Red Hat Will Pay Microsoft To Get Past UEFI Restrictions

ToriaUru writes "Fedora is going to pay Microsoft to let them distribute a PC operating system. Microsoft is about to move from effectively owning the PC hardware platform to literally owning it. Once Windows 8 is released, hardware manufacturers will be forced to ship machines that refuse to run any software that is not explicitly approved by Microsoft — and that includes competing operating systems like Linux. Technically Fedora didn't have to go down this path. But, as this article explains, they are between a rock and a hard place: if they didn't pay Microsoft to let them onto the PC platform, they would have to explain to their potential users how to mess with firmware settings just to install the OS. How long before circumventing the secure boot mechanism is considered a DMCA violation and a felony?" Note that the author says this is likely, but that the entire plan is not yet "set in stone."

Comments

"Literally"

[Anonymous Coward]

Need I say more?

Re:"Literally"

[Jeremiah Cornelius]

I literally flew off my chair, steam coming out of my ears, when I read this!

Re:"Literally"

[Tanktalus]

Yes.

How is "controlling a system and getting money in exchange for licenses" not literally owning?

Up to now, their figurative owning is an "effective" ownership, as in "there are effectively no competitors in this space." However, should you know what you're doing, you could get something else with little effort. With this change, they are actually getting paid for compettitors to be allowed into their space. That is de facto, or literal, ownership.

Re:"Literally"

[b0bby]

They meant to say "literally pwning it."

Re:"Literally"

[Kalriath]

No they're not. Symantec/Verisign is. Microsoft doesn't issue certificates, and this entire fucking article is flat out wrong.

Lawsuit here I come

[Anonymous Coward]

Well your honor, i bough this Item from company X and their Partner company Y won't let me do XX to My property, and XX is perfectly legal.

Wow M$ though that one through...

Re:Lawsuit here I come

[DarwinSurvivor]

I think Sony already proved that strategy to be fruitless.

Lawsuit

[dmitrygr]

Lawsuit in 3...2....1..

Re:Lawsuit

[Anonymous Coward]

EU will have a field day with this in court. MS, of course, will be the ones having a bad day in court.

Re:Lawsuit

[SETIGuy]

I wish I could believe that. The EU is distracted with other things right now.

Re:Lawsuit

[TheDarkMaster]

Lawsuits is for the weaks. I use a 120mm SABOT shell.

Re:Lawsuit

[DarwinSurvivor]

Like with the PS3 right? Oh, right....

Re:Lawsuit

[Anonymous Coward]

Typical Ameritard, The EU has the power to impose fines, yes fines, on even international companies and yes, that includes Microsoft, Go check the history of the EU vs Microsoft. Sigh. Where's the troll spray.

Re:Lawsuit

[sg_oneill]

He's refering to the EU courts. Metagovernments , like normal governments, can multitask.

Re:Lawsuit

[Elldallan]

I don't see why the IT Commissioner will be all that tied up with the economy hassle, she can recommend the Commission to go after MS and if the rest of the Commission is too busy to look into it they will probably just rubber stamp her request it and pass it along to the courts where it will continue to be tied up for years, hopefully the court will grant a preliminary injunction against MS forbidding them to enact this scheme until the courts are done with them, that way it will be implemented roughly around the time Windows 58 makes it to the shelves.

If microsoft controls the 'keys'

[nurb432]

How can this be legal and not an abuse of their monopoly power?

Aside from the fact you can turn it off ( for now ) it still sounds like a clear case of abuse to me and someone should be talking to an attorney about this.

Re:If microsoft controls the 'keys'

[Anonymous Coward]

Yeah, if this isn't "monopolistic action in restraint of trade" I'm not sure what is. MS is probably greedy enough to try something like this, but I don't think they're stupid enough to think they can get away with it.

Re:If microsoft controls the 'keys'

[ZeroSumHappiness]

I particularly like how the UEFI signing format only allows one key to sign it and that signature being (apparently) on the hardware. Yeah, this isn't a clear way of entrenching a monopolistic interest at all. I mean, I understand why someone would want secured, signed hardware all the way up the stack (assuming, of course that no one breaks the scheme), but it's entirely obvious how this makes it harder for the little man to get ahead in the game.

Re:If microsoft controls the 'keys'

[zill]

Microsoft isn't scared of the DOJ. In the last anti-trust case Microsoft was found to have committed monopolization and tying and yet they paid exactly 0 dollars and 0 cents in fines.

Re:If microsoft controls the 'keys'

[Penguinisto]

Maybe that's why Microsoft was so eager to drop in that 'no class action' thing into their EULA.

Re:If microsoft controls the 'keys'

[Korin43]

Basically, Red Hat is big enough that they could get hardware companies to put another key on their hardware, but no one wants to manage that key except for Microsoft.

FTA:

An alternative was producing some sort of overall Linux key. It turns out that this is also difficult, since it would mean finding an entity who was willing to take responsibility for managing signing or key distribution. That means having the ability to keep the root key absolutely secure and perform adequate validation of people asking for signing. That's expensive. Like millions of dollars expensive. It would also take a lot of time to set up, and that's not really time we had. And, finally, nobody was jumping at the opportunity to volunteer. So no generic Linux key.

Re:If microsoft controls the 'keys'

[IamTheRealMike]

Because charging Red Hat, a billion dollar company, $99 for access to signing services is not "monopoly abuse"? The author of TFA already pointed out that nothing stops somebody from providing the same services to the Linux community, but it's difficult and expensive and they can't be bothered, so it's easier to pay Microsoft to do it for them. As can anyone else.

Secure boots and trusted computing are fundamentally a good idea. Having OEMs provide a set of root keys to control what boots is a good idea. The problem is the creator of BobLinux who wants to have thousands of random users install his random kernel is indistinguishable technically from the creator of some boot sector malware who wants to have thousands of users permanently rooted. It becomes distinguishable once you have people who check out what the software is and signs it, which is the service Microsoft are providing - for very little, actually. As I said, apparently others don't feel like offering similar services when it's expensive to do and Microsoft are offering to do it cheaply. But they could.

Re:If microsoft controls the 'keys'

[sjames]

Any proper system would have the end user hold the root key for the system and they could choose (or not) to bless certs from various vendors (or just directly sign the bootloader). Of course, MS doesn't want a proper system, they want lock-in.

Re:If microsoft controls the 'keys'

[ZeroSumHappiness]

I may have poorly read the article, but what I inferred was that hardware is signed and can only be signed once. I assume that all the hardware vendors will go through the MS signing process and won't bother making user-signable skus for those who don't want to accept the MS key.

Re:If microsoft controls the 'keys'

[ZeroSumHappiness]

By hardware, I mean add-in hardware, not the motherboards. Stupid no edit button...

Re:If microsoft controls the 'keys'

[SCY.tSCc.]

Aside from the fact you can turn it off ( for now )

What if new PCs start shipping with this turned on by default?
Linux distros/*BSD/Random-Recovery-Tool are going to have a hard time convincing people to first go to the BIOS and turn it off.

What if Microsoft Windows refuses to start unless it is turned on, so the choice is either run Windows OR (this is an exclusive OR) run Linux/*BSD/Whatever. Those who use Windows as their primary OS sure don't want to switch any more.

Re:If microsoft controls the 'keys'

[dkleinsc]

I can think of about 1.8 million reasons why the US Justice Department might be inclined to look the other way.

Re:If microsoft controls the 'keys'

[ZeroSumHappiness]

Uhm, this is exactly monopoly abuse.

Industry: We should support code signing to ensure a trusted compute path.
Microsoft: I agree. Let's use this scheme that makes it impossible for drivers to be signed with multiple keys simultaneously. And if you want to work on Windows (the most popular OS out there) you need to use Microsoft keys, so we have to sign it. And this all has to be turned on by default.
The Rest: Wait, wouldn't that make it really hard for anyone else to get a large amount of buy-in resulting in installation of a non-Microsoft OS very difficult?
Microsoft: *Trollface*

Re:If microsoft controls the 'keys'

[Anonymous Coward]

When Apple ties our hands, the result seems to work.
    When MS ties our hands, not so much.

Also, the /. coverage of this story seems a bit overblown.
      The story describes a reasonable compromise to make things simple for non-techie Fedora users.
      Techies can still disable the firmware boot checking and boot whatever they darn well want to.

I will admit that MS has pushed to industry to make the compromise,
                        but if somebody like FSF would step up to the plate and do signing, the compromise would be unnecessary.

Re:If microsoft controls the 'keys'

[Anonymous Coward]

Right, because the lawsuit against Microsoft was completely baseless.

You are a troll, astroturfer, or just plain idiot, or perhaps all of them.

Re:If microsoft controls the 'keys'

[marcosdumay]

The text you quoted does not say what you describes.

Of course there won't be a generic Linux key. The entire point of a secure boot system (even a honest one) is to not run whatever some random person put up toghether on the street. That does not makes it impossible for Red Hat to have a private key.

And the reason Red Had had to pay Microsoft is that the MS's proposal only permits one key, so the hardware manufacturers can either permit RH's key or MS's key, not both. They are paying MS to sign their OS with MS's key.

Re:If microsoft controls the 'keys'

[rjstanford]

You realize that that list includes contributions by Microsoft employees (really, by anyone who writes "Microsoft" onto their donation form as employer). It works out to about $30 per US employee...

Re:If microsoft controls the 'keys'

[RightSaidFred99]

Begging the question. Microsoft does not control the keys.

Re:If microsoft controls the 'keys'

[marcosdumay]

The author of TFA already pointed out that nothing stops somebody from providing the same services to the Linux community

And the author of TFA is lying, because only Microsoft could provide such service. Only MS has their private key for signing kernels, and only their private key will be permited by default.

The problem is the creator of BobLinux who wants to have thousands of random users install his random kernel is indistinguishable technically from the creator of some boot sector malware who wants to have thousands of users permanently rooted.

Yes, thus MS "fixes" that by making the boot sector malware writter target the userland tools instead, and run the rooted OS in a virtual environment. The consequences are exactly the same, but now the boot is secure.

Re:If microsoft controls the 'keys'

[marcosdumay]

Anybody can run and write for whatever OS they want.

Not anymore. Have you even read what TFA is about?

Re:If microsoft controls the 'keys'

[marcosdumay]

How can Windows know that it is on? My guess is that all the BIOS (for PCs, not servers) will get out with "unknown" bugs on that code.

Re:If microsoft controls the 'keys'

[spongman]

Microsoft was found to have committed

remember that the Jackson ruling was overturned in appeal and the two sides settled out of court.

Re:If microsoft controls the 'keys'

[Hatta]

How does anyone interpret my post to mean that the lawsuit against Microsoft was completely baseless? Really? I don't see it.

Re:If microsoft controls the 'keys'

[Hatta]

You sound really stupid yourself, considering that the technical issues are irrelevant to Microsoft's abuse of monopoly. The problem is Microsoft using their monopoly position to force vendors to ship computers with only Microsoft approved keys. Secure boot is a valid and useful feature, but preloading keys will have profound anti-competetive effects.

Re:If microsoft controls the 'keys'

[Korin43]

Maybe I should have quoted the paragraph before that too:

We explored the possibility of producing a Fedora key and encouraging hardware vendors to incorporate it, but turned it down for a couple of reasons. First, while we had a surprisingly positive response from the vendors, there was no realistic chance that we could get all of them to carry it. That would mean going back to the bad old days of scouring compatibility lists before buying hardware, and that's fundamentally user-hostile. Secondly, it would put Fedora in a privileged position. As one of the larger distributions, we have more opportunity to talk to hardware manufacturers than most distributions do. Systems with a Fedora key would boot Fedora fine, but would they boot Mandriva? Arch? Mint? Mepis? Adopting a distribution-specific key and encouraging hardware companies to adopt it would have been hostile to other distributions. We want to compete on merit, not because we have better links to OEMs.

So yes, Red Hat could have got (some) OEM vendors to carry their key, but they chose not to. Part of the reason is that they couldn't get all of them to do it, but a big part is that very few Linux vendors could do the same (probably only SUSE and Ubuntu). Whether this is just trying to make themselves look good after finding out that the other solution wasn't workable is up to interpretation, but they're right -- getting every Linux vendors' key into the BIOS is unworkable for small (or free) distros.

Of course there won't be a generic Linux key. The entire point of a secure boot system (even a honest one) is to not run whatever some random person put up toghether on the street. That does not makes it impossible for Red Hat to have a private key.

There's no reason you couldn't create a generic Linux key, and then only sign code that meets certain standards (basically do the same thing that Microsoft is doing with their signing program). The big problem is that verifying things is complicated and expensive, so no one (except Microsoft) wants to do it.

I agree that it would be preferable for a non-Microsoft entity to be signing the Linux keys, but such an entity does not exist right now. I hope one of Red Hat's priorities is to set one up, sometimes you have to just work with what you have.

And the reason Red Had had to pay Microsoft is that the MS's proposal only permits one key, so the hardware manufacturers can either permit RH's key or MS's key, not both.

One key per signature -- as in, I can't sign a bootloader with both MS's key and Red Hat's key. I can have both keys and sign one bootloader with one and the other bootloader with the other. They can -- and some vendors are willing to -- allow both MS and Red Hat's keys. The real problem that the one-key-per-signature (or one-signature-per-binary if you prefer) situation is that you can't use secure boot without trusting the MS key, since all of the included components are signed with it.

Re:If microsoft controls the 'keys'

[Em Adespoton]

That's a big assumption -- but this is likely the scenario for discount desktop PCs. It'll basically mean that low-end desktop PCs will be cheaper with Win 8 on them than without. Netbooks on the other hand will likely be just fine, as will tablets, servers, high-end PCs, PCs using other architectures, etc.

Re:If microsoft controls the 'keys'

[Em Adespoton]

You sound really stupid yourself, considering that the technical issues are irrelevant to Microsoft's abuse of monopoly. The problem is Microsoft using their monopoly position to force vendors to ship computers with only Microsoft approved keys. Secure boot is a valid and useful feature, but preloading keys will have profound anti-competetive effects.

Actually, preloading keys prior to sale without a big disclaimer on the box will open MS to massive lawsuits. People will be buying a "Windows box" while under the false impression they're buying a personal computer with Windows bundled.

I think this would actually shake itself out pretty quickly. My guess is that the end result would be that the MS key gets installed during the "first use" process, and not as part of the build and ship process. The lawsuit will still happen, but it will take longer.

The next step of course will be either a) the MS key being leaked, or b) UEFI being jailbroken. Goodbye bootkit protection.

Re:If microsoft controls the 'keys'

[Anonymous Coward]

MS doesn't control the keys; it's just that they're the ones driving the requirement so no OEM has a reason to ship a system with security enabled and not have the MS key.

The requirements for x86 hardware are that the system must ship with restrictions enabled, but the user must be allowed to disable the restrictions or add their own keys. In other words, there is nothing preventing you (the owner) from doing whatever you want with the machine. If you don't want the restrictions, simply turn them off and install whatever code you like.

The only issue is that machines with the Windows 8 logo will be required to ship with the restrictions enabled and RedHat doesn't want installation instructions that start with "disable UEFI security" or "enroll the RedHat public key".

Other options they rejected are:

1. Get all manufacturers to ship with RedHat's key in the firmware (in addition to MS's). The manufacturers had no problem with this, but there's no way they could possibly find every OEM to get them to do it, and they didn't want to be in a privileged position ("install RedHat because it's trusted by your OEM").

2. Get all Linux distros to coordinate on a single Linux key and have the OEMs add it to their hardware. This is undesirable because nobody wants to be responsible for maintaining the One True Key, and even then there would still be OEMs who don't ship with it.

In the end, the easiest thing is to pay a one-time fee of $99 to MS and have them sign a mini-bootloader that can start up grub. That doesn't sound like such a big deal to me.

Note that the issue with having only one signature on a file is unrelated. That just means a user can't realistically remove the MS key from their system because lots of drivers will be signed with it. Allowing multiple signatures on a file would not change RedHat's position.

dom

Re:If microsoft controls the 'keys'

[JCCyC]

Sigh.

Troll: "That ball's color is a mixture of red and blue."
Person: "Um, I see that ball and it's not purple."
Troll: "How does anyone interpret my post to mean that the ball is purple? Where did I say 'Purple'?"

Re:If microsoft controls the 'keys'

[Hatta]

Ok, if I have to spell it out from you, the DOJ used an entirely legitimate complaint against Microsoft as an excuse to shake them down. You can tell the DOJ wasn't really serious about protecting consumers, because in the end they did nothing at all to protect consumers. All they did is send Microsoft a message that they are not above paying the piper. Microsoft apparently heard that message loud and clear.

Since the previous antitrust actions were not intended to help consumers, then it would be unlikely for the DOJ to attempt to help consumers in the future. Therefore, you can expect no DOJ action on this issue.

Does that make sense now? I still don't see how anyone who speaks English could interpret my previous post to mean that Microsoft wasn't guilty of antitrust abuse.

Re:If microsoft controls the 'keys'

[bmo]

>You can tell the DOJ wasn't really serious about protecting consumers, because in the end they did nothing at all to protect consumers.

What happened is that in the middle of everything, we went from Clinton to W and W's influence on the DOJ, and we all know how Republicans feel about regulation, any regulation at all.

--
BMO

Re:If microsoft controls the 'keys'

[rabtech]

Any proper system would have the end user hold the root key for the system and they could choose (or not) to bless certs from various vendors (or just directly sign the bootloader). Of course, MS doesn't want a proper system, they want lock-in.

Actually this kind of scheme is already an automatic fail. Remember that users routinely answered *yes* to install malicious ActiveX controls from insecure websites. Do you really think they will have any clue in your scenario? (Hint: I just want to see my video/punch the monkey/see that bikini photo, YES you dumb computer! Stop asking so many questions!)

Heck, on Android people routinely answer YES to the security dialogs when some random game or utility asks for every possible permission... that's how all those SMS malware apps and the like end up being installed by thousands of people.

Anything that relies on the user to make a security decision has failed before it leaves the drawing board. That's what makes this so damn complicated and annoying. We already have problems with chain of trust now that there are hundreds of CSAs, some of whom routinely get compromised (sometimes for years) and are used to issue bogus certificates.

RedHat/Fedora is completely correct - if you want to be secure you need to deal with the certificate chain of trust (which they are punting on by using Microsoft to handle it) and you must sign the boot loader, kernel, and all modules/drivers. That's the only way to be at least somewhat certain that no one has injected malware along the way.

Re:If microsoft controls the 'keys'

[sl4shd0rk]

In the end, the easiest thing is to pay a one-time fee of $99 to MS and have them sign a mini-bootloader that can start up grub. That doesn't sound like such a big deal to me.

Aaaaaand... this is precisely where the control of the keys lies. No, $99 is not a big deal for Redhat. Trusting M$ won't "Ooops, lol.. guess we borked your key sign just before you had that big competing product release. Gee, sorry. We'll get that fixed right away."

Re:If microsoft controls the 'keys'

[rabtech]

One key per signature -- as in, I can't sign a bootloader with both MS's key and Red Hat's key. I can have both keys and sign one bootloader with one and the other bootloader with the other. They can -- and some vendors are willing to -- allow both MS and Red Hat's keys. The real problem that the one-key-per-signature (or one-signature-per-binary if you prefer) situation is that you can't use secure boot without trusting the MS key, since all of the included components are signed with it.

Not quite... part of the UEFI spec says that hardware should carry the UEFI driver on-board and be able to spit it out for the firmware to use prior to OS boot. (The UEFI environment is basically just a stripped-down OS of its own). This gets around having the BIOS require foreknowledge of your peripheral/standard... it knows what a disk controller is, so your add-in card can just provide a disk controller UEFI driver that understands the card's command set, etc.

Unfortunately that spec says the drivers only have a slot for one signature so by default almost every hardware manufacturer is going to use the MS provided signing key to sign their driver, meaning removing the MS root key from your system will likely lead to all your UEFI-capable hardware to suddenly stop working because the system can't verify that it hasn't been tampered with. This is a useful capability since hardware is often full of holes and I can totally see malware flashing itself onto add-in cards to make it unremovable/undetectable.

This part is only really relevant for the paranoid who want to ditch Microsoft's key - unless you have some mechanism to verify and whitelist the drivers you will be stuck with an extremely limited set of compatible hardware.

None of this fixes the chain of trust issues that affect certificates in general (eg SSL CAs being compromised).

Re:If microsoft controls the 'keys'

[bobbied]

(assuming, of course that no one breaks the scheme)

I think that is a bad assumption. Eventually somebody will crack this scheme and be able to sign code without paying Micro$oft to sign it and then the whole gig will be over, at least until everybody can get their hardware upgraded. Given that the Linux community along with all the Black Hat Hackers out there will be looking for the key, I don't think it will take that long.

Personally, I figure that this is a good thing, assuming you can continue to disable "secure boot" and run what you want, because it means that life is harder for malware writers in general.

Re:If microsoft controls the 'keys'

[zill]

My bad, I forgot about that.

I love how it's called a "plead bargain" for a criminal person, but for a criminal corporation it's suddenly a "out of court settlement".

Re:If microsoft controls the 'keys'

[IamTheRealMike]

Did you even read TFA? The article explicitly states that a Red Hat or "Linux community" key would be allowed and OEMs were even enthusiastic about it (Microsoft not involved), but Red Hat didn't want one for themselves and the overheads involved with running a "Linux community" key and keeping it secure enough were too high. How did you get from that to "only their private key will be permitted by default"?

Re:If microsoft controls the 'keys'

[newcastlejon]

Maybe that's why Microsoft was so eager to drop in that 'no class action' thing into their EULA.

How you do figure that? Assume that EULAs are legally enforceable and "no class action things" are too. How does that affect Red Hat, who aren't actually buying copies of Windows?

The issue here is anti-competitive behaviour, which frankly has damn all to do with EULAs that seek to deny end users of their right to sue. One might argue that these measures are meant to prevent people from running alternative OSes, but that has no bearing on dubious licence agreements.

Re:If microsoft controls the 'keys'

[lister king of smeg]

LMI (https://en.wikipedia.org/wiki/Linux_Mark_Institute) would probably be fine with doing so. they would probably want several keys thought one for well know trusted sources (Debian Redhat Ubuntu Fedora, Opensuse) another for lesser know small distros and another for betas alphas experimental, ect. they might also want to go in on it with the BSD's and other open source OS's like OpenSolaris descendants, Haiku, Darwin, ReactOS and others.

Re:If microsoft controls the 'keys'

[shutdown -p now]

Exchanging service for a fee is something that is well covered by the law - if MS takes $99 but doesn't deliver, do you seriously think it would take RedHat long to sue and win whatever damages they suffer as a result? Not to mention that that would likely be an enticing "monopoly abuse" angle as well, in addition to break of contract...

Re:If microsoft controls the 'keys'

[DarwinSurvivor]

The UEFI (new school BIOS) will actually perform a 2-way signed handshake with the OS. This means that the firmware knows the OS is legit and the OS knows the firmware is legit.

Re:If microsoft controls the 'keys'

[DarwinSurvivor]

Their "certified by Microsoft" agreement requires that there only be ONE key installed, and guess which is the only key Microsoft will let you sign Windows with...

Re:If microsoft controls the 'keys'

[shutdown -p now]

Microsoft is a trans-national company and is subject to monopoly investigations in many countries, not just US.

EU, for example, has fined Microsoft to the extent of something close to $4 billion dollars overall for issues with IE (that's not a single fine, but rather the original fine + various non-compliance fines which are usually $X million per day).

Re:If microsoft controls the 'keys'

[Penguinisto]

It's pretty simple, actually.

End-users want to put something else on the computer. Given the UEFI, they can't - they're locked into what could be called, say, "Son of Vista", but without the means to do something about it (such as installing/"downgrading" to Windows XP). Enough end users complain to get a lawyer interested... but that little EULA says they can't.

Whether it's legal or not? Who knows. I agree with you in principle, but unfortunately, most end users haven't the foggiest idea about such principles. I suspect the legal team at MSFT has an equally tenuous grasp of it.

Re:If microsoft controls the 'keys'

[sjames]

You are correct. That's why it is nothing like a proper system. It's little more than a power grab.

Re:If microsoft controls the 'keys'

[sjames]

It's not like it will be something accessible from the OS. They'd have to figure out how to boot to a configuration mode (the EFI shell) first.

I'd be fine with it if the MS key is pre-signed and installed as well. The clueless will get a locked down system that way. The clued in could either disable the whole thing or sign whatever they see fit. Anything that doesn't allow that option (INCLUDING iPhone and locked down Android) should be illegal under the principle that the owner gets to control it.

Re:If microsoft controls the 'keys'

[Glock27]

Excellent suggestion.

The entire "secure" approach to computing seems to be as much about extracting every possible dollar as it is anything else.

The existence of Windows 8 should NOT end the manufacture of sane, open computer systems. Period.

Re:If microsoft controls the 'keys'

[exomondo]

And the reason Red Had had to pay Microsoft is that the MS's proposal only permits one key

No, the reason they have to pay (it's actually not to Microsoft, it's to Verisign since they actually sign it) is because they want to sign it with Microsoft's key rather than having hardware manufacturers implement RedHat's own key.

so the hardware manufacturers can either permit RH's key or MS's key, not both.

Why? I haven't seen anything that suggests it is limited to one key.

They are paying MS to sign their OS with MS's key.

Actually, if you RTFA, you'll find they're paying Verisign.

Re:If microsoft controls the 'keys'

[exomondo]

Let's use this scheme that makes it impossible for drivers to be signed with multiple keys simultaneously.

Why would you sign a driver with multiple keys?

Re:If microsoft controls the 'keys'

[sjames]

On x86, MS doesn't fully control the keys (yet) but they make it hard enough that RedHat has to consider this option. On the ARM systems MS absolutely insists that they do control the keys and the option will not exist to disable the key (unless a hack is discovered). It seems a lot like leveraging a monopoly position to me. I can only hope the European courts smack them HARD for that, the DOJ and U.S. courts won't.

Re:If microsoft controls the 'keys'

[Anonymous Coward]

Microsoft was found to have committed

remember that the Jackson ruling was overturned in appeal and the two sides settled out of court.

not quite!

the ruling on remedies (break up microsoft) was overturned, but the ruling on fact (microsoft is a monopoly and abused it to enter new markets) was NOT overturned.

 

Re:If microsoft controls the 'keys'

[jonwil]

Reading the information it looks like the plan is to get a small bootloader signed who's whole job is to launch GRUB. This small bootloader would be the only thing that needs signing and would not be something that would change very much (if at all)

So once its initially signed, it wont need to be re-signed unless something changes in the mini-loader (unlikely) or if a new key shows up.

Re:If microsoft controls the 'keys'

[styrotech]

not quite!

the ruling on remedies (break up microsoft) was overturned, but the ruling on fact (microsoft is a monopoly and abused it to enter new markets) was NOT overturned.

Thank you. At least someone remembered it correctly.

Re:If microsoft controls the 'keys'

[Fjandr]

It's not a big assumption, because in order for drivers to work on secure boot hardware they have to be signed with a key resident in the UEFI BIOS. Guess which one will be the only default key pretty much guaranteed to reside in the BIOS? Microsoft's. Since the drivers can only be signed once, guess which key they'll be signed with? Microsoft's.

It's also not something that just affects low-end PCs. Anything certified to run Windows must comply with the process. This includes servers, tablets, high-end PCs, etc. As for other architectures, not only does it affect ARM, but secure boot cannot even be disabled on ARM and keys cannot be added after it leaves the equipment manufacturer. If your signing key doesn't come on it from the factory, you can't boot the device with it. At least in the case of ARM, the machines running Windows won't likely be designed to run anything else.

At least generic drivers usually exist for OEM hardware, since otherwise this would mean OEM hardware would probably no longer be usable on a motherboard not produced by that same OEM.

Re:If microsoft controls the 'keys'

[Fjandr]

The payment actually goes to Verisign, not Microsoft.

Re:If microsoft controls the 'keys'

[Fjandr]

Like most legal definitions, "monopoly" does not mean what most people think it means.

Re:If microsoft controls the 'keys'

[exomondo]

In the end, the easiest thing is to pay a one-time fee of $99 to MS and have them sign a mini-bootloader that can start up grub. That doesn't sound like such a big deal to me.

Aaaaaand... this is precisely where the control of the keys lies. No, $99 is not a big deal for Redhat. Trusting M$ won't "Ooops, lol.. guess we borked your key sign just before you had that big competing product release. Gee, sorry. We'll get that fixed right away."

Except its Verisign, not Microsoft.

Re:If microsoft controls the 'keys'

[exomondo]

The existence of Windows 8 should NOT end the manufacture of sane, open computer systems. Period.

Are you suggesting it will? Nothing stops you from running Linux on an x86 Windows 8 computer.

Re:If microsoft controls the 'keys'

[Sloppy]

Get all Linux distros to coordinate on a single Linux key and have the OEMs add it to their hardware. This is undesirable because nobody wants to be responsible for maintaining the One True Key, and even then there would still be OEMs who don't ship with it.

I'll do it. I hereby volunteer. Give me the key. I will take on this responsibility.

I know I can do this job quite effectively, too, without the "millions of dollars" in security and signing practices that Matthew Garret spoke of.

BTW, along the aforementioned line of saving money, I will need some help with offsite backups. Anyone want to help me? In order to keep this root signing key Absolutely Safe from loss, I intend to share it with at least One Million helpers. You won't catch me keeping all my eggs in one basket, no sir.

Why wouldn't this approach work? Why does Red Hat give a damn about the security of the key or loadable modules or drivers or anything else, at long as this approach makes their OS bootable?

Re:If microsoft controls the 'keys'

[exomondo]

The problem is Microsoft using their monopoly position to force vendors to ship computers with only Microsoft approved keys.

Rubbish, there is absolutely nothing to stop vendors from shipping computers without Microsoft approved keys, moreover they can even ship computers with Microsoft's key and any other keys.

Re:If microsoft controls the 'keys'

[SolitaryMan]

Exactly. I don't give a flying fuck about this trusted computing thingy. Where do I opt out?

I hope this thing breaks in some horrible way.

Re:If microsoft controls the 'keys'

[_0x783czar]

---- Booth was a patriot ----

Actually I believe he was a Vampire

Re:If microsoft controls the 'keys'

[exomondo]

Exactly. I don't give a flying fuck about this trusted computing thingy. Where do I opt out?

It's in the UEFI settings, called SecureBoot, just turn it off.

Re:If microsoft controls the 'keys'

[SuricouRaven]

"The requirements for x86 hardware are that the system must ship with restrictions enabled, but the user must be allowed to disable the restrictions or add their own keys."

Except on ARM, where MS has made it quite explicit they will not allow OEMs to even give users that option. I have a very strong suspicion that some time around Windows Ten they'll be making a similar change on x64 as well. In the name of 'security,' of course.

Re:If microsoft controls the 'keys'

[SuricouRaven]

It'd also need to be resigned and reissued - a massive undertaking, requiring every user by a new motherboard - for every single kernel version. You couldn't just sign GRUB - that would render the system pointless, as GRUB can then go on to launch something else. No, you'd have to sign a specially modified build of GRUB that only boots a single kernel.

Re:If microsoft controls the 'keys'

[SuricouRaven]

But *which* OEMs would be enthusiastic? There are lots of them? Are we going to end up in a situation where, say, you can run linux on HP servers but not their desktops? Or you can run it on Acer laptops, but not Dell laptops or Acer netbooks? It'll be back to the point where you need to search through compatibilitity lists before knowing if you can buy a PC.

Re:If microsoft controls the 'keys'

[AmiMoJo]

Most phones don't allow you to install an alternative OS. I imagine the line they are taking is that the PC manufacturer decides to turn the option on in the BIOS to protect their customers from viruses attacking the boot sector.

Re:If microsoft controls the 'keys'

[sjames]

Actually, the trend for Android is towards unlocked these days. I am quite consistent, I don't believe any of those devices should be locked against the owner's wishes.

Re:If microsoft controls the 'keys'

[jez9999]

Yes, but these compatibility lists are going to be telling you whether this is a "PC" (general purpose computing device that can run any code) or a "pseudo-PC" (computing device that is locked into running only certain code). We have to avoid pseudo-PCs, and encourage everyone else to do likewise.

Re:If microsoft controls the 'keys'

[SuricouRaven]

Your average user doesn't care if they can run unrestricted code, so long as the device will let them 1. Do the tasks they commonly need to do and 2. Access facebook.

Re:If microsoft controls the 'keys'

[ZeroSumHappiness]

So that I can remove the Microsoft key from my machine and still use the driver for a non-Microsoft OS.

Re:If microsoft controls the 'keys'

[bobbied]

Reality rules here.

I'm no fan of Microsoft, but they do have a large market share in the PC world and thus have most of the control. One can debate if Microsoft should be allowed to continue its domination of the desktop market, but that's not what this is all about. This is a plain and simple security issue, and Microsoft should be commended for making the effort to deal with it. Where I share your concern about Microsoft literally "holding the keys" in this case, I don't see them acting in bad faith (at least at this point). I also commend Fedora for their thoughtful approach and willingness to cough up the nominal fee on behalf of their user base. Other distributions would do well to emulate Fedora's approach and maintain the security throughout the whole system by requiring the use of digital signatures for kernels, modules and the like.

The concern here is that with Microsoft holding the keys, they further strengthen their domination of the desktop world. I'm not stupid enough to think Microsoft won't ever leverage this new power for profit, but what are the options at this point? Perhaps we could get Microsoft to agree to creating an independent third party to hold the keys and sign the code? Many folks might feel better, but I don't think it would fix the real issues in play here.

Re:If microsoft controls the 'keys'

[rtfa-troll]

remember that the Jackson ruling was overturned in appeal and the two sides settled out of court.

I'm going to call that statement "deeply and deliberately misleading" rather than a lie. You know fine that the findings of fact were confirmed on appeal. That means that the appeals judges agreed Microsoft did everything that Jackson said they did. The only thing overturned was the penalty. The out of court settlement avoided further proceedings at that stage.

Re:If microsoft controls the 'keys'

[mcgrew]

As long as I have the option to turn it off in the BIOS settings I wouldn't be bothered, but I'd never buy a motherboard or notebook that would only let me run Windows as an OS.

Re:If microsoft controls the 'keys'

[mcgrew]

Three keys for the Elven-kings under the sky,
Seven for the Dwarf-lords in their halls of stone,
Nine for Mortal Men doomed to die,
One for the Dark Lord on his dark throne
In the Land of Redmond where the Shadows lie.
One key to rule them all, One key to find them,
One key to bring them all and in the darkness bind them
In the Land of Microsoft where the Shadows lie.

Re:If microsoft controls the 'keys'

[Korin43]

It'd also need to be resigned and reissued - a massive undertaking, requiring every user by a new motherboard - for every single kernel version.

You can use the same key multiple times. As long as your key isn't compromised, you could theoretically sign all kernel releases for all time with one key. If this were true, Microsoft would have to ship a new motherboard with every Windows update.

You couldn't just sign GRUB - that would render the system pointless, as GRUB can then go on to launch something else. No, you'd have to sign a specially modified build of GRUB that only boots a single kernel.

Yes, the post also mentions that they're going to make some changes to GRUB 2 so that in secure boot mode, modules are disabled and it will only boot signed kernels (using any key loaded in EFI). FTA:

What about grub? We've already switched Fedora 18 over to using grub 2 by default on EFI systems, but it still needs some work before it's ready for secure boot. The first thing is that we'll be disabling the module loading. Right now you can load arbitrary code into grub 2 at runtime, and that defeats the point of secure boot. So that'll be disabled. Next we'll be adding support for verifying that the kernel it's about to boot is signed with a trusted key. And finally we'll be sanitising the kernel command line to avoid certain bits of functionality that would permit an attacker to cause even a signed kernel to launch arbitrary code. These restrictions will all vanish if secure boot is disabled.

Re:If microsoft controls the 'keys'

[mcgrew]

Nothing stops you from running Linux on an x86 Windows 8 computer

Except for the fact that every non-Apple x86 computer sold has Windows preinstalled, and when W8 comes out, every non-Apple x86 computer sold will have W8 preinstalled, along with secure boot.

Re:If microsoft controls the 'keys'

[mcgrew]

I don't think you've thought this through. How do you reconcile "the Linux community along with all the Black Hat Hackers out there will be looking for the key" and "it means that life is harder for malware writers in general"?

The key will be broken, malware writers will again be able to break in, but everybody and his dog will think malware is a thing of the past. This will mean the malware writers win.

Re:If microsoft controls the 'keys'

[bobbied]

... everybody and his dog will think malware is a thing of the past.

I hold no such illusion. Malware is here to stay and the only thing anybody can do is try to make it difficult to produce Malware. There will be no lasting solutions to this problem as long as the PC platform continues with multiple vendors producing hardware.

Re:If microsoft controls the 'keys'

[mcgrew]

They are doing no such thing. Microsoft is not forcing vendors to ship computers with only MS approved keys

When's the last time you saw a non-Apple x86 computer for sale without Windows preinstalled?

Re:If microsoft controls the 'keys'

[ClioCJS]

In that case, Apple is more of a monopoly than Microsoft.

Re:If microsoft controls the 'keys'

[spongman]

no, a plea bargain is a different thing entirely: the defendant in a criminal trial pleas guilty in return for reduced charges from the prosecution. out-of-court settlements are for civil cases where the plaintiff (the DOJ, in this case) can decide to cease litigation at any time, for any reason.

your term "criminal corporation" implies that Microsoft in this case committed a crime which is ridiculous since they weren't even charged with committing a crime by the DOJ. the anti-trust laws in the US are enforced by civil action.

Re:If microsoft controls the 'keys'

[nurb432]

Even if you never want to buy another desktop or laptop, you "next" phone, or tablet will have the same problem.

Re:If microsoft controls the 'keys'

[Chris Mattern]

if MS takes $99 but doesn't deliver, do you seriously think it would take RedHat long to sue and win whatever damages they suffer as a result?

"Geez, we really screwed that up. Okay, here's your $99 back."

Re:If microsoft controls the 'keys'

[exomondo]

Generally drivers are written for a specific OS, you aren't going to use Windows drivers in a Linux OS for example.

Re:If microsoft controls the 'keys'

[exomondo]

Except for the fact that every non-Apple x86 computer sold has Windows preinstalled, and when W8 comes out

No that is not correct.

every non-Apple x86 computer sold will have W8 preinstalled, along with secure boot.

And that stops you from running Linux on it how? I don't think you know what secureboot is and just see it as a thing that locks out non-Windows OSes. If you have a key and a signed linux bootloader you install that key using secureboot custom mode, if not then you can't use secureboot and you just turn it off, very simple, not a hard concept to grasp.

Re:If microsoft controls the 'keys'

[cryptizard]

Maybe you should read the article before you call the author a liar. All they need to do is have Microsoft sign their super low level bootloader (just loads Grub and hands off) and then they are free to do whatever they want. Presumably the way you would have a Linux community secure boot thing is to have some organization register with Microsoft and get their bootloader signed, which in turn would only load OSes signed by their key. At that point they have bypassed Microsoft entirely and have a new root of trust.

Re:If microsoft controls the 'keys'

[mcgrew]

It probably won't affect me, but what of the users who want to run Windows Dual Boot on a Linux or Apple box?

Re:If microsoft controls the 'keys'

[exomondo]

It probably won't affect me, but what of the users who want to run Windows Dual Boot on a Linux or Apple box?

How will that affect them? They don't have to run Windows in a secureboot environment, but they can if they want to, I know I won't be as I will be dual booting on my Mac.

Re:If microsoft controls the 'keys'

[mcgrew]

From everything I've read, Windows 8 won't run unless SecureBoot is on. That means to swap OSes, the user would have to boot into the BIOS every time he wanted to change OSes. That's just shitty.

Re:If microsoft controls the 'keys'

[exomondo]

From everything I've read, Windows 8 won't run unless SecureBoot is on. That means to swap OSes, the user would have to boot into the BIOS every time he wanted to change OSes. That's just shitty.

Well again, that's wrong. Do you actually believe they would expect you to discard all existing non-UEFI machines and have no upgrade path? They still support 32bit x86 but you think they would abandon traditional BIOS?
Anyway:
Windows 8 will also enter the market in a time when the industry is shifting to the Unified Extensible Firmware Interface (UEFI) for BIOS on all new client systems. We will continue to support the legacy BIOS interface
http://blogs.msdn.com/b/b8/archive/2011/09/20/reengineering-the-windows-boot-experience.aspx

Re:If microsoft controls the 'keys'

[Pigskin-Referee]

How can this be legal and not an abuse of their monopoly power?

Aside from the fact you can turn it off ( for now ) it still sounds like a clear case of abuse to me and someone should be talking to an attorney about this.

The simple fact that it can be turned off defeats your argument. Plus, are you so naive to believe that no one, i.e. Microsoft, Symantec/Verisign, Red Hat, etcetera have not properly vetted this with legal counsel?

In any case, vendors who make the hardware are the only ones who could be sued. Microsoft can make any software they want. If the vendors don't make adjustments to their hardware to facilitate its operation, then that is the end of it. Second, vendors can make any hardware they want. They are under no legal obligation to make any specific hardware that suits any specific environment. Failure to do so may well cost them money; however, they are legally allowed to do so.

This is just another example of the FOSS being a day late and a dollar short again. This entire scenario was announced nearly 18 months ago. What did the FOSS do? As usually, nothing. Procrastination is its own punishment.

Re:If microsoft controls the 'keys'

[sjames]

Apple locks the hardware IT makes. The various Android OEMs lock the hardware THEY make. MS is throwing it's weight around to lock hardware made by 3rd parties. One of those is illegal.

Re:If microsoft controls the 'keys'

[ToasterMonkey]

Any proper system would have the end user hold the root key for the system and they could choose (or not) to bless certs from various vendors (or just directly sign the bootloader). Of course, MS doesn't want a proper system, they want lock-in.

Which UEFI systems don't do this?

Re:If microsoft controls the 'keys'

[sjames]

The ones that are approved for Windows 8 apparently. RTFA!

PCs turning into a closed platform...

[eagee]

...is about the only thing that might turn me into an Apple user.

Re:PCs turning into a closed platform...

[Anonymous Coward]

Microsoft proposes draconian DRM schemes.

Apple implements them.

Re:PCs turning into a closed platform...

[Anonymous Coward]

You say that, but Apple implemented EFI years ago, and then even helped users who wanted to install Windows or other operating systems via BootCamp.

Re:PCs turning into a closed platform...

[FudRucker]

i will put the used PC resellers on speed dial when this borks the new PCs

Re:PCs turning into a closed platform...

[fustakrakich]

Very funny!

Re:PCs turning into a closed platform...

[ClioCJS]

This is exactly the same as what Apple does. I am totally embarrassed and full of pity when reading your comment.

Re:PCs turning into a closed platform...

[Anonymous Coward]

"This kind of shenanigans is why I use apple products. Right now I can install any free OS using free Virtual Box or just native. This has always been the case. If I try to install MS Windows, I must have copy of windows for each VM, and hope that the license allows it to be used in a VM. I must call and beg MS to allow me to make a hardware change. "

If you think that's draconian, you should try to install a supported version of OS X on non-supported hardware!

Seriously, use whatever you'd like. But based solely on the reasoning you presented here, you should probably put on a helmet before you leave the basement each morning.

Re:PCs turning into a closed platform...

[Anonymous Coward]

Apple will probably implement Secure Boot for OS X only ... Windows and Linux can continue to use the legacy BIOS.

Re:PCs turning into a closed platform...

[Wain13001]

They had to to keep full market value...there are an awful lot of programs that don't exist for the Mac.

Re:PCs turning into a closed platform...

[tao]

... Except: Apple is doing it on their own hardware. Microsoft is requiring it from all hardware manufacturers that want a "Certified for Windows 8" sticker, which means pretty much all non-Apple hw makers. See the difference? If Microsoft were doing their own hw and restricting that (like, say, the X-Box), I'd think it was fair game. A pity, yes (just like I consider it a pity that Apple cripples their hardware), but monopolistic? No. But this *is* monopolistic.

Re:PCs turning into a closed platform...

[ducomputergeek]

Then you aren't the target market for the app store. The App store is for common joe six pack who frankly doesn't need to editing their apache config files in the first place. Sandboxing apps from the app store makes a lot of sense from a security stand point for the average user.

My guess is that in the future you'll need a Mac Developers account to access the core features of OSX if you want to do any customizations.

Re:PCs turning into a closed platform...

[Anonymous Coward]

...is about the only thing that might turn me into an Apple user.

Given that Apple seems to be headed down the path of turning OSX into iOS .. I'd have a plan B up my sleeve if I was you.

As an example of what Apple is doing to Apps on OSX, Apps sold through the App store now have to be sand boxed and cannot work on files outside of their defined area (and that was a really bad description). I found this out when I downloaded the latest TextWrangler from the App store instead of Bare Bone's website and found out that I couldn't open the /etc config files for Apache on my own computer .. even when attempting to do so with sudo and my account being in the sudo'ers list. Note I believe that if I had downloaded TextWrangler from the website, then that version would not have to conform to the sandboxing requirement - but I need to look into this more.

I'm wondering what Apples next move will be in this area. Mountain Lion is going more down the secured path, but it is what comes after that that is worrying me.

Umm, you can go into the security settings and turn that off...

Re:PCs turning into a closed platform...

[spire3661]

You might want to do some research on Apple's upcoming Gatekeeper. apple wants the same thing, default whitelist and everything else is 'dirty'. Its an active campaign to make it look like anything that comes from non-approved vendors as not trusted and shouldnt be run. The win 8 'warning dialog' makes it feel like unapproved software is going to break your machine.

Re:PCs turning into a closed platform...

[SETIGuy]

Yeah, because Apple isn't going to be requiring signed code in OSX? What planet are you smoking?

Re:PCs turning into a closed platform...

[Macrat]

Really?

Really.

You can easily install Window, OpenSolaris, Linux, etc on a Mac.

http://www.apple.com/support/bootcamp/

Re:PCs turning into a closed platform...

[Macrat]

This is exactly the same as what Apple does. I am totally embarrassed and full of pity when reading your comment.

Apple doesn't prevent users from installing other OSes on Mac hardware.

Re:PCs turning into a closed platform...

[Macrat]

I'm wondering what Apples next move will be in this area. Mountain Lion is going more down the secured path, but it is what comes after that that is worrying me.

You are trying to say that making the Mac OS more secure indicates the hardware being limited to one OS?

Re:PCs turning into a closed platform...

[Microlith]

Then you aren't the target market for the app store.

And if you aren't the target market for the App Store, better hope Apple never pulls Gatekeeper out.

The App store is for common joe six pack who frankly doesn't need to editing their apache config files in the first place.

Deliberately crippling software so that its utility is limited in the name of "security," even if it hinders the end-user's ability to use it, is stupid as fuck.

My guess is that in the future you'll need a Mac Developers account to access the core features of OSX if you want to do any customizations.

I expect this too. And then we can mock anyone who suggests that OS X is an open platform.

Re:PCs turning into a closed platform...

[MichaelJ]

Note that BBEdit has a Mac App Store FAQ page where they explain:

In BBEdit and TextWrangler, authenticated saves (the ability to save changes to files that you do not own) and the command-line tools are not available in the Mac App Store versions, in order to comply with Apple’s submission guidelines.

And then provide methods to circumvent these restrictions.

Re:PCs turning into a closed platform...

[Em Adespoton]

If you think that's draconian, you should try to install a supported version of OS X on non-supported hardware!

Seriously, use whatever you'd like. But based solely on the reasoning you presented here, you should probably put on a helmet before you leave the basement each morning.

Draconian: I don't think that word means what you think it means.

MS Windows licensing is draconian: MS hoards access. Apple licensing is NOT draconian. They tell you what they want you to do, and leave it up to you to behave yourself. Comparing third party driver support of the OS to intentional crippling of the OS is a false comparison.

Look at it this way: you could compare Apple's stance to Harley Davidson not offering support for choppers built with HD bikes as the base, nor Honda cycles with HD parts jury-rigged onto them.

Whereas with MS, it's that every time you want to modify your Harley, you must first get permission from MS. The situation we're discussing here is the equivalent of saying that from now on, engines will be locked to the controlling system first installed on them -- so you won't be able to take an engine out of a Harley and drop it in a Honda.

(yes, I was tired of car analogies)

Re:PCs turning into a closed platform...

[Microlith]

Bootcamp was only necessary because Windows XP needed the legacy BIOS to function. Windows 7 and most modern Linux distributions will readily boot from EFI systems.

I installed Ubuntu 12.04 on my 2006 Macbook recently, with the intent of doing so without having a trace of OS X on the system. The amd64+mac ISO they have installed cleanly without a single problem, and boots directly into Ubuntu without needing Bootcamp or OS X on the platform.

The same will not be possible on PCs once Windows 8 ships. It will be a pain in the ass for anyone not blessed by Microsoft.

Re:PCs turning into a closed platform...

[Lord_Jeremy]

You are so immensely full of shit...
To prove that you CAN edit files in /etc using the TextWrangler downloaded from the Mac App Store I have recorded a video of me doing JUST THAT! I even opened TextWrangler using sudo to show that I can write to a config file.
http://www.youtube.com/watch?v=tWAKQjJWJvk
http://www.youtube.com/watch?v=dvULnO52RY0
I suspect that you didn't notice the Enable: All TextWrangler Documents drop down menu. Don't ask me why that's necessary, but changing it to everything made all the .conf files selectable. So yeah, you're full of shit and yet you've been modded +5 insightful...

Re:PCs turning into a closed platform...

[maccodemonkey]

Does it really matter why? The fact of the matter is that Macs ship with an open EFI and BIOS emulation, and can boot any operating system. That makes Macs a heck of a lot more open than PCs after this transition occurs.

Re:PCs turning into a closed platform...

[epyT-R]

nevermind the fact that a locked system discourages joe sixpacks from learning about their system in the first place. yeah that's what we all need.

Re:PCs turning into a closed platform...

[AdamWill]

That's an interesting definition of 'helped'.

By 'helped', what you appear to mean is 'Apple wrote a monumentally fucked up implementation of UEFI which completely screws up the careful provisions in the UEFI spec for booting multiple devices and operating systems, then grudgingly implemented their own bizarrely designed and borderline-unworkable alternative, which they support solely for the purpose of booting Windows'.

If they'd just written a sane UEFI firmware in the first place, it would be able to boot any OS you like inherently. But they didn't want to. Then their users forced them to come up with a bad hack to make Windows boot work. Exemplary behaviour, this is not.

Re:PCs turning into a closed platform...

[TheRaven64]

Bootcamp was only necessary because Windows XP needed the legacy BIOS to function

Bootcamp also provides a tool for shrinking HFS+ partitions and a set of Windows device drivers for things like the multitouch trackpads and other hardware in Apple machines, in a convenient bundle. I believe it also includes its own installer, so you can install Windows and the drives from OS X and then just reboot into the newly installed system.

Re:PCs turning into a closed platform...

[Princeofcups]

I'm wondering what Apples next move will be in this area. Mountain Lion is going more down the secured path, but it is what comes after that that is worrying me.

Macintosh is far from a monopoly, and there are other viable options for a desktop or laptop computer. However, they have a pretty large slice of the tablet market. If they become large enough in that market to do what Microsoft does in the PC market, then we have reason to be concerned.

Re:PCs turning into a closed platform...

[shutdown -p now]

Microsoft is not requiring OEMs to only allow Windows to boot. It requires that any PC sold with a "Designed for Windows" sticker has secure boot enabled by default, and that it includes the key that enables it to boot Windows. The OEM also must provide a way to let the user disable secure boot, or add his own keys; and may include additional keys that enable it to boot other OSes out of the box, with zero configuration.

RedHat is paying $99 because they want all PCs with a "Designed for Windows" sticker to be guaranteed to boot RedHat and Fedora out of the box. Hence why they're going through MS for this. They could have also went directly to OEMs - in fact, TFA says that they did just that, but there are so many of them that it's easier and cheaper to go to MS which already has the necessary deals.

Re:PCs turning into a closed platform...

[recoiledsnake]

Gimme a fucking break. What a load of horseshit.

Really? Read this from 2002 http://epic.org/privacy/consumer/microsoft/palladium.html

Apple basically implemented that in iOS.

Re:PCs turning into a closed platform...

[Microlith]

True, I forgot about the resizer utility. Mostly it brings to mind how bootcamp refused to work if I had pre-planned and partitioned the device accordingly ahead of time, insisting that the only way it could work is to take space from the HFS+ utility. I don't recall using the installer however, but I never installed Windows on the unit.

Re:PCs turning into a closed platform...

[arkane1234]

Except: Apple is not doing this on their own hardware. You can install Windows & Linux on Apple hardware.

You just can't install a piece of software (OSX) they made for Apple hardware, on another non-Apple hardware. It's different, and less restrictive by a long shot.

Re:PCs turning into a closed platform...

[Kalriath]

Sandboxing? No, you can not. You can disable Developer ID verification (which is the stupid shit that makes it so random binaries downloaded off the internet need to be signed by an Apple Developer certificate just like App Store ones) for now, but sandboxing is mandatory.

Re:PCs turning into a closed platform...

[ToriaUru]

One big, major problem with building your own box is this. Cut and copied from a discussion on Google+ about this article. From Intel on UEFI to Sourceforge.net The verification steps for images signed as described in section 1.4 are: 1. Authenticate the image’s format and structure. 2. If the image is unsigned: If its signature in in the authorized database (DB) and is not in the forbidden database (DBX), run the image, otherwise deny. 3. If the image is signed, check if its certificate has been authorized (for example, the image’s certificate is found in the KEK or the authorized database (DB), and is not in the forbidden database (DBX)). 1 If the image’s certificate is authorized, then unless the image’s signature is in the forbidden database (DBX), run the image If the image’s certificate has not been authorized, then check its signature. If its signature is in the authorized database (DB) and is not in the forbidden database (DBX), run the image, otherwise deny running the image. So it sounds like you could build a machine with signatures for every piece of firmware in DB, and then you'd be able to remove the microsoft keys from the KEK. But the simpler solution is probably going to be just to leave the MS keys where they are. If you don't run any microsoft code, then the chief danger that poses to you is that someone lifts their private key (unlikely) and even if they do the worst that happens is that you're back to pre-secure-boot security (not such a big deal, given it's doomed to failure anyway).

Re:PCs turning into a closed platform...

[exomondo]

Does it really matter why? The fact of the matter is that Macs ship with an open EFI and BIOS emulation, and can boot any operating system. That makes Macs a heck of a lot more open than PCs after this transition occurs.

How so? This isn't preventing any software from running on PCs, if you actually read what's going on you'll see the only difference is MS is providing a key for their OS such that you can use the standard UEFI feature called SecureBoot if you want to.

Re:PCs turning into a closed platform...

[exomondo]

... Except: Apple is doing it on their own hardware. Microsoft is requiring it from all hardware manufacturers that want a "Certified for Windows 8" sticker, which means pretty much all non-Apple hw makers. See the difference?

Apple gets someone to build hardware to spec for them, Microsoft puts out a spec and hardware manufacturers build hardware for them to that spec, not really much of a difference.
Particularly when this clearly doesn't prevent hardware manufacturers from installing any other keys they like and it doesn't prevent users from turning the feature off if they don't want it (in fact it mandates that they must be able to do so).

Re:PCs turning into a closed platform...

[robthebloke]

You say that, but Apple implemented EFI years ago, and then even helped users who wanted to install Windows or other operating systems via BootCamp.

That's because the folks at Apple wanted all of their users to experience the benefits of using MyCleanPC!

/ducks

Re:PCs turning into a closed platform...

[DJ Particle]

Yes, and the user has the option of not only setting how strong to make Gatekeeper, but also the option of turning Gatekeeper *off*. Most people will use it because they don't know better to keep crap off their machine. Power users will turn it off and install what they wish. I don't see the problem with Apple's Gatekeeper.

Re:PCs turning into a closed platform...

[maccodemonkey]

How so? This isn't preventing any software from running on PCs, if you actually read what's going on you'll see the only difference is MS is providing a key for their OS such that you can use the standard UEFI feature called SecureBoot if you want to.

Sure it is. The system will actively block you from running a non-MS signed OS unless you disable secure booting (which is on by default.)

How many users do you think are going to know how to disable secure booting? How many places can OEMs find to put that option?

Re:PCs turning into a closed platform...

[ClioCJS]

Cherry picking. And Microsoft is not preventing any users from installing other OSes on hardware either. Read the article again. Now try to install something Apple doesn't approve of on an iPhone, iPod - you know, the devices people have a lot more than Macs. You can't without jailbraking it. It is far more restrictive in Apple-land, even with this new change. Microsoft users can still install whatever they want on ALL microsoft products. Apple users never could - unless you go back to the 1990s.

Re:PCs turning into a closed platform...

[exomondo]

Sure it is. The system will actively block you from running a non-MS signed OS unless you disable secure booting (which is on by default.)

No, it obviously isn't, it's a UEFI standard feature that you can either turn it off or install your own key. The platform is absolutely no more closed than it ever has been.

How many users do you think are going to know how to disable secure booting?

If they are installing Linux i don't think they are going to find it overly difficult to change one documented BIOS option, very simple, otherwise there is no reason to disable it.

How many places can OEMs find to put that option?

Well it's mandatory that the option be available, it's quite well documented.

Re:That's it...

[vux984]

RTFA. Then comment.

Would someone please explain to me...

[EmagGeek]

... how the FUCK this passes the slightest hint of anti-trust scrutiny?

Re:Would someone please explain to me...

[characterZer0]

http://www.opensecrets.org/orgs/summary.php?id=d000000115

Re:Would someone please explain to me...

[EdZ]

Because you can :
a - Choose not to use Secure Boot, and run whatever the hell you want (i.e. the current situation with regular BIOS and UEFI)
b - Add your own key to the mobo, and sign your distro with it.

Both of these are predicated on buying a motherboard or pre-built that allows you to do so. The onus is on the manufacturer to allow you to do stuff with Secure Boot, the microsoft requirements (for non-ARM architectures) do not require Secure Boot be fully locked, only that the default setting is "boot Windows 8 securely".

Re:Would someone please explain to me...

[braeldiil]

Because there were several other paths they could have chosen to work with secure boot, but this was the most efficient? Because Microsoft is making a whole $99 to handle verification and signing for them? Seriously, this is sad. Microsoft will sign a boot loader for them for basically no money. This isn't a "Microsoft tax" situation - Microsoft will undoubtedly lose money on the arrangement, even if it's $99 every time Red Hat wants to update their "pre-grub" bootloader, and not the one-time registration fee the article implies that it is.

Re:Would someone please explain to me...

[Microlith]

Because there were several other paths they could have chosen to work with secure boot, but this was the most efficient?

Most efficient? Hardly.

One thing MS could have done was ensured, for the sake of not appearing totally anti-competitive, was to put a 3rd party in charge of the process, include guidelines in UEFI for how keys could automatically be installed safely, and specify a minimum functionality set for "custom mode" so using Linux and Windows securely on the same machine isn't a binary choice.

It is deliberately inefficient, and it puts Microsoft in a position of power. They'll happily take a loss for such control, as we've seen in the past.

Re:Would someone please explain to me...

[rrohbeck]

Not funny, unfortunately.

Re:Would someone please explain to me...

[rrohbeck]

I'm pretty sure that only "enthusiast" mobos will have the elaborate BIOS features. Consumer boxes and garden variety mobos probably won't. It would only confuse end users and generate support calls, thus increasing the cost for the manufacturer.

Re:Would someone please explain to me...

[shutdown -p now]

The onus is on the manufacturer to allow you to do stuff with Secure Boot, the microsoft requirements (for non-ARM architectures) do not require Secure Boot be fully locked, only that the default setting is "boot Windows 8 securely".

Actually, Microsoft "Designed for Windows" requirements for non-ARM require the manufacturer to allow you to disable Secure Boot or add your own keys.

Re:Would someone please explain to me...

[recoiledsnake]

>was to put a 3rd party in charge of the process

What third party? And if they did do that, everyone here will be complaining about MS getting to pick them.

How about the Linux/BSD/Haiku/ReactOS/Hurd community pick a 3rd party or just one of themselves? The OEMs are more than willing to include the keys.

>include guidelines in UEFI for how keys could automatically be installed safely

Automatically and safely don't go together. The reason is the dancing bunnies problem.

http://blogs.msdn.com/b/larryosterman/archive/2005/07/12/438284.aspx

Re:Would someone please explain to me...

[Microlith]

What third party?

Verisign maybe? Someone already established in the industry that isn't obviously biased?

How about the Linux/BSD/Haiku/ReactOS/Hurd community pick a 3rd party or just one of themselves?

And have to run around and convince all the hardware vendors to include them, only to be ignored readily? I suspect the only reason Redhat had success was precisely because they are Redhat.

the dancing bunnies problem.

Ah yes, better to spew some FUD and not approach the problem rather than think of a way it could be done safely. Blame the user and use it as a justification to impose even more onerous restrictions. Why not use it as a justification to bar disabling UEFI or changing keys? Because MS knows they'd get nailed to the wall for being anti-competitive. Again.

Re:Would someone please explain to me...

[Kalriath]

Microsoft's certification requires those things you dismiss as "elaborate BIOS features" (leaving aside that UEFI is not BIOS, and there won't even be a BIOS on these boards). So, you will be able to change these settings, because Microsoft demanded it. Funny, your "M$ monopoly!!11!!1one" situation is defused by Microsoft's action.

Re:Would someone please explain to me...

[Kalriath]

Funny you mention that, because UEFI keys don't have to be signed by MS. Verisign may in fact sign them. Hell, YOU could sign them. The only rub is getting OEMs to include the keys on the boards. Red Hat decided they didn't want to do this as it would mean that they would be in a better position than any other Linux vendor, and instead negotiated with Microsoft to have them sign a GRUB loader for them so that any machine with the keys needed to boot Windows would boot Fedora and RHEL out of the box. Leaving aside that based on this, Red Hat could have gotten an agreement with the OEMs to have a Red Hat key installed in the UEFI and then made their signed GRUB available instead, I can't see how this is an example of MS being anti-competitive.

Re:Would someone please explain to me...

[rrohbeck]

By "elaborate features" I mean SETUP features to add another private key or disabling secure boot.

Re:Would someone please explain to me...

[TangoMargarine]

how keys could automatically be installed safely

I definitely wouldn't want anything modifying my BIOS without my explicit permission and physical intervention...

Re:Would someone please explain to me...

[bill_mcgonigle]

http://www.opensecrets.org/orgs/summary.php?id=d000000115 [opensecrets.org]

you win the thread.

Go green: turn off your refrigerator.

And take cold showers. Hot showers are a luxury of the first-world planet haters.

Re:Would someone please explain to me...

[Microlith]

No, you wouldn't. I note elsewhere that it should be possible to safely and securely install keys automatically from a read-only volume. You know, one that was pre-fabricated or required direct, manual intervention to set up.

Re:Would someone please explain to me...

[Darinbob]

Anti-trust is not about whether it's possible to use something else or whether or not competition exists. The fact that it requires extra work for the user to use a competing product combined with the fact that Microsoft has an overwhelming market share means that this is an anti-trust issue. In other words MS is using their monopoly position in order to entrench its monopoly position further.

Re:Would someone please explain to me...

[Kalriath]

Yes, exactly. Those very things that Microsoft demands be present. So no, you'd be wrong.

Re:Would someone please explain to me...

[EdZ]

I'd take issue that "user actually has to read the damn instructions" is somehow entrenching a monopoly position. Microsoft has pulled some dodgy things, but this isn't one of them.

Re:Would someone please explain to me...

[Darinbob]

Instructions will not be presented with each new computer in an easy to find or read form. Average user will not understand this. This is essentially the same idea as preinstalling a browser and then claiming that the user can always figure out how to install their own; technically true but still determined to be illegal in some countries.

Re:Why not hardware manufacturers?

[WrongSizeGlass]

I don't understand how Microsoft is as fault here. Isn't it the hardware manufacturers that are locking out everyone but Microsoft? Shouldn't the hw people be the ones to make the platform open?

You have to do it MS's way or they won't let you sell hardware with Windows on it. MS controls the certificates used in the secure UEFI boot process. You either do it MS's way or you do it your own way ... without any MS products to pre-install.

Re:Why not hardware manufacturers?

[shentino]

MS is probably strongarming them.

rock meets hard place

[MickyTheIdiot]

I am pretty sure that if a hardware manufacturer like Dell locks out Linux operating systems that quite a number of large institutions like Universities will refuse to buy from them. I am not 100% sure because there are a lot of unis with microsoft-centric IT departments. Institutions with hard sciences depend quite heavily on different flavors of Unix and Linux to get work done.

Anyway... this is a disgrace and it's bound to blow up in quite a number of people's faces.

Re:rock meets hard place

[Missing.Matter]

I am pretty sure that if a hardware manufacturer like Dell locks out Linux operating systems

If Dell wants Windows Certification it better not do this. Per the Windows Certification Requirements, page 122:

MANDATORY. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:

a) It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx) which will put the system into setup mode.

b) If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system will be operating in Setup Mode with SecureBoot turned off.

c) The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults.

Re:rock meets hard place

[0123456]

If Dell wants Windows Certification it better not do this. Per the Windows Certification Requirements, page 122:

Of course for Windows 9, blocking non-Windows operating systems will become mandatory on all devices.

You don't get the 'slippery slope' thing, do you? Or are you one of those 'slippery slopes don't exist' bozos?

Re:rock meets hard place

[liquiddark]

Slippery slopes tend to be less slippery when there's a wall of legal text already established to prevent the slope in question from being greased too liberally.

Re:rock meets hard place

[vux984]

I am pretty sure that if a hardware manufacturer like Dell locks out Linux operating systems

That is not the case AT all.

Its REALLY simple; linux is not being locked out of desktops.
x86 hardware shipping with win8 pre installed needs to have:
a) secure boot functionality
b) windows 8 boot signing keys
c) secure boot functionality turned on
d) and it must be possible to disable secure boot
e) and it must be possible to load additional boot signing keys

So, linux users buying dell pcs (x86) will be able to exercise option d) and disable secure boot.

They can also exercise option e) and install a linux signing key, and leave secure boot enabled.

Linux users are NOT locked out at all.

However, if I want to try Linux for the first time, I'd like stick in a live CD and boot it... I might be intimidated by having to go into bios first to disable secure boot. I'm very likely to be intimidated by having to install a signing key into bios first.

Redhat wants linux to "just work" without the user having to jump through those hoops so the ideal option would be to coordinate with all the oem manufacturers to get a "redhat" or at least "linux" signing key into the bios, so that the linux bootloaders can be signed against that. (The OEMs were fine with this, even enthusiastic... but the cost to do this is extremely high, and there would still likely be several cases where the redhat key was missing, leaving us with an inconsistent and annoying situation.

The other option was to just sign the bootloader with the microsoft key; microsoft is already working with all the OEMs, and already has all the infrastructure in place. Fedora decided to piggy-back on the microsoft key and pay to get the bootloader signed by microsoft.

Is it ideal? No. But in terms of what it does for the users of linux? Its a great thing. Fedora will "just boot" in secure boot mode. Users don't have to disable secure boot to use linux, which is a good thing. Users don't HAVE to manually install a linux key into bios to use secure boot (although they still can if they prefer not to use the microsoft signed version).

The x86 ecosystem remains truly open (in that users can manage boot signing keys themselves if they wish), and trying out linux is remains easy because it will boot with the default installed microsoft keys.

Overall its a good compromise.

Note that on arm tablets the situation is entirely different. option d and e are not available, and fedora isn't getting the software signed for that platform... if you buy a windows 8 arm device you'll have to crack it to put linux on it.

Re:rock meets hard place

[jthill]

This may be implemented by simply providing the option to clear all Secure Boot databases

The only requirement is that the choices marked "secure" be Microsoft or nothing.

Re:rock meets hard place

[Anonymous Coward]

You do realize that the slippery slope is a fallacy, Right?

Re:rock meets hard place

[shutdown -p now]

Of course for Windows 9, blocking non-Windows operating systems will become mandatory on all devices.

That's when you get to sue for monopoly abuse.

Re:rock meets hard place

[recoiledsnake]

>Its REALLY simple; linux is not being locked out of desktops.

So what?

Why should Linux be locked out of ARM and portable devices?

Answer that, you fucking shill.

--
BMO

Egads, here we go again with the accusations. Anyone pointing out any facts here is fair game.

>Why should Linux be locked out of ARM and portable devices?

First, there are more than 250 models of Android tablets available out there. There's so much choice. Some Android OEMs lock the bootloader. I don't see you railing against them?

Second, Windows might be lessening the license cost of Windows RT(thus reducing price to consumer) in hope of making it up on the app store and music/video/games etc. Users loading a different OS will deny them that and fill the coffers of Google instead. This is the same model for game consoles, Kindle Fire(LOCKED BOOTLOADER OMG SHILLS), Nook Tablet (LOCKED BOOTLOADER OMG SHILLS) etc. etc.

Third, I don't see you railing against Apple this way, who are leading the post-PC sales, Windows RT tablets could easily be a big flop and some analysts are predicting they won't take off. So why are you more worried about a few percent of the market compared to the ~50% that Apple has? This shows your anti-MS bias and hate. And stop calling people shills.

Re:rock meets hard place

[Guy Harris]

>Its REALLY simple; linux is not being locked out of desktops.

So what?

Why should Linux be locked out of ARM and portable devices?

Answer that, you fucking shill.

-- BMO

Does

Note that on arm tablets the situation is entirely different. option d and e are not available, and fedora isn't getting the software signed for that platform... if you buy a windows 8 arm device you'll have to crack it to put linux on it.

as copied from the posting to which you replied, count as an answer? Admittedly, vux984 didn't explicitly add "And that sucks." at the end, but my suspicion is that he/she thinks it does.

Re:rock meets hard place

[exomondo]

Of course for Windows 9, blocking non-Windows operating systems will become mandatory on all devices.

Nice FUD, unfortunately for your idiotic conspiracy theory we've seen MS get done for anti-trust violations before and obviously doing such a thing would most definitely be an anti-trust violation.

You don't get the 'slippery slope' thing, do you? Or are you one of those 'slippery slopes don't exist' bozos?

Firstly what's the precedent you believe is being set here and secondly if you believe there is a problem then how should UEFI be implemented? Or should UEFI not be allowed to exist?

Re:rock meets hard place

[Billly Gates]

I doubt this. Hell bios versions as late as 2009 still had VESA and pallete snooping for OS/2. I was surprised.

Many XP users are still out there and iwll continue to be out there in the enterprise well past 2014 sadly.

Re:rock meets hard place

[jez9999]

But in terms of what it does for the users of linux? Its a great thing. Fedora will "just boot" in secure boot mode. Users don't have to disable secure boot to use linux, which is a good thing.

It's a good thing for Fedora. Is it a good thing for the majority of Linux users who use other distros?

copyright

[girlintraining]

...they would have to explain to their potential users how to mess with firmware settings just to install the OS. How long before circumventing the secure boot mechanism is considered a DMCA violation and a felony?"

The only real option here is to ignore the law, as many of us here do now. The United States, and much of the western world, has become so enamored with short-term profit gain, that they're sacrificing the technological progress of all of humanity. The only rational course of action is to ignore them until another group or organization either through economic, political, or military means, remediates the problem.

Yes, I am suggesting that copyright law could eventually become an issue which countries go to war over. No, I don't think it's that crazy: Governments are already engaging in mass electronic attacks of their enemies. It's only a matter of time before things get physical. UEFI could be perceived as a threat to national security: It's giving one corporation carte blanche access to hardware owned by other governments. Redmond, WA may soon be ringed with missiles and armed guards to keep out other governments when they find out their hardware has been taken over by a foreign power. This is just how the world seems to be evolving... there's too much at stake now.

Re:copyright

[vinayg18]

Cool story bro

Re:Why not hardware manufacturers?

[Anonymous Coward]

If I had points, I'd mod you up. Your insight is boundless.

Re:That's it...

[WrongSizeGlass]

Red Hat is willing to pay to be licensed to be able to run on the new hardware. They are going out of their way so you can run Fedora on the new hardware. And you want to ditch them because of it? Remind me never to buy you a beer.

Re:Where are antitrust lawyers now?

[virgnarus]

They're doing the same with IE, so they get to deal with two antitrust cases.

The article is wrong.

[Anonymous Coward]

This has nothing to do with PCs. Nothing. Not one thing.
This is all in reference to UEFI on ARM tablets that Microsoft has partnered up with OEMs to produce to their specs SPECIFICALLY FOR: Windows 8.

Nothing has changed here, nearly all ARM systems are locked down today by OEMs.
Do any of you expect Microsoft to produce one that isn't (zune: locked down xbox: locked down)?

Re:The article is wrong.

[unixisc]

This makes more sense. As it is, the writing is on the wall that people won't be wanting Windows 8 on their PCs, so PC manufacturers might as well continue to ship boxes w/o UEFI, since it's not a requirement in Windows 7. But for the tablets or phones, it's justified, particularly if Windows RT is put on a tablet or phone, and the manufacturer doesn't want WRT to be replaced by Android, any more than an Android tablet would be replaced by WRT, or iOS would be replaced by Android.

Re:The article is wrong.

[Burdell]

Nope, you've got it wrong. To get the Windows 8 "certification", Microsoft is requiring x86 vendors to ship systems with UEFI Secure Boot enable. They are requiring there also be a way for end users to add/remove keys and completely disable Secure Boot as well.

For Windows 8 on ARM, Microsoft is not only requiring Secure Boot, but requiring the exact opposite of x86: that it cannot be disabled or keys modified.

Note that Fedora is not planning on signing the ARM binaries; that would be releasing something that the users can't modify, and they don't think that's right (the answer there is "don't buy Windows tablets and expect to run anything other than Windows on them").

Re:The article is wrong.

[samkass]

This has nothing to do with PCs. Nothing. Not one thing.
This is all in reference to UEFI on ARM tablets that Microsoft has partnered up with OEMs to produce to their specs SPECIFICALLY FOR: Windows 8.

Nothing has changed here, nearly all ARM systems are locked down today by OEMs.
Do any of you expect Microsoft to produce one that isn't (zune: locked down xbox: locked down)?

You are completely wrong-- what you say is the opposite of true.

This is referring to x86, not ARM. Fedora is not going to play Microsoft's game on ARM where Microsoft has little influence. But they are going to pay Microsoft a fee to get their bootloader signed for the x86 platform so they can run in the Windows8 world.

Re:The article is wrong.

[0123456]

I somehow think you are mistaken, I don't see a lot of Redhat running arm devices around

My ex-employer ran a cut-down version of Redhat on their ARM-based systems. But they also built all the hardware so it was a non-issue.

Re:The article is wrong.

[marcosdumay]

...so PC manufacturers might as well continue to ship boxes w/o UEFI, since it's not a requirement in Windows 7.

MS will certainly end all distribution of Windows 7 once W8 gets out.

Re:The article is wrong.

[caladine]

If you actually read the article, Fedora is doing as a convenience to the users, so that they don't have to screw with UEFI settings on their x86 devices.
On non-ARM systems, one can and will be able to disable secure boot.

Directly from the Win8 cert doc: (http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256)

Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:

It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx) which will put the system into setup mode.

If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system will be operating in Setup Mode with SecureBoot turned off.

The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults.On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled."

x86 devices can still install whatever they want, barring this extra hoop to turn off Secure Boot. Like I said earlier, Fedora just wants to ship their image with a signed loader so the users don't have to go through that hoop.
From TFA:

While Microsoft have(sic) modified their original position and all x86 Windows machines will be required to have a firmware option to disable this or to permit users to enrol their own keys, it's not really an option to force all our users to play with hard to find firmware settings before they can run Fedora.

ARM (essentially tablet) devices are locked down completely - which is absolutely no different than what Apple does right now on the iPad.

Re:The article is wrong.

[AdamWill]

Er, no, it really isn't. The article is talking specifically about the situation wrt Intel hardware. Not ARM. You are entirely incorrect.

$99 bucks

[Anonymous Coward]

Wait - Is this article saying they paid a whole $99 bucks to get their bootloader signed?

Re:$99 bucks

[Anonymous Coward]

It's not $99 per pc , it's a one-time $99 dollar fee for access to the dev portal. But that is beside the point, Why should they have to pay MS anything? Why is it only MS that has the certificate for UEFI?

Re:$99 bucks

[Anonymous Coward]

Reading comprehension brought to you by Public Education.

It's $99 paid once by Redhat, not per PC.

Re:$99 bucks

[a90Tj2P7]

What? It's not the cost of the OS, it's not per-machine, it's not the users paying. The company pays, once, to get their software signed. How much that cost relates to the average cost of a machine or the cost of a licensed OS is completely and utterly irrelevant.

Re:$99 bucks

[Cederic]

Erm. Red Hat pay $99, once. Everybody else pays nothing, ever.

The $99 basically covers Microsoft's administration costs. In business terms, this is a very nominal fee - Red Hat have spent more cash than that just investigating this issue ($99 covers maybe 3-4 hours of someone's time).

It actually looks pretty reasonable.

Re:$99 bucks

[hawguy]

Erm. Red Hat pay $99, once. Everybody else pays nothing, ever.

The $99 basically covers Microsoft's administration costs. In business terms, this is a very nominal fee - Red Hat have spent more cash than that just investigating this issue ($99 covers maybe 3-4 hours of someone's time).

It actually looks pretty reasonable.

$99 doesn't even cover a 15 minute meeting with their attorneys to begin looking into it.

Re:$99 bucks

[marcosdumay]

To sign one version of the kernel. Next week it will be another $99.

But that is besides the point. The AC up there is right, the price does not matter.

Re:$99 bucks

[h4rr4r]

Even free would be too much. MS should not be in the position of controlling what I can boot on my hardware. You really think they will not in Win9 or Win10 demand that PCs only boot with the Secure boot on?

Then it is easy enough to refuse to certify any non-MS OS.

Re:$99 bucks

[ColdWetDog]

Really guys, get some perspective on things.

RedHat probably spent more than $99 in coffee staying awake long enough to just get a hold of somebody at Microsoft to take their money.

Re:$99 bucks

[AdamWill]

"($99 covers maybe 3-4 hours of someone's time)."

It covers a hell of a lot less of mjg59's time than that, I suspect.

Re:$99 bucks

[shutdown -p now]

It helps to RTFA before you post comments, that way you'll end up with fewer stupid ones. For one thing, they're signing the boot loader, not the kernel (once they can boot, they can establish their own chain of trust using their own keys). For another, they specifically made some arrangements to avoid having to re-sign often to update the bootloader. Quoth TFA:

We've decided to take a multi-layer approach to our signing for a fairly simple reason. Signing through the Microsoft signing service is a manual process, and that's a pain. We don't want to have bootloader updates delayed because someone needs to find a copy of Internet Explorer and a smartcard and build packages by hand. Instead we're writing a very simple bootloader[2]. This will do nothing other than load a real bootloader (grub 2), validate that it's signed with a Fedora signing key and then execute it. Using the Fedora signing key there means that we can build grub updates in our existing build infrastructure and sign them ourselves. The first stage bootloader should change very rarely, and we don't envisage updating it more than once per release cycle. It shouldn't be much of a burden on release management.

Re:$99 bucks

[shutdown -p now]

Actually, it's a $99 fee for a Verisign certificate, apparently:

The last option wasn't hugely attractive, but is probably the least worst. Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access edit: The $99 goes to Verisign, not Microsoft), but it's cheaper than any realistic alternative would have been.

Re:$99 bucks

[a90Tj2P7]

A vendor can also run their own licensing server. Or they can provide keys for you to add. Allowing people to piggyback on their own licensing server is just a courtesy - they're not in control over secure boot keys, their key is just already present on Win8-ready computers.

Re:That's it...

[MickyTheIdiot]

Microsoft doesn't have the right to "license" hard ware. It's not their hardware, it's not even their design.

This is Microsoft forcing vendors in the corner with their O.S. once again. This is non-competitive behavior once again.

If they have such a great O.S. there is no need for locking out others. It's weak and it's sick.

Re:Why not hardware manufacturers?

[Anonymous Coward]

Good thing Microsoft's way includes a required option in the UEFI setup to turn off secure boot. This whole story is horribly misleading.

Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

I was at 2 major industry tech conferences last month.

In every keynote and all-hands session, Apple hardware was center and present. Nothing special was made of this - just every damn computer used to demo solutions or held by a GM, VP or C-Level was a MacBook. Desktops were non-existant. Every time an iPad could be used, it was. There were a couple of minor Android appearances - demonstrating multi-platform support, or what not.

There were a few odds: The HP guys had their own gear, and the IBMers had Lenovos. Some brilliant man from SAP was sadly dragging a 'book of non-descript, perhaps Dell sourced, black plastic...

Overwhelmingly, if you wanted to look like you knew why-the-fuck you ought to be on stage, in front of 8,000 people, you went Mac.

Re:Microsoft Pledges to Sell More Macs for Apple

[Anonymous Coward]

Not really. Apple machines are a PITA with weird hardware for Linux users too. All it means is Linux users will go back to building their own PCs. Box shifters will simply do a parallel line for server sales.

Re:Microsoft Pledges to Sell More Macs for Apple

[mystikkman]

>Overwhelmingly, if you wanted to look like you knew why-the-fuck you ought to be on stage, in front of 8,000 people, you went Mac.

Think Different.

Re:Microsoft Pledges to Sell More Macs for Apple

[jedidiah]

> Overwhelmingly, if you wanted to look like you knew why-the-fuck you ought to be on stage, in front of 8,000 people, you went Mac.

Translation: If you want to look like you've got money to burn, then you show off overpriced Apple products.

The "BMW" comparison is very apt really, including the crap quality.

Seeing is decieving...

Re:Microsoft Pledges to Sell More Macs for Apple

[haruchai]

I noted the same at a Cisco show; all the vendors & booths were using iPads and Macbooks; the only PC devices were a few shared laptops in the Wireless cafe.

Re:Microsoft Pledges to Sell More Macs for Apple

[Anonymous Coward]

Maybe in a perfect world, but in the enterprise, Apple is an obstacle and something to have to work around, rather than work with:

1: Can Apple get me product announcement roadmaps so I can time IT budgets to when models are released? Nope, Apple doesn't do that. IBM, HP, Oracle, and even Dell do, as long as you sign their NDA.

2: Can Apple get me flexible hardware and software GPOs? Windows's main thing is that I can manage all the thousands of users from relatively few boxes. There are very few tools for this on Mac, and they are department level, not enterprise grade.

3: Can I get TPM chips on the laptops to ensure protection of data? Nope. FileVault 2 is decent, but can be gotten around with a modified bootsector that would set aside the drive's encryption key. TPM chips stop that cold.

4: Can I get Macs without cameras due to policies? Sure, if I want Mac Minis.

5: Can Apple give me a 24/7/365 service time with a 4 hour tech on site? In the past yes, but with the death of the XServe, the best I can do is call and wait a day for a tech to wander out.

Sorry, Apple isn't enterprise grade. They know this too -- they are making their living by being a "toymaker" and selling to the consumer. I'd love it Apple could get some inroads into the enterprise, but right now, they are not interested in that market.

Re:Microsoft Pledges to Sell More Macs for Apple

[SurfsUp]

I was at 2 major industry tech conferences last month.

In every keynote and all-hands session, Apple hardware was center and present. Nothing special was made of this - just every damn computer used to demo solutions or held by a GM, VP or C-Level was a MacBook.

Oh interesting, and in two years most of them will be Android tablets. Just a modest prediction.

Re:Microsoft Pledges to Sell More Macs for Apple

[Tough Love]

Not really. Apple machines are a PITA with weird hardware for Linux users too. All it means is Linux users will go back to building their own PCs. Box shifters will simply do a parallel line for server sales.

You're right, this boneheaded move by Microsoft is the best help they could possibly give for Linux on the desktop. Of course, that just not let Microsoft off the hook for antitrust violations, specifically abusing its market power. I can smell a new EU action on the the way, at the very least.

Re:Microsoft Pledges to Sell More Macs for Apple

[Anonymous Coward]

Objections noted. Now either setup these iPads or we'll have to get somebody else.

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

FOUR LETTERS:

BYOD

This is the CIO's only strategy to win. He's accountable for a desktop that needs to remain compatible with apps that he has no responsibility over. That's why XP is still there.

BYOD moves IT out of the loop - and plays to new devices.

I still remember: "Who will support these "PC computers" that departments are buying, behing the back of MIS?"

And: "These LANs that you claim are so successful in a handful of special cases, will never scale to the needs of Corporate IT. "

Re:Microsoft Pledges to Sell More Macs for Apple

[obarthelemy]

Or, if you're a premium-salary, in-the-spotlight kinda guy, you get a machine that looks good because looking good is an important criterion. More then tech specs, sturdiness...

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

Will you direct me to the STURDY Dell? HP? Toshiba? Sony?

All of these have breaking hinges, cracking plastic, marred finishes - at least the models I'd been force-fed since 07-08.

And the 4-core, 4GB and 72000 RPM Hyperthreaded Dell with Intel VT cannot run ONE instance of Linux on either VMware WS or Virtualbox. Inspiron? Insipidon: The world's FASTEST Powerpoint machine...

Re:Microsoft Pledges to Sell More Macs for Apple

[IntlHarvester]

Wow, I hadn't see this angle on "BYOD", but your PC analogy is probably exactly correct. Let 'the business' bring in a bunch of tablets, and then in five-ten years once everything has shaken out, the CIO can save the day by centrally managing all this crazy stuff.

Re:Microsoft Pledges to Sell More Macs for Apple

[Anonymous Coward]

I'm an engineer. I use a MacBook. It works great - the only desktop Unix to date done right. Great quality hardware, too.

By the way, does your bitterness cause you physical pain?

Re:Microsoft Pledges to Sell More Macs for Apple

[abigor]

I can say firsthand that Macs have made serious inroads at Cisco, not just for mgmt but for programmers as well.

Re:Microsoft Pledges to Sell More Macs for Apple

[Miamicanes]

> You're right, this boneheaded move by Microsoft is the best help they could possibly give for Linux on the desktop.
> Of course, that just not let Microsoft off the hook for antitrust violations, specifically abusing its market power.
> I can smell a new EU action on the the way, at the very least.

Unless I'm misunderstanding UEFI, that's not quite right. Contrary to the headline-hype, I believe Microsoft's OTHER explicit requirement for certification is that end users must be furnished with a way to disable it that's impossible to do by mistake, but entirely possible to do voluntarily. For example, flip a DIP switch, place or pull a jumper, enter a 32-character encryption code printed on a tiny sticker permanently affixed to the motherboard, etc.

Put another way, the UEFI rules won't stop a single Slashdot user from using Linux. Redhat is paying Microsoft for explicit approval so it can sell Redhat Linux to the OTHER potential Linux users who don't WANT to go through that much trouble to unlock their PC.

I'm sure Microsoft's motives with UEFI aren't entirely pure & MUST be scrutinized constantly, but so far, they've played everything by the book. They've guaranteed that we'll get a copy of the keys to our own systems, even if we'll have to get our hands slightly dirty to actually USE them.

Truth be told, I fear Microsoft less than the possibility of TiVO-ized Linux. God forbid, if someone decided to start giving away free laptops that are bootloader-locked to an Ubuntu variant and have advertising & "analytics" baked into the kernel & network stack, and eventually induce others to do the same thing, we're screwed. By 2020, we'll be in a position where a "free" PC hardwired to ad-supported Linux is "free", but a "non-free" "unlocked" PC costs $2,000... and can't play rented movies, run half the commercial applications out there, or access some paranoid bank web sites because it it's "untrusted". *THAT* is the scenario we have to fight like crazy and ensure never happens.

For the most part, Microsoft DOES behave itself in public. It might be grudgingly-good behavior, and it probably has plenty of impure thoughts, but as long as the EU and US are keeping an eye on it, it's unlikely to try anything blatant that would give it a permanent "hard" monopoly over x86 computing architecture.

As long as anybody can download Ubuntu and install it over a "free" copy of Windows, Microsoft is legally off the hook (in the US, at least), regardless of how few people actually *do* it. Microsoft would have to be completely *insane* to give up that magic "See, we aren't a real monopoly after all because end users can theoretically install Linux!" get-out-of-jail-free card. Linux is USEFUL to them. In the phone arena, Linux is practically a cash cow for Microsoft... they make more in royalties from the sale of an Android phone than they do in licensing fees when a phone running Windows gets sold.

Re:Microsoft Pledges to Sell More Macs for Apple

[Tough Love]

I'm sure Microsoft's motives with UEFI aren't entirely pure & MUST be scrutinized constantly, but so far, they've played everything by the book.

That is not up to Microsoft to decide, that is up to the competition watchdogs to decide.

Do you really think that Microsoft is playing fair, as opposed to playing by the book? And do you really think Microsoft is actually playing by the book, considering its record?

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

Nope.

Terminal equipment.

Re:Microsoft Pledges to Sell More Macs for Apple

[ppanon]

To be fair, UEFI can be one line among many in a defense-in-depth approach. Redhat does work hard to present themselves as the more secure/hardened Linux distribution, starting with baked-in SELinux and associated policies for Redhat-distributed packages (and including SELinux MAC customization as part of the RHCE BOK for at least 5 years now). Support of RHEL as a signed O/S under UEFI fits into their marketing strategy pretty well, and it gives them a way to differentiate themselves from CentOS.

If I was planning on running a web server with financial transactions, that would be a positive feature. For use as a workstation? Meh. If I was really paranoid about information on an end-user system, I would probably reboot with a read-only Live CD when handling secure info.

Re:Microsoft Pledges to Sell More Macs for Apple

[reallocate]

No. Motherboard makers face the same requirement. And, as I understand it, this requirement does not apply to server hardware.

Whatever you think of MS and Red Hat, this is a problem tht every Linux distribution needs to address. Rhetoric about freedom and urging lawsuits won't change anything.

  Users will be able to go into firmware and disable secure boot, but I don't think many will do that just to try Linux. They are much more likely to just go buy a Mac. Especially if there are initial problems when this is rolled out.

Folks who dual boot Linux and Windows could be really screwed because an unsigned bootloader will be seen by Windows as malware, with an MS update eventually coming down to disable it.

Re:Microsoft Pledges to Sell More Macs for Apple

[Princeofcups]

Seeing is decieving...

Seriously, troll, learn to spell. This makes you look even dumber.

Re:Microsoft Pledges to Sell More Macs for Apple

[reallocate]

I suspect the ability for users to disable secure boot makes a legal challenge to this moot. At best, MS might be compelled to make secure boot opt in. I.e., compel users to enter firmware to enable it.

And I expect it to be a sales boon for Apple. People annoyed by this will go to the mall and buy Apple. They won't go home and try to install Linux.

Re:Microsoft Pledges to Sell More Macs for Apple

[Tough Love]

Microsoft would have to be completely *insane* to give up that magic "See, we aren't a real monopoly after all because end users can theoretically install Linux!" get-out-of-jail-free card. Linux is USEFUL to them.

The fly in that ointment is, the free and open community has not been and never will be satisfied with playing a cameo role as a handy excuse for Microsoft to get away with murder. And I agree with you, there are other potential murderers we need to worry about, but that does not mean Microsoft's bad acting can be ignored. We've done more than enough scrutinizing to justify taking action.

Re:Microsoft Pledges to Sell More Macs for Apple

[vga_init]

Reminds me of the OLPC XO-1. It was a Linux based platform that used openfirmware, and the device shipped with the firmware totally locked down. There was no way to access the firmware or load another OS unless you applied to OLPC for a special key that [looked like it] was generated based on your machine's serial number and only they knew. Otherwise you would only be able to boot disk images signed by them.

To me this was really a nuisance, and I promptly disabled the firmware security and forgot about it, but arguments in favor of this sort of thing are something along the lines of "prevents hacking" or "prevents you from accidentally screwing it up."

Heck, even your average PC today probably has some BIOS settings that need to be fiddled with before you can successfully boot a new operating system, so it seems like standard fare.

Re:Microsoft Pledges to Sell More Macs for Apple

[shutdown -p now]

Unless I'm misunderstanding UEFI, that's not quite right. Contrary to the headline-hype, I believe Microsoft's OTHER explicit requirement for certification is that end users must be furnished with a way to disable it that's impossible to do by mistake, but entirely possible to do voluntarily. For example, flip a DIP switch, place or pull a jumper, enter a 32-character encryption code printed on a tiny sticker permanently affixed to the motherboard, etc.

It's a bit more specific than that (source PDF):

MANDATORY. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:

a) It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx) which will put the system into setup mode.

b) If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system will be operating in Setup Mode with SecureBoot turned off.

c) The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults.

So it seems like it requires the switch to be implemented in UEFI setup software; it cannot be a purely hardware switch like a jumper.

Re:Microsoft Pledges to Sell More Macs for Apple

[arkane1234]

oh boy, even while kicking and screaming they pull the whole reality distortion thing ahah
How cute.

Re:Microsoft Pledges to Sell More Macs for Apple

[ozmanjusri]

Really?

My dad has an old eMac on it's last legs. Should I tell him to sell it to a bank?

Re:Microsoft Pledges to Sell More Macs for Apple

[mug funky]

how is this +5 interesting and not -1 offtopic?

Re:Microsoft Pledges to Sell More Macs for Apple

[Kalriath]

I'm pretty sure you can convince the NT Boot Loader to start GRUB or LILO though if you wanted to. Then, since the unsigned boot loader was loaded by a signed one, you have no problems there.

Re:Microsoft Pledges to Sell More Macs for Apple

[Tough Love]

So, the object is to 1) make it somewhat inconvenient and highly nonobvious for the end user to turn off the boot lockdown and 2) to scare the user every time they run the machine in that state. How is this any different than the tactics Microsoft has used in the past to exercise its market power illegally, such as issuing scary warnings when their software found itself running on top of DR Dos, a crime for which they were found guilty and had to pay $billions?

Re:Microsoft Pledges to Sell More Macs for Apple

[VortexCortex]

"I'm an engineer. I use a MacBook. It works great - the only desktop Unix to date done right."

As an engineer myself, I hope they fire you. Nothing personal but if you can't tell the difference between a "MacBook" and a "desktop" then you need to be put out to pasture.

Re:Microsoft Pledges to Sell More Macs for Apple

[ShieldW0lf]

Support of RHEL as a signed O/S under UEFI fits into their marketing strategy pretty well, and it gives them a way to differentiate themselves from CentOS.

Unless I read the article incorrectly, it costs $99 to produce signed binaries. Which is inconvenient if you as an end user want to be able to compile your own stuff and sign it, but it means the folks at CentOS only need to pay $99 to release signed binaries for all their end users.

Re:Microsoft Pledges to Sell More Macs for Apple

[Guy Harris]

"the only desktop Unix to date done right" -- Consider the following: Opinion = Asshole.

(Presumably referring to "opinions are like assholes - everybody's got one"; I sincerely doubt I'm the only person to add "and many of them are full of shit". BTW, are there any citations of that line prior to its use by Insp. Harry Callahan?)

Re:Microsoft Pledges to Sell More Macs for Apple

[Guy Harris]

"I'm an engineer. I use a MacBook. It works great - the only desktop Unix to date done right."

As an engineer myself, I hope they fire you. Nothing personal but if you can't tell the difference between a "MacBook" and a "desktop" then you need to be put out to pasture.

OK, then, he should have said "desktop and laptop Unix" (presumably if The Year Of XXX Linux arrives, and most of the PC's shipped with Linux are laptops, we'll have to call it "The Year Of Laptop Linux" rather than "The Year Of Desktop Linux").

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

Look, I have had my computers supplied by IT. I don't pick 'em - I just take what they give to Consultants and Architects at top global software companies.

And Toughbook (Panasonic BTW) or Alienware are not the line machines that go out.

I miss the TP 600X and T20. Last of a breed of PC laptops. The Toshiba that followed these was replaced 4 times in the same lifespan of these.

Fanboy? No. But a 5 year old MacBook Pro is now beating the pants off the last-years Latitude E6400. Or, as I call it - the Dell Lassitude.

Re:Microsoft Pledges to Sell More Macs for Apple

[jersey_emt]

Or it is just simple jealousy.

Re:Microsoft Pledges to Sell More Macs for Apple

[smash]

You mean intel audio, broadcom nics, nvidia/amd video and intel x64 cpus? yes, they have EFI, but that's no major hassle these days.

Re:Microsoft Pledges to Sell More Macs for Apple

[smash]

Solution: Don't run OS X servers. Apple don't make real servers. Apple don't even use their own servers in-house. Server and desktop do not have to be the same platform. Buy commodity server hardware, run vSphere on it, and present shares, etc to your mac clients using FreeBSD/Linux/etc...

Re:Microsoft Pledges to Sell More Macs for Apple

[smash]

Use the correct tool for the job. End user devices, apple is good. Servers, use something else. Desktop OS and server OS do not have to be (and in the past never were) the same.

Windows client to Windows server is a relatively recent abberation. desktop and server OS have totally different and conflicting requirements.

Re:Microsoft Pledges to Sell More Macs for Apple

[Ultracrepidarian]

I think the DR-DOS settlement was more like hundreds of thousands.

Re:Microsoft Pledges to Sell More Macs for Apple

[Ultracrepidarian]

Unless you are Ransom, then you would know for sure.

Re:Microsoft Pledges to Sell More Macs for Apple

[ABCC]

How very dare you! It shall be called "The Year of Laptop GNU/Linux" of course!

Re:Microsoft Pledges to Sell More Macs for Apple

[xouumalperxe]

Unless I'm misunderstanding UEFI, that's not quite right. Contrary to the headline-hype, I believe Microsoft's OTHER explicit requirement for certification is that end users must be furnished with a way to disable it that's impossible to do by mistake, but entirely possible to do voluntarily. For example, flip a DIP switch, place or pull a jumper, enter a 32-character encryption code printed on a tiny sticker permanently affixed to the motherboard, etc.

Installing Linux already has a reputation for being technically challenging (even if it actually isn't, these days, but whatever). What you're saying is that, unless distros jump in on the secure boot ship, then they'll have to add to their installation instructions something like "depending on the make of your motherboard, you'll need to open the computer and perform one of flipping a DIP switch, placing/pulling a jumper, or entering a 32-character code that's written on the motherboard".

That, alone, will desktop kill Linux for non-techies. And if that isn't worthy of anti-trust investigation, I don't know what is.

Re:Microsoft Pledges to Sell More Macs for Apple

[SurfsUp]

I think the DR-DOS settlement was more like hundreds of thousands.

Why would you think that?

Re:Microsoft Pledges to Sell More Macs for Apple

[SurfsUp]

I suspect the ability for users to disable secure boot makes a legal challenge to this moot

I suspect it doesn't. Look, for example, at the series of fines Microsoft had to pay in the EU for just pretending to comply while in reality maintaining barriers.

Car analogy: Ford didn't actually have to put bombs into the Pintos to be liable for exploding gastanks. The gas tank just had to have a probability of exploding. Microsoft just has to be guilty of making things inconvenient to be found to have used its market power to erect a barrier to competition.

Re:Microsoft Pledges to Sell More Macs for Apple

[Barsteward]

yes, i think the EU will jump on this one, at least i hope so. The US's justice dept. is useless at dealing with this sort of nonsense.

Re:Microsoft Pledges to Sell More Macs for Apple

[Kalriath]

I get that, really. The cheap models are shit - that's what I said. But your original statement was "direct me to the sturdy Dell, HP, Toshiba" - an assertion that such a thing does not exist. However, those machines do exist - but they cost a premium. Much like Apples cost a premium, and are sturdy constructions that run well (my Macbook has hit the ground a couple of times and kept on trucking). It's unfair to pit machines that are most definitely not "cheap shit" end of the market against machines that are definitely "cheap shit" end of the market and use that to claim that good machines do not exist outside of Apple. That's what I said, and I stick to it.

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

Fair enough.

At work, I get the choice of the Dell "Power User" Business Lattitude. - Or?

A MacBookPro.

I need to run ESXi virtualised on top of Workstation or Fusion. Dell killed me, trying to get this to work - 4 cores and all...

So Apple's limited choice in models, and non-responsiveness to IT requests for support features plays to the interest of the user.

Re:Microsoft Pledges to Sell More Macs for Apple

[Brooklynoid]

You said: Overwhelmingly, if you wanted to look like you knew why-the-fuck you ought to be on stage, in front of 8,000 people, you went Mac.

I guess I'm missing the point. Isn't it better to actually know why the fuck you ought to be onstage instead of merely looking that way?

Re:Microsoft Pledges to Sell More Macs for Apple

[Jeremiah Cornelius]

Not in front of an audience of several thousand or more.

Look at Reagan and Obama.

Re:Microsoft Pledges to Sell More Macs for Apple

[cheesybagel]

It's $99 now. Who knows what it will cost in the future. It is still wrong. Why the heck should anyone have to ask Microsoft to be able to run software on their own PC? Microsoft isn't even a PC manufacturer.

Re:Microsoft Pledges to Sell More Macs for Apple

[Miamicanes]

> That, alone, will desktop kill Linux for non-techies.

OK, reality check... how many real, honest-to-god NON-techies do you know of who've EVER installed Linux on their own PC on their own initiative and without having a hardcore techie standing over them while they did it? Yeah, there are a few... but if you eliminate the non-techie users who didn't get introduced to Linux via bootable CD/DVD/flashdrive, those who had it installed for them, and those who otherwise ended up with it on their computer without actually doing the installation themselves, you're left with so few users that adding a requirement to do something like pull/place a mobo jumper would have statistically zero effect, anyway. And before anyone criticizes me for saying Linux is too hard for non-techie users to install, how many of those same non-techie users could install WINDOWS on a computer with a bare hard drive and nothing more than a retail Windows CD? Maybe 3 or 4 out of a hundred?

The truth is, we're lucky to have gotten what we did. Microsoft COULD have left the door open for mischief by allowing motherboard or PC makers to sell unlock codes as a "value-added" feature, or only available with special "developer" models (like Motorola's "Developer Edition" Razr, which has earned them plenty of justified hate since you can only buy it for full inflated price, can't buy it in America, and can't have an existing Razr converted over even though there's no technical reason why they couldn't do it.)

In the real world, you have to pick your battles and save your strength for the ones that matter. In a real sense, we've basically won this round -- PC/Mobo makers MUST give us a copy of the metaphorical key, period. And they have to do it for free. That's an epic win. Instead of grousing about Intel architecture keys, we SHOULD be fighting to get the same deal with ARM hardware.

Re:Microsoft Pledges to Sell More Macs for Apple

[geekprime]

posting to undo a oops moderation

$99

[Greger47]

What the sensationalist headline and summary forgot to mention is that RedHat is paying a whopping $99 to Microsoft.

What is more worrisome and more headline worthy is that Microsoft has now become the de facto gatekeeper of your computer BIOS. Without their signature you operating system will not run.

/greger

Re:$99

[Anonymous Coward]

Any operating will run since you can switch the key checking off. The problem is the switching procedure is not standardized and requires manual BIOS configuration. Most Linux distributors catering to people with an attention span of 5 minutes would prefer their software to just run, hence the Microsoft-signed boot loader.

Re:$99

[DigitAl56K]

Or you could... you know, turn on custom mode so that you can run any OS you like.

Or you could, you know, not allow the monopoly PC OS vendor to control the keys that allow the system to boot competing OS's.

Regardless of whether or not you _can_ turn off the secure boot, when you consider what the _majority_ of end users feel comfortable and competent in doing, what kind of barrier to entry does this raise? Would your parents know how to tweak this setting on their own, or feel comfortable doing so? I for one would not even bother attempting to ask my parents, or even some of my siblings, to go and change such an option.

Are the instructions to change this setting even consistent across hardware so that they can be easily published by alternative OS vendors?

RedHat should not have to pay a dime to MS for this IMO, and neither should anyone else. Why couldn't MS have made an option to turn on secure boot by user prompt when they first start their new computers, and require some method provided as standard in the BIOS that allows turning it on only?

Re:$99

[dskoll]

Microsoft, presumably, could decline to sign Red Hat's bootloader. Then what? Suddenly it's not just a "whopping $99" that's the problem.

Re:$99

[Microlith]

Or as Microsoft would prefer you believe, "insecure mode." You know, because it's scary if you aren't "secure." Also, there's no guidelines whatsoever on how "custom mode" works, which will probably result in a lot of BIOSes having "off" as the only custom mode option rather than the ability to install new keys.

Re:$99

[MozeeToby]

Arg, how do people not understand this? OS signing is a good thing! It's a feature you should want on your next piece of hardware. Being forced to disable this feature to get around MS control is not a good thing!

Re:$99

[Missing.Matter]

Regardless of whether or not you _can_ turn off the secure boot, when you consider what the _majority_ of end users feel comfortable and competent in doing, what kind of barrier to entry does this raise?

The majority of end users hardly feel comfortable and competent in turning on their computer, let alone installing a new OS UEFI secure boot or otherwise. Pretending this is the one thing that will prevent the masses from running Linux is disingenuous.

Re:$99

[NardoPolo88]

Or you could, you know, not allow the monopoly PC OS vendor to control the keys that allow the system to boot competing OS's.

Fedora/Redhat could create their own keys. But is was specifically states in the article that they didn't want to take advantage of their dominance (and then have you asking why only 2 major players can own the hardware) so they are going to let MS sign a bootloader stub.

Now I don't about you but if someone in my family buys a computer that isn't a Mac it *will* have windows on it and if they want something else or windows needs to be reinstalled I will have to do it. If I can trust them to even reinstall windows why would I ask them to turn off secure boot? If it came to the point that secure boot would need to be turned off I would be the one doing it.

I can accept what they are doing. More likely than not the other major Linux players will follow suit. Do you think any of the big players are going to try to work with getting their key on every piece of hardware if they can pay MS $99? From a business perspective it makes the most sense for a main stream distro. Smaller distros aren't the ones that a novice would try and therefore could just warn a potential user that disabling secure boot is required.

To this end I think we maybe putting the cart before the horse. Since this is not an official statement from Redhat or Fedora and we still cannot be 100% sure how all this will shake out in the end. It is just one possible scenario based on someone who claims to work for Redhat and work on the Fedora project. Might be best for all of us to just to take a deep breath and wait for something official.

Re:$99

[Anonymous Coward]

The majority of end users hardly feel comfortable and competent in turning on their computer, let alone installing a new OS UEFI secure boot or otherwise. Pretending this is the one thing that will prevent the masses from running Linux is disingenuous.

Installing popular Linux distros today simply involves inserting a DVD and rebooting, then following an installation sequence largely similar to that of Windows. To your point, the masses may not want to install a new OS, but for those that do, this will make it more complicated to get started, unless Linux vendors play this game.

One OS vendor should not be in such a position over others.

Re:$99

[eric_herm]

He doesn't claim to work for, he work for. However, yes, that's a proposal to be discussed on Fedora list, and as said in the on going thread and the article, RH tried to change things ( as well as Canonical ), yet they did not managed to have a satisfying solution for everybody. I think the whole "let's make the signing be done by a third party" to be better, but as Matthew say, the whole setup is expensive ( think cost of CA, like the type of cost that prevented cacert to be properly added to firefox due to audit cost )

Re:$99

[shutdown -p now]

Or you could, you know, not allow the monopoly PC OS vendor to control the keys that allow the system to boot competing OS's.

You missed the point. Microsoft does not control the keys that let system boot other OSes; the manufacturer of hardware does that. Microsoft is requiring that manufacturers that are willing to have "Designed for Windows" sticker must 1) ship with secure boot on, and 2) have a key enabling it to boot Windows out of the box.

The OEMs are still free to stick in other keys there. In fact, TFA says that RedHat considered going directly to OEMs to have them add their own key directly to hardware, but this is too lengthy due to the sheer number of manufacturers, and they wanted to ensure minimal hassle for users so that they wouldn't have to check compatibility lists and such. The easiest way to achieve this is to piggyback on top of MS deals with OEMs, and sign your bootloader with MS key, which is what costs $99 (and even that goes to Verisign, not MS). But it's not the only way to do things, so if you don't want to deal with MS in any way whatsoever, you can.

Re:$99

[SolitaryMan]

TFA says this money go to Verisign, not Microsoft.

Re:That's it...

[WrongSizeGlass]

You are correct, but MS is using its dominance to control hardware vendors. A 'licensed' secure boot certificate - licensed from MS - is what will allow Fedora to boot using the secure UEFI boot mechanism.

Re:That's it...

[Burdell]

Red Hat Linux started on x86; it was never "only available for the DEC Alpha" (it didn't get ported to Alpha for several years).

They are doing this so that Fedora can be installed without end users having to disable Secure Boot in their UEFI firmware settings. If you want to disable Secure Boot, Fedora will run equally well. Fedora is also going to have signing tools, so you put your own key in the firmware and then sign your own loader and kernel (giving you more control, not less). If you switch to another distribution or OS that doesn't have a signed boot-loader, you'll also have to disable Secure Boot.

This "feature" exists because malware that affects the boot loader and kernel is a real and growing problem, and there isn't really any other technical means to block it. Setting up an independent CA to sign keys for loaders and then trying to get vendors to include the CA key would be highly expensive and would still result in Fedora having a key that you don't have. As long as Microsoft will sign things cheap, it is much better to go that route (if they were to stop signing, then this would obviously change).

The alternative is to tell users that want to run Fedora to not buy hardware that has the Secure Boot functionality, but that is going to become scarce once Windows 8 ships. Here in the real world, I'd like to continue running Fedora on new hardware.

Re:Why not hardware manufacturers?

[Penguinisto]

I'm just wondering why Fedora doesn't include a small boot ISO that starts up, presents a simple menu, and takes the pain of unlocking the UEFI chip out of the equation.

I agree perfectly that they shouldn't have to do that, but the tech is certainly there, and most folks are sufficiently apt enough to do it (see also jailbreaking phones, etc).

They are talking about having to pay 99 USD.

[DAldredge]

Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access), but it's cheaper than any realistic alternative would have been. It ensures compatibility with as wide a range of hardware as possible and it avoids Fedora having any special privileges over other Linux distributions. If there are better options then we haven't found them. So, in all probability, this is the approach we'll take. Our first stage bootloader will be signed with a Microsoft key.

Re:They are talking about having to pay 99 USD.

[a90Tj2P7]

it's cheaper than any realistic alternative would have been

You mean like including a switch on the motherboard that allows an OS to be installed?

But that is there. In the UEFI (read: "BIOS") settings.

Re:They are talking about having to pay 99 USD.

[0123456]

Or just letting users install whatever OS they want?

That is Before Jobs thinking.

Today users are fully aware that their computers should be locked down and not allow them to do anything that The Jobs wouldn't let them do.

Re:They are talking about having to pay 99 USD.

[0123456]

But that is there. In the UEFI (read: "BIOS") settings.

For now.

And it's a heck of a lot more complex than 'insert CD, boot and come back to your newly installed operating system after a coffee break'.

Re:They are talking about having to pay 99 USD.

[DigitAl56K]

but it's cheaper than any realistic alternative would have been.

It's cheaper than the alternative would have been based on the way secure boot has been designed.

Re:They are talking about having to pay 99 USD.

[Microlith]

The process could not be owned by Microsoft, which would be a start.

Re:They are talking about having to pay 99 USD.

[Princeofcups]

Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access), but it's cheaper than any realistic alternative would have been.

For how long? For which version? How many times have we been burned by "embrace and extend?"

Re:They are talking about having to pay 99 USD.

[scharkalvin]

Really? Have you EVER built a new computer WITHOUT going into the bios settings to tweak something? At the very least you will have to set the time and date! I usually also have to change the boot device order so I can boot off the CD/DVD, most times the bios is shipped to ONLY boot off the first floppy (well not anymore....) and then the first HD and nothing else! (Even if the CD/DVD is second on the this it WON'T be called unless the HD is missing or defective. If the HD is present but has no boot on it the bios often just errors out and quits without going on to the next boot device so you HAVE to set the CD/DVD as boot device #1). Also many power freaks will also change the over-clocking settings. So there is one more thing to change, BFD.

Re:Why not hardware manufacturers?

[WrongSizeGlass]

Good thing Microsoft's way includes a required option in the UEFI setup to turn off secure boot. This whole story is horribly misleading.

So they must turn off secure booting in order to run another operating system. The DMCA implications aside, I'm not sure which is worse for the consumer: a 'secure boot' of Windows or a 'non-secure' boot of any other operating system?

Obvious, but serious question

[lyapunov]

Could somebody, who is hopefully familiar with corporate law, explain how this could possible hold up in court against an antitrust complaint?

Re:Obvious, but serious question

[paulatz]

Could somebody, who is hopefully familiar with corporate law, explain how this could possible hold up in court against an antitrust complaint?

It can hold thanks to the fact that the payment is a one-off of 99$. Of course they can always decide to change their pricing policy, but at the moment it is only a symbolic sum, like the 5$ you need to publish on the google app store (or whatever it is called this month)

Re:Obvious, but serious question

[Missing.Matter]

explain how this could possible hold up in court against an antitrust complaint?

Not familiar with corporate law... but there's an option to turn off secure boot, and is actually required for Windows Certification on non ARM machines. TFA mentions this. TFA also has this gem of a line:

It's not really an option to force all our users to play with hard to find firmware settings before they can run Fedora.

No really sure how flicking a firmware switch to turn off Secure Boot is that difficult for any user installing any Linux operating system.

Re:Obvious, but serious question

[FaxeTheCat]

Nobody prevent you from turning it off... so what is it that should hold up in court?

The reason RedHat do this is to make it easier for the users to install Fedora. You can turn it off, but that involves fiddling with the hardware, and the good folks at RedHadt think the Fedora users deserve something simpler. So they pay Microsoft $99 to sign the executable.As they mention in the article, there were other alternatives, but this one is the most convenient for them, for the other Linux distributions, and for the users. $99.

Re:Obvious, but serious question

[mister_playboy]

Since anyone can pay $99 for a signed bootloader, doesn't that make the entire system a bit of a joke?

This whole setup is enormously complex and has very little benefit to anyone other than Microsoft.

Re:Obvious, but serious question

[oxdas]

The $99 fee is per OS though. So now RedHat has paid it for Fedora. What about Debian, Ubuntu, Slackware, FreeBSD, etc. I use my own variant of TinHat Linux on my server, so will I have access to secure mode? It is not clear if you will able to run in secure boot mode with those operating systems. Of course, you have the option of turning off secure boot, but this may be challenging to the not-so-technically-inclined and it introduces a level of security that may not be available to any vendor without paying the $100 to Microsoft. Personally, I don't see this sitting well with the EU, but the US won't care.

Re:Obvious, but serious question

[spongman]

1) virus writer tries to pay microsoft $99 to get his bootloader to run on oem machines. good luck with that.
2) savvy users manually disable secure boot, or install their own keys.

either way, not an issue.

Re:Obvious, but serious question

[hawguy]

The $99 fee is per OS though. So now RedHat has paid it for Fedora. What about Debian, Ubuntu, Slackware, FreeBSD, etc. I use my own variant of TinHat Linux on my server, so will I have access to secure mode? It is not clear if you will able to run in secure boot mode with those operating systems. Of course, you have the option of turning off secure boot, but this may be challenging to the not-so-technically-inclined and it introduces a level of security that may not be available to any vendor without paying the $100 to Microsoft. Personally, I don't see this sitting well with the EU, but the US won't care.

If my favorite Linux distribution is unable to come up with the $99, I will personally donate the entire $99 to the developers so they can sign the operating system (despite the fact that I'll be able to turn off secure boot myself). It's still cheaper than buying an MS license, and everyone else who uses the distribution can take advantage of it too.

Re:Obvious, but serious question

[mvdwege]

So it's not just pay M$ and be done. It's: pay M$ and hope for M$' goodwill.

Yes, that is an issue.

(They've never earned that M$ moniker like they have done now)

Mart

Re:Obvious, but serious question

[oxdas]

I use my own Linux version, but I will probably be able to use my own key (at least is sounds like that now). The problem here really isn't about money, it is the limitation (and the principle). Microsoft is now going to be the gatekeeper of secure booting with UEFI. They will be the central repository of all the keys. All hardware you run on your system will need to now have Microsoft's key. Microsoft will also have sole discretion in blacklisting keys. I don't trust Microsoft in this role. Do you?

Because of the nature of UEFI, everything that touches the hardware needs to be signed, kernel, modules, drivers, etc. This just erects more barriers for creating a customized version of Linux and sharing it.

At $99 for a key, what's to stop malware writers from just buying their own keys? Also, most geeks are simply going to turn off secure booting to get around its stringent limitations. It seems to have lots of negatives and few positives from my perspective.

Re:Obvious, but serious question

[paulatz]

At $99 for a key, what's to stop malware writers from just buying their own keys?

In order to pay those $99 you have to give your credit card number and identity to microsoft, if it turns out you used it to sign malwre they can send a big guy to your door to kick your arse. Yes you can use a stole credit card. And a fake ID and adress. But they can double check it and have you wait for a couple of weeks just in case your card number is reported stolen.

As always, no security system is prefect, but $99 fee in not the problem. In this case the problem is that Microsoft can apply a discretional choise on what you can run on your PC. It would be much better if and independent authority was in charge of that.

Re:Obvious, but serious question

[cas2000]

No really sure how flicking a firmware switch to turn off Secure Boot is that difficult for any user installing any Linux operating system.

some things for you to consider:

1. it will fuck up dual-boot. an unsigned grub won't boot if Monopoly Boot is enabled. Windows 8 won't run (or will run crippled with, e.g., media players disabled) if Monopoly Boot is disabled.

dual-booting between linux & windows is important to a lot of people.

2. the signing is for the boot-loader, not the operating system itself. this means that every upgrade of grub will need to be signed. Microsoft has effectively inserted themselves into the approval chain / release cycle of a fairly important part of the open source ecosystem.

3. ditto for network boot loaders like ipxe and gpxe, so this will make netbooting things like clonezilla and gparted a PITA. this is particularly important in large organisations (corporates and universities, for example) where central IT are particularly clueless and refuse to disable Monopoly Boot because it's called "Secure Boot"....preventing use of software like clonezilla for backup & cloning & SOE installation

4. the clueless central IT issue in 3. above will also prevent academics from running linux workstations for their research needs. and local faculty IT staff from setting up linux-based computer labs for students as central IT departments tend to take over things like purchasing and initial setup (incl. bios lockdown/passwords).

Re:Obvious, but serious question

[cas2000]

and one very important point i forgot to mention:

5. even if you do run RH or another Linux with a signed boot-loader & kernel, it will make it impossible to compile and boot your own custom kernel, and makes it impossible to run unsigned driver modules (just as we got a system - dkms - that actually solves all of the issues with 3rd-party and out-of-mainline-branch drivers).

and even if that's something that 99% of users never do, it still fundamentally changes the nature of using linux. it's TIVO-isation on a mass scale, TIVO-isation of generic PCs.

Re:Why not hardware manufacturers?

[Virtucon]

I was wondering that myself? This may start to become just like the CPU Serial Number fiasco with the Pentium III that was envisioned again by MSFT. So, fundamentally I think that market pressure like back in the 90s will take care of this dumb situation.

Re:Why not hardware manufacturers?

[Anonymous Coward]

I'm going to go ahead and guess the computer you are using now boots through BIOS. The non-secure UEFI is practically the same as BIOS (doesn't require a signed boot loader). We dealt with it for a couple decades now, it can't be that bad.

Sure thing hoss

[Tailhook]

Entry no. 3, in between all the banks, content owners, universities and trail lawyers.

no

[ClioCJS]

No, it's not antitrust. You can get a phone or an apple device. Of course, those devices will also only let you run things the company wants you to run (with the exception of Android). Microsoft isn't doing anything evil here. They're simply moving from the high ground to the low ground, because that's what Apple already did.

Re:Why not hardware manufacturers?

[Anonymous Coward]

Why can't I just be in control of my own damn property without being at the mercy of manufacturers?

Re:lottery for me

[FacePlant]

That's entirely off-topic. Did you even TFA?

Can you not simply turn it off?

[mark-t]

When you want to run Windows, turn the thing on. When you want to run a different OS, turn it off.

Not that I think that this is remotely a good thing, but really... we've seen this coming for something on the order of a decade or more now. Is anybody surprised?

Re:Can you not simply turn it off?

[FaxeTheCat]

You can turn it off. But they want to make it simple to install Fedora. It is all in the article.

Re:Can you not simply turn it off?

[mark-t]

I would think that if one were going to use Linux at all, then they've already adopted a policy of not wanting to be spoon-fed, and so it shouldn't tend to matter if its necessarily as straightforward as Windows. How difficult is flipping a switch, anyways?

Re:Can you not simply turn it off?

[king neckbeard]

Not really. I would argue that as a general rule, GNU/Linux is easier than Windows. Also, having to take an additional step isn't exactly spoonfeeding IMO.

Re:Can you not simply turn it off?

[mark-t]

Also, having to take an additional step isn't exactly spoonfeeding IMO.

That was my point... people who choose Linux are, in fact, making a deliberate choice to do so. They are already running against the grain of what the general trend would otherwise be, and I would not expect the extra step of having to flip a switch to accomplish that goal to somehow be a dealbreaker for them.

Re:Can you not simply turn it off?

[king neckbeard]

I use GNU/Linux because I'm lazy and it's less work for me to use GNU/Linux than Windows. This situation means I have to do extra work, which interferes with my main reason to use GNU/Linux. Not enough to make me switch back, but enough to piss me off.

Re:Can you not simply turn it off?

[mark-t]

There are so many bigger things in this world to bear concern over, and the idea of flipping a switch annoys you?

(facepalm)

You know, if something that small will seriously make you pissed off, I might suggest that you consider not using computers at all. Or at the very least, only using computers that belong to other people so that you don't have to shoulder any of the burden that might come with having to administrate or maintain it.

If I seem unsympathetic, it's because I am. I don't tend to feel sorry for people who are too lazy (by your own admission, I'm not name-calling here) to take responsibility for their own choices, which, in this thing that grown-ups call the "real world", sometimes means having to do some real work.

Re:Can you not simply turn it off?

[king neckbeard]

It's not the size of the annoyance, but that the annoyance is without a particularly good reason.

You know, if something that small will seriously make you pissed off, I might suggest that you consider not using computers at all. Or at the very least, only using computers that belong to other people so that you don't have to shoulder any of the burden that might come with having to administrate or maintain it.

It's quite the opposite, really. I generally hate using other people's computers, particularly when I don't have the power to administrate it. If it is MY computer, I can usually make it get out of my way and let me do what I want. If it's someone else's computer, it gets in my way to a certain extent and I have to exert extra effort to compensate for my lack of control. This restrictions shifts the computer from being "my computer" to "not my computer," at least a little bit.

Re:That's it...

[cpu6502]

>>>I think it's time to consider a new distro, if this is how Red Hat/Fedora want to work

But the other distros won't work.
Did you not RTFS?
Also I don't recall Red Hat ever saying their were "free as in liberty" software. It's always been a non-free system.

Re:Why not hardware manufacturers?

[sjames]

There's plenty of fault to go around. MS is strong-arming the HW guys and the hw guys aren't even demanding lube. Meanwhile, the DOJ should be standing in the corner twirling a pair of handcuffs rather than sucking at Ballmer's ass.

No more dane-geld!

[gman003]

Well, time to check Red Hat off my list of distros. Any company willing to pay essentially blackmail money does not deserve my business.

For those mystified by the comment subject

Re:No more dane-geld!

[FaxeTheCat]

Did you read the article? No?

They pay Microsoft $99 because it is the most convenient solution, not because the absolutely have to.

Re:No more dane-geld!

[Fosterocalypse]

Why would they not try to compete? Red Hat wants government business. It is slowly taking over Windows servers with RHEL why would they not continue to push their desktops? The last thing they need when it comes up to a bid for contract is.....oh we can't really run on new hardware unless you do these extra steps. Most businesses want a computer that you can basically plug in and had it automatically setup and be ready to go. It sucks that things are going this way. I just worry that the money that's getting dumped into it is going to take away from development or somewhere else that it is actually needed.

Re:No more dane-geld!

[oxdas]

I think you are misunderstanding their argument. The problem is not that RedHat is doing this out of convenience or not, but simply that RedHat is unwilling to fight Microsoft on an issue of this magnitude. It is because RedHat has made the choice to do what is convenient for them instead of what would be best for the Linux community at large. Personally, I don't use RedHat or Fedora, but I don't approve of their choice here either.

Re:No more dane-geld!

[gman003]

Did you read my link? No?

It is always a temptation for a rich and lazy nation,
    To puff and look important and to say: --
"Though we know we should defeat you, we have not the time to meet you.
    We will therefore pay you cash to go away."

Re:No more dane-geld!

[eric_herm]

The article speak of trying to convince OEMs, and Red Hat has been fighting Microsoft on the patent level ( never wondered who gave patent to the OIN ? ), have been trying to lobby the congress ( there is some people paid just to do evangelism ), pay developpers on various interoperability stuff ( there is samba devs, libreoffice devs, etc, paid by Red Hat ).

So saying that Red Hat is unwilling to fight is IMHO ignoring some facts. And that's a proposal yet, this will be discussed like the rest by Fedora board.

Re:No more dane-geld!

[AdamWill]

...except that's about a large but lazy 'nation' dealing with small but plucky gadflies. Which is more or less the precise opposite of this situation. Unless you wish to argue that Red Hat has the ability to exert a stronger influence on the desktop market than Microsoft can, but can't be bothered to go the trouble, in which case I would very much like two of whatever you're having.

Re:No more dane-geld!

[oxdas]

I certainly hope they are will not settle for this, simply because servers are off the table. I am concerned that placing Microsoft in this position is a slippery slope. Maybe Microsoft is sincere this time, but history has shown that they will use their monopoly power in abusive ways.

Re:No more dane-geld!

[bill_mcgonigle]

Any company willing to pay essentially blackmail money does not deserve my business.

Be strong and avoid the ones who pay ICANN fees too. ICANN is somewhere between worse than useless and maliciously evil. Anybody who would pay such a fee doesn't deserve your patronage.

WRONG!!!

[Anonymous Coward]

The PC industry turning into a closed platform environment would make me turn to building my computer from the ground up. From the COMPONENT LEVEL!

Re:WRONG!!!

[swalve]

Someone call Digikey and order 600 million transistors!

Re:WRONG!!!

[moeinvt]

"Someone call Digikey and order 600 million transistors!"

ROFL.

Re:WRONG!!!

[solidraven]

Actually, making your own motherboard with off the shelf components isn't all that complicated as you might think (at least to get a basic system that boots). Intel provides great documentation with its processors that pretty tell you exactly what to get and how to connect it to the processor. Most of the parts are available from distributors like Farnell and Digikey. Others you can actually get as samples straight from the manufacturer. The issues start once you want a complete system with support for modern peripherals. Another problem might be mounting all the BGA components they're so fond of today. But it's doable with a toaster oven if you're really into doing things at home.

Re:Why not hardware manufacturers?

[WrongSizeGlass]

I boot through EFI, which isn't this new fangled 'secure' UEFI ... and yes, it's secure enough. My comment was targeted at the marketing mindset that MS will be pushing to try to convince non-Windows users that without MS's blessing your OS is no longer 'secure'.

Re:Why not hardware manufacturers?

[liquiddark]

So they must turn off secure booting in order to run another operating system.

From TFA:

While Microsoft have modified their original position and all x86 Windows machines will be required to have a firmware option to disable this or to permit users to enrol their own keys

If they know what they're doing they're ok. Fedora is doing this for the rest of their users.

Wow

[a90Tj2P7]

I'd blame the drama over this just on the article, but the summary's definitely got some FUD to it as well. For x86 systems, all you need to do is turn off the feature. And that's if you insist on running unsigned software - it's not like there isn't an open and inexpensive process to get signed.

Re:Wow

[DigiShaman]

I figured it was just a BIOS option to toggle off/on. OEM machines (Dell, HP, Toshiba, etc) may or may not be user selectable. I would think they would be given Hyper Threading was also user selectable if you wanted to run Windows 2000 or older for optimum performance in the past. Even HW virtualization is user selectable for most platforms (OEM or not). For sure Asus and other DIY motherboard vendors will make this user optional as well.

If you ask me, there's a whole lot of groupthink bitching going on. Nothing to see here. Move along please.

Re:Wow

[oxdas]

As long as I can sign my own operating system (without paying anything to Microsoft), I will be fine. If not, then I am not getting the benefit of the UEFI bios because of Microsoft and that is an abuse of their monopoly position.

Re:Wow

[AdamWill]

All machines will allow you to disable the feature. This is now a requirement for Microsoft certification (one of the concessions Red Hat and others were able to get out of Microsoft while we were busy not fighting this and rolling over...wait a second.)

Re:Wow

[Doctor_Jest]

It's not that it won't be easy to turn off (or add one's own keys to) Secureboot, it's that we're starting this journey and giving Microsoft the keys to the gate. x86 is not immune from some nefarious company totally screwing it up if they wanted to (it's an open architecture after all), and there's no evidence Microsoft has the user's best interest in mind with anything they do. Given their track record, anything Microsoft tries to mandate on a platform-specific level should be viewed with not only skepticism but a sense of dread at their future plans and motives.

I am not against Secureboot and signing. I don't think most people complaining are. But what we all are complaining about is a corporation known for actively trying to destroy anything that isn't Windows is becoming a node on the path to "security".

I don't trust that sweating monkey-boy ballmer any farther than I could throw him.

Re:That's it...

[ClioCJS]

And this is different from Apple _____?

How will this affect Building your OWN PC?

[Angrywhiteshoes]

So, just as the subject asks, is this going to affect pc builders in anyway? For instance, I haven't purchased a pre-built computer in almost a decade, aside from laptops. I assume this means that if companies want to sell items that want to be able to run windows 8, they'll have to support this policy.

Might be time to purchase a stockpile of parts just to weather the storm.

Re:How will this affect Building your OWN PC?

[FaxeTheCat]

Not at all... unless you want a Windows8 logo on it..in which case it would not be a problem anyway.

Re:How will this affect Building your OWN PC?

[Rich0]

If you don't care about being able to secure-boot, then this won't impact you at all. If you stockpile parts they won't support secure boot anyway.

If you do care about being able to secure-boot, then you need to get MS to sign your bootloader, period. If you build your own linux from scratch or whatever, then you need to get them to sign your own personal machine's loader. Otherwise you have to disable secure boot, and your computer will happy boot a rootkit or your custom OS.

I do think that this practice should be banned. I want secure boot, and I want to be able to secure boot my own OS. Why should I only have the option of secure boot if I buy Windows and run it?

Re:How will this affect Building your OWN PC?

[Jeng]

Considering Windows 8 is going to suck massively this probably will not effect you until the replacement for Windows 8 is out.

My current computer I built myself and it has EUFI, doubt it has a secure boot component to it though.

Re:How will this affect Building your OWN PC?

[Alumoi]

It may be just me, but I seem to recall I must have a motherboard in order to start building my own computer. And guess what, BIOS/UEFI is on the motherboard. So it won't matter if you buy a pre-built computer or build your own, the firmware is already there.

Re:How will this affect Building your OWN PC?

[Angrywhiteshoes]

If you don't care about being able to secure-boot, then this won't impact you at all. If you stockpile parts they won't support secure boot anyway.

If you do care about being able to secure-boot, then you need to get MS to sign your bootloader, period. If you build your own linux from scratch or whatever, then you need to get them to sign your own personal machine's loader. Otherwise you have to disable secure boot, and your computer will happy boot a rootkit or your custom OS.

I do think that this practice should be banned. I want secure boot, and I want to be able to secure boot my own OS. Why should I only have the option of secure boot if I buy Windows and run it?

So basically, I continue living life as if nothing happened. If I choose not to secure boot, that is. Otherwise I need a certificate to boot my machine with secure-boot. Thanks!

Re:How will this affect Building your OWN PC?

[eric_herm]

You have the option of adding your key. I am quite sure that you can also ask to some chineses manufactures to do a MB for you.

vapor hardware

[mbaGeek]

I don't think Microsoft will actually be able to do what the article is worried about - and it probably requires a history lesson on how the PC (and PC "clones") came about in the first place to fully explain "why" - but I'll just point everyone at Triumph of the Nerds

and does anyone remember IBM's "microchannel"?

the lesson from Microchannel was that people don't HAVE to pay you royalties just because you are the industry leader and come up with something new - they can form a gang of nine and do it another way...

this sounds a lot like Microsoft saying "pay us and get in the box" - I don't think they have that kind of power (and if you were working on PC's in the mid-late 90's you probably saw IBM PS/2's getting sold by the skid to be melted down for the gold in the connectors MCA used)

Shelley's "Ozymandias" is probably relevant ("My name is Microsoft, king of software/Look on my operating systems, ye competitiors, and despair") :-)

what about loading windows 7 on new systems

[Joe_Dragon]

what about loading windows 7 on new systems MS trying to lock that out will be very bad for enterprise.

Most places have just / still are rolling out windows 7 so no way they will go to windows 8 this year. Also windows 8 needs to have the old start menu come back as well app side loading at least let enterprise have then own IN HOUSE apps that don't need to go though a store to be loaded.

Re:what about loading windows 7 on new systems

[tepples]

Windows 8 for x86 has desktop application sideloading. Going through the Store is necessary only for Metro Style applications.

Re:what about loading windows 7 on new systems

[smash]

You'll find that either MS will put out an updated version of Windows 7 that is signed, or you'll need to turn the BIOS option off.

Re:what about loading windows 7 on new systems

[smash]

Alternatively, when you order your PCs from your OEM, you will probably specify "EFI secure boot option ON/OFF", just like you do with PXE boot, VT instructions, etc. No big deal.

Re:Why not hardware manufacturers?

[WrongSizeGlass]

If they know what they're doing they're ok. Fedora is doing this for the rest of their users.

Though most Linux users will be brave enough to do this for themselves, those who are on the fence or who want to try something besides Windows may not be willing to futz with the UEFI (formerly known as BIOS) boot config.

Re:Why not hardware manufacturers?

[firewrought]

Good thing Microsoft's way includes a required option in the UEFI setup to turn off secure boot. This whole story is horribly misleading.

G'uhgh.... once again geeks confusing a technical capability with a real-world practicality. Turning off secure boot sounds bad and raises the barrier to entry for non-Microsoft OS'es. It also complicates the newbie install experience, which is something that Ubuntu, Debian, and many others have worked for years to simplify. And now they are using their monopoly position to extort tribute from a competitor.

Really?

[Sparticus789]

Red Hat != Fedora . Close, but they have been growing apart since Fedora 12/RHEL 5

Re:Why not hardware manufacturers?

[RoboRay]

"Secure" is simply a euphemism, and a laughable one at that, for "Microsoft."

Re:Hewwy!

[Anonymous Coward]

I am so freaking stoked about this part:

A system in custom mode should allow you to delete all existing keys and replace them with your own. After that it's just a matter of re-signing the Fedora bootloader (like I said, we'll be providing tools and documentation for that) and you'll have a computer that will boot Fedora but which will refuse to boot any Microsoft code.

Believe that I will use this to render any Linux computers I set up in the future to be "unbootable" via any MS operating system. Seriously, there is nothing worse than going through a ton of trouble setting up a great Linux computer for someone who loves it and then their punk nephew blasts all of your work away with a pirated windows copy.

Re:Why not hardware manufacturers?

[Rich0]

Non-secure is the same as what we have now, but it isn't all that great.

I'd love to be able to tell my computer to only boot an OS that I assign, so that I know that it can't get corrupted by viruses/etc. I could boot from a signed rescue disk if something goes wrong.

The problem is that the standard won't give the consumer choice over which OSes are trusted. The choices will be MS, or no secure boot at all.

Re:Why not hardware manufacturers?

[Anonymous Coward]

A whole $99 one time. Ain't that a bitch.

Secure Boot? No Thanks.

[mister_playboy]

http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/statement

Pointless? No more pointless than bitching on Slashdot, I guess.

Re:That's it...

[westlake]

They are going out of their way so you can run Fedora on the new hardware. And you want to ditch them because of it? Remind me never to buy you a beer.

They went out of their way to avoid exploiting Red Hat's privileged position with OEMS to gain an advantage over other Linux distros:

We explored the possibility of producing a Fedora key and encouraging hardware vendors to incorporate it, but turned it down for a couple of reasons. First, while we had a surprisingly positive response from the vendors, there was no realistic chance that we could get all of them to carry it. That would mean going back to the bad old days of scouring compatibility lists before buying hardware, and that's fundamentally user-hostile. Secondly, it would put Fedora in a privileged position. As one of the larger distributions, we have more opportunity to talk to hardware manufacturers than most distributions do. Systems with a Fedora key would boot Fedora fine, but would they boot Mandriva? Arch? Mint? Mepis? Adopting a distribution-specific key and encouraging hardware companies to adopt it would have been hostile to other distributions. We want to compete on merit, not because we have better links to OEMs.

Implementing UEFI Secure Boot in Fedora

Re:Why not hardware manufacturers?

[swalve]

I think the whole point of UEFI security to to prevent software from doing just that. You HAVE to go into the BIOS (or the UEFI environment, more technically) to make changes like that.

Re:WTF?

[drunkennewfiemidget]

What you've just said is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul.

Linux

[Cro Magnon]

Where does this leave people who want Ubuntu? Or Debian? Or even Slackware?

Re:Linux

[RobbieCrash]

It leaves them going into their BIOS when they want to install, selecting either:

Disable Secure Boot
or
Installing their key

The amount of stupid in this comment thread is astounding.

Re:Linux

[Missing.Matter]

It leaves them with going into the UEFI settings and turning on custom mode, then installing any OS they want.

Re:Linux

[Microlith]

Up shit creek without a paddle, while hoping people can work through their BIOS screens to turn off secure boot.

Re:Linux

[eric_herm]

I guess Canonical will do the same as usual, copy what other did and pay 99$ ( and this is not a joke, they were present in the NDAed meetings hinted in the article, see fedora-devel ). I suspect Debian will refuse on philosophical ground, or will still not finish the flamewar until Windows 11 is out..

Re:Linux

[smash]

It leaves Canonical the option of A - spending 99 dollars on a code signing certificate or B - having their users turn off secure boot to install the OS - on machines that shipped with Windows 8 installed.

Re:Linux

[smash]

FUD. Dell machines still have plenty of BIOS options. I don't have one right here to check, but I do have a fleet consisting of 50% dell machines here and the BIOS can certainly have settings such as boot-sector protection and VT instructions turned on and off.

Re:Linux

[Doctor_Jest]

Does your grandma know how to get to the BIOS? All we need are millions of technophobes to create an ecosystem of "enabled" secureboot platforms for MS to take things to the next level. Hell, it isn't a problem for ./ users... but this isn't about us... this is about the Great Unwashed and their ability to accept every pile of filth coming from Redmond or Cupertino. Fear the average... it makes things demonstrably more difficult for us in the long run.

I don't want Microsoft nosing in any point of the "security" chain. What I find astounding is the amount of denial and flippancy on the part of most people here. I wouldn't expect less of the astroturfers... but the real ./ crowd should be rightly remembering why Bill Gates looked like a Borg for so long on this site.

Re:Linux

[RobbieCrash]

No, but she doesn't know how to install Linux either. My grandma buys a computer with Windows on it, and tthat's it.

This is strictly related to computers with Windows preinstalled. Anyone who's ripping out Windows to install linux knows how to get in the BIOS.

If you don't want to deal with this, don't buy a computer with Windows on it.

Re:Why not hardware manufacturers?

[j00r0m4nc3r]

rather than sucking at Ballmer's ass.

I'm not sure I can tell which end that is anymore...

FUD.

[RightSaidFred99]

This is nonsense, the editorial on this article is gibberish.

First, secure boot is a legitimate concern. If you can guarantee a specific boot loader, you have a trust base to build a more secure system.

Second, you can install any OS you want. Just turn off secure boot, it's perfectly valid to do so. Just understand that now your boot foundations are untrusted, just like they are now on almost all PCs.

And what kind of person is going to install Fedora but can't be bothered how to boot into their BIOS and click "Yes, allow me to install other operating systems [X]"? Generally you can even install your keys, just like you can with SSL certs that you might trust.

Finally, Microsoft is doing Fedora a _favor_ here. Fedora is, as actual author indicated, totally free to get their own keys added. Microsoft isn't the problem here, but as usual the breathless, bloviating editorial text tries to make them out to be.

Re:FUD.

[Dr_Barnowl]

The default position right now with many Linux distributions is that you can insert a CD or USB thumb, maybe push a function key during boot, and try them out.

With secure boot you will have to go into the BIOS, and disable something labelled as a security feature. I wouldn't be surprised to discover that, while on the face of it, Microsoft are insisting that OEMs include Custom Mode, but also quietly insisting that that switch pops up a nasty-looking dialog which says "Are you SURE you want the Evil Haxxors to root your machine!?!"

People trying Linux for the first time are going to go "Huh, I thought Linux was supposed to be more secure, yet here it is, making me disable security features just to run it!". Or they are going to go "Huh, a message saying 'This operating system bootloader is corrupted or infected with a virus." ; I guess this Linux stuff don't work as well as they say it does."

It puts a barrier in front of new user adoption of Linux, which is, of course, a highly desirable effect for Microsoft. Redhat are calling them out and getting them to sign their bootloaders to avoid this effect. It sticks in the craw somewhat that they have to beg askance of Microsoft to get their binaries signed, but I think Redhat are probably taking the best path available to them.

Secure boot is an otherwise desirable feature, in the control of the user, but that's never going to happen with an MS operating system.

Re:FUD.

[CheshireDragon]

I really like what you said

I just don't understand why any self-respecting manufacturer would do this...bending over the table for M$ to jam the M$ cock up their ass.
It honestly sounds like manufacturers would commit by only allowing an M$ product. I have a strong feeling that there will be manufacturers that won't do this.

Re:FUD.

[smash]

Because the alterantive is "insecure by default". Which microsoft have taken huge flak for in the past. If you want to run Linux or other, you have 2 options: run linux that is code-signed, or turn code signing off and run it like you would today. This is a NON-ISSUE that will drastically improve security for operating systems which support it.

Re:That's it...

[mister_playboy]

Complacency here starts us down a very nasty rabbit hole.

TFA states as much, since the author admits there is no plan as to how Fedora will be bootable on Win8 certified ARM hardware except to "pray somebody makes non-Win8 certified ARM hardware".

Re:Why not hardware manufacturers?

[Metabolife]

Exactly, why don't the virus makers just add a friendly cookie monster eating their data while they unlock your GPT?

Re:Why not hardware manufacturers?

[SuperTechnoNerd]

sarcasm-on

You dam geeks with wires really think your pc is your property? pc manufactures build it, we write the software. All you do is pay for it. That makes it more ours than yours. You geeks simply can't be trusted to do things in ways that ensure our profits, so we will do it for you.

now shut up and go back to playing with your wires... Leave the big decisions to us..


sarcasm-off

Re:WTF?

[a90Tj2P7]

they must be smoking the same waky-tabaky that Comrade Obama is smoking, that has him asserting that he's spent less than any president in modern history, or somesuch bat-s**t insane claim like that..

Off-topic, but that's a matter of easily-verified fact. Government spending is lower than is has been in the last five administrations. If you disagree with policy or actions, go right ahead, that's the point of democracy, but waving that off as "bat-s**t insane" is simply denial.

The day I go to buy a machine and find that I'm locked out of putting MY CHOICE of OS on it, is the day I get PISSED!!!

Too pissed to go into "BIOS" and turn off the secure boot feature? Because that's all you need to do.

So MicroSoft is looking to be put out of Business.

[3seas]

With a MASSIVE anti-trust Lawsuit...

Re:Why not hardware manufacturers?

[CompMD]

But why? StrongARM processors are SOOO last decade. Besides, Windows 8 for ARM probably won't run on anything earlier than ARMv7 architecture.

Re:lottery for me

[mister_playboy]

I think your troll detector needs new batteries. :)

Re:Where are antitrust lawyers now?

[RightSaidFred99]

Because MS isn't fucking doing anything. You can still install whatever OS you want on your PC, Fedora can still get their own keys added by hardware vendors. Microsoft is being nice enough to help Fedora out. This is all much ado about nothing by people who don't have the foggiest idea of what's going on but see "M$" and instantly go full retard.

One should avoid going full retard at all costs.

Re:Why not hardware manufacturers?

[Anonymous Coward]

Interesting then that Microsoft provide a way for others to sign their software... which is what Fedora is doing.

Exactly - by paying Microsoft for that right. Isn't that what this whole thread has been about?

$99 once? get over it

[Balial]

It's one-off fee for a commercial company. Get over it.

The real story here, though, is that they're actually taking a real stab at doing signing right and requiring a chain of trust. They're also doing it in a very cooperative open source way.

This is an excellent step for the assurances of trusted computing for their users!

Re:$99 once? get over it

[0123456]

It's one-off fee for a commercial company. Get over it.

Have you actually read the article? Not only does it require everything from boot loader to kernel to drivers have to be signed, but Microsoft can revoke permission at any time.

Re:$99 once? get over it

[smash]

You know how purchasing code signing certificates works yes? You buy a cert, ONCE and then use the 99 dollar cert to sign all your code. yes, it can be revoked, that is the point of PKI. If someone steals your code signing cert and puts malware out with it, you get the cert revoked and issue a new one.

Re:$99 once? get over it

[Balial]

Have you actually read the article?

Yes

Not only does it require everything from boot loader to kernel to drivers have to be signed,

That's the whole point of trusted computing. It's an excellent thing.

but Microsoft can revoke permission at any time.

Revocation is critical to security.

Re:Why not hardware manufacturers?

[jedidiah]

Once again the Lemmings engage in the usual fear mongering and anti-intellectual rhetoric. The bar really isn't that high here. Anyone with a little gumption can manage to put a LiveCD into their system and boot it.

This pointless bit of security theater just adds a little more scaremongering on top of your usual level of scaremongering.

Re:That's it...

[RightSaidFred99]

You don't know what you're talking about, but thanks for broadcasting such so I know to ignore your bloviating in the future. Neither MS nor Redhat/Fedora is doing anything even remotely wrong here.

Clueless neckbeard dweeb:

OMG Fedora is paying MS $99 to have a nicer user experience to save their users 30 seconds of going in and disabling secure boot or manually installing Fedora keys!?!! OMG, I IZ BREATHLESS AND ENRAGED!!!

Fucking neckbeards. Ironically they have a reputation for being good in IT/software but at least 50% of them are semi computer-illiterate dim bulbs.

Re:Why not hardware manufacturers?

[haruchai]

They probably have no real choice; if they locked out everyone else they would essentially be monopolizing the PC market and I don't think they want to go through that court circus again.

Re:lottery for me

[ColdWetDog]

That's entirely off-topic. Did you even TFA?

Maybe his DNS server is from North Carolina or similar and it's resolving Slashdot.org to RandomBibleVerseToday.com.

Re:Why not hardware manufacturers?

[SETIGuy]

Yes, if you pay enough you can get a key. Microsoft is following in Apple's evil footstep by requiring developer registration and, I assume software distribution only through valid Microsoft channels. Do you like any software that you didn't pay for? Well, you'd better find a substitute. Microsoft is tired of FOSS and legacy software cutting into their profits.

Er Ummm????

[Anonymous Coward]

Why is it then that Mint works with everything on my 2011 Mac Mini. Wifi, everything OOTB.

My MBP (2008 17in) Runs CentOS. The only thing I had to fiddle with was the Wifi but that is normal as there are no proprietary blobs shipped with the OS.

I have to say that in my experience Apple H/W is a lot more Linux friendly than some of the H/W sold by the likes of Dell and HP. THe only other H/W I would recommend for running Linux on OOTB is Lenovo.

Re:Why not hardware manufacturers?

[SETIGuy]

It also won't run your existing software or any other software that Microsoft didn't sign. Welcome to the iPC.

Still FUD

[RightSaidFred99]

Aww, modded down by angry, clueless nerds. I'll just post again.

This is nonsense, the editorial on this article is gibberish.

First, secure boot is a legitimate concern. If you can guarantee a specific boot loader, you have a trust base to build a more secure system.

Second, you can install any OS you want. Just turn off secure boot, it's perfectly valid to do so. Just understand that now your boot foundations are untrusted, just like they are now on almost all PCs.

And what kind of person is going to install Fedora but can't be bothered how to boot into their BIOS and click "Yes, allow me to install other operating systems [X]"? Generally you can even install your keys, just like you can with SSL certs that you might trust.

Finally, Microsoft is doing Fedora a _favor_ here. Fedora is, as actual author indicated, totally free to get their own keys added. Microsoft isn't the problem here, but as usual the breathless, bloviating editorial text tries to make them out to be.

Re:Still FUD

[Chelloveck]

Sure, you can turn off secure boot. Go into setup, uncheck the "Enable Secure Boot" option. Click past the dialog that reads, "WARNING! Turning off Secure Boot will make you vulnerable to hackers! Do you really want to let the cyberterrorists win (y/N)?" Or similar text which will be equally scary to non-technical users.

OS vendors other than MS will have three choices: Get their key included by the all the motherboard manufacturers; pay MS to sign their bootloader; or subject their users to the Scary Dialog of Cyberdoom. Everyone here understands that it's just FUD. But will the average computer user understand it? It's creating a sense of "Microsoft == Security" and "Others == Trousers Around Your Ankles". Ooh, better stick with Windows or the cyberboogieman will get you!

And on top of it all, I give it less than a year before MS's master private key is leaked, stolen, or otherwise hacked to render "Secure Boot" about as secure and useful as WEP or CSS (the DVD kind, not the Web 2.0 kind).

Re:Why not hardware manufacturers?

[Sir_Sri]

Um.... that's as it should be.

If you're running something at the OS level unintentionally that can be really fucking bad for your computer can't it? If you want to install linux this isn't a particularly difficult problem to solve.

The vast vast vast vast majority of users have no idea what the hell is going on on their computers. But they're on the network with the rest of us. Should we take away anti lock brakes because professional drivers can use regular brakes better than anti lock brakes? I think not. There is a way to circumvent UEFI if you definitely know you want to. If you don't know you want to, you don't want to, and should be protected from some malicious application doing it for you.

The vast majority of consumers aren't going to run, or want to run anything on this particular computer they are buying other than windows. I know that's not a popular concept around here, but it's reality. Making it easier for them to be more secure significantly trumps the relatively minor inconvenience suffered by people who know stuff about computers having to use that knowledge and their ability to read.

Re:Why not hardware manufacturers?

[SETIGuy]

I assume that like it will be an annual fee with a sliding scale based upon net worth and how much Microsoft likes you. Plus a per unit charge. And your software will need to be distributed through Microsoft's distribution channels which won't be built for OS installation.

Re:Glad I quit Linux

[scarboni888]

Hey hey hey - easy there with the linux-slaggin buddy. You're on slashdot now.

sarcasm brackets.

[mevets]

If you have to alert people that your doing it; you probably arenâ(TM)t doing it right.

Will the EU stand idly by?

[FridayBob]

For me, UEFI is not a problem, because I'll just continue to do what I've been doing for almost two decades: building my own servers and workstations from individual components.

On the other hand, if at some point in the future a client asks me to migrate all of their existing workstations and servers from Windows to Linux, then UEFI may make that difficult. For that matter, it may also become difficult to install Linux on the average laptop.

Will the the EU stand idly by (as I'm sure Uncle Sam will), or will it stand up for consumers everywhere before it's too late?

Re:Will the EU stand idly by?

[Microlith]

UEFI is not a problem, because I'll just continue to do what I've been doing for almost two decades: building my own servers and workstations from individual components.

Your motherboard will come with Microsoft's key and default to secure boot.

if at some point in the future a client asks me to migrate all of their existing workstations and servers from Windows to Linux, then UEFI may make that difficult.

Precisely.

Re:Why not hardware manufacturers?

[Anonymous Coward]

It's worth noting that in this case, "enough" is a $99 one time fee. I seriously doubt they will be breaking Red Hats bank any time soon.

Re:That's it...

[h4rr4r]

It seems logical from one point of view.
RH should have at least tried some lawsuits first.

Buddying up to MS never ends well.

Re:That's it...

[h4rr4r]

They should have used that position to advocate for a neutral key issuer.

Say NO to Microsoft Danegeld

[Pepebuho]

If Fedora yields on this, I'd go to another distribution. Paying $99 to Microsoft for the "right" to install the OS of my choice on my own hardware is making Microsoft $99 richer off the efforts of the volunteers who brought Linux and Fedora to us, and it makes my Free-gratis OS effectively cost $99, no longer free.

I'd rather go back to the time of compatibility lists and give my money to those companies that support my needs than give it to those Microsoft-bought hardware manufacturers.

Say NO to Microsoft Danegeld

Re:That's it...

[h4rr4r]

You think they won't stop signing at some point or delay signing?

You really think MS will do this out of the goodness of their hearts?

Here in the real world we should let the SSL CAs run this. Since they already are running a similar program.

Re:Why not hardware manufacturers?

[Lisias]

On the other hand, the Common Joe (that can't handle messing with the UEFI) shouldn't install anything in his computer at first place.

The problem here is that the average knowledge level of the computer users are dropping meteor style: fast and speculatively. This kind of user should not be expected to be able to install a Operating System - not mention trying to install a O.S. on hostile environment (i.e., a Windows computer - I don't have to mention all the little artificial problems MS caused in the past and still causes nowadays - my Win7 box committed suicide last time I installed Linux).

You can't expect to dumb down everything.

Re:Why not hardware manufacturers?

[Microlith]

If they know what they're doing they're ok. Fedora is doing this for the rest of their users.

Which is part of the goal. Raise the bar, make it harder to migrate away from the platform. I suspect we'll see zero real security improvements on Microsoft's end as a result of this but lots of complaints and comments on various Linux forums asking why they can't boot their Linux USB key or ISO.

Not Just Linux

[McDee]

I suspect that Microsoft doesn't care much about linux one way or the other; if users want to tweak a BIOS option and run linux it won't bother them.

However, I wonder if Microsoft is looking at the far more lucrative fact that those with Windows 7 and Vista licenses will be forced to buy a new Windows 8 license or else run an "insecure" setup. It gets rid of a problem that they've had for years where users upgrade their hardware and keep their old OS around.

Seems like a massive money spinner in the medium term for them.

Re:Not Just Linux

[couchslug]

Precisely.

LOTD isn't a problem for MSFT.

Old WOTD _is_.

Ass, meet U and ME

[Em Adespoton]

Once Windows 8 is released, hardware manufacturers will be forced to ship machines that refuse to run any software that is not explicitly approved by Microsoft — and that includes competing operating systems like Linux.

Really? Even hardware manufacturers like, say, Apple? Even for hardware that doesn't use UEFI? Or does that sentence really mean that consumers will have the option to purchase machines that are locked down to the OS bundled on them?

This train of thought seems to make a whole bunch of leaps of faith to come to dire conclusions. I can't really see people running racks of servers with OSes on the hypervisor binding all EFI loaders to Windows 8.

I think the real story here is that "Common discount consumer-grade desktop PCs will be locked to the bundled OEM OS, unless third party access is granted a la MS/Red Hat."

In other words, it's not really that big of a story, and will be excellent news for potential bootkit victims everywhere (at home and in an office deployment).

Re:Ass, meet U and ME

[smash]

Exactly. Machines installed with Windows 8 by default will have secure boot turned on to protect the OS. End of story. Want to turn it off? Turn it off.

Re:Why not hardware manufacturers?

[mcl630]

According to TFA, the money actually goes to Verisign, not Microsoft.

Re:Why not hardware manufacturers?

[Anonymous Coward]

Im curious, but can you point me to any meteors that have fallen speculatively?

Re:Why not hardware manufacturers?

[jader3rd]

You have to do it MS's way or they won't let you sell hardware with Windows on it.

OEM's can sell Windows 8 without secure boot. They can't put the sticker on the box that says "Windows 8 certified" without secure boot.

The fact that said devices were spotted by you...

[Mister Liberty]

... was the only thing important in the minds of their respective owners.
Snobism abounds.

Have a nice day yourself.

Re:Why not hardware manufacturers?

[Megane]

...except on ARM, where they require that there be no way to disable secure boot.

Want to run Linux on that shiny ARM Win 8 tablet? Tough luck.

Also, what's to stop them from changing their minds a few years later require the same for PC hardware when Win 9 comes around?

I have more of a problem with MS being in charge of all this, than with the basic idea by itself. It's very much a case of the fox guarding the henhouse.

Re:Why not hardware manufacturers?

[Megane]

It'll be a real bitch when MS "accidentally" revokes your key. Oops! Sorry about that!

The best part is that the revocation will probably only happen to newly manufactured motherboards, so you might not even know about it until one random day you start hearing about people unable to install your OS in their new PC.

Re:Why not hardware manufacturers?

[Anonymous Coward]

RTFA. One time fee. The money doesn't even go to Microsoft, it goes to Verisign.

Re:Why not hardware manufacturers?

[iplayfast]

The amount doesn't matter. If someone wouldn't let you into your car unless you paid them a dollar, it would be the same thing as if they forced you to pay 99 dollars. It's still immoral to lock someone out of something they own. It's also still immoral to lock out one particular brand of gasoline.

Dual Boot

[organgtool]

Does this mean that if I want to dual boot my machine with Windows and another OS, I need re-enable Secure Boot in the UEFI options every time I boot into Windows and disable Secure Boot every time I boot into the other OS? What a pain in the ass that would be if that's the case.

Re:Dual Boot

[AdamWill]

No.

Re:Dual Boot

[organgtool]

Thanks! That one-word answer completely clarifies the situation I proposed.

Re:$99 ... 'Defective' Motherboards

[scharkalvin]

Actually (if you read the article) M$ does not get any of that $99. The fee goes to Verisoft. Microsoft is acting as the gatekeeper for the signup process.

Now I will be VERY pissed if I buy a new motherboard to build my own computer and it won't boot Linux unless I have to buy a key for $99. In such a case I would return the MB as being defective. I hope Asus and other MB makers will give me a choice of bios options when I buy a new MB.

Re:Why not hardware manufacturers?

[SCPRedMage]

I'd get right on that, but I'm too busy with this Gibson that needs hacking...

Re:Why not hardware manufacturers?

[Lord_Jeremy]

That's a serious problem. The requirement of explaining to people running all kinds of different hardware with all kinds of different UEFI setup screens is adding a massive hurdle to Linux adoption.

My CompSci teacher in high school routinely set up Linux dual-boots on the basic Windows machines so he could actually teach his class. Of course he routinely butted heads with the district's asinine IT department. The BIOSes on the school machines are always password locked and they head administrator refused to give him access. If those machines were replaced with systems running UEFI secure boot, I can guarantee he wouldn't be able to run Linux anymore. He wouldn't even be able to boot the systems every morning with a LiveCD like he did for an entire year when he was forbidden to install anything to the hard drives.

Re:The fact that said devices were spotted by you.

[Jeremiah Cornelius]

I'm just analytical and hyper-observant.

It's a bias, I admit.

Break them up

[WOOFYGOOFY]

What are we waiting for? They should have been broken up when they were found guilty of monopolistic practices the first time.

Let's get this done. No fucking around the edges.

Re:Why not hardware manufacturers?

[Microlith]

The UEFI spec (which Microsoft has a HUGE hand in writing these days) explicitly denies the ability to automatically install keys. They could have made it possible to do so, say by requiring it happen from read-only media, but they didn't.

It's left vague enough that it's virtually guaranteed to be an enormous pain in the ass to enable secure boot for any platform not explicitly blessed by Microsoft.

why

[shentino]

Microsoft probably told the OEMs that either they played ball Microsoft's way and locked down the motherboard, or they didn't get to preinstall Windows at all.

Re:Hewwy!

[frost_knight]

If you've sold the laptop, or given it away as a gift or a donation, by what right do you have to limit what the recipient can do with it?

Re:Why not hardware manufacturers?

[Iceykitsune]

You have to do it MS's way or they won't let you sell hardware with Windows on it.

OEM's can sell Windows 8 without secure boot. They can't put the sticker on the box that says "Windows 8 certified" without secure boot.

Do you honestly think that retail outlets will even consider selling computers without those stickers?

"All hardware is belonging 2 us." Microsoft

[__aasdno7518]

I still say this has never been about making Windows safer, but it's been about killing it's biggest threat once and for all...That biggest threat being Linux. I've said for years there would eventually be 3 OS's running on 3 different sets of hardware...As of Windows8,that will come true. I've used Linux for eight years and Microsoft can kiss my ass.

Re:Not Legal in Europe

[JCCyC]

Yeah, like that diner at the beginning of "The Untouchables" was free not to acquire the protection services offered by that gentleman.

Re:Why not hardware manufacturers?

[tepples]

There are two companies called Verisign. The one that's a certificate authority is owned by Symantec now.

Re:Why not hardware manufacturers?

[Missing.Matter]

The money goes to Verisign, not Microsoft. Did you read TFA?

the sky is falling

[spongman]

wow, RedHat pays $99 to Verisign for a code-signing cert and gets Microsoft to give it to their OEM logo hardware partners?

it's the end of the freaking planet people.

run for the molehills.

Re:WTF?

[JCCyC]

I came to the same conclusion as you at "Comrade Obama".

Jesus H. Christ.

Fine

[DaMattster]

I don't really see the problem here because market forces will open an opportunity for a hardware manufacturer to specialize in creating solutions for operating systems other than Windows. Besides, I'll bet you might still be able to turn UEFI Secureboot off and just use the regular BIOS. It means you won't be able to run Windows, but who cares.

Re:Fine

[__aasdno7518]

I don't really see the problem here because market forces will open an opportunity for a hardware manufacturer to specialize in creating solutions for operating systems other than Windows..

I agree..Companies like Zareason and Systen76 will see that this happens.

Re:Why not hardware manufacturers?

[mlts]

This exactly is my concern. Why? ARM brings a lot to the table, so if MS can lock ARM devices to being Windows only, they will have gained immensely:

1: ARM based servers are being worked on. For tasks like DNS, DHCP, and other fairly static items, they are hard to beat. In general, ARM CPUs use significantly less power than x86, so the amount of MIPS per watt can be a game changer, especially when businesses are under constant attack about having eco-friendly data centers.

2: ARM based desktops for businesses will be a useful market. Because of the non-x86 architecture, games and "unauthorized" software won't work. However, Office and Outlook will. This will be a major boon for low level IT desktop support. I can see this selling like hotcakes in the enterprise because it keeps support costs down, guarantees a Windows foothold, and helps ensure that only authorized stuff will run. A new architecture means that virus and malware writers are sent to the drawing board as well.

Re:Why not hardware manufacturers?

[Metabolife]

You'll never hack it, I have a skateboard and a Da Vinci sketch on my wall.

It's time

[slazzy]

To buy Microsoft stock for my retirement plan...

UEFI...

[jmerlin]

Secure booting -- provides no added benefit and is therefore totally useless (except as a tool of extortion). All we need is partition write locking on OS install. When was the last time you actually heard of malware that touched the bootloading process, anyway?

Re:UEFI...

[smash]

Yeah right... because if you don't have code signing then how do you know your firmware updates are valid?

DANGER AHEAD! Microsoft KINdows? Windows KIN?

[Jeremiah Cornelius]

Which name will predominate?

I think we just go with KINdows, for now.

Re:That's it...

[h4rr4r]

I meant even MS should have to go get their software signed by a neutral party. I read the article, it did not mention Red Hat even suggesting this, nor did it seem as though they even considered legal action to make that happen.

Public Key?

[gr8_phk]

Does the signing use a public key for UEFI to verify the signature? Does anyone know the key so people can get crackin? Sure it's probably a large key beyond current methods to crack, but it makes research in such areas feel more relevant with a specific target you can talk about. Theoretically with algorithm X is would take 169 years to break the MS UEFI key using 50000 CPUs. Using Y it only take 165 years...

Re:Why not hardware manufacturers?

[hairyfeet]

I'm sorry but its FUD. The simple fact is all X86 machines are required to allow bypassing secure boot which is as simple as flipping a single setting in BIOS, that's it, that's all. No harder than telling a PC to choose CD as first boot (which one is gonna have to do to install an OS anyway) so this is just FUD. Are they SERIOUSLY saying Fedora users wouldn't have enough common sense to flip a single switch in UEFI? Really? because i find that pretty much impossible to believe. This IS Fedora we are talking about here, an OS so bleeding edge its CDs have stigmata and not the kind of thing Joe Dumbass would be trying for shits and giggles. They even admit in the very first paragraph that ALL X86 are required to allow the simple bypass of secure boot!

So I'm sorry but FUD is FUD and this is FUD. there is no way in hell someone that is intelligent enough to 1.-Know what Fedora is, 2.-Knows how to download and burn an ISO will be 3.-Too stupid to push Del at boot and choose "Turn off Secure Boot" which is only being turned on by default because rootkits are still a serious problem. Isn't it the Linux community that is always bitching about windows security? why aren't you cheering that they are doing something about it?

Surely to God the geeks here are seriously fucking dumb enough to believe that a person who would know what Linux is and download and burn an ISO would be too fucking retarded to flip a setting in UEFI, surely not. Hell if they are THAT fucking stupid how would they be expected to even run Linux? Especially a bleeding edge alpha distro like Fedora where being able to do forum lookups and Google their way past problems and do bug reports is the order of the day? There is simply no way in hell to have a user smart enough to do that but too retarded to flip a switch, no fucking way. Its FUD, pure and simple FUD.

Re:Dual Booting?

[Dr_Barnowl]

Unless all the installed operating systems are signed, you may have to revert to "custom mode" ie, non-secure boot.

Of course, there may be features of Windows that don't work without secure boot, like media playback in full HD, etc.

clever slopes

[epine]

You don't get the 'slippery slope' thing, do you? Or are you one of those 'slippery slopes don't exist' bozos?

Says user "0123456" who couldn't slide all the way to seven. Not even "0123456etc". From the later username it would be right and proper to dish this kind of abuse.

I was about nine years old when I saw my first picture of Beautiful Asian Rice Terraces. I went "wow, it's amazing how anyone ever thought of that". And now those clever slopes rule the world.

Re:Why not hardware manufacturers?

[hairyfeet]

Has Linux sudenly been infected by rootkits? Did I miss a memo? the point of secure booting is to block rootkits, most Linux bugs i've seen are Java based or get in through PEBKAC so there really isn't a point in secure boot for Linux. Sure it might make a bullet point for workstations but workstations ain't running Fedora so the whole thing doesn't make any sense.

Reminds me...

[Bigsquid.1776]

This reminds me of when everyone fumed that Dick Cheney was running the world. Dick Cheney couldn't do anything that George Bush didn't sign off on.

Microsoft can't do anything the hardware manufacturers don't sign off on. Microsoft doesn't run the world. If they have some hair-brained idea that gets enshrined in hardware, don't blame Microsoft... blame the hardware people. Don't buy their crap! There are many different processors and platforms that run modern operating systems. Tell Blizzard to port Diablo and Wow over, then wave farewell to Microsoft.

Re:Why not hardware manufacturers?

[Anonymous Coward]

I didn't know Microsoft has the authority to revoke Verisign certificates, that's pretty surprising OH WAIT SOMEONE DIDN'T RTFA. Tool.

Re:Hewwy!

[jdgeorge]

As long as the purchaser or recipient understands the limitation before buying or accepting the gift, there's nothing wrong with selling or giving the modified device.

If he misrepresented the device as being in "like new" condition, that would be different.

MS owning PCs is like Fox owning Cable

[ChronoFish]

While I use a PC at work, since I joined the smart-phone and tablet era my PC at home has been virtually untouched. That doesn't help the many distributions of Linux...but nor does it help Microsoft (in my case Google/Android is getting my eyeballs).

The analogy in my subject RE Fox is simply that Fox News is the #1 watch (cable) news channel and with several shows constantly ranking highest viewership.

However... Cable usage in general is going down. So while Fox continues to grow and dominate, it is with an aging population and on a (slowly) dieing platform. Eventually Fox may be able to claim 90% viewership, but if there are only a couple thousand viewers to begin with it really won't matter.

MS has dominated the PC world for 25+ years, and this new "protection" will all but solidify that. But again... having 90% of the market won't matter if there are only few consumers remaining.

-CF

Re:Hewwy!

[CanHasDIY]

The same right that MS, Apple, and the various Android vendors have to lock the hardware that they rent^H^H^H^H sell/give away/barter or what have you. Oh, that's right, I forgot, they're multi-national mega-corps thereby they have intrinsic rights that me as a mere citizen don't have.

So, because they are evil fucks who don't care about their customer's, you think it's justified for you to do the same?

Yea, that's logical... if you're a sociopath.

Have you considered fucking off and dying perchance?

Oh, you are a sociopath...

Figures.

Re:Why not hardware manufacturers?

[CrazyDuke]

Actually, I suspect the LiveCD is likely what this is meant to shut down. The little progress that other desktop OSes have made in the IBM PC compatible market in the past few years has been due to Joe Blows tossing a live CD in. Heck, I give them to friends and family for when their Windows installation gets trashed by the latest and greatest Rapeware. There's no way I am being a writer and phone support for my own version of The Idiot's Guide to Playing with FireX4aBIOS Settings.

That, and I can imagine DRM refusing to authenticate on a system with the secure boot setting disabled. We are the enemy, after all.

Re:Why not hardware manufacturers?

[tqk]

Microsoft is tired of FOSS and legacy software cutting into their profits.

The last I heard, FOSS users (I'm one) are a mere blip compared to the installed base of commercial offerings. They're not forgoing much by us not coming over to the dark side. I'd say MS ought to be a lot more resentful of the vast number of NT, XP and Vista users who've so far refused to upgrade.

Please, don't add to the FUD. There's enough of it out there already. I think UEFI stinks and I'm sorry Fedora thinks they need to accomodate it, but as long as I can turn it off as easily as going into the BIOS, I'll be satisfied.

On the other hand, if UEFI can do something to make up for all the horrible things MS's lousy security model have enabled over the years (malware, botnets, ...), it could be a good thing.

Re:Why not hardware manufacturers?

[hairyfeet]

Oh Lord, paranoia the destroya...Riddle me this SETIguy...WTF would be the POINT of secure boot if you just handed it out to anybody? After all if they just handed it out because it was Fedora they could get sued for showing favoritism when "Bob's distro" came along and they wouldn't hand THEM the keys. What Fedora is paying for is the whole song and dance of being checked for key security compliance and as a barrier to entry, otherwise any malware writer could just start his own distro and demand a key thus making the whole damned thing pointless.

The fact you got modded insightful for a conspiracy theory just shows how damned batshit the FOSSie mods are here on /., sometimes the groupthink here is as thick as the smell of feet in a lockerroom and anything that says "MSFT is evil and burns babies ZOMFG!" is assured to get a +5 even with zero proof.

As a final note before i move away from the batshit crazy fest I'd just point out that bypassing UEFI secure boot is as simple as pressing a button and that you will have to go in there anyway if you are installing an OS because OEM machines generally aren't set to boot from CD out of the factory. Considering the ability to bypass secure boot is MANDATORY and part of the spec this whole thing is just an exercise in FUD and crazy. Anybody that would give a shit about secure boot sure as hell isn't gonna be running a test bed alpha distro like Fedora, they would be running a workstation OS like Red Hat if they wanted Linux. Hell there isn't even a point in having fedora secure boot, because you are gonna be doing enough work on it that you won't be keeping a stock install anyway. hell that is the whole damned point of Fedora, to let the beta testers work out the bugs before they can get into RHEL. So this whole argument is stupid, pointless, and FUD. I'm outta here.

Re:Why not hardware manufacturers?

[Hognoxious]

Is it going to kill all the dinosaurs? Is it not going to kill all the dinosaurs? Difficult to tell at the mo$%^,,,l.@@
  no carrier

Re:Why not hardware manufacturers?

[Anonymous Coward]

You have a point. But, as a Linux admin, this is something I'm glad about if it gets into RHEL. Why? All my hardware is installed automatically, via PXE boot, which is a single keypress on boot. Having to change a BIOS setting would be really irritating. It's not the end of the world. It's not complex. It's just irritating and time consuming.

Re:Why not hardware manufacturers?

[Man On Pink Corner]

So I'm sorry but FUD is FUD and this is FUD

No, this is a classic slippery slope. In the UEFI version that supports Windows 9, only secure boot is supported. You can't turn it off, but you can still enter a key manually when installing an Untrusted Non-Microsoft OS (UNMOS). The key is 256 characters long, and looks like a ROT13-encoded Perl script.

The version that supports Windows 10 also supports secure boot only, and still requires key entry. This time, though, UNMOSes are now called IOSes (Insecure Operating Systems.) They will run under a Microsoft-supplied hypervisor that includes mandatory hardware packet filtering.

And wait'll you see the third-party OS support strategy for PCs approved for Windows 11, code-named "Overton." The plan for Overton is that third-party OSes called PDOSes, or Potentially Defective Operating Systems, can still be run, but not on your local hardware. They will run only on cloud-hosted secure platforms over VNC.

All of this will happen because someone noticed that people will cheerfully bend over and accept restrictions in each generation that would not have been tolerated in the previous one. Evidence of this claim? Look at the history of Trusted Computing. Starting with the innocent-sounding idea of TPMs with unique CPU ID stamps, which were fought heroically by users until the next season of American Idol came on and everybody kinda forgot about it, the people behind the curtain have gotten everything they wanted over time. All they had to do was demand a little more "compromise" than they could get at any one stage of development.

In short, everything old is new again. We are all IBM customers now.

Re:Why not hardware manufacturers?

[tqk]

The problem here is that the average knowledge level of the computer users are dropping meteor style: fast and speculatively.

... can you point me to any meteors that have fallen speculatively?

Maybe the ones that graze the atmosphere and bounce off?

Perhaps he meant "spectacularly." Damned autocomplete.

Re:Why not hardware manufacturers?

[turgid]

I can see that there will be a flurry of unencumbered Free/Open Source BIOS/firware software being developed.

Perhaps for large corporate deployments, the manufacturer could be persuaded to to the BIOS configuration for you, or be paid to install something like OpenBIOS?

If I'd been 10 years younger I'd have been all indignant and worried, but these things have a habit of sorting themselves out.

Re:Hewwy!

[cheater512]

Good question. Why is Microsoft doing just that?

Re:Why not hardware manufacturers?

[DarwinSurvivor]

No, but what about all the smaller distros? Hell, what about the poor suckers running LFS?!?

Re:Why not hardware manufacturers?

[DarwinSurvivor]

The whole POINT of secure boot is so you CAN'T just put a live-cd in a boot off of it, you need to disable secure boot or sign the bootloader first!

Don't forget that Windows is going to be written so it will only boot if SecureBoot is enabled (to preven man-in-the-middle), which means if you dual-boot with an unsigned linux OS (LFS, etc most definitely won't be signed) or need to use a live-cd as a rescue disk, you need to enable/disable secure boot EVERY FUCKING TIME you switch OS's. No thank you!

Re:That's it...

[Burdell]

No, I really don't think they'll stop for PCs. It makes it easier for them to get vendors to agree to the Secure Boot requirement to begin with. I don't believe they could really get HP and Dell to ship computers that were unable to run anything other than Windows 8.

Even if they do, we're no worse off than we would be if Fedora didn't get a key signed (telling users how to disable Secure Boot or trying to get vendors to include a Red Hat key in the UEFI firmware).

Re:Why not hardware manufacturers?

[Princeofcups]

Yes, if you pay enough you can get a key. Microsoft is following in Apple's evil footstep by requiring developer registration and, I assume software distribution only through valid Microsoft channels.

Apple can do what they want with their own hardware, just like any hardware vendor. It's when a convicted monopolist is strong-arming the majority of hardware vendors to make it difficult to use any other OS that we should be concerned.

Re:Why not hardware manufacturers?

[tqk]

G'uhgh.... once again geeks confusing a technical capability with a real-world practicality

And once again, geeks not realizing anyone but geeks install and use operating systems other than the one that came with their hardware.

I'm more than willing to consider (and help out) anyone who tries at least a geek-in-training. Generally, they're more likely to ask someone to do it for them, or teach them how. Either's fine by me.

FUD

[jklovanc]

How long before circumventing the secure boot mechanism is considered a DMCA violation and a felony?

The answer to that is never. Using the installed configuration tools to turn off a security feature is in no way "circumventing" anything. By that logic, turning off the windows firewall so one can use another firewall would also be "circumventing". To fall under "circumventing" external software or unconventional editing (such as using a third party bit editor to change non-volatile RAM) would need to happen.

Stop with the sensationalism. The issue is that Red Hat has two choices; pay for certification or describe how to turn off the security feature. From a sales point of view it is better if the user does not have to do anything to their BIOS settings to install an OS. On the other hand it is a good Idea to make it difficult to unknowingly install a hacked version of an operating system.

We have discussed this issue before and it is not a "big bad Microsoft blocking Linux" issue. Microsoft is trying to make their installs safer.

Re:FUD

[wet-socks]

Using the installed configuration tools to turn off a security feature is in no way "circumventing" anything.

And when those tools are no longer installed?

Re:FUD

[jklovanc]

Maybe never. One can come up with many scenarios in the future that may or may not happen. As of now they are loaded. If there is a proposal in the future to not load them that is the time for protest. Getting your nickers is a twist about something that may or may not change in the future is a waste of time.

MOD PARENT UP

[keith_nt4]

Please, for the love of CowBoy Neal, MOD PARENT UP

One voice of reason in a sea of insanity that is "discussion"...

Re:Why not hardware manufacturers?

[CompMD]

*Whoosh*

StrongARM...it was a DEC built ARM cpu...parent made a joke about strongarming...haha funny?

ARMv7 is currently the most advanced ARM architecture on the market. I don't know how a CPU architecture can be fat or memory hungry.

Re:That's it...

[eric_herm]

Maybe they did advocate, and maybe no neutral key issuer was present ? The article say this would be expensive ( like running a certified CA, with audit, stuff like that ), and they surely advocated. Doesn't mean they managed to do it however.

And so far, that's a proposal, nothing more. If accepted, this would be done quite fast, but the best way is to find a better idea.

Re:Glad I quit Linux

[BanHammor]

Gee, I wonder why are you posting this anonimously.

Re:That's it...

[AdamWill]

We did. No-one wanted to be one. It would be a thankless task which involved a large degree of legal liability and no profit. There are not exactly organizations lining up to do the job.

Re:Why not hardware manufacturers?

[eric_herm]

You mean like it would have been with the current "password protected BIOS" ( already there since years ) + "disable boot on cd" ( on bios since years ) + lock on the hardware ? ( cause i do not know for your high school, but where I studied, there was people stealing memory from the labs , so lock preventing case opening were added ).

Re:Why not hardware manufacturers?

[penix1]

What I do see this doing is killing dual boot options. It would be a PITA to have to go into BIOS every time I wanted to switch to the other OS. I also see it killing other virtualization environments for the same reason. I.E. You possibly could run a virtualized Linux in Windows but the reverse wouldn't be true. I think that is the real thing MS wants to destroy. The ability to virtualize their OS.

Well, enough of this tinfoil hat stuff. We will see what they come out and how much hot water they get into with antitrust first.

Re:Why not hardware manufacturers?

[AdamWill]

Erm...except it does. Try reading the article, not the badly misleading summary. SecureBoot allows the user to add new keys as trusted keys. It will be perfectly possible to generate your own key, add it to your UEFI firmware, sign your OS bootloader with that key, and ditch the Microsoft key, if you don't want to boot Windows. pjones is in fact already working on tools to help you do this.

UEFI is a good intention on the road to hell

[WaffleMonster]

Redhat forking over cash is yet another path stone along the way.

Whenever a trust anchor grows so large its value approaches priceless or becomes ubiquitous to the world then you might as well just toss it overboard. Do yourself a favor and just assume it is no longer worth trusting cause it aint.

Someone blesses an exploitable kernel loader just once and all the effort wasted on security gets flushed down the toilet. Clever key management is not going to be able to save you.

What they should have done is what no committee is capable of doing -- provide a good enough but not perfect solution requiring a leap of faith during initial install or some kind of configuration (RS6000 configuration key) button the user must press when installing a new operating system to establish an initial trust relationship.

In a way I'm glad Microsoft is choosing UEFI to protect boot phase of their propritary (ARM) hardware as platform documentation is avaliable and common boot environment will make it easier to both expliot and reap the benefits post expliot.

Re:Why not hardware manufacturers?

[DarwinSurvivor]

Oh, of course, but having to enable/disable secure boot (which Windows won't boot without) each time you switch OS's (on a dual-boot setup) is going to be a royal PAIN IN THE ASS. Also note that less-technical distros (arch, debian, Mint, and probably even Ubuntu) will be affected by this.

The $99 goes to Verisign, not Microsoft

[Rick Richardson]

http://mjg59.dreamwidth.org/12368.html

"The $99 goes to Verisign, not Microsoft"

Re:Why not hardware manufacturers?

[Lord_Jeremy]

There were locks on the cases and the BIOS was secured but CD booting was not disabled.

Re:Why not hardware manufacturers?

[cas2000]

Isn't it the Linux community that is always bitching about windows security? why aren't you cheering that they are doing something about it?

because this does nothing to improve windows security. the purpose is to be a barrier to entry (installation) for non-microsoft operating systems. it doesn't have to be 100% effective, it just has to make it more difficult for non-experts to try out linux (or freebsd or whatever) or to use special-purpose linux-based boot CDs like clonezilla or gparted.

Also, there's no guarantee at all that disabling will be "as simple as flipping a single setting in BIOS". on some machines, it might be. on others, it won't.

FUD of the highest quality

[Altanar]

Once Windows 8 is released, hardware manufacturers will be forced to ship machines that refuse to run any software that is not explicitly approved by Microsoft — and that includes competing operating systems like Linux.

FUD FUD FUD. Also: Bullshit. You will **ALWAYS** be able to install another OS onto your system. Just toggle off the hardware certification in the BIOS. Don't you just love it when people hate FUD when it's against something they like, but go ahead and use it themselves when it's against the "enemy". Microsoft requiring it's hardware manufacture to use the verified boot feature that has been baked into the UEFI standard for **YEARS** now is not the same as banning OSes. It's designed to block malware from affecting the boot path. You are correct; Microsoft completely blocking other OSes would be essentially illegal. That's why it **isn't** happening.

Also, I think it's freaking hilarious that the article says the Fedora feels it's forced to pay because "they would have to explain to their potential users how to mess with firmware settings just to install the OS". Let me get that straight: You're worried that your LINUX customer won't know how to change a setting in the BIOS? To install an OS that nearly requires a near expert level computer knowledge to use?

Okay, let's pretend that these computer neophyte Linux users exist. Hardware manufacturers could always just install a physical switch that Google uses on **ALL** Chromebooks. Flip the switch, and the verified boot is disabled. Then these neophyte Linux users can continue on to install the OS they won't know how to use.

Re:FUD of the highest quality

[smash]

Thankyou. I just posted as much before reading your post. This hard code signing option, turned on by default. Any OS distributor who wants to get code-signed will be able to install and take advantage of code signing. Those who don't... can be installed by turning the BIOS/EFI option OFF.

Re:Why not hardware manufacturers?

[Missing.Matter]

Except TFA says it's a one-off $99 fee. And the money goes to Verisign, not even Microsoft. How is your crazy ranting rated +4 Insightful?

Re:Why not hardware manufacturers?

[Missing.Matter]

You don't need Linux to teach Computer Science. You don't even need a computer to teach computer science.

Re:That's it...

[shutdown -p now]

Fedora can boot using secure UEFI boot with their own certificate out of the box, if they can get all the OEMs to add it. They've tried to do that, and found out that it's too much headache for them, simply because there are so many companies to go to. Hence why they went and bought, effectively, the right to sign their own bootloader with MS key, which is obviously going to be supported by most OEMs out there. They didn't have to do that, though, and they didn't have to go to MS at all, though it would have probably cost them more money due to sheer time spend arranging everything in the end.

The lawyers have won, yet again

[dgharmon]

"Once Windows 8 is released, hardware manufacturers will be forced to ship machines that refuse to run any software that is not explicitly approved by Microsoft"

Well, a job well done, the lawyers have won yet again and in the process forced up the cost of Open Source through the cost of legalistic nonsense such as 'compliance`.

Re:Why not hardware manufacturers?

[Missing.Matter]

Want to run Linux on that shiny ARM Win 8 tablet? Tough luck.

If you want to run Linux on a tablet, why don't you just buy one of the hundreds of ARM android tablets out there and run Linux on that?

Re:Why not hardware manufacturers?

[cyber-vandal]

According to the article they'll be paying Verisign.

Re:That's it...

[shutdown -p now]

MS will do this because no-one wants to be responsible for a decision that will lead to another 2.5 billion dollar fine in EU.

Re:Why not hardware manufacturers?

[Sir_Sri]

Well the virtualization licences are a whole other ballgame anyway.

We'll have to see how it's implemented to know for sure what is, and isn't killed. It's possible the virtualization software itself can get all the permissions it needs to behave properly. If that wasn't the case I would think VMWare would have had a very public fit by now.

Re:Why not hardware manufacturers?

[Lord_Jeremy]

That's a silly excuse. The main issue is that this secureEFI requirement is cumbersome and will create problems for some people.

The lawyers have won, yet again

[dgharmon]

"Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access .. In fact, chances are that everything will carry the Microsoft key."

It's always what Microsoft wanted, complete control over the Desktop PC. The lawyers have won yet again and in the process forced up the cost of Open Source through the cost of legalistic nonsense such as 'compliance`.

Re:Congratulations.

[Man On Pink Corner]

Congratulations, you are now a 'grown up'.

Sigh.

All we're saying is that it was considered a Pretty Good Thing when the mainframe era was brought down by the PC. Now, people like you are standing around cheering while the monster reassembles itself.

People older than you remember the way IBM dominated both the hardware and software sectors for many years. They held their customers hostage in every sense but the literal one. They used every technical and legal tool available to suppress third-party innovation. Eventually, people like Ross Perot, Jobs and Wozniak, and finally Bill Gates barged into the room and threw their proverbial hammers at the screen.

Fast forward to 2012. Steve Ballmer is pulling underhanded, abusive shit that would have earned him a fistbump from T. J. Watson. The rebels who once sponsored the '1984' commercial are now working feverishly to put the pieces of the telescreen back together... only this time, they're using Gorilla Glass.

Some of us are old enough to understand that this is not how things were supposed to go. If you're not so old or wise, that's fine... but by calling people who disagree with you "children," your post only shows your own lack of awareness and conscience.

Re:Why not hardware manufacturers?

[hairyfeet]

Uhhh...where have you been friend? All AMD machines are coming with Coreboot now, which is a open EFI style BIOS that you can download and modify to your heart's content.

So if UEFI truly bothers you simply buy AMD, which lets be honest the average user won't notice the difference between a Liano and a Sandy bridge anyway, they simply don't stress either one. I've been building AMD exclusively for the past two years and not a single complaint, not one.

If you are running Linux you'd be better off with AMD anyway, as they have opened the specs on all their hardware and even paid for devs to help the open driver guys get up to parity so if you truly want to support FOSS and care about UEFI you can just support AMD and Coreboot. It seems like a simple and easy way to vote with your wallet to me.

Re:Why not hardware manufacturers?

[hairyfeet]

And as I replied o another poster AMD has decided to go with Coreboot and has been using it since brazos so there is NO slippery slop here. if you don't like the Wintel UEFI you can buy AMD and use Coreboot which supports the 4 freedoms so if it doesn't do what you want you can simply download the source and reflash the chip.

I SERIOUSLY doubt MSFT is gonna risk another antitrust by blocking AMD systems from running Win 9, don't you? So this is simply a case of voting with your wallet, don't like UEFI and Secureboot? Buy AMD and go Coreboot. Its REALLY that simple. I've been building AMD exclusively for a couple of years now and I can tell you X86 is so overpowered that there isn't hardly any job a normal user can come up with that is gonna stress even a low end AMD dual and since they've opened their specs Linux users would be wise to support them anyway.

So no slope friend, just good old fashioned FUD, just not being cranked out by MSFT for once.

Re:Why not hardware manufacturers?

[kcitren]

But they're not paying Microsoft, they're paying $99 to Verisign for a certificate. It's just like getting an SSL cert, it's a non-story.

From TFA: $99 goes to VERISIGN

[CockMonster]

Not Microsoft. It was even highlighted in the article. Sheesh!

Re:Why not hardware manufacturers?

[Kalriath]

What's your point? It's not his hardware, it belongs to the school district. Him not being able to run alternative operating systems on someone else's hardware is not a problem. In fact, if they don't want to let him run Linux on their hardware that is their right and he should be disciplined for ignoring them. He can bring in his own hardware if he wants to run programs the owners of the hardware don't want.

Re:Why not hardware manufacturers?

[cavreader]

Sort of like Apple?

Red Hat buys signing key for Fedora from Msft

[Guy Harris]

(Alternate title giving some more details; "Microsoft" abbreviated as "Msft" to make the title fit given /.'s apparent title-length restrictions.)

Read TFA before commenting.

Re:That's it...

[Kalriath]

A key signed by Symantec/Verisign works too. They just didn't want to do that.

Re:Pot meet Kettle

[Guy Harris]

So, it is OK for Apple to do it, because its a 'better' system, but when Microsoft does it, it should be illegal? Apple fannatics lack any sense.

To exactly match what Apple are currently doing, Microsoft would have to refuse to give out signatures for Windows 8 ARM tablets (as, without jailbreaking, I don't think you can run your choice of OS on iOS machines) and not do any secure-boot stuff on Windows 8 x86 machines (as Macs don't do secure boot by default).

Re:Why not hardware manufacturers?

[Missing.Matter]

Blaming your teacher's woes on Microsoft rather than the school's IT policy is pretty silly as well.

Re:That's it...

[Anonymous Coward]

This "feature" exists because malware that affects the boot loader and kernel is a real and growing problem, and there isn't really any other technical means to block it.

You just lack imagination.

An operating system, once booted, should be able to protect the UEFI boot partition from unauthorized modifications just fine. Let Microsoft implement whatever signing mechanisms they wish.

Booting from removable media on the other hand, can be secured simply by requiring an explicit action to boot them. BIOS systems already can optionally do this.
Simply mandate explicit boot into removable media, and the malware will have no attack vectors aside from the installed OS or infected installation media, neither of which should present a problem for Microsoft.

Re:Why not hardware manufacturers?

[ShieldW0lf]

Oh, of course, but having to enable/disable secure boot (which Windows won't boot without) each time you switch OS's (on a dual-boot setup) is going to be a royal PAIN IN THE ASS. Also note that less-technical distros (arch, debian, Mint, and probably even Ubuntu) will be affected by this.

The people distributing Arch can sign their releases for $99. The people distributing Debian can sign their releases for $99. Etc, etc. It's a trivial cost for any of the distributions you named to follow in Fedora's footsteps.

On a completely unrelated note... wouldn't it be awesome to see RMS' reaction if all the major GNU/Linux distributions were signed by Microsoft?

Re:Why not hardware manufacturers?

[MaskedSlacker]

The key is 256 characters long, and looks like a ROT13-encoded Perl scrip

Oh, so it's just a regular sentence? That doesn't seem so bad...

oh please

[smash]

There will be an EFI/bios option to turn this off. if you think microsoft would EVER get away with this in the post-antitrust over IE days, you're kidding yourself.

It might be turned on BY DEFAULT, but this is "secure by default" behaviour and should be the way it is.

If you want to run unsigned code, so be it. If redhat or another vendor want to get their code signed so be it. This is a lot of hot air over nothing.

Re:Why not hardware manufacturers?

[diamondmagic]

At least with an SSL certificate they're verifying "Yep, Public key hash 01234567890ABCDEF (as opposed to a malicious party) is indeed used by bank.example.com". What's the excuse for signing software?

i didnt notice anyone asking the question...

[corvax]

What happens when you get this on your screen ................. its not a matter of if its a matter of when. Stallman doesnt look so crazy anymore!

Re:i didnt notice anyone asking the question...

[corvax]

Content could not be loaded because secure boot is disabled please enable secure boot and run a signed os its

Re:Why not hardware manufacturers?

[ShieldW0lf]

If no one else were willing to do it, your comp sci teacher could pick the flavour of LiveCD he likes, pay Verisign $99 to have it signed and be able to do just as he was before. And, he could throw it up on a torrent site and anyone else who downloaded it would be able to boot off it in secure mode. In fact, if you were a serious malware writer, you could probably bypass this obstacle by having your malware signed with a fake identity. All they're really doing through this process is attaching a name to a hunk of code.

Re:Hewwy!

[frost_knight]

Where did I say that the vendors had the right to do it either?

Re: Those pesky hard-to-find firmware options

[rnturn]

``While Microsoft have modified their original position and all x86 Windows machines will be required to have a firmware option to disable this or to permit users to enrol their own keys, it's not really an option to force all our users to play with hard to find firmware settings before they can run Fedora.''

Uh, define ``hard to find''. Will vendors now make the means of accessing the firmware become something akin to playing Myst? Will the UEFI options be hidden to all who do not press F8 during some narrow and undocumented window? Will the options be worded so cryptically that end-users won't be able to decipher the settings?

I'm having trouble envisioning where all this difficulty is going to be encountered. I only see dual-booters as the ones having this trouble and, yeah, it would sucketh mightily to have to tweak firmware settings every time you wanted to boot to the other OS. Perhaps I don't see the problem since none of the systems I use are dual-booting. Most have ever even had Windows installed on them and, if they did, the Windows disks were reformatted long ago (i.e., 5+ years ago). Dual-booting is a kludge that I don't find necessary any more. Maybe I'm just lucky.

What's the Vegas line on when there will be a call by the more fanatical Linux proponents to shun Fedora like there has been for SuSE?

It may be legal, but

[durdur]

Microsoft looks, acts, and thinks like a monopoly. Having dealt with fairly senior Microsoft execs and techies personally, I can testify that as far as I could tell, they just "don't get" the idea of open platforms. Open means you cooked up something with a few preselected other vendors, in secrecy, and then released it, probably with onerous conditions and encumbrances.

Re:It may be legal, but

[Miamicanes]

> Open means you cooked up something with a few preselected other vendors, in secrecy, and then released it

You're right. Thank ${deity} Google is so open with Android, and enthusiastically embraces community development and contributions.

Oh, wait a minute.

Sigh.

Re:That's it...

[Doctor_Jest]

It isn't... yet. It'll be a race to the bottom with these two companies... and they're taking the x86 platform with them for the bumpy ride.

Apple does it on their own hardware (Apple is going to turn their Mac platform into an iPad sooner rather than later), Microsoft wants to do it on all hardware. Apple has an App Store... Microsoft wants an App Store. (Metro Apps only available through their App store... go figure.) Apple is closing their open OS. Microsoft is plugging leaks in their old OS and attempting to sidestep the openness of x86 to get a boatload of otherwise nice people (but clueless) to buy into their schtick. Letting their colossal foot in the door is a huge mistake. People harping about the "but you can turn it off" forget the tenacity and vast cash reserves of Apple AND Microsoft. They don't have to win on merits.. they'll starve competition out. Why? Because they can....

Re:WTF?

[CheshireDragon]

now put that in a quote and give credit where credit is due, you DRUNK!

who is going to enforce it? the FTC? hahaha

[decora]

you appear to live in some fantasy world where there is this thing called 'government regulation of big business'. in case you haven't been paying attention, every politician higher than dog catcher has made a career of doing this over the past 30 years.

Re:Why not hardware manufacturers?

[shutdown -p now]

Windows Store has some dedicated language in the license so as to explicitly enable FOSS apps (yes, including GPL)

Re:So MicroSoft is looking to be put out of Busine

[exomondo]

You realise anti-trust is a competition issue and that in this situation they aren't doing anything anti-competitive at all?

Re:Why not hardware manufacturers?

[FatLittleMonkey]

GGP was talking about the terminology. Windows with be "secure" and Linux will be "non-secure". Do you think the pointy-heads will know the difference? It's a MS marketingdroid's dream.

Red Hat is willing to pay to be licensed to be abl

[LucyMary]

They are going out of their way so you can run Fedora on the new hardware. And you want to ditch them because of it? Remind me never to buy you a beer.

Who pays for returned hardware

[Anonymous Coward]

When a user buys a blank PC and tries to load linux and it fails and they return the hardware.. who pays?

Microsoft because they locked other operating systems out?

Re:Congratulations.

[hairyfeet]

Hell look at the posts after you and you'll LYAO, they've full on jumped from "MSFT will make Linux a felony ZOMFG!" right into "MSFT is gonna move the OS into the cloud and you'll get arrested if you don't pay your $699 license fee ZOMFG!" full on batshit.

Ya wanna know what the REALLY sad part is to me? Most of the normal folks like me that were using Linux in 05 and 06 have frankly moved away simply BECAUSE of all the batshit. Its like being a normal person around total weirdos, its just creepy. Hell I know every time I had a problem and went to the forums I always got works for me and Ur a M$ Ninja!

I don't know what happened because i swear it did NOT used to be like this. Guys used to actually care about problems and wanted Linux to get better, and would bitch when things were broken or got worse. Now i swear its like a damned religion, where ALL comments that aren't simply praise of "the one true god" causes the nutters to come down like flies on shit, and all the FOSS posts or articles, hell even articles that don't have a damned thing to do with FOSS, end up with nothing but conspiracy theories and pointless "just use Linux!" posts. No wonder so many look at FOSSies like this. Hell I'm starting to wonder if that isn't an accurate description myself.

Re:Congratulations.

[TapeCutter]

People older than you remember the way IBM

How old do you have to be? I'm 53 next week, I was also an IBM contractor for a few years in the 90's, and guess what, I've even done some work on IBM mainframes. I agree people should be wary of vendor lock in, particularly with IT infrastructure but I'm highly skeptical of claims that this is an anti-competitive move. Now to the actual point of my post, hyperbolic speculation about what could happen just makes the person who posted it look like a fool when everything is still humming along a decade or so later. Every one of those foolish reactions is a paraphrase of one or more posts in this thread, many which are rated +5 insightful. I think they are silly and childish now, if you can't see that now come back and review their dire predictions in 2020.

Re:Why not hardware manufacturers?

[Lisias]

As stated below, we meant to type spectacularly. :-)

But let's bite the bait and play little with my foolish:

http://www.huffingtonpost.com/2012/05/29/asteroid-near-misses-earth-space-rocks_n_1553252.html

http://neo.jpl.nasa.gov/news/news174.html

http://www.sciencedaily.com/releases/2012/03/120315225625.htm

http://news.discovery.com/space/asteroid-impact-hazard-2040-120228.html :-)

Re:Why not hardware manufacturers?

[Elldallan]

I'd still bet that the EU Commission will slap Microsoft hard over this unless getting your OS signed is trivial and similar to FRAND rules.
For example Microsoft forbids vendors to offer the ability to disable secure boot in ARM devices, that is very clearly a monopoly abuse by EU standards.
IANAL

Re:Why not hardware manufacturers?

[Elldallan]

Sounds like Microsoft is begging the EU Commission to slap them with another multibillion euro fine and then some.

Re:Why not hardware manufacturers?

[DarwinSurvivor]

The fact that you think every competitor to windows having to pay them $99 just to have the PRIVILEGE of being installed on YOUR hardware is "trivial" frightens me somewhat. The fact that you probably aren't alone frightens me a great deal.

So, then...

[unitron]

...That's UEFI, short for

User comma End: Fucked comma Intentionally?

hmmm

[SuperDre]

I'm pretty sure that MS forcing HW-makers to block other OSses is illegal, so I do hope the EU commison which also forced MS to 'remove' IE and Mediaplayer will step in to make sure this isn't going to happen.. Also I just hope one other big linux company will go to court because of this..

Re:hmmm

[DragonTHC]

I'm with you there. Can't enforce this one with a shrinkwrap license.

Re:Why not hardware manufacturers?

[ShieldW0lf]

The fact that you think every competitor to windows having to pay them $99 just to have the PRIVILEGE of being installed on YOUR hardware is "trivial" frightens me somewhat. The fact that you probably aren't alone frightens me a great deal.

Yeah, frightening. I think it's trivial for a business that wants to use SSL encryption to pay for an SSL certificate too.

Re:Why not hardware manufacturers?

[Sloppy]

It would be a PITA to have to go into BIOS every time I wanted to switch to the other OS.

I'm pretty sure the way it works is that you would be doing that once, at the time you install your OS (or your Linux-based Dom0 or whatever virtualizer your're using).

That in itself is somewhat anti-competitive, and I think some people are concerned about that, but to techies it's just not a big deal. Their ARM stance is much more evil, and of course people are going to be suspicious that MS will try to bring their ARM evil to x86 on the next iteration, so 5-10 years from now they might really try to make it so that you're not allowed to run non-MS OSes.

Yes, at least one Linux Rootkit is coming

[Sloppy]

Has Linux sudenly been infected by rootkits? Did I miss a memo?

In all honesty, give us any UEFI-signed Linux kernel, and yes, Linux will be infected by rootkits (or rather "kernelspacekits"). It will be done on purpose, by the people who own the machines upon which Linux is installed, so that they can maintain their systems.

A UEFI-signed Linux kernel, like any other Linux kernel will start to become obsolete within a week or two, because Linux is without a doubt that fastest-improving and best-maintained OS in the history of computing, whether you think it's a good OS or not. (That's a fact, Jack. Sorry FreeBSD fans. I'm not dissing your OS, just saying you're not the mainstreamiest of the Free OSes and you don't have a Red Hat or Canonical or IBM paying its employees to work on your project full time.) Part of why you use Linux, is that you want to take advantage of the awesome maintenance that popular Free Software projects get, and Linux happens to be one of the most popular and well-funded ones. So you probably are going to sometimes want to install kernel updates.

Your UEFI-signed-for-$99 kernel will be that kernel's bootloader, and the loading will be accomplished via some exploit, possibly a deliberately-created one for that very purpose.

Re:Yes, at least one Linux Rootkit is coming

[hairyfeet]

So its just as I said then, you'd be better off just turning it off and calling it a day. Frankly i don't know why so many are getting their panties in a twist, its not like Win 8 is gonna be a hit, its a failwhale and everybody knows this.

I've had a Pentium dual running in the shop with Win 8 for customers to play with, know how many that have WANTED Win 8 after playing with it? NONE, zip zero nada squat. Not the old folks, not the workers, hell not even the kids like it, they ALL find it irritating and want to know "How do i turn this off and get to the desktop?". Hell I figured if nobody else would like it kids would, but even tweeners already know Win Desktop and have no desire for a cell phone replacement, that's what their cell phone is for. the closest i got to a "compliment" was this exchange with a sweet LOL: "That's a nice looking cell phone, is that Android? I've heard of that, its supposed to be nice...what do you mean Windows? Windows what? why that is just stupid! Why would I want a cell phone on my computer?" and from the mouth of a LOL comes wisdom.

So there's really no point in getting worked up over this or WinRT locking the boot, Windows has less than 5% of the mobile market and the OEMs sure as shit isn't gonna cripple all their PCs to where they will only run Win 8 thus giving them shitpiles of inventory they can't give away. Win 8 will flop as bad as WinME, even worse than Vista, hopefully Ballmer will be "retired" and then they can bring back Ozzie or another of the old guard to right the ship.

Your solution to secureboot is lame

[Sloppy]

My solution is better. My solution will allow you to to load Linux via secure boot, and effortlessly update grub or the kernel from your distribution, no matter which distribution that is (it doesn't have to be Red Hat) -- or you can compile the kernel or grub yourself, if you like, and it'll still get signed. My solution works for everyone. Just make me responsible for the root signing key and I will solve all the problems to almost everyone's satisfaction.

For maximum security, though, I do still need offsite backup volunteers. Wanna be one?

Re:Your solution to secureboot is lame

[exomondo]

My solution works for everyone.

No it doesn't, if you bothered to read the passage i was replying to (which i even quoted right there), you would see he doesn't want trusted computing.

Re:Why not hardware manufacturers?

[Sloppy]

Do you honestly think that retail outlets will even consider selling computers without those stickers?

That's a tough question. At first we all assume that the stickers must be pretty important, but my guess (pre-looking-at-evidence) is that most retail sellers would in fact be willing to do just that, since users never asked for those stickers in the first place; they're ads.

(What forces, other than MS's insistence, have created the need for these stickers? Have retailers, in fact, pressured OEMs for them?)

I know they're not retail outlets (exactly not what you asked about, I realize) but I can't help but notice that when you try to search for computers at newegg, MS certification isn't one of the search options. Even trivia such as 3.1GHz vs 3.3GHz CPU clockspeeds seems to be more important. (?!) At least among mail order customers, we have evidence that there exists no market force which favors certification.

At this point, yeah, I think I can honestly say that retail outlets will sell computers without those strickers. Sure, I could be wrong, but all intuition and evidence points me that way.

I wonder if I ought to visit a retail outlet and peel the stickers off all their computers. Then monitor how it effects the sales at that particular outlet. That would be a good experiment..

..if only it weren't so absurd. Just imagining the experiment, makes me think even more that the stickers don't matter a bit.

That would probably make for good website poll, alas at sites other than slashdot: "do you look for a MS certification sticker prior to buying a computer?"

Re:Why not hardware manufacturers?

[cupantae]

Why would you assume that? It's good to be critical of Microsoft, but you're just pulling ideas out of your ass.

Re:Why not hardware manufacturers?

[mfraz74]

Do you honestly think that retail outlets will even consider selling computers without those stickers?

That's a tough question. At first we all assume that the stickers must be pretty important, but my guess (pre-looking-at-evidence) is that most retail sellers would in fact be willing to do just that, since users never asked for those stickers in the first place; they're ads.

I wouldn't be so sure about that. When Windows 8 comes out 'Windows 8 certified' will be all over the adverts and retailers such as PC World and Comet will be expected to say things like "this computer is better than that one because it is Windows 8 certified".

Re:Why not hardware manufacturers?

[Sloppy]

retailers such as PC World and Comet will be expected to say things like "this computer is better than that one because it is Windows 8 certified".

The heart of the issue is: "expected by who?" Evidence (it was lame but at least I cited something; what have you got?) suggests it's not the people who buy the computers.

Re:Why not hardware manufacturers?

[Iceykitsune]

Remember, the average /. user != the average consumer who doesn't know any better.

Dual booting?

[aquabat]

So, this is the end of multi boot menus that include Windows 8, I guess?

I envision a box with two separate physical boot devices: one with a Windows 8 signed bootloader, and one with a bootloader that lets me choose another OS to boot. The second one may or may not be signed with the Windows 8 key. In any case, Red Hat's won't be able to chainload Windows 8, because only the first stage will be signed with the Windows 8 key.

Did I miss anything?

Re:Why not hardware manufacturers?

[turgid]

I've been running AMD processors since 1999 when I bought a K6-2/400. I'm currently on a Phenom II X4 940 BE at 3.0GHz. I keep my Athlon XP 2000+ (1.67GHz) as a secondary machine and print server.

AMD stuff rules. Over the years, I've bought and used intel and AMD for work. The intel stuff isn't that bad nowadays, but the AMD stuff is better for me.

My current motherboard is an ASUS M4A77D which is probably a little over 18 months old (I'm getting too old to remember these things precisely) buy it doesn't have CoreBoot AFAIK. It has a conventional PeeCee BIOS.

I have a lot of old UltraSPARC boxes lying around and, of course, they have Open Firmware which means a FORTH system :-)

It would be really cool if mainstream motherboards came with it. UEFI from intel looks like yet another case of intel NIH sour grapes. They could easily have brought out an implementation of Open Firmware. In fact, they could have "leveraged" the open source implementation (OpenBIOS).

I suppose it better serves their (intel's) business needs to have a proprietary non-standard locked-down firmware implementation of their own.

I once did OS development on a storage appliance that used CoreBoot (then LinuxBIOS) to load Linux directly off of a raw flash disk. I modified it to use a bootloader called FILO so that the kernel could be on an ext2 filesystem, and you could choose from various configurations and root partition images.

A few years ago it struck me that it should be possible to implement a simple GUI or menu system in Open Firmware to hide the command line and I thought it would be a cool hack for a laugh, but I think someone beat me to it by several years...

Re:Congratulations.

[turgid]

What, the summary doesn't scare you?

It depresses me.

Congratulations, you are now a 'grown up'.

I'm very old all of a sudden.

Over the years, I have been very lucky to learn and work in environments where I have acquired knowledge through curiosity that helps me to have a certain degree of personal freedom over these fascist corporate restrictions.

I'm a pretty darn good C coder, I know a bit of assembly, I've worked on everything from web GUIs down to protected-mode boot loaders and I'm reasonably good with vi/vim.

I was fortunate to cut my teeth on an 8-bit Z80 micro in the early 80s.

I'm not scared of DRM, I'm not scared of flashing BIOS chips, I'm not scared of setting dip switches and jumpers, I can use a disassembler and know how to decipher hex. You won't find Windows on any of my computers.

I'm quietly confident nowadays that the various Free and Open Source movements have sufficient momentum and influence that despite what the most evil and absurd business interests try to do to deny our freedoms, for the sufficiently savvy and motivated, we will almost always be able to do what we want to.

Eternal vigilance is important, and we must keep out-innovating them. We must make sure that our politicians don't pass laws that let the greedy take our rights away.

These silly companies that try to lock us out often end up hurting themselves more. When you start treating your customers with contempt, as cattle to be corralled, milked and exploited, and incapable of independent thought, they leave.

Microsoft is getting increasingly desperate. I've been working as a Software Engineer now for over a decade and I haven't written a single line of code for, or sold a single product that runs Windows. It's all been Unix (Solaris) and Linux.

Google is the new Microsoft. Android is the new Windows.

Re:Why not hardware manufacturers?

[Rich0]

Well, I doubt that MS won't let windows run unsigned software. They might very well not let it install unsigned drivers or something like that, and they might very well implement Palladium/etc.

So, if you put your computer in unsecure mode then Windows will refuse to play HD video or whatever. If you put it in secure mode then it will refuse to install uncertified drivers/etc, and the computer could perform remote attestation that you have a clean chain from bootloader to video card for playing back DRM'ed content. Of course, somebody will still find a bug in a driver, and these days it is actually practical to capture raw DVI/HDMI video as well (something that wasn't practical back when all this stuff was dreamed up, and HDMI hadn't been cracked in practice back then). This is all silly since you can always just record the display output, and at high resolution under optimum capture conditions an analog recording can be pretty-darn good. After all, the light reflecting off the actor's faces was analog in the first place (assuming the entire movie isn't CGI).

Re:Why not hardware manufacturers?

[hairyfeet]

My board is an AM3 that is about 4 months old and it don't have it either, they didn't start on the desktop until Liano. I haven't had the chance to put one together yet (still scoring good deals on AM3 and AM3+ so I've been using those instead) but from what I understand the FM1s are already using it, as is later E series chips. I have one of the first Brazos E350 and Asus used EFI and NOT UEFI so it has none of the locks like secureboot. Its quite possible some of the OEMs might just go that way instead as the only advantage UEFI over EFI is secureboot which I'm sure will just cause more support calls so I can see many just using EFI.

But according to AMD's press releases they are committed to CoreBoot and all chips going forward will be built with Coreboot. as another said one COULD tie Coreboot into UEFI but from what I've seen its gonna be a very basic EFI that works as a BIOS (So they can support larger HDDs) which quickly hands off to Coreboot which takes care of the rest. what really pisses me off is Asus offers Expressgate with their machines but frankly its become so crippled its not worth messing with if you aren't a 14 year old girl. its pretty much designed around FB and chat now and it doesn't even have Skype anymore, and no easy way to add any apps to it. That is a shame as having an OS that boots in 6 seconds and gives me full Wifi is nice, but without being able to even add support for any video other than Flash it just too crippled to make a difference.

So as long as AMD is going with Coreboot there is nothing wintel can do, not unless they want to risk another antitrust. But you are right that AMD rules, I have been selling AMDs exclusively for 2 years with nothing but happy customers and I eat my own dog food, me and my boys are rocking two hexacores and a quad and they do anything we can think up and are crazy fast. I even sold my full size for a EEE E350 netbook and having a machine that plays 720P for 6 hours on a charge or does basic office work for 7 is damned nice.

If your board supports it might want to look into snatching a Thuban while they are cheap, I went from a 925 to a 1035T and I can tell you that Turbocore kicks ass and take names. If you watch their email fliers Tiger has been selling Thuban for as low as $100 which is damned cheap for a 6 core. I paired mine with a $30 Hyper N520 cooler and it runs around 95f idle and barely reaches 122 under load, just a great chip. Oh and 1 final note, if you don't know about them Starmicro sells chips for all the older sockets cheap, its a great way to max out that older AMD PC.

Re:Why not hardware manufacturers?

[penix1]

The way I am reading how it works is that without it on programs won't run in Win8. If that is the case, then you would have to turn it on every time you went into Windows and turn it off when you switched OS. Am I wrong on that?

Re:That's it...

[Timex]

Red Hat is willing to pay to be licensed to be able to run on the new hardware. They are going out of their way so you can run Fedora on the new hardware. And you want to ditch them because of it? Remind me never to buy you a beer.

I think it sets a really bad precedence, to be perfectly honest, and I don't like it a bit.

As for the beer, don't lose sleep over it: I don't drink.

Re:That's it...

[Timex]

How does this make you mad at RHEL/Fedora and not Microsoft?

I've been planning to avoid MS Win8 from the beginning. If I wanted a tablet, i'd have one by now. If I have new hardware, I'll put the OS I want on it, and if I can't then I won't buy it. It's that simple.

This whole thing makes me pissed at RH/Fedora because they're effectively letting MS think they can turn this into a "win/win" situation: MS either makes money selling half-assed operating systems that hardware is locked into using or MS makes money by licensing access to that hardware.

Screw them, screw the hardware.

Re:That's it...

[Timex]

How is this move by Redhat in concept any different from what Novell did? I still think that Microsoft is the agressor/enemy, not either RH nor Novell (nor SUSE)...

I don't use SuSE, either. I wasn't happy with the way that Novell bought DR-DOS and basically laid there like a dead fish.

Re:Why not hardware manufacturers?

[jader3rd]

Do you honestly think that retail outlets will even consider selling computers without those stickers?

It's possible. I honestly don't think that the retail outlets will care. I think it would be the OEM's who care more. Sloppy had some good points, but I also think it will depend on if there's a seperate Windows 8 Logo program in addition to the Windows 8 Certified program.

It probably also depends on the percentage of the market who bought an early netbook and returned it (or stopped using it) because it wasn't Windows. That group of people will probably be looking explicitly for a Windows logo. The other factor would be how often the following conversation would occur:

Salesman: Here's a nice Windows 8 computer, and here's a nice one that Windows 8 certified.
Customer: What's the difference?
Salesman: The Windows 8 certified has UEFI secure boot.
Customer: What's that mean?
Salesman: It protects against rootkits.
Customer: I've heard about rootkits, I want to be protected against them; I'll get the certified computer.

Now you can argue that rootkits will get around UEFI secure boot, and they very well may at some point. But I still imagine that until it's well known that they do, that'll be the conversation that may take place at a point of sale. If that conversation doesn't happen (perhaps on newegg or amazon) and OEM's find certification to be a costly burden to bare, I can see them considering making non-certified computers.

Re:Why not hardware manufacturers?

[segedunum]

I think that is the real thing MS wants to destroy. The ability to virtualize their OS.

I think so too. Restricting Linux as a dual boot OS is nice but the ability for Microsoft to get back control over their own OS regarding what hardware it is run on is the most important thing for them. Heck, with virtualisation you can upgrade your hardware and run pretty much any version of Windows you want without upgrading it right now.

Apple would be smart to open things up

[DrStoooopid]

....with Microsoft locking things down, if Apple wants superiority. Now is the time to allow installation on non-Apple hardware (without having to Hack'in'tosh things together).

Windows8 is a kind of terrible of Vista proportions.
Windows is the last of the OS's not to use a Unix'esque kernel
8 will be the last nail in the coffin, Microsoft has truly lost their way.

Microsoft freezing out other OSes screams monopoly

[thesquire]

!It looks like I am not the only one who sees a giant red flag here: Microsoft is knowingly and deliberately squeezing or freezing out all OS competition with the pressure it is putting on software companies. This is probably a monopoly violation. The first economic region to deal with this will be Europe and the EU, but even the completely corrupt US governmental system will be forced to recognize what is going on and deal with it. Nice try, Balmer and Gates!