Slashdot Mirror
Will Secure Boot Cripple Linux Compatibility?
MojoMax writes "The advent of Windows 8 is drawing ever nearer and recently we have learned that ARM devices installed with Windows 8 will not be able to disable the UEFI secure boot feature that many of us are deeply concerned about. However, UEFI is still a very real danger to Linux and the freedom to use whichever OS you chose. Regardless of information for OEMs to enable customers to install their own keys, such as that published by the Linux Foundation, there are still very serious and as yet unresolved issues with using secure boot and Linux. These issues are best summarized quoting Matthew Garrett: 'Signing the kernel isn't enough. Signed Linux kernels must refuse to load any unsigned kernel modules. Virtualbox on Linux? Dead. Nvidia binary driver on Linux? Dead. All out of tree kernel modules? Utterly, utterly dead. Building an updated driver locally? Not going to happen. That's going to make some people fairly unhappy.'"
Would someone interested in Linux on these particular tablets be able to order one from a vendor with Linux (or no operating system) pre-installed? I couldn't find information on whether or not OEMs are restricted from selling pre-installed Linux versions of the tablet. The SoftwareFreedom website says "any ARM device that ships with Windows 8 will never run another operating system, unless it is signed with a preloaded key or a security exploit is found that enables users to circumvent secure boot." The phrase there is "ships with Windows 8," which suggests to me that Custom Boot-enabled versions could ship without Windows. Admittedly, I have a hard time seeing it as a freedom issue, as these are just tech gadgets at the end of the day. I'd rather it was framed as an inconvenience argument, not a freedom one.
Don't purchase any of these ARM powered devices which run Windows 8.
It seems to me this only affects a subset of devices that don't even yet exist. If what you want to do is run linux with virtual box and other assorted unsigned kernel modules then why would you be buying a 'Designed for Windows 8' ARM device? You wouldn't, just like you wouldn't buy an iPad to do those things. You would buy an x86 device, or an Android device, or an ARM device that is not 'Designed for Windows 8'.
I don't think /. comprises that much of the tablet market.
Oh fuck off.
Right now, the ARM architecture equates to tablets and phones for many, maybe most people.
However, a number of companies (Qualcomm, NVIDIA, and others) have announced that they are developing ARM processors to challenge Intel in laptops and desktop systems. Probably they are going with ARM because Intel is being somewhat uncooperative (and maybe anticompetitive) by not letting them have licenses that would allow them to produce x86 compatible systems.
For these companies, having Windows on their ARM systems is vital. However, we shouldn't be short-sighted - restricting the ability for ARM systems to boot anything but Windows will (in the long run) benefit Intel, AMD, Via, etc. as much as it will benefit Microsoft by restricting which operating systems the upcoming ARM based systems can boot. They will either run Windows or they will run everything else, depending on the boot ROM in the system. Guess which most will chose.
You are comparing Apples(tm) and Windows(tm). What OS does Apple sell? What computer models does Microsoft sell? See the difference?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
knoppix and other testing / recovery tools also need secure boot.
Does networking booting work with secure boot?
Ghost?
Hard Drive Diagnostics tools (self booting ones)
Dell Diagnostics tools (self booting ones)?
Acronis True Image
clonezilla?
Memtest86+ (better and more to the hardware then the windows memory test tool)
There is alot of stuff some still dos based that is need out side of windows.
You buy a screwdriver and use the handle to pound in nails when they stop making hammers because Microsoft uses their monopoly to drive hammer makers out of the market.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Don't feel bad bonch, I got accused of shilling for saying IE is shit. I still haven't figured out how saying something is shit is a positive endorsement for it, maybe its rapper lingo or something, hell if I know.
As for TFA watch how quickly i get modded down by FOSS zealots and their giant perceptual bubble, ready? Hey FOSSies, its just MSFT copying Apple again, so quit getting your panties in a wad, okay? you can't put anything on an iPad but iOS and this is THE EXACT SAME DEAL. There will be NO CHANGE when it comes to X86, in fact part of the "designed for Windows 8" specs state that they MUST allow the secure boot to be disabled, the only place its different is the ARM chips which as many have pointed out will probably be heavily subsidized by MSFT who don't want "Hey turn that $299 Windows 8 tablet into a $500 Android tablet!" posts all over the net 3 weeks after it comes out.
And I know this will piss you off, get ready for it....DON'T BUY IT...is that REALLY so hard? why the hell is it any business of yours what MSFT does with chips they contracted out for, or with OEMs they are paying to build their designs? it isn't like you don't have more choices than EVER before, you've got Apple, Google, RIM,, there is X86/64, ARM,MIPS, hell you got choices coming out your asses, so WTF are you bitching for? Vote with your wallet okay? But just because YOU don't like doesn't mean you get to tell ME or anyone else what device we should buy or what features it should have. If I was gonna buy one of these things, which I'm not BTW, I wanna try one of those $70 Android Indian pads the net has been buzzing about, but if I did and was actually gonna use this for real work I'd WANT it locked down, because if its one thing we've seen its that these things are giant targets for the malware guys! look at Android it seems like every other day we are reading of some exploit.
But in the end you have not a damned thing to bitch about in mobile. Android is switching between first and second place constantly, there are a bazillion different hacked droid ROMs out there you can play with, life is good man so why get your panties in a wad for a device you would NEVER buy in a million years anyway? And if you are buying Windows devices to get the trialware price breaks and then loading Linux YOU are a damned hypocrite and part of the problem, as there are many guys like System76 busting their asses trying to support you and if you don't buy from them and support Linux then you're just being assholes and have NO right to complain about the numbers showing Windows share being so high because you are part of those numbers!
But now you have no excuses, you can buy damned near any device you want running Linux, so vote with your wallet and let everyone else vote with theirs, okay? if the world likes what you have it'll win, if not then that simply means you aren't listening to the people and giving them what they want, simple as that. But bitching about Win 8 ARM not letting you boot Linux when most of you wouldn't piss on a Win 8 anything is just bitching for the sake of being a bitch and more than a little pointless, okay? Nobody is taking anything "away" from you if you would have never bought it in the first place, and ARM chips are about as different from x86 as night is to day, with ARM everything is custom chips whereas x86 will run any old thing. If you want freedom? you've got the droid, have fun, I'll be joining you when those $70 Droid tablets hit just for shits and giggles. But when MSFT is paying for a device let them design it however they wish.
ACs don't waste your time replying, your posts are never seen by me.
There will be a "jailbreak" or somesuch available for these within a matter of hours from when they hit the street.
I've been known to piss on requirements in specifications from time to time because they subvert my interests or they have effects I believe to be more harmful than helpful.
All secure boot does is give the computer some assurance whatever it is handing off control to can be trusted.
There is no technical way for UEFI or anything else to enforce signed drivers in the form of modules loaded dynamically at runtime. If the kernel is blessed by the computer these "requirements" are simply empty words on a page that can and will be ignored with impunity.
Yup, we should just STFU and let the two biggest companies in consumer computing shut down all but each other as options in the market.
But none of how that works is defined, so chances are each vendor will have a different way of doing it and when that happens, the likelihood of automating the process goes way down (if it was ever possible) and the barriers to entry go way, way up.
Of course not. They want to undercut Android and drive it out of the market. Prices will probably jump back up (but the security won't be relaxed) if they succeed.
If Microsoft succeeds in their obvious goal of eliminating all other choices aside from Apple, nope, it won't be. Because there will be no choice.
Because a company with a powerful monopoly known for acting in anti-competitive manners is establishing requirements that make it extremely difficult, and in some cases impossible, for alternative software platforms to be used on these devices.
Sure, sure. I would too. But that's not what this hardware is being set up for. It's designed to keep a lid on you just as much as anything else.
Well I won't knowing that it's been deliberately crippled. I do buy "designed for windows N" hardware now because until this point it didn't guarantee that I would be locked out or forced to perform contortions to put whatever OS I wanted on it.
They make nice large laptops, no tablets or cellphones. But yeah, I can't wait until my choice in hardware is reduced to a tiny handful of companies because Microsoft has manipulated the rest of it into being exclusive to them. That's fucked up and BROKEN.
Gimme a fucking break. I'd buy a Windows 8 device... if it would let me do as I wished up to and including replacing Windows 8. But now I know that since I can't, no I won't. And I'll bitch that choices are being deliberately limited by an anti-competitive monopolist. To ignore the moves being made here is foolish in the extreme.
FIGHT HARD, O WHITE KNIGHT! MICROSOFT SHALL SURELY REWARD YE IN THE END!
hell you got choices coming out your asses, so WTF are you bitching for? Vote with your wallet okay? But just because YOU don't like doesn't mean you get to tell ME or anyone else what device we should buy or what features it should have. If I was gonna buy one of these things, which I'm not BTW, I wanna try one of those $70 Android Indian pads the net has been buzzing about, but if I did and was actually gonna use this for real work I'd WANT it locked down, because if its one thing we've seen its that these things are giant targets for the malware guys!
First it's a matter of culture, which does and can effect every one of us. A culture where corporation control what you can or can't do with a computer is a culture detrimental to everyone. Second who has the keys? Locking your stuff up as long as you have a key is not problematic at all. What is is when the key is controlled solely by someone who is willing to sacrifice your interests and goals for the sake of their own.
I'm sure they don't realize what they are doing... but they will in time. They (unlike apple) don't sell the hardware their software runs on. Therefore.. it's not under their control how many devices are in the market that can run an OS that is so locked down. At first there may be many... but those choices will taper off as sales of linux based devices will always be less expensive. That and people don't like windows on non desktop platforms and I seriously doubt they have done enough right with the next iteration of Windows to change that perception. So in the end.. this will resemble yet another failed Microsoft mobile platform and less like the next desktop OS for the future. In the mean time.. they will continue to shed 3rd party developers as this slow motion train wreck unfolds.
Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats. -HLM
Honestly, I think you have it backwards. I think its less that UEFI secure boot is most advantageous to Microsoft and more that it happens to be inconvenient to Linux. The open source community, for both good and bad reasons, has made a series of decisions that make a signed code model difficult to implement (and stomach).
Forgetting about who runs the signing service for a moment, do you have a better idea of how to solve security problems with boot firmware? It's one thing if you don't like the implementation of UEFI secure boot, but you seem to be suggesting that the entire concept behind UEFI secure boot benefits Microsoft. If that's true, what is the alternative?
I don't think Microsoft particularly wanted to run the signing service. It has already given them headaches, and it opens the door for a lot of potential problems with liability. But who else was going to run it? The UEFI Forum never gave any indication they were willing to run it when the specification was being written. Given they were the natural choice, I think it's pretty clear that means they explicitly didn't want to run it. Who else was going to run it? Verisign? I'm sure that would have gone over much better... Even if things did go that route, who was going to pay for it? If Microsoft funded it, which they probably would have had to, people would have just assumed Verisign was going to do whatever Microsoft told them to.
Red Hat and Canonical have never given any indication they were willing to run a signing service either. And people in the industry did ask them to. I'm not sure they ever explicitly said no, but they certainly never said yes either.