been buzzing about, but if I did and was actually gonna use this for real work I'd WANT it locked down, because if its one thing we've seen its that these things are giant targets for the malware guys! look at Android it seems like every other day we are reading of some exploit.
But in the end you have not a damned thing to bitch about in mobile. Android is switching between first and second place constantly, there are a bazillion different hacked droid ROMs out there you can play with, life is good man so why get your panties in a wad for a device you would NEVER buy in a million years anyway? And if you are buying Windows devices to get the trialware price breaks and then loading Linux YOU are a damned hypocrite and part of the problem, as there are many guys like System76 busting their asses trying to support you and if you don't buy from them and support Linux then you're just being assholes and have NO right to complain about the numbers showing Windows share being so high because you are part of those numbers!
But now you have no excuses, you can buy damned near any device you want running Linux, so vote with your wallet and let everyone else vote with theirs, okay? if the world likes what you have it'll win, if not then that simply means you aren't listening to the people and giving them what they want, simple as that. But bitching about Win 8 ARM not letting you boot Linux when most of you wouldn't piss on a Win 8 anything is just bitching for the sake of being a bitch and more than a little pointless, okay? Nobody is taking anything "away" from you if you would have never bought it in the first place, and ARM chips are about as different from x86 as night is to day, with ARM everything is custom chips whereas x86 will run any old thing. If you want freedom? you've got the droid, have fun, I'll be joining you when those $70 Droid tablets hit just for shits and giggles. But when MSFT is paying for a device let them design it however they wish.
ACs don't waste your time replying, your posts are never seen by me.
There will be a "jailbreak" or somesuch available for these within a matter of hours from when they hit the street.
is why isn't anyone up in arms that Microsoft is going to heavily subsidize Windows 8 Tablet & phone sales. Isn't that an Anti-Trust violation? I'm pretty sure Walmart did the same thing with cosmetics and got in all sorts of trouble...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
As I understand it this is about what the firmware loads having to be signed. It then trusts that program to do the right thing and apply tests to ensure that other operating systems or modues are correctly signed before loading them. Ie a chain of trust.
How long do you think it will be before a signed version of GRUB (that will happily load anything) appears on an FTP site somewhere ? Either by someone cracking the signing key, or someone working late at night at an office somewhere where they have the ability to generate signed binaries and doing a bit of unrecorded extra work. There is a good chance that whoever does it will not be caught ... just pass the binary down a chain of contacts the last of which puts it up somewhere.
Revoking a key will take a lot of work, it might not be possible to do on kit that is already out in the field. They might make using this signed GRUB illegal, but on what gounds ? They would need new laws.
What man can do - man can break.
Give the guy a break.
He already sold his soul, that silver is all he has left to live on.
I've been known to piss on requirements in specifications from time to time because they subvert my interests or they have effects I believe to be more harmful than helpful.
All secure boot does is give the computer some assurance whatever it is handing off control to can be trusted.
There is no technical way for UEFI or anything else to enforce signed drivers in the form of modules loaded dynamically at runtime. If the kernel is blessed by the computer these "requirements" are simply empty words on a page that can and will be ignored with impunity.
Yup, we should just STFU and let the two biggest companies in consumer computing shut down all but each other as options in the market.
But none of how that works is defined, so chances are each vendor will have a different way of doing it and when that happens, the likelihood of automating the process goes way down (if it was ever possible) and the barriers to entry go way, way up.
Of course not. They want to undercut Android and drive it out of the market. Prices will probably jump back up (but the security won't be relaxed) if they succeed.
If Microsoft succeeds in their obvious goal of eliminating all other choices aside from Apple, nope, it won't be. Because there will be no choice.
Because a company with a powerful monopoly known for acting in anti-competitive manners is establishing requirements that make it extremely difficult, and in some cases impossible, for alternative software platforms to be used on these devices.
Sure, sure. I would too. But that's not what this hardware is being set up for. It's designed to keep a lid on you just as much as anything else.
Well I won't knowing that it's been deliberately crippled. I do buy "designed for windows N" hardware now because until this point it didn't guarantee that I would be locked out or forced to perform contortions to put whatever OS I wanted on it.
They make nice large laptops, no tablets or cellphones. But yeah, I can't wait until my choice in hardware is reduced to a tiny handful of companies because Microsoft has manipulated the rest of it into being exclusive to them. That's fucked up and BROKEN.
Gimme a fucking break. I'd buy a Windows 8 device... if it would let me do as I wished up to and including replacing Windows 8. But now I know that since I can't, no I won't. And I'll bitch that choices are being deliberately limited by an anti-competitive monopolist. To ignore the moves being made here is foolish in the extreme.
FIGHT HARD, O WHITE KNIGHT! MICROSOFT SHALL SURELY REWARD YE IN THE END!
I'm really confused by Matthew Garrett's assertion that secure boot creates problems for virtualbox, OS device drivers, and other kernel modules. UEFI secure boot only applies to UEFI executables (basically UEFI device drivers and bootloaders). Only the bootloader hands off control to the OS, UEFI secure boot's job is done. It's up to the OS bootloader to decide if it wants to check a signature on the OS. And from there, its up to the OS to decide if it wants to verify signature on other kernel modules, including drivers. If the Linux folks aren't worried about malicious device drivers acting as rootkits, they don't need to verify device drivers. It's just that simple.
And maybe if Matthew and the FOSS community are that concerned about standardized key formats for UEFI they should actually join the UEFI Forum. Red Hat and Canonical have certainly been invited to the table, but they instead choose to criticize from the outside rather than be part of the solution. Microsoft has gone out of their way to try to placate the FOSS folks here, at least on x86 (I agree that the situation on ARM is a bit different). MS will sign other bootloaders, if someone will submit one, allowing Linux folks to take partial advantage of UEFI secure boot. MS is requiring user-configurable trust anchors on x86, which is exactly what Red Hat and Canonical asked for.
I really don't understand Matthew here. He got what he wanted on x86. I can understand him not being happy with the requirements for ARM systems, but he should be ecstatic with Microsoft's new draft requirements for x86 systems.
Yep, that's true. Any bootloader, including bootloaders on boot CD/DVDs, will need to be signed when UEFI secure boot is enabled. You'll probably need to disable UEFI secure boot when using old add-in cards, like discrete video cards, too. At least, I think you''ll have to if you want to be able to be able to use your monitor in the preboot environment.
That actually raises an interesting question though... If you have a motherboard with UEFI secure boot enabled by default, and you try to use an old video card that doesn't have a signed UEFI device driver, how would you even go into the BIOS settings to turn off secure boot?
SOPA PIPA, the "return" of public-domain artefacts to the status of "intellectual property", "secure" boot.
My .sig is no joke. If the elite in the US and Europe were told "make the choice between keeping Corporate Capitalism or Republican Government?
I think you know that the last vestiges of the old republic would be swept away... in a twinkling.
GET THIS STRAIGHT! Democracy is MORE IMPORTANT than mere COMMERCE!
But it's too late, isn't it? Now, it's all over - except the shouting.
"Flyin' in just a sweet place,
Never been known to fail..."
hell you got choices coming out your asses, so WTF are you bitching for? Vote with your wallet okay? But just because YOU don't like doesn't mean you get to tell ME or anyone else what device we should buy or what features it should have. If I was gonna buy one of these things, which I'm not BTW, I wanna try one of those $70 Android Indian pads the net has been buzzing about, but if I did and was actually gonna use this for real work I'd WANT it locked down, because if its one thing we've seen its that these things are giant targets for the malware guys!
First it's a matter of culture, which does and can effect every one of us. A culture where corporation control what you can or can't do with a computer is a culture detrimental to everyone. Second who has the keys? Locking your stuff up as long as you have a key is not problematic at all. What is is when the key is controlled solely by someone who is willing to sacrifice your interests and goals for the sake of their own.
I'm sure they don't realize what they are doing... but they will in time. They (unlike apple) don't sell the hardware their software runs on. Therefore.. it's not under their control how many devices are in the market that can run an OS that is so locked down. At first there may be many... but those choices will taper off as sales of linux based devices will always be less expensive. That and people don't like windows on non desktop platforms and I seriously doubt they have done enough right with the next iteration of Windows to change that perception. So in the end.. this will resemble yet another failed Microsoft mobile platform and less like the next desktop OS for the future. In the mean time.. they will continue to shed 3rd party developers as this slow motion train wreck unfolds.
Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats. -HLM
Linux they could run WINE and then access x86 applications that Windows 8 ARM cannot.
Wine on non-x86 can't run x86 Windows applications. Qemu in theory could... very slowly, but then again that can run on Windows too. They certainly want tight control over the ecosystem from top to bottom, but they are probably more afraid of consumers getting cozy with sideloading apps instead of the more profitable 'market' rather than Linux replacing their OS at this stage in the game. They are envious of Apple's model and desperately want that for themselves.
out-innovate on it as a community better then MS can (think kinect there).
I know many examples where OSS world has outmanuvered MS in terms of interesting work, but Kinect is a pretty bad example, nearly *all* the interesting work done to date has been atop MS platforms using MS SDK resources. The specific Kinect implementation has pretty much gone precisely as Microsoft could have hoped.
I do think Win8 ARM (if it *really* happens) is a very bad idea for MS strategically speaking. MS OS is nothing particularly special in and of itself and at this point is propped up by popular software support. They dilute that message and it could mean significant trouble.
XML is like violence. If it doesn't solve the problem, use more.
It's interesting that Microsoft has long been strong-arming hardware vendors into REQUIRING that they sell their machines with an OS(oh, any OS is fine *wink* *wink*). Now apparently they want to make sure you can't take Windows off of the device. This isn't so different from encrypted bootloaders on android devices.
Now that these mobile devices have advanced to being full blown computers in every sense of the word, they are still not referred to as such. They are not even referred to and single-purpose/special-purpose computers. They are referred to as consumer electronic devices or mobile phones. People are used to consumer electronics and mobile phones being proprietary devices, this is normal and accepted. There is still the pervasive idea that with desktop computer or a notebook computer that the machine is the PROPERTY of the OWNER of the machine. "This is my machine and you can't tell me what I can or can't put on it."
They idea of buying a laptop computer that you cannot, WILL NOT, run anything but the operating system shipped with it is just weird. If people aren't thinking of the device as a computer, but merely a telephone or a gadget, this idea doesn't seem weird at all.
Does nobody see the irony of the people blasting Microsoft in preference for Android, which is (ultimately) a closed system, mostly installed on locked-down hardware and unrootable installs?
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
Well you sir are coming off as a bit of a loonie and more than a little stalkerish, is that REALLY how you wish to be seen? its not like we aren't grown ups here and can judge for ourselves what is bullshit and what's not, marketing bullshit is pretty easy to spot BTW as they always fall for "buzzword bingo" like synergy or in the example you keep posting "seamless experience' which if that doesn't just scream marketing bullshit i don't know what does.
But you see the problem with guys like you is you encourage the REALLY batshit to take up you claims, such as my own personal stalker whose been following me a couple of months now. he posted in this thread BTW, not once but twice counting AC posting, see if you can spot him. he is convinced that I'm actually a "M$ Ninja" secretly hidden in a "warroom" in Redmond, which is extra funny since i've never been west of OKC, and that I "have a file on him" and an "Agenda to destroy FOSS and freedom' along with kill kittens or something, who can understand the truly batshit. Now he has it in my head I'm old Pete, aka APK, even though old Pete and i had a pretty nasty row last year until we finally agreed to disagree and we still frankly can't agree on shit, but old APK pointed out one of his "Linux magically protects you from viruses' posts was bullshit so now he MUST be me.
So you see friend, pointing out bullshit once is fine, following them around? make YOU look like the douchebag. Don't worry friend with phrases like seamless experience it isn't like he isn't as easy to spot as Bozo at an Amish wake, his own language trips him up. but when you stalk like that you embolden the REAL nutjobs that are frankly killing /. like a cancer, the ones that treat OSes like religions and anyone who doesn't parrot the party line as heretics. The shills? We can deal with them easy enough, like I said their own love of buzzword bingo gives them away, but its the crazies that are frankly ruining the site for everybody as nobody can have a simple discussion about any subject with militant fanbois and perception bubbles. BTW don't label me a shill for using perception bubble, I prefer to use blatant circlejerk but I was told perception bubble was nicer and i'm trying to be more sophisticated in my phrases and shit, kay? But do you REALLY want to see this site become another Kuroshin, where nothing but trolls and crazies hang anymore because the loonies ran everyone else off? Shilling by ANY group is easy enough to ignore, but the crazy flag waving and perception bubble simply ruins any chance at a dialog and makes it pointless to continue
. Its like the difference between someone handing you a flier for some company and someone jumping in your face and yelling '"fuck you muthafucker!", one is easy to simply ignore while the other one turns posts into endless dick waving. Hell look at the posts below you friend, how quickly they went from having constructive arguments to being the equivalent of Halo teabagging. all civility went right out the window, all the militant dick wavers saw you as a "fellow traveler' and joined in, nothing really more can be posted because the civility is gone and everyone moved on. IS that REALLY what you wanted to accomplish? i hope not, but that was the result.
ACs don't waste your time replying, your posts are never seen by me.
we have anti-trust laws and such to prevent them
Uh, no we don't. Our society has not agreed that monopolies are not beneficial, in fact, quite the opposite in many cases. We have laws preventing monopolies from doing certain things, but not actually preventing monopolies themselves. In many cases, monopolies are better than the alternative, and is beneficial for society.
I guess it is the user facing aspect of computers that I am most disappointed with. For me, the text editor is the performance benchmark. I edit large programs, sometimes thousands of lines. Way back, I remember running Wordstar on a Wyse 50 terminal at 38400 with no handshaking required, and the code flew past. Later on in the Windows NT time, I had a code editor with what I would call a live scroll bar. You moved the scroll bar, and the text flew past, thousands of lines if that was what you were working on. I could really get around in the code. Soon afterwards, things slowed down a lot, and because the hardware and software could not keep up, Microsoft detached the scroll bar from the document, and when you stopped scrolling, the doc repainted. I could no longer scroll through my programs at top speed, looking for familiar shapes to tell me where I was in my large program. Then a while back I switched to the Mac, and regained that "live" sort of scrolling that I really want for my working tools. During my travels through professional programming, people gave me various guidelines about how long users should be made to wait for results, usually gauged in seconds. It seems like even though I have a modern machine with Windows 7, plenty of ram... It often makes me wait 30 seconds for a program to load. I used tons of different operating systems over the years, but it was the Unix based workstations that finally caught my interest. I am afraid just adding SCO failed to make a PC into a workstation, but Mac OS X on top of substantial Intel hardware assets makes what I consider a good workstation. I still have to use Windows for some things, but not by choice, and I don't enjoy the experience.