Slashdot Mirror
Ubuntu Lays Plans For Getting Past UEFI SecureBoot
An anonymous reader writes "Canonical has laid out their plans for handling UEFI SecureBoot on Ubuntu Linux. Similar to Red Hat paying Microsoft to get past UEFI restrictions, Canonical does have a private UEFI key. Beyond that they will also be switching from GRUB to the more liberal efilinux bootloader, and only require bootloader binaries be signed — and they want to setup their own signing infrastructure separate from Microsoft."
Does only the kernel need signing or is there more to it than that for Linux?
The soylentnews experiment has been a dismal failure.
Along with draconian DRM and anti privacy laws, UEFI SecureBoot is crippling the computer as a tool.
It will take generations and countless wars to undo the damage that is currently being done.
Shouldn't I be able to load my own private key (or that of my distribution of choice) in the UEFI interface and then sign the bootloader I want with it (or use that of said distribution)? Ideally changing the key would only be possible while a jumper on the board is set.
If I trust Ubuntu, then my computer would reject the Windows bootloader and vice versa. Isn't that how it should be?
Seems like this leaves things open for an MS rootkit. A rootkit that happens to have an entry point resembling a linux kernel seems a likely scenario.
Also surprised with efilinux. It can load from block devices only, which omits network boot. I understand that grub2 GPL3 concerns make sense, but you would think they might go with elilo. It may be less 'active', but it is capable of doing more than efilinux, notably network deployment.
XML is like violence. If it doesn't solve the problem, use more.
It is the bootloader that needs signing. The problem is that any bootloader capable of loading more than one (signed) kernel would defeat the purpose of secureboot. I mean the official purpose, protection against rootkits, not the actual purpose.
Does only the kernel need signing or is there more to it than that for Linux?
Do you even read the summary? Your answer is right there:
Beyond that they will also be switching from GRUB to the more liberal efilinux bootloader, and only require bootloader binaries be signed
Only the bootloader, if you read the summary. I know reading summary is tough for you folks...
The next step should be requiring a background check in order to have access to a compiler. Compilers are a subversive tool that is essential to creating malware, the cyberspace equivalent of a chemistry lab. Just as having an unauthorized chemistry lab should automatically make one suspect for creating drugs, explosives or chemical weapons, posession of an unauthorized compiler and of a machine that does not have a secure boot should make one suspect of cyberterrorism.
Of course, this is impossible right now, just as fifty years ago nobody would have taken such a dire view on chemistry. However, the next generation of people raised in fear of pedophiles and terrorists will work hard to make this a reality. And the generation after that will be the blessing of knowing that things have always been like this, since all authorized books will be in electronic format, periodically updated with the best and most recent knowledge about the past.
FOSS/GNU/Linux people will not purchase Windows 8 signed machines anyway. They will be forced to build their own PCs, which is, guess what, what they do already.
This will force more people to build their own or steer clear of any large OEM that wants Windows 8.
I don't think I need to say anything else.
This smells of the war against terror. There are actually very few pieces of malware out in circulation which rely on rootkits invoked by the bootloader. It's something which we haven't really seen much of since the viruses of the DOS days. I'd rather take my chances with the malware than have the liberties of doing what I want with my computer taken away.
If the kernel is not signed, the rootkit would just infect the kernel instead of the bootloader.
enjoy your microsoft tax, fags.
The next step should be requiring a background check in order to have access to a compiler.
Microsoft, Nintendo, and Sony already require this for software that runs on their video game consoles.
In order to compete with Microsoft, they have to beg Microsoft to sign their bootloader? UEFI's secure boot was dubious idea at best, and Microsoft has just hijacked it into a way to greatly inconvenience all the competition under the excuse of security against a threat that barely exists. Red Hat and Fedora might be able to jump through these hoops and beg Microsoft for permission to compete (Which I sure will involve a hefty signing fee for 'administrative costs') but how are the hundreds of smaller distros and niche distros supposed to exist? Right now the only concession made to them is that Microsoft generously permits for secure boot to be disabled (though only on x86, not ARM) - and who here trusts them not to reverse that policy in a few years?
I have no problem with security features being put in the bios. But if they could potentially make given OS's incompatible then it has to be something you can turn off.
And if you can turn it off then everyone gets what they want.
MS gets a little security on their malware plagued OS. And everyone else can just shut it off.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
There are, however, easy-to-use piracy tools for Windows that do exactly that. I'm pretty sure it's a big chunk of MS motivation for the whole mess.
That's what I like about it. They're not even paying lip service to that bullshit official purpose. Red Hat made it sound like they have drank some of the Koolaide, with all their worrying about how the person who owns the computer might abuse an unsigned module to take control of their computer.
Once you're running your bootloader, then the issue is over. There is no need to further check for any other signatures or try to guarantee that the owner can't run their own code. You have satisfied the requirement and thereby gotten the computer to work.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Take off the tin foil hats. This for Trusted boot and Trusted Virtual Environments and hell even the DoD is demanding this feature in new hardware. I don't know about you but I am not of the mind to roll my own Mainframe OS or System P os and getting screwed over by the Signed and Measured boot process. I don't think there is a whole lot of DRM on music to worry about floating around on AIX or Z LPARs either. Both of which required this sort of thing for government workloads
I have multipl issues wih this whole uefi secureboot shebang.
How can it happen that one company (however large) can seemingly make most of the manufacturers to comply with their crazy ideas? The option to easily disable uefi secureboot _should_ be there on every and each motherboard (desktop, server or laptop). It should not be the manufacturer (and indirectly Microsoft) who decides what kernel and drivers (regardless f the operating system) a user or developer uses. How would anyone make custom kernels and/or modules (Linux) and/or drivers (e.g. Windows) if signing everything through a 3rd party signing service would be required every time? This is crazy.
Second, I don't like where Fedora/RH and Ubuntu are going with this. Aligning with MS on this issue is definitely not the right way to go and most people start to see this. Yet, nobody seems to want to find a way out, most seem to even have stopped protesting, or asking for mandatory secureboot disable options. There are not only 2 distros out there, there are a lot more of them, and most of them will not go along with MS-signing kernels and drivers. Also, if Ubuntu goes for a secureboot lockdown scheme, they might be good from the enterprise side, moving away from the average users, and that just might be what they want to do.
Some still say this whole thing is a non-issue and too much fuss about nothing, but if it were so, then please, for crying out loud, why is there so much smoke around about the planned existance or non-existance of a secureboot disable option? If manufacturers would just say disabling will be there always, this whole issue would just go away.
The biggest problem still is that most average users can't see the point in all this, simply don't care, thus unwillingly participating in making it worse for those, who do.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
I blame it on lack of coffee.
The soylentnews experiment has been a dismal failure.
Seriously... I read the article the FIRST time this UEFI news was posted from http://mjg59.dreamwidth.org/12368.html, when it was regarding Red Hat, and the edit was already made back then. The money does not go to Microsoft! Why are people still saying this?
It is very misleading to write "Similar to Red Hat paying Microsoft to get past UEFI restrictions" when it is really not the truth.
"Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access edit: The $99 goes to Verisign, not Microsoft - further edit: once paid you can sign as many binaries as you want)"
my bias: I have Linux on all of my systems, no MS OS around here. Please, stop the inaccuracies and write what is true.
That sounds plausible.
Lame
I want to boot whatever software I want, not what you gracely will allow me.
Hardware is MINE, not yours!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Except that it *isn't* for DoD stuff or mainframes or even virtual machines (Where it'd be utterly useless anyway, as the host could twiddle whatever bits it wanted in the VM memory at any time). Microsoft are mandating that Secure Boot be available and enabled by default on all Windows 8 OEM machines, including those sold to people for home use.
No, it's more like Gowachin-style respectful disrespect. They go along with it only to subvert it.
Couldn't the buyer of an OEM PC with Windows just flash their UEFI with one allowing disabling the Secure Boot?
This would add just one step to the alternative OS setup!
Nobody is saying secure boot is an inherently bad idea that I see. They're saying they should be able to sign their own stuff and load their keys. I want to but a computer and not some glorified appliance so I happen to agree. I also think its a bit shady that other vendors are in a position where for practical purposes they have to pay Microsoft to get signed.
The soylentnews experiment has been a dismal failure.
That sounds though like just the type of thing Microsoft may use as an excuse to refuse to sign, and they control the one key that you can be confident all computers will accept.
Yet another Micro$oft tax ... Red Hat is the first one to pay it, who's next in line ???
But no, instead they'll institute this ludicrous dance of keys which will impair the end user's boot experience (which is what UEFI should really be all about) without adding a gram of security (loadable modules at runtime = zero advantage from using "secure" boot).
Absolutely, 100%, this. In doing this, M$ is looking out for its bottom line; it is only tangentially interested in your data security, and then only insofar as it affects said bottom line. The only rootkits "in the wild" that M$ is even remotely concerned about are the ones which circumvent its own activation and policing systems.
Why not have a very simple but signed boot loader that turns around and loads an unsigned bootloader like Grub2. I have had to do similar things before when I installed Ubuntu on a Mac.
Hi Guys & Gals,
before you all get worked up, please remember that Ubuntu was founded by Mark Shuttleworth. Mark became a billionaire by running Thawte. Thawte is a certificate authority for X.509 certificates.
My take is he knows a thing or two about such infrastructures and I also think he is a positive influence for the free software world.
have a good day!
If I understood the earlier story on /. correctly, Red Hat is paying Microsoft so their customers have the privilege of running anything *but* Microsoft. That's not even wrong...
All of a sudden, a genuine reason to buy Raspberry Pi! Sparc/PowerPC workstations and laptops back in demand as being "better for business/medicine/science" when consumer x86 hardware is restricted to tablet touchscreen OS! PC vendors pissed off by Surface offer custom desktops/laptops for running Linux and FreeBSD and without Windows 8 support!
I for one welcome our new diverse hardware overlords.
Nobody is saying secure boot is an inherently bad idea that I see. They're saying they should be able to sign their own stuff and load their keys... I also think its a bit shady that other vendors are in a position where for practical purposes they have to pay Microsoft to get signed.
"Paying Microsoft" actually goes entirely to Verisign, as RedHat clarified previously. But besides that, they definitely don't have to - as Ubuntu is talking about doing, they can always run their own key server. Or load their key manually. Or disable the feature on x86 systems.
NO a high cost NDA with lots of fine print is the next place.
"Booting our CDs will rely on a loader image signed by Microsoft's WinQual key, for much the same reasons as Fedora: it's a key that, realistically, more or less every off-the-shelf system is going to have,...
So that means if my bootcd's that I create or the ones that I have like Hiren's boot cd, bartpe or any other won't work anymore if its not signed by MS ? That means the IT world will get a kick in the balls with this... like Hiren's will pay for the key
Besides, Microsoft made it clear that arm computers which is loaded with windows 8 will make it impossible to disable the UEFI. in other words, no other OS will be possible. Is it me or it's a very bad idea for all of us...except Microsoft which is clear what their intent is with this crap.
No. As soon as Windows kernel comes up it uses the TPM to determine who loaded it. If the answer is not someone Microsoft trusts (ie, UEFI), the system is running in 'unsecure' mode.
I'm not really worried so much who the money is going to, the point is that it is going to somebody be it MS, Verisign, or the man in the moon. I don't really care. As far as running your own keyserver, you have to convinece the hardware makers to accept your keys out of the box which is a non-starter with a niche desktop OS like Fedora or Ubuntu. Loading keys manually or disabling the feature is too much to ask the non-technical audience Canonical is going after.
The soylentnews experiment has been a dismal failure.
It isn't really an excuse. The stated purpose of secure boot is to prevent unauthorized and therefore unsigned kernels from running. Why would they authorize something that exists specifically to subvert this? I don't understand why it is so onerous to require the user to simply add a distro signing key to their own PC and get on with their lives. It's not like Linux users don't have to jump through hoops to get stuff working anyway.
I work in a lab where we often need to make a custom build machine. There is no way we will accept any kind of UEFI OS restrictions, nor will we pay an extra fee for their removal. If they wish to do business with us and our partners, then we must have the option to install whatever we like.
Seems to me like the easier solution would have been to actually secure the OS so that no program, kernel or otherwise, has sufficient direct disk access to write a new bootloader. Loading a new bootloader should require booting into a special mode to do so (BIOS level?). I dont believe Ive ever seen a windows update or servicepack that touched the bootloader.
Of course truecrypt et al need to mess with the bootloader, but I dont see why you couldnt simply load it from CD at boot time.
On that note, does anyone know if there are any plans regarding truecrypt etc that need custom bootloaders?
How does it know the TPM is the one answering?
Assuming this is the first boot, there must be some way to build a liar TPM.
This smells of the war against terror. There are actually very few pieces of malware out in circulation which rely on rootkits invoked by the bootloader.
Whether or not the reasons they gave are bogus, THIS isnt true. There are TONS of rootkits out there that screw with the bootloader, which is why MBRCheck should be a standard part of everyone's rootkit removal kit. If you ever see a machine with a virus, you must assume the bootloader has been tampered with.
Off the top of my head, Sinowal and TDSS come to mind.
So you want to break the computer to protect it?
How do you prevent me from just using DD?
The only way I can see this working is if you store the bootloader on some other storage, like a flash card on the mobo that is normally read only. Then require a hardware switch to be flipped when the bootloader is installed. That might actually be a good idea.
Which is fine and dandy for me because I am not getting a Windows 8 machine, and I am recommending that all my clients skip it.
Secure boot is stupid because there is a much easier solution: Dont let the bootloader be modified from within the running OS. Require a reboot to a special mode (maintenance mode) or a boot-to-CD (for programs like truecrypt).
Why was this modded up?
Slashdot users who have been had an account for about a month, posting a comment per day that gets moderated up, get the privilege to moderate up their own comments by one point. The "karma bonus" is only slightly harder to earn than, say, the "autoconfirmed" privilege on Wikipedia.
the most common ways of accessing FreeBSD filesystems from Windows are read only due to the potential damage they could do via a bug.
Consider a user who has only Windows installed on a PC. Malware running as an administrator could install a subset of FreeBSD that compromises Windows and chain-loads to it, so that whenever the user turns on the computer, he's really starting FreeBSD which in turn starts compromised Windows. Obviously, the FreeBSD installer has to write to the FreeBSD file system.
The point isn't to protect against bootloader infections, per se. The problem is that if you use a protection mechanism based on one layer being signed (say, signed application code), then it's made irrelevant by attacking one layer lower. So you need to sign from the bottom-most layer all the way up. That means either a signed BIOS or one that can't be changed in software, a signed bootloader, a signed kernel, signed drivers, and signed application code. The purpose of the signed bootloader isn't to protect against bootloader malware that exists now, but to protect against the bootloader malware that would appear if you started relying on a signed kernel.
I'd rather take my chances with the malware than have the liberties of doing what I want with my computer taken away.
So turn off UEFI Secure Boot.
I meant for Microsoft to add that capability to its OWN OS. Obviously it could not enforce such a restriction in Linux; I would think there, if there were a need for such protection, someone could write a kernel module that did the same thing and was an optional component for hardened installations.
What Im saying is that rather than doing this at an EFI level and crippling all OSes, each OS maker should be responsible themselves for making sure that the MBR is untampered with.
Nobody said you can't sign with your own keys. However, doing so (and updating UEFI to accept your keys) is not trivial, and is something the vast majority of the users are not going to want to do. If you are trying to convince people to use your distribution (ie Ubuntu) it is up to you to make it easy, whether that means paying Verisign to sign your stuff or convincing hardware manufacturers to load your key for you.
So what do you propose as an alternative - make the manufacturers ship in non-secure mode, and require the vast majority of users who want to run in secure mode to go through the hassle of enabling it?
You can build a perfectly valid TPM. What you don't have the capacity to do, is lie. Lying requires that you execute a MitM attack, but you're trying to do this between two entities who have already met each other out-of-band.
And what "actual purpose" would that be, to rip off Apple? Let's be honest folks, Gates was evil, Ballmer is just quasi-evil, he's the light beer of evil, half the calories and a total buzz killer.
Seriously folks look at the man's track record- killing the successful playsforsure for Zune market (iTunes), paying actual money to rebrand the Gigabeat and make it shit brown no less and calling it the Zune (iPod), paying another assload of money to Nokia, whom i believe they'll eventually buy because if its one thing Ballmer knows how to do its piss away money, to crank out WP7 phones nobody wants (iPhone), and for the final uberfail taking their flagship X86 OS, one of the few actual money makers they have, and taking a MASSIVE dump on the UI all so he can treat developers as retards thinking he can "trick them" into developing for ARM Windows (iPad).
Look to do something really evil requires.....of what's the word?....oh yeah, ACTUAL THOUGHT which so far we have yet to see Steve ballmer actually be capable of. Wanna know where he got Secureboot? Apple, hell that is where he has stolen every damned idea he's had, just take something Apple did first and half ass it. In case everyone ain't noticed you can just slap any old OS on an iPod or iPad neither and that is what Ballmer is brewing up like a giant Sunday crap, yet another ripping off of Apple with a half ass incomplete mess with a Win Logo.
So don't worry your little heads about it none FOSS guys, the OEMs won't be putting out in X86 you can flip a switch and kill Secureboot because they know guys like me are gonna spend the next year and a half wiping the shitpile that is Win 8 for the goodness that is Win 7, and the only way you're gonna come across a Win 8 Pad (unless you're thick and buy one at release) is over on Woot! when the OEMs, if there are any which after we saw what they are gonna charge may be few if any, dump the things for firesale prices ala the Touchpad.
To get worried about this turkey is like being worried about WinME taking over the world, it just ain't gonna happen and you might as well not give a crap until you see what happens at release which i predict will be just like this only with cursing which is what I've seen at the shop. The only interesting thing about TFA is Canonical is doing the job for any malware writers that wanna get around secureboot, maybe they'll be nice and send Shuttleworth a thank you note. Not that it matters, until 2014 most of the malware guys seem to be happy going after XP the most since its the lowest hanging fruit. Bet it must be like heaven for 'em, a decade plus old creaky OS with hundreds of millions running as admin? Easy pickings.
ACs don't waste your time replying, your posts are never seen by me.
If the kernel isn't signed then you can just make the bootloader load another bootloader that shims Windows.
In Fedora the bootloader will be signed, the kernel will be signed, and the device drivers will be signed. The kernel will be restricted to limit raw memory and raw hardware access so you can't subvert the signed kernel. Additionally high speed virtualization will be restricted so that it can also only start signed copies of Linux. (So you can't use linux+kvm as a shim to create a fake real system to hoist windows into)
Windows 9 will require you to insert your genitals between its spinning blades during the boot process...
From a quick read of this, it sounds like Canonical is basically trying to build a signed chain loader that will make a transition from a Microsoft-signed boot environment to a libre boot environment. Seems to me as if this will be useful not just for Ubuntu, but for pretty much anyone who wants to boot Linux on a Microsoft-encumbered computer.
If that's the case, we'll eventually start to see Debian, Mint, etc. distributions that make use of the Ubuntu boot loader to get the system up and running.
Tired of FB/Google censorship? Visit UNCENSORED!
Make it drop dead easy (think Apples's bootcamp) for consumers to go into "Custom" mode. Also make the interface for this standard so it can be documented as part of the install instructions from the various distros. That's one possibility that springs to mind. I'm sure there are others.
The soylentnews experiment has been a dismal failure.
Don't you worry, the secure boot system is anyway totally compromised to begin with. Anyone with a fake ID and 90 USD will be able to buy a trusted key from Microsoft. This is even more silly than the current CA system.
What you have to understand here, is that Ubuntu is only adding yet another layer of vendor lock. It's not better than the one from Microsoft.
The only REAL and TRUE freedom and equality would have been to ask all users to first type a fingerprint before they can use their computer for the first time. Having keys already installed in the BIOS by default is a pure travesty.
And don't tell me that too hard to do for the average user. There's in fact only 2 categories for which it is the case: blind people and those who shouldn't ever touch a computer anyway.
The problem is that any bootloader capable of loading more than one (signed) kernel would defeat the purpose of secureboot.
Yes, it would defeat the purpose, because if the boot loader isn't signed, then you could replace the boot loader with one that didn't even worry about signed kernels.
I mean the official purpose, protection against rootkits, not the actual purpose.
The official purpose is to lock down a computer such that you can be assured that it boots off of the intended software. It is not only protection against rootkits, but that is one item it could help with.
The issue now is that there is no way to differentiate between approved software and unapproved software. Signing is an elegant, tried, and stable solution for identifying origin of software. However, signing requries that your keys are distributed with hardware that guarantees it will only work with binaries that can be unlocked with your keys.
Fedora attempted to distribute their keys to all the major motherboard manufacturers; however, even with positive feedback from the hardware manufacturers, it became clear to Fedora that they would not have their keys in every UEFI secure boot system. So they had to make a choice. Either one would need Microsoft Windows as a prerequisite to install Fedora (by launching to Windows and disabling the secure boot system), or they could use a $99 a lifetime key signing portal to sign their bootloader with a key that is guaranteed to be present (due to Microsoft's market presence) so UEFI could boot Fedora install media without launching Windows.
I think Fedora found the right solution, despite the fact that there is a horrible history with Microsoft. After all, the alternative is to require running Microsoft Windows to disable UEFI. Getting an installation boot loader signed once is far less intrusive than requiring a launch of Windows, I mean, you would have to buy a copy of Windows to install Fedora.
Of course, one might argue that PCs ship with the secure boot option of UEFI disabled by default. This still might happen; however, nearly everyone wants the shipped operating system to be the one that boots, so it is not clear how disabling secure boot would assure people that they are booting what they bought.
... not the actual purpose.
Allusion to a sinister purpose without even describing it is blatant fearmongering. There might be a ulterior motive, there might not be an ulterior motive. If you really suspect ulterior motives, have the balls to detail them.
If Microsoft didn't want any other operating system to boot, then they wouldn't even have offered the bootloader signing portal. If they didn't want Linux to boot, then they would have altered the terms of service to be incompatible with the legal protection structure surrounding Linux. They didn't do either, and their price seems so low that I wonder if the service is being offered "at cost".
If you don't like it, disable the feature.. except for the whole ARM fiasco.
Why?
I havent seen a bios that did not have the ability to disable MBR writing for 5 years now. What idiots are installing the OS and not turning on the MBR lock in bios?
Do not look at laser with remaining good eye.
But, isn't Windows piracy a big part of it's ubiquity? If cheap PC assemblers in the third world can't install a pirated Windows, they might install Zorin or some other windows-like Linux distro...
No sig for the moment.
Secure boot is stupid because there is a much easier solution: Dont let the bootloader be modified from within the running OS. Require a reboot to a special mode (maintenance mode) or a boot-to-CD (for programs like truecrypt).
If the bootloader could not be modified from within the running OS, pray tell, how would one reconfigure it to boot anything else? Special mode is a "special" running OS, why wouldn't every OS that wants to modify the boot loader deem itself special?
The MBR lock actually only works for OSs that go through the BIOS calls. That means DOS and... well, that means DOS. The MBR-infecting viruses dated from the DOS days and spread via infected floppy. Leave one in your drive when you turn on the computer and it'd write to your MBR, and then to any floppy inserted.
Your suggestion would [...] require them to figure out how to resize partitions without anybody noticing it.
Because of rounding, statistically nobody is going to notice losing 100 MB of a 500 GB partition.
What's more why the fuck would you use immutable files if you're intention is to use it to hijack the system.
One wouldn't use FreeBSD immutable files to hijack Windows. I was referring to using FreeBSD or Linux to hijack Windows, not to hijacking FreeBSD or Linux.
"So turn off UEFI Secure Boot."
And how long before Microsoft and/or the OEMs start saying you can't do that?
It isn't just plausible its pretty damned obvious. Go to TPB and you'll see they have "Windows 7 all versions pre-activated" DVD which will give you ANY version from Basic to Ultimate and they all get full Windows Updates using the bootloader hack. Since the hack involves using legit OEM bootloaders to shut it down they'd have to blacklist so many OEM desktops and laptops it'd be chaos so they might as well consider Win 7 a total wash when it comes to piracy.
As someone who works in a little PC shop if anybody at MSFT with any clout reads this? i have the solution to Windows piracy without any secureboot crap, ready? Win HP at $50, Win HP family packs at $100. I saw guys who had NEVER had a legit version of Windows buy when you had Win 7 HP at $50, in fact while that was going on I don't remember seeing a pirate version around, they were all legit HP. You jacked up the price and now Craigslist is filled with $100 PCs with $300 copies of Win 7 Ultimate on them.
so take a lesson from valve MSFT, the carrot don't work. Are you forgetting what happened with Vista? You made it originally pretty damned pirate proof, even having a kill switch, remember? it BOMBED because its those same guys that actually know how to pirate that support your ass by telling their families what to buy and supporting them. lets face it you've never made your big money at retail anyway, so selling Win HP at $50 isn't gonna kill you but it WILL turn a lot of pirates into actual paying customers because at $50 frankly it isn't worth the hassle to pirate. I'll be the first to admit the reason my family is running Win 7 HP is the family packs and if it wasn't for the 3 for $100 deal they'd be running hacked pro, paying $100+ a machine for HP when the machines themselves cost $250-$350 a kit? Not worth it. there is a sweet spot MSFT, and I'd argue its Starter at $35, HP at $50, Pro and the family packs at $100.
ACs don't waste your time replying, your posts are never seen by me.
The MBR lock actually only works for OSs that go through the BIOS calls. That means DOS and... well, that means DOS.
I think it might also mean OS/2....
And you can, or at least could as of a few years ago, use BIOS calls in Linux -- only really useful as a workaround for some dodgy IDE controllers with bugs worked around in the BIOS, and with the corresponding workarounds not (yet) implemented in the Linux driver. (That may well have bitrotted by now.)
Of course you're essentially correct. But what is /. without pedantry?
They can use their own keys, yes - but then they have to convince every OEM to include support for those keys in their computer firmware. A giant like Red Hat may be able to pull that off with some of them, but the smaller and niche single-purpose distros wouldn't have a hope. Just imagine a five-man team of noncommercial hobbyists writing to the likes of Dell and asking for their key to be incorporated in future laptops... they wouldn't even get a reply.
The MBR lock is useless. The fact that dd is able to clone and overwrite the MBR-- the fact that dd even exists-- should answer the question of "why is it useless".
Something like a config option - 'Enable OS installation for one boot cycle.'
If the purpose of secureboot were just to secure the boot process, that's all it'd take. The whole system of key signing is a rather obvious attempt to squeeze all the little players out of the game so the big boys can seize more power and profits.
I hope these are just interm solutions whilst both companies support some coreboot developers.
http://www.petitiononline.com/system76/petition.html
Seriously, Redhat and Canonical should hook up with system76 and make it happen.
And how long before Microsoft and/or the OEMs start saying you can't do that?
Not very. And I don't have much hope given the hordes of people on the last article that honestly believed that Microsoft was being altruistic in this and that anyone questioning their motives was a conspiracy theorist/had a low IQ.
Not at all, at least not yet...
If windows became impossible to pirate, then they would lose millions of users to linux. Many people simply cannot, or will not pay for software. Once linux usage reaches a certain critical mass that third parties can't ignore it, you would end up with a cascade reaction and a fairly rapid death of windows.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
You want the purpose stated? Ok. I believe that the reason Microsoft is promoting Secure Boot is because it raises barriers to installing an OS that isn't supported by the OEM. Barriers that are trivial to a large OS vendor, but a serious impediment to niche players. I also believe that Microsoft is playing somewhat fair right now, by mandating that users do have the option of disabling secure boot and running the signing service, but that there is no guarantee they will continue to do so in future - and, once the technology is established, it would be in their own best interest (from a purely business point of view) to change their policy in these areas. I also believe that this new policy was inspired by the success of tablets, which have shown that locked-down hardware designed to be capable of running only an approved OS can still be accepted by the majority of users and achieve commercial success. Thus the requirement that Windows on ARM not only be locked using the ARM equivilent of Secure Boot, but that the user not be giving any access to remove this lock - just as is currently the case in almost all smartphones and tablets. I support of this I point out that the security benefits of secure boot could be achieved in a far simpler manner (simple read-only flagging on sensitive areas of storage that could only be disabled through the EFI configuration, or a hash of the bootloader code taken before loading which will cause a warning upon modification and require manual acceptance of the new value) without the need to impose a key signing and OEM-endorsement-of-OS mechanism that creates this undesireable market distortion, and that were security alone the true intent of Secure Boot then this would have been the approach taken. Intel may have started with on Secure Boot with good intentions, but Microsoft realised they could turn the technology into a new way to hinder their competition.
And the incentive for anybody to do that is what, exactly? If Microsoft, Red Hat and SuSE sign their stuff, the vast majority of corporate desktops are covered. If Microsoft, Fedora, and Ubuntu sign their stuff, the vast majority of consumers are covered. All without the users having to do anything. The hardware manufacturers don't have to do anything special either, except maybe install a few keys. You are asking the hardware manufacturers to design and implement a standard just to make things easy for a tiny, tiny set of their customers. Ain't gonna happen.
Yeah, and all those Ubuntu users will be happy one day when their key gets revoked, after it turns out some rootkit uses it to infect the MBR.
MBR runs trusted Ubnutu bootloader. Ubuntu bootloader looks at its virus-written config file and loads the rootkit. The rootkit goes on and boots windows.
They won't. A $99 service cannot possibly audit the code they're signing, and much less, they can't even begin to fathom the myriad subtle consequences of that code.
It will be signed without a thought.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
We need the companies involved to band together and make something like this an option. http://www.petitiononline.com/system76/petition.html Screw proprietary BIOS
The "maintenance mode" (and in fact the bootloader itself) can simply be part of the UEFI. Want to install any OS (Windows, Linux, BSD...)? Just boot into "maintenance mode" with the install media in place. It can then install any protected stuff it needs (boot loader, keys... it could even install any part of the OS that can be read-only...), reboot back into "standard mode" and perform the rest of the installation. Everything from then on can be wholly signed with the keys just installed (or not, depending on the bootloader), just as with SecureBoot, and the user would have as much security as they wanted.
Booting into "maintenance mode" would require user interaction (just like getting into the BIOS or UEFI configuration screen), which would mean malware wouldn't be able to install rootkits. You could still install whatever you wanted, though. Which is good.
Of course this would allow users to *voluntarily* install custom bootloaders. To, for instance, trick Windows into believing it's autenticated. Which is one of the reasons we're stuck with SecureBoot and computers as appliances.
Nobody is saying secure boot is an inherently bad idea that I see.
Secure boot is an inherently bad idea.
It flies in the face of the concept of the machine as a general-purpose reprogrammable computer.
General purpose means user control of all software right down to the firmware.
The line that secure boot is intended to protect against bad guys on the internet is a lie. The way to do that is to harden network connectivity & all applications that access the network.
The line that secure boot is there to protect against other attack vectors such as the insertion of a USB drive with a virus or a virus on a DVD is also a lie. Physical access is total access. The way to protect against these attack vectors is to physically secure the machine.
The intended target of secure boot is the user.
friends don't let friends teleport drunk
Something like a config option - 'Enable OS installation for one boot cycle.'
If the purpose of secureboot were just to secure the boot process, that's all it'd take.
That limitation isn't possible, because the UEFI/BIOS is not a hypervisor. Once something else is running in ring 0 there is no way to prevent it from doing whatever it wants. Implementing those kind of hardware locks would entail a much more serious change to many parts of the PC architecture.
The whole system of key signing is a rather obvious attempt to squeeze all the little players out of the game so the big boys can seize more power and profits.
Despite the above, this statement is probably quite accurate, though. It's certainly a convenient side-effect.
For systems based on one popular architecture, about 6 months ago.
For other architectures, as soon as they think they can get away with it.
Welcome to the Panopticon. Used to be a prison, now it's your home.
$50 windows 7 HP, $100 family pack and I'll upgrade ALL of my machines to Win7 from XP. So, I concur.
If you were me, you'd be good lookin'. - six string samurai
I never said they had or didn't have an incentive to do this. You asked for an alternative and I gave it. I'm under no delusion that manufacturers will lift a finger unless either their real customers, i.e., Microsoft et al tell them to or consumers stop buying their products so I don't know what you are trying to argue against here.
The soylentnews experiment has been a dismal failure.
We're speaking about UEFI here.
There is no "boot sector".
The UEFI firmware is able to open the boot partition and load and execute a boot loader executable straitgh from the file.
In "linux bootloader" parlance: there's no stage1, the UEFI is the stage1.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
A compiler compared to a chemlab, yes the analogy holds somewhat, however if they do succeed ... ... but they can't lock down electrons and can't take those away from me. Maybe its just time to start
in locking me out... Fine.I got a mind that wants to play and I will find another outlet. They may be
able to lockdown firmwares,
(in reality it is locking down the CPU itself so it will only execute a signed firmware)
thinking on a larger scale outside the (linux) box.
Every time these motherfuckers push forward something else arises that complicates their plans.
Jesus christ if they dropped a family pack version to $100 I'd buy it in a heartbeat! I've got three personal machines running Windows and I haven't bought a single license because Home Premium is $200. Never mind that I occasionally use something like XP Mode so having Ultimate was helpful. Actually right now a new Win7 HP license on Newegg is $100, presumably due a price drop in the wake of Win8. On the other hand, Win7 HP upgrade (from Vista or XP) is still $120.
It will take generations and countless wars to undo the damage that is currently being done.
Or it will take a signed bootloader that let you then load whatever you want.
That's what Canonical is paying for:
they get EFILinux signed.
EFILinux in turn can load pretty much any kernel you want.
- Either an official distro provided one.
- Or your own compiled linux kernel
- Or another system's kernel (*BSD, ReactOS, etc.)
- Or even a better/bigger bootloader like GRUB's stage2.
What we need now is the legislative framework so Microsoft can't revoke the bootloader without attracting a shitstorm of antimonopoly antitrust suits.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Since when have you ever had access to all the hardware firmware in your system?
So you need to sign from the bottom-most layer all the way up.
But that is still defeatable. To root such a system, I just have to install Ubuntu's signed bootloader that lets me run unsigned kernels (as they have stated they will allow). Then I can modify your signed kernel however I want before loading and running that. How is UEFI supposed to protect against that?
It's not like Linux users don't have to jump through hoops to get stuff working anyway.
I a Linux user, and I haven't had to jump through hoops to get thing to work in years. Well, not any more hoops than I have to jump through for Windows or the Mac. Linux had long ago achieved parity in this respect.
Also surprised with efilinux. It can load from block devices only, which omits network boot. I understand that grub2 GPL3 concerns make sense, but you would think they might go with elilo. It may be less 'active', but it is capable of doing more than efilinux, notably network deployment.
Canonical specifically stated that EFILinux could be used to a non-signed Grub2 (or maybe they could even sign it through their own infrastrucutre if they can make it GPLv3 compliant). On non-SecureUEFI machine, this is supposed to be the default behaviour they want to do (if EFILinux detects that Secure is disabled, it chains straight to Grub2).
The idea is to load the smallest possible bootloader in signed mode and then do everything else you want from that point onward.
Once EFILinux has chained to Grub2, you can do all the crazy cool stuff you want here.
Just think of EFILinux as a special type of stage1 that is compliant for SecureUEFI devices. (Well technically, the UEFI firmware is the stage1, but you got the idea).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The "Industry" and your "Government" do want total control over everything everywhere but
they realize they can't do it in one huge leap (wars help with that though). Right now the idea
is to lock computing to a few vendors like Apple and Microsoft and a few token open source
alternatives like Ubuntu and Redhat. The first step towards limiting alternatives is to lock out
all the little guys like you and me, guys like you and me who actually bring innovation, guys who pop
up out of the woodworks unexpectedly and upset things. They do not like the unexpected at all,
they are in fact terrified by it. Then after a few years there will be convergence offerings, that
for example will allow you to run linux software in a windows environment, a few years after that
there will really only be a handful of systems left, some for server purpose some for clients
and whatever os and hardware you will be permitted will be designed for surveillance.
I don't have to see their papers to know what the plan is, its an obvious set of moves from their game
perspective.
Of course it's a conspiracy. That doesn't mean it's wrong. Those conspiracy nutters can be so crazy, when a real conspiracy comes along people tend to reject the idea out of hand.
More information on the Ubuntu UEFI plan is here:
http://benjaminkerensa.com/2012/06/20/uefi-secureboot-situation
This is trusted computing all over again...
http://en.wikipedia.org/wiki/Trusted_computing
I can't wait for the day I'll have to pay to some company to sign the bash scripts I wrote so I can run them on my own machine...
but how are the hundreds of smaller distros and niche distros supposed to exist?
Piggy back on the efforts of Canonical and Fedora.
Notice that Canonical is explicitely signing NOT their kernels, but a small piece of boot loader (efilinux).
And if you read phoronix's report, this bootloader could in turn load anything.
This includes canonical's kernel, but not only.
This even includes Grub2 (canonical want to make this the default behaviour if no Secure is currently detected to be active).
So the hundreds of smaller distro, or even non Linux OSes (*BSD, ReacOS, etc) only need to ship EFILinux and use that to load their non-signed stuff.
Bigger distro could also pool to sign other similar boot loaders (ELILO, a non-GPLv3 stage1 for grub, etc.)
We just need to have a choice of bootloader to make it possible to do whatever everyone wants without needing advanced actions (like changing jumpers or flashing new firmwares).
We also need a good legal frameworks, so the day Microsoft decides to revoke the possibility to boot such bootloader, a legal shitsorm of anti-monopoly suits hits them. I think the EU could happily play such a whatchdog position.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
So, assuming the UEFI loads a signed bootloader, the bootloader can run anything it wants.
Yup, and if you read the phoronix blurb, that's their plan.
Have efilinux run either official canonical kernels, or any custom kernel compiled by the user, or even Grub2 for a more complex boot behaviour (the default behaviour if SecureUEFI is not detected to be active).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
So the malware just patches the part of the kernel doing that check to not do that check. The Windows kernel can't know who loaded it because it can't know that its own process of checking who loaded it hasn't already been compromised. This is basically Descartes's Evil Demon. There is nothing you can do to detect the demon if the demon can manipulate your reasoning ability (by making your always conclude the demon doesn't exist) or memory (by making you falsely remember concluding the demon doesn't exist).
The ability to disable secure boot is in the spec.
In the specs, but not necessarily in the actual hardware. That's the main problem in this debate.
Microsoft aska that any ARM hardware shipping with WinRT can *only* boot signed code. To be able to license WinRT on their hardware, any ARM hardware maker needs to remove the possibility to deactivate secure boot. The surface tablet can only boot signed code (like WinRT) and nothing else.
And that's what Canonical and others are addressing: signing a small piece of bootloader (efilinux in canonical's case) which can fulfill the "obligatory secureUEFI requirement". And then in turn could load pretty much anything (including linux distros without the financial ability to signs their own code).
What we only need is the legal framework to avoid microsoft pulling a "sony-linux" trick on those boot-loader. But UE's tendency of anti-monopole suits against them could be a deterrent.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
How would anyone make custom kernels and/or modules (Linux) and/or drivers (e.g. Windows) if signing everything through a 3rd party signing service would be required every time?
By signing a small boot loader.
The boot loader complies with the "signed code only" part of the equation.
The boot loader then in turns loads pretty much anything the user want, signed or not. (official kernel, custom Linux kernel, other os like BSD or ReactOS, or even a better bigger boatloader like grub).
That's what canonical is getting to.
We need also to get the UE involved to by sure that Microsoft gets a nice anti-monopoly smackdown if they ever come close to thinking about pulling a "Sony-Linux" and trying to revoke the boot loader.
If manufacturers would just say disabling will be there always, this whole issue would just go away.
The problem is that disabling Secure Boot will not be available for ARM tablets running WinRT.
And you can bet that carrier will also happily try to force the same on handset manufacturer (that's already the case: some android handset only boot signed kernels).
We need to a have a hacker/homebrew friendly bootloader forced into this signing infrastructure.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I want to boot whatever software I want, not what you gracely will allow me
For x86 hardware, that's what disabling Secure UEFI boot is for.
For ARM hardware, where microsoft require a non-removable Secure UEFI boot, you need a small signed boot loader, that in turns let you boot whatever software you want.
Tha'ts what canonical is attempting to do by signing efilinux.
The UEFI firmware boots a signed efilinux (so Secure UEFI boot is happy).
efilinux lets you boot everything you want.
Just get the EU legal watchdogs to keep an eye on microsoft to avoid a "sony-linux" trick.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Were's speaking about ubuntu here.
It's supposed to be a newbie-friendly distro. So soldering a JTAG header in order to reflash a UEFI firmware with a selectable secure-boot option (instead of the default secure-only for WinRT) is a little bit out of the league.
The second best option is to get a small bootloader signed which can in turn boot whatever the user want (Ubuntu or any other custom kernel). That's why canonical is sining efilinux (instead of their kernels).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
That's only half the problem. You also need cheap MS Office licenses. (Windows 7 + MS Office) pro bundle for $100 and I might just switch.
When our name is on the back of your car, we're behind you all the way!
If that's the case, we'll eventually start to see Debian, Mint, etc. distributions that make use of the Ubuntu boot loader to get the system up and running.
...and according to the phoronix blurb even Grub2. (For more complex booting option beyond the small capabilities of efilinux itself).
Just get the EU legal whatdogs involved to hit microsoft with a big legal anti-monopoly hammer, if they ever try to put a "sony-linux" and suddenly decide to revoke the bootloader.
Also, other big players with money (Novell Suse ?) could join the trend and signs other similar boot loaders (elilo got mentionned) to give more such options.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
MS has not thought of it as your computer for quite some time. Vista took away your control further in order to please the movie industry which does not trust anybody (if they could, they'd require a memory zapper so we couldn't remember films we've seen without paying a fee.)
Democracy Now! - uncensored, anti-establishment news
Yeah, I thought about that. There are interesting wrinkles, though.
1) Most of those Ubuntu users would be uneffected. The revocation can only happen if you perform a Windows update. If you never go out of your way to run MS code, they can't damage your computer's operation by revoking your permission to run Ubuntu.
But some people do dual-boot, or may wish to install Ubuntu on a used computer which previously had run Windows plus an update. Here is where it gets really fun.
2) The revocation will have been done by Ubuntu's commercial competitor. Furthermore, Ubuntu paid to have their software certified, and regardless of whatever happened, Ubuntu's bootloader isn't the malware, so Ubuntu has likely not violated any terms. Ubuntu now has a claim against whoever (Microsoft) is maliciously transmitting revocations against harmeless bootloaders. I smell action. OTOH, if these signatures are only offered by signing something saying you won't ever sue if Microsoft for misconduct, then proceed to step 4, below.
3) Furthermore, a user whose computer was damaged by the update, has a claim against MS. For those who run Windows or otherwise get bound by the EULA, the new arbitration thing adds an interesting wrinkle, but not everyone who is harmed by Microsoft will be a Windows user or ever clicked an "I agree" so courts could still get involved.
4) Microsoft has to be offering this cheap ($99) signing service to deal with antitrust fears. If they start revoking competitor's certs for reasons as frivilous as the example you gave, they might as well have faced the antitrust risk head-on.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Ubiquity, by itself, doesn't pay for code development.
Bow-ties are cool.
What about signing the applications and drivers?
Wouldn't allowing any unsigned binary of any type allow a rootkit in?
Microsoft acts like it's in charge of the PC market and people and other companies go along with it. I cannot believe that Red Hat paid Microsoft a red cent. Canonical has it right -- go around it and set up your own method. By caving to Microsoft, people and companies are acknowledging what Microsoft wants -- control. Contrary to what anyone believes, it is an "us and them" exercise. They are out to kill FOSS.
Despite what people think of him, Theo de Raadt has it right when it comes to drivers and signing stuff. The open source world needs to do it better, openly, and on our own. RMS, while a bit of an extremist, also puts forward good points on stuff like this. Capitulating with stuff like this will end up with distros like OpenSUSE, which are seen as compromised because of Microsoft.
Stuff like this has me wanting to support distros like Mageia and others which don't have a hegemony. One of the reasons I like FOSS is because of a lack of hegemony -- as it should be. It's a community thing or it's corporate.
Jesus christ if they dropped a family pack version to $100 I'd buy it in a heartbeat! I've got three personal machines running Windows and I haven't bought a single license because Home Premium is $200. Never mind that I occasionally use something like XP Mode so having Ultimate was helpful. Actually right now a new Win7 HP license on Newegg is $100, presumably due a price drop in the wake of Win8. On the other hand, Win7 HP upgrade (from Vista or XP) is still $120.
I always thought that the way capitalism was supposed to work was the more copies you sell the lower the selling price. Win win. Why doe MS who owns 80% of the market have to sell their software at $100+ dollars and Apple who has a tiny part of the market is happy with $20.00? Greed?
Since when is "public safety" the root password to the Constitution?
According to Fedora, their key will only work for Fedora. This means that the Fedora based distributions, like Scientific Linux and CentOS, will not be covered by the Fedora key and will have to get their own.
It's time for the consumer to control the market. Refuse to purchase any computer that requires UEFI secure boot. Purposely goto best by, que up a sale, and at the last minute ask if it requires a signed bootloader.. and after they say yes. Walk away from the sale. Apple, HP, Gigabyte, and ASUS won't keep shipping motherboards they can't sell. It's time we take technology back. If this is the way it's gonna be I'll import my motherboard from a company that enables you to disable secure boot. DRM was forced upon us, we are winning the battle. Now it's time for another fight.
My current BIOS has a bootloader check already and will at least notify me of any attempts to modify the boot area. Why would I need this UEFI?
Uhh... OEM versions of Home Premium have always been $99. OEM Pro usually sits at about $140, but I grabbed 3 copies when they were on sale for $120 at Newegg. That was a limit-3 deal, and I bagged that limit while I could.
Retail versions of Windows have always been a rip-off. It's reserved for early-adopters, clueless masses, and Linux users that aren't familiar with how Windows typically works.
Anytime Upgrade (tm)(r)(c)(wtf) is also a rip-off and is for the lazier members of the clueless masses.
And, to top off my smug elitism trilogy, Home Premium itself is a rip-off and is only for people who don't use their computers for anything of consequence and should be replaced immediately with a Linux distro. Anyone using Windows for something that actually requires Windows is going to use Pro or a Server edition anyway, and the gamers are all so "leet" that they have a pirated Ultimate install with several rootkits baked in. So Home Premium is sorta useless.
As with anything, YMMV.
First off, this isn't going to effect corporate users at all. This system is not going to be implemented for servers and corporate IT departments will control their own systems (and certainly sign them with they own keys).
As for consumers, the largest current Linux distro is Mint. Unfortunately, according to Fedora, keys will only work with the core distro and not with distros based on that core. This means that Ubuntu, Lubuntu, Kubuntu, Mint, etc. will each need their own keys. Which, in turn, means that the majority of consumer Linux users will not be covered unless each of the largest distros and the large distros based on them receive keys.
The real concern here is not that hardcore Linux users won't be able to circumvent the system, the concern is that it will become more difficult to convert new users to Linux, BSD, etc. in the consumer space.
Personally, I don't think a simple, standardized interface that allows a person to turn off, on and customize their UEFI secure boot would not be too onerous of a requirement for hardware manufacturers.
Secure boot is a fine concept. It just needs to be carried out in a way that no OS maker can possibly exclude another.
You have to remember that there are two types of 'trust' involved here. The first part is the user trusting that his machine has not been compromised. The second part is that others trust that the users machine has not been compromised.
The whole thing is a chain of trusts. Any element of that chain can check to see if the chain is unbroken. So yes, you can patch the kernel to remove the 'who loaded me' check, and if you have trusted a boot loader that doesn't verify the kernel before loading it the kernel will load and run. However, the kernel will also attempt to verify things it loads (drivers, apps, etc). And those things can check to see that the chain before them is unbroken. So now you not only have to patch the kernel to remove the 'who loaded me' check, you also have to patch everything else that contains the check. You also have to patch the signature verifications that are done before the kernel loads something else.
If you have installed a (signed) boot loader that does not verify signature of the kernel, you are open to some malware being installed. That is of your own doing.
The second thing that the chain provides is remote attestation that your software is unmodified. Since that is done remotely, you can't just patch it out. So, by using a bootloader that doesn't verify the kernel you can defeat your protection against malware, but doing so does not mean that remote things can be tricked into thinking your software stack is unmodified.
Don't lie to me. I've tried to make multi-monitor work on Ubuntu in the last year and it took about 3 runs through GUI before I started googling and had to start hacking around in config files. That three year old Dell happily runs Windows and has multiple displays today.
If you have installed a (signed) boot loader that does not verify signature of the kernel, you are open to some malware being installed. That is of your own doing.
But you don't have to install a signed boot loader that does not verify signature of the kernel, to be open to some malware being installed.
Malware can install a signed boot loader that does not verify signature of the kernel. (All large software has bugs, thus all kernels have zero-days. SecureBoot is about preventing the malware from burrowing deeper into the system, not about preventing malware from getting on the system in the first place.)
And those things can check to see that the chain before them is unbroken.
OK, so an app generates a random number and asks the OS to encrypt it with the private key stored in the TPM but the TPM will only encrypt the number with that key if the hash of the memory from the kernel matches a specified list. Finally, the application decrypts the result provided by the OS and compares the result with the original random number. Is something like that what you mean? I can believe that that would work (if we assume that malware authors don't have time to patch every app and can't crack the TPM), but that process doesn't require or involve the bootloader checking the signature of the kernel or the boot process checking the signature of the bootloader. So why again should we be locking down the bootloader and the boot hardware to only load signed kernels and bootloaders?
To review: the lower levels can't stop a break in the upper levels of the chain (because the malware can install a signed bootloader that will load an unsigned kernel), and the way that upper levels catch a break in the lower levels of the chain doesn't need the lower levels to only load signed versions of the upper levels. It sounds to me like SecureBoot doesn't actually provide any protection.
Negative six months - this is already the case for ARM hardware that is sold with Windows software.
Because Apple already made that extra $80+ (and then some) dollars on the hardware.
Here's a link for an Office license for $0: http://www.libreoffice.org/
I hadn't known there were so many idiots in the world until I started using the Internet -Stanislaw Lem
I don't think Ubuntu's bootloader will be signed by any key distributed by OEM's. My guess is you will need to install their key (which requires *physical* access) before install Ubuntu.
And how long do you think it will be before Microsoft removes that little clause from the x86-certification rules? In fact, how long do you think it will be until they make it mandatory that it can't be disabled?
I'm not lying -- but I should add that it depends on the distro you're using. I've never had luck with Ubuntu -- I could never get even simple things like you mention to work in Ubuntu without a lot of pain.
Debian, however, has been a breeze for me.
I don't think malware protection is the main driver of trusted computing. The main driver is allowing others to trust you. For instance, before a site streams a movie to you it can request that your PC attest that it is running a trusted software stack, to ensure that you have not modified the system to enable you to capture the stream on disk. Or before you are allowed access to a sensitive database at your work they can insure that your access is only by approved software.
In order for that goal to be met, there must be remote attestation as to the state of your software. If there is any break in the chain, from boot to application, the remote attestation will fail. That is what secure boot gets you.
The last time I re-flashed my BIOS.
I've never updated the microcode on my hard drives though, so I guess you have a point.
On a side note, there was a hard drive that I lost due to problems with the power-saving routines in the hard drive controller. If I had known in advance the nature of the problem, the ability to reprogram the IO controller would have been nice.
friends don't let friends teleport drunk
If you're going to insist on using Window 7 or windows xp. Your're a retard if you're not using Windows 7 ultimate or Window xp pro. And if you dont think so just open the command terminal and run "gpedit.msc" to find out why. Fedora user migrating towards FreeBSD because Gnome and Apple users are fking up linux.
So the hoop, in this case, is knowing which of the thousands of distributions to choose.
Sure, it would get interesting, but I doubt any of that is going to stop MS from revoking a key used by Malware if they have control over the revocation list.
What would be more interesting is if OEMs just published a keypair for their machines for anybody to use. The win7 requirements state that secure boot must be on, and the MS key must be in the list of trusted keys. The specs also state that the OEM can include other keys, and do not stipulate any controls for those. The master key must be protected, but you don't need the master key to boot something using secure boot - just any of the trusted keys (not even MS will have an OEM's master key).
Well if thats what they stated then they lied to you.
Seeing Red Hat pay Microsoft to get past UEFI restrictions is like voting for Obama to watch out for the little guy, and watching in horror as he sells us down the river in favor of the banks again and again and again.
You don't have to make up fanciful theories as to the purpose of Secure Boot. The purpose of Secure Boot is to enable Trusted Computing, which doesn't work without Secure Boot. The stated purpose of Trusted Computing is to allow others to trust your software stack. So for instance, the operator of a streaming service can check if you have modified your software to allow copying to disk, and refuse to stream to you if so.
So why is Microsoft pushing for this? So they can go to content providers and say 'use remote attestation, and you can safely serve stuff to people'. All of the Windows tablets, and some portion of Windows desktops are automatically supported, and the rest can be easily enabled. Of course, any platforms which don't have Trusted Computing are locked out from those services, but such is life. Then they can run an ad campaign saying 'with a Windows tablet, you can stream all of the latest movies and songs - can't do that with platform x'.
Preventing loading of an alternate OS doesn't really benefit them much. Providing a reason for people to buy their OS does.
Yeah, BOYCOTT something you can turn off and that delivers tangible benefits to most consumers. You rock, brohan!
It isn't Apple's real product. Microsoft makes Windows to sell Windows. Apple makes OSX to sell Macs.
Microsoft don't drop their prices (XP Home is still £65), the reason for the price difference is retail vs. OEM copies. The OEM version is significantly cheaper, but in theory has to be sold with hardware. A lot of places just ignore that requirement. In Japan shops sell it with cheap components like floppy drives (yes, even now) just to comply.
The two versions are identical in every way, except that retail keys don't work with OEM discs and vice versa, but feature wise they are the same.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Don't worry, no-one has managed to produce an un-rootable computer yet. Every tablet, every phone, every games consoles has been cracked open.
It would make sense for them to allow you to turn it off. That way there would be no reason to crack it other than to write malware, meaning far fewer and far less talented individuals working on the problem.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
The difficulty in that is that there are still a lot of PCI/PCIe cards out there that don't have UEFI option ROMs. Notably, you might want to use that 2-year old video card when your system is booting. Or, maybe you have an I/O card that you're booting off of. Certainly not everyone is going to need that, but enough users are going to be pretty upset (think: big enterprise customers with lots of users) that I don't think they could do that. However, before Microsoft announced the requirement that systems ship with a UEFI Secure Boot off-switch, I thought some laptops might ship without that option. Still, I think there are enough corporate customers running older Windows OSes or Linux on new systems that OEMs wouldn't do that. I don't think Microsoft is planning a patch to Win7 so that it works with Secure Boot enabled. A lot of corporate customers will be running that for a while.
The chain of trust starts in the CPU.. when the arm core is powered up it starts execution in a rom that is on the chip itself.
This rom has code with a verification key that will load the first few kilobytes of the firmware into a ram which is also
on the cpu. Then the rom code will verify if the loaded firmware segment is correctly signed and if it is then the code
will actually start executing the remainder of what's in the flash. So yeah I''m pretty sure you can reflash the firmware quiet
easily, it just wont do you any good, you'll essentially brick the box until you flash back a valid image.
One way would be if you could somehow tamper with that rom (fat chance), and then there's all the things the people who ... and then finally there's the hope that china built a ... like what they did with a bunch of chips that are used predominantly by the US military (hahahaha
cracked the ipad2 could do (which in future they wont be able to)
backdoor into the chip
hohohohohoh hehehehehe harharharharr)
Enjoy your shitty future.
You mean for hardware vendors to ditch their enterprise customer base? If you've ever worked in enterprise IT, you'd know custom boot code is extremely common.
All of the big name enthusiast hardware makes sell lots of features for their high quality boards. I'm sure someone will advertise easy secure-boot key management as it is a hot subject.
If there is any break in the chain, from boot to application, the remote attestation will fail. That is what secure boot gets you.
Then there is no reason to prevent booting unsigned software. This is what I'm objecting to. Let the unsigned software boot. If it fails remote attestation later, then fine. But locking out unsigned software from even booting buys nothing(*).
(*) Other, than a means for Microsoft to scare users off from trying other operating systems.
Ubuntu plans to have a loader image that is signed by Microsoft's WinQual key (which chains to efilinux which then chains to Grub2 (this is madness) which then loads unsigned kernels). They mention it only for booting the install CD, but I suspect an enterprising malware author will figure out a way to use this path.
Go to TPB and you'll see they have "Windows 7 all versions pre-activated" DVD which will give you ANY version from Basic to Ultimate and they all get full Windows Updates using the bootloader hack.
Just a heads-up for anyone considering going to TPB or any other torrent site and downloading one of these things to install:
Welcome to the botnet.
Every single one of them is infected. The ones that scan clean have simply not had their rootkits entered into the malware databases yet, and it takes a good while for it to happen. Some people download these because they are pre-trimmed and degoobered. Microsoft has its own trimmed down Windows versions, like WinFLP which is spectacularly good for VMs. Use those instead.
Any and all Windowses you acquire should match the MD5 sums available at Microsoft. If it doesn't match, then it's garbage.
It's not difficult to install the loader yourself on a clean copy.
Or you can just forego all the above and install Linux and never have to worry about that bullshit again.
--
BMO
Bootloader wars..yeah! Just what we need right now. Can it get more retarded?
...scaremongering or FUD, except that its the linux crowd that is effectively doing microsoft's job for it (either that or shills posing as linux advocates, which isn't new either)
...ANYTHING?
take a step back and think about it for a bit...
is there anything in human history that couldn't ever be broken into?
history shows that the more you lock something down, the more effort is spent by persons outside the system to try breaking into it (proportional to its perceived worth/value). remember that hacking isn't all just script kiddies and softice; there are real hackers out there that can create devices that can get around pretty much any form of computer security. there is literally no such thing as a completely secure computer system.
even if (and its still a big IF imho) every single motherboard vendor decides to prevent anything but windows from booting, there will soon after be bios flash images or even replacement bios chips available to circumvent the secure boot features.
if OEMs decide to prevent anything but windows from booting, good on them... they are basically becoming microsoft subsidiaries anyway.
for my linux machines i will always buy the individual components (mobo, graphics, case, psu, etc) separately from my local computer guy for nearly half the price of an equivalent OEM box anyways.
if mobos are sold individually with uefi locking out all but windows (i doubt it), a community will spring up overnight to get around it, or new mobo vendors (chinese probably) will become prominent to take advantage of the gap in the market. remember that many fortune 500 corporations depend on linux for their daily operations, so regardless of what microsoft wants, much of the big end of the business world simply doesn't want windows running their back ends and datacenters. there will always be demand for linux, an markets always cater for demand.
UEFI will be a short-lived security blunder for microsoft, but the FUD campaign leading up to it will probably be looked back upon as a resounding financial success
I pray for the day that all people will be `actually' able to choose between Windows and Linux. But no, I'm not fantasizing it with the "progress of the OS" in mind but with the "progress of human understanding". The OS is there, really any non idiot should be able to install his own version of (at least) Ubuntu onto a PC. The knowledge is out there, freely accessible. Progeny has created all the bases why can't we as a species just move to the next level?
-- no sig today
Sounds like yet another reason why piracy is more desirable than some hypothetical "legitimate" channel that uses such a ridiculously involved mechanism to stream a movie. If you thought getting HD video to render correctly through HDMI was difficult, just wait until somebody deploys a service that depends on this bit of idiocy.
Meanwhile, somewhere, someone is running a machine that doesn't secure boot, can run any software they want, and can rip the same movie from BluRay and invoke the endless perfect copy machine that is the Internet and we're right back where we started, only more so.
Did it ever occur to you that what they are doing is already possibly criminal, and that even they know how far over the line that would be?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Microsoft already demands that you can't turn it off on ARM hardware.
Just because I'm paranoid it doesn't mean they aren't out to get me!
Cleverly disguised as a responsible adult.
Accidentally moderated 'Troll' ... commenting to remove that.
Much as I like and use open source software, applications like this are about five years behind. For example, where's Libre Office's OneNote equivalent? Oh that's right... it doesn't exist.
When our name is on the back of your car, we're behind you all the way!
Well here is the family pack for $130 with is $43 a license. It says upgrade but frankly I've used the family pack to clean install with no problems, in fact its what I used to switch my family off of XP. You get one disc for X86, one for X64, and the key is good for three installs.
I still think my pricing is better though, as for that short period where they had HP at $50 and the family packs at $100 frankly I never saw a pirate edition, they were ALL legit Windows. As we have seen with valve the way to beat pirates is not the stick but the carrot, and now would be a perfect time to do so and offer those that buy the $15 Win 8 upgrade they are offering the retailers with new PC sales. This would give people an incentive to go legit and give them an incentive to buy Win 8. Since MSFT seems to think piracy is a problem this is a sure fire way to stop it, as with a price like $50 for HP honestly most would just buy rather than deal with a pirate version.
If it were me you'd see Starter at $35, HP at $50, and Family and pro at $100 and you would be able to upgrade to the Win 8 version of the same level for $20 if you bought the upgrade ticket with your Win 7 purchase. Not only would this virtually wipe out piracy but would get more people interested in Win 8 as well, since they'd already have a key for the RTM download. Seems like a win/win to me.
ACs don't waste your time replying, your posts are never seen by me.
Actually Mr or Mrs AC you have proved that YOU are equally clueless, as there is nothing other than AD support in Win Pro that can't be had cheap or free with third party products that run fine on Win 7 HP. I have several customers using HP at work and frankly not a single one has any trouble running a small business on HP, and if they run into any old software that won't run (rare) they simply use their original XP install that was turned into a VM and just use VMWare Player.
So there really isn't a point of pro or enterprise unless you are working in a place that requires AD, and while ultimate does have bitlocker there are several other free disc encryption tools out there that would just as good like Truecrypt. Frankly the only ones I've ever seen with Ultimate are gamers that treat their PC as an ePeen and have more damned bling on them than an LA ricer.
And finally I'm sorry but if you honestly think a Home user can have their PC replaced by Linux WITHOUT a full time admin to fix the damned thing when the updates crap on drivers? Well then you might be interested in these magic beans I have for sale. Linux is like a 75 Dodge sitting in a field, IF you learn all its quirks AND spend hours on fixing it up AND are willing to jump through hoops to keep it running? It can be good, maybe even a hot rod if you sink enough time in. the rest of the world would rather just get something that runs NOW and will KEEP running. That simply isn't the state of Linux right now friend, as the rants about Nvidia and ATI drivers we saw this week soundly illustrates.
ACs don't waste your time replying, your posts are never seen by me.
Since the certification requirements for Win8 (on x86) mandate that Secure Boot can be disabled, I predict that the instructions for the Win8 version of Windows Loader (or whatever it is the kids use these days) will be roughly:
1. Disable Secure Boot.
2. Run program, click OK
I also predict that for Win9 MS will change that requirement to its opposite, due to the "overwhelming success of the programme" or somesuch, citing the fact that even Linux vendors have signed on as a "see, we're not evil" argument.
I wonder what's next in the piracy race. A signed Linux kernel, with a small initrd that loads a VM? A signed Linux kernel which executes the loader via kexec? Somehow, I don't think technological solutions to piracy will ever work. As long as people want to pirate, they will find a way to do so. After all, there's no shortage of people who find cracking a new copy protection too good a challenge to pass up.
Proud member of the Ferengi Socialist Party.
https://en.wikipedia.org/wiki/NSA_key
Just a reminder.
Why do we have to pay Microsoft anything to use a computer with no Windows???
It is not good to give Microsoft ANY KIND of leverage in what runs in the system. With the UEFI boot they are in a position of control over all systems.
The Canonical approach is just a temporary hack, not a solution.
If this is not abuse of monopoly, I don't know what is.
The "vast majority of users" don't want to run in secure mode because they not only have no idea what it is but wouldn't give a shit even if they did. It's Microsoft and only Microsoft that wants it, and the reason Microsoft wants it is purely anti-competitive.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
That's already been done; it's called a TPM.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
The only problem with this reasoning, if you have hardware new enough to support UEFI booting, then you have hardware new enough to support SLIC 2.0, and can mod the SLIC table so you don't need a bootloader to bypass genuine activation. The logic that is missing from this discussion is astounding.
I've got a windows 7 upgrade disk that refuses to install unless there is a licensed and acitivated copy of a previous windows version already installed.
That's what I like about it. They're not even paying lip service to that bullshit official purpose. Red Hat made it sound like they have drank some of the Koolaide, with all their worrying about how the person who owns the computer might abuse an unsigned module to take control of their computer.
Once you're running your bootloader, then the issue is over. There is no need to further check for any other signatures or try to guarantee that the owner can't run their own code. You have satisfied the requirement and thereby gotten the computer to work.
For a home computer (what UBUNTU is), your statement makes perfect sense. However, for a cluster or even a 24/7 server, you would like confirmation that all critical software is signed. I guess too that if the UBUNTU loader can do a sha256sum of its critical modules and compare that value to some table entry, it would be good enough, until... until sha256sum itself is compromised.
Leslie Satenstein Montreal Quebec Canada
That's weird, where did you get that? The family pack I used to get my family on Win 7 and the single use Win 7 HP I have on my desktop didn't ask for anything like that, simply if i wanted to keep the old install (using the Windows.Old folder) or install clean. Is it one of the OEM discs that are tied to a brand, like Dell? Because i warn people at the shop away from those things, they can be had for cheap on places like Amazon but you often have to run cracks to get the damned things to work on hardware other than the make/model they were sold with.
So if it helps the green box HP upgrade and the orange/brown family packs didn't do that, in fact i installed clean on both of my boys machines because i built from kits and saw no point in installing XP on machines that crossed the 3.25Gb RAM limit and they went great. I also did the same for my dad and his GF, using a family pack to install his work, home, and her newly built desktop, not a single one gave me a bit o' trouble.
I probably shouldn't say this but WTF, here is how you can get around that: Most people don't know they never bothered building a WGA for XP X64 so you can get a copy of that from TPB and it'll run with the included key. since you already have a key for Win 7 and aren't gonna keep XP X64 I don't see any harm in letting you know you can slap that on there and it'll be ready to go, no activation required. all you need is a 64 bit CPU which I'm sure your machine has if it isn't ancient, slap on XP X64 and then upgrade it to whatever version of Win 7 you have.
ACs don't waste your time replying, your posts are never seen by me.
Citation please? because that is the same argument that the game corps have been using to try to keep people from downloading games yet frankly i haven't seen an infected game in half a decade. Just for shits and giggles i took a disc from 2009 with the original RTM Win 7 with the bootloader hack and scanned it with 4 different scans, nothing. Zip zilch nada squat, which surely they would have gotten any malware into their DBs after 3 fricking years, yes?
So unless you can show citations by someone OTHER than MSFT or the BSA i'm calling FUD, because most of those releases are done by the new Razr1911 or Fairlight teams and those guys are quite proud of their hacks, most even have the checksums of their release so you can make sure its not been tampered with.
Sounds to me like you just want to push your Linux dogma which honestly? Linux is a good decade behind the curve on the desktop, thanks to all the infighting, NIH, reinventing the wheel, the DE wars, hell even torvalds is pissed at the drivers as we've seen on the Nvidia and ATI articles we saw this very week. frankly Linux can't even upgrade without crapping over drivers, Pukeaudio craps on itself, wireless is a fricking nightmare, I've even seen Ethernet crapped all over so you can't even get to the net to do the forum hunts and CLI fixes that sadly linux users consider par for the course. there is A REASON why people would rather steal Windows than take your product for free, its because your product is a mess that is built for servers and NOT home users, sorry.
ACs don't waste your time replying, your posts are never seen by me.
>Citation please?
Personal fuckin' experience. And if you are so crippled as to not find the official downloads at Microsoft through MyDigitalLife, then I don't know what to fuckin' tell you.
Fuck off. Honestly. You are one of the dumbest people here.
Bye.
--
BMO
http://www.bhphotovideo.com/c/product/645759-REG/Microsoft_GFC_00236_Windows_7_Home_Premium.html
Here's the family pack for $110 --
http://www.bhphotovideo.com/c/product/645759-REG/Microsoft_GFC_00236_Windows_7_Home_Premium.html
A better way hairy, is to use the Windows 7 disk to install a NEW copy first, and when it asks for the key, select "Trial". Once the install is complete, then run it again, and it will detect the trial version and allow you to upgrade it. The "second" install/upgrade is very quick.
In other words "I have nothing but "studies" handed to me by the BSA that says all of TPB is an infect and when you download software you kill a kitten". Again Razr provides checksums (as you insisted on) in both MDA5 and SHA to check ANY release by them, same with the new Fairlight.
So don't blame the world because YOU sir can't use a checksum or scan a disc. If you are downloading off of gnucleus or some other malware haven for noobs I'd say that's a personal problem, but feel free to look at the NFO for the Win 7 release and you'll see they DO provide checksums so you can check it yourself, you can also mount the image and use as many malware scanners as you like. Or are you saying they have come up with "magical" malware that NO scanner can possibly detect? because if so I'm sure the three letter agencies would like to buy that.
Doesn't change the fact that I haven't see an infected game .exe nor an infected Windows install disc in over half a decade, all the Windows discs come with checksums and the games come with the same cracks they have at gamecopyworld, no difference. If you want to use FUD to push an agenda that is YOUR business, but FUD is FUD and if you can't back up your statements with facts then that is what it is, FUD.
ACs don't waste your time replying, your posts are never seen by me.
Huh, never thought of that but then again I do have a WinXP X64 disc sitting around left over from when I ran it from 05-09 so I guess i never saw a need to experiment. I'd still like to know where he got the disc from though, because I have never run into ANY hassles with Win 7 except for those OEM discs that are tied to a brand, such as the Dell laptop discs.
The green box Win 7 HP upgrade and the orange box family packs I've used a good dozen times on all kinds of hardware and never a peep, never a complaint, it just installs and takes the key, easy as pie. That is one of the reasons i prefer them over the OEM discs, with my own system I have replaced every single part but the case itself over the last two years and only needed a single online reactivation when I changed out the board, less than 12 seconds and it was right back to being fully activated. Hell even XP wasn't as hassle free as the green HP upgrade discs are.
ACs don't waste your time replying, your posts are never seen by me.
Well the nice thing about doing it with Windows 7 is that you don't have all the left over legacy crap from doing an upgrade from Windows XP. All the defunct registry settings, outdated .dll's etc aren't still there when you are done. The second install is also much quicker since it doesn't have to do a full upgrade.
This smells of the war against terror. There are actually very few pieces of malware out in circulation which rely on rootkits invoked by the bootloader. It's something which we haven't really seen much of since the viruses of the DOS days. I'd rather take my chances with the malware than have the liberties of doing what I want with my computer taken away.
Back in those days, you could set your bios to pop up a bios-level warning when the bootloader was overwritten. Updating lilo? Sure, up pops the message, and away you go. Running "funscreensaver.exe"? Press No.
You don't seem to get that any more.
"In other words "I have nothing but "studies" handed to me by the BSA "
What part of "if it doesn't match the MD5 it's junk and can't be trusted" do you not understand? You seem to be an admin somewhere, and if I was your boss and I read what you wrote, I would have had you fired so fucking fast that you wouldn't know what happened until you were hurtling down the highway in your retard-mobile.
Fuck you.
--
BMO
How would a TPM do that? TPMs, for the most part, can just do things the main CPU asks it to do, like storing hashes or performing digital signature operations. TPMs can't, despite widespread FUD, interfere with software running on the main CPU. And it certainly can't stop malicious software from overwriting critical OS files.
Actually, upon further reading, it looks like efilinux is replacing Grub2 and will load the OS kernel directly from efilinux. So basically, they're just adopting a new boot loader and getting it's binary signed.
This only effects end user consumers of tablets, handsets and whatever other junk Microsoft peddles on the portable market as they have this laughable secureboot enforced on them. Laughable because CAs are 20th century technology and anyody can get a cert and sign away whatever they wish. I guarantee somebody will null out the UEFI instructions for secureboot or find a way to bypass it within a month of Windows Phone 8 being released and then tell the world how to do it, rendering all this work a waste of time, effort and money.
What happens when Microsoft removes the requirement to be able to disable Secure Boot? It may be cheaper for OEMs to only make one part, one that can't disable it.
What happens when the only way to install Linux is to buy parts off NewEgg and assemble your own system? Potential new Linux users won't be interested in buying a new computer to install an unknown OS that can't even stream Netflix. And would you still be able to install Windows on such systems if you needed to dual-boot?
What happens when only a few motherboard manufacturers are making boards that can disable Secure Boot? Will they be more expensive, being lower-volume? Will Microsoft and others pressure them to stop making such boards? Will the market sustain such boards from their bean-counting perspective?
What happens when their chip suppliers aren't interested in making such chips anymore? Will it be cheaper to just make chips that can't disable it? Will Microsoft force them to stop making them?
What happens when only enterprise users and server farmers can afford systems that are open enough to install whatever software you want? What happens when you have to get a license or authorization of some kind to get unlocked hardware?
What happens when the only unlocked hardware available is old and dying? What happens when there are no more old parts to buy on eBay? What happens when all that's left is low-end stuff like Raspberry Pi?
I sure hope all this doesn't happen--but it wouldn't surprise me if it does.
"Those who consume the bulk of goods are those who make them. We must never forget this secret of our prosperity."
And which part of "It has an MD5 dumbass" are you not able to comprehend? Groups like Razr wouldn't put out a bug because it would destroy their cred on the scene and make damned sure their inside sources dried right up.
So unless you have something other than the BSA and MSFT I call bullshit, frankly i haven't even SEEN an infected .ISO or game in over half a decade, because the ratings system quickly causes anything that has a bug to simply drop off the map. download it yourself, check the MD5 in the NFO, and then scan it until you drop, you won't find a damned thing because there simply isn't anything to find.
Its obviously been years since you've ever dealt with malware, if you ever have, because if it had been anytime in the last 5 years you'd know it all comes from social engineering like Security Tool and AV20xx, or by using out of date third party software like Adobe and Java. Frankly nobody has done it by spreading malware infected discs in years, ratings killed that shit ages ago.
ACs don't waste your time replying, your posts are never seen by me.
*sigh*
Let me explain something to you.
I hang in IRC with a certain individual who actively creates his own botnets by uploading infected software to torrent sites. He hasn't been on the channel lately because Rizon bans him repeatedly for running C&C operations there among other shenanigans.
Do the ratings systems flag his malicious software? No. Because:
1. Nobody ever checks MD5s
2. Nobody ever scans.
3. Those that do scan don't realise that malware attached to recent uploads have been already checked against the current top 10 scanners before uploading to make sure it doesn't get detected. Scanning software is only as good as the most recent update. If it ain't in the database, it's going undetected.
4. The cries of "false positive" are rampant. "Because that's the way the crack works"
5. People take 4 at face value. And shit just stays up for years.
For shits and giggles, last year, I downloaded Catia from a torrent. Because the version I saw apparently runs in Wine and I wanted to check it out. I ran it through a scanner. It was infected. Did *any* of the comments mention even a false positive? No. It's just that malware scanning had finally caught up to the malware being spread.
It sat there for a year before I ran into it and scanned it. A year of positive comments and spreading malware.
1. Unless you can get your grubby hands on the physical media, check the MD5.
2. If it doesn't match, don't use it. It's poisoned. Even if it scans clean, it's fucking poisoned.
This rules out every single "custom" eXPerience "trimmed" Windows. Because even if eXPerience himself does not infect his ISOs, other people take his, add their malware, and upload. And since the MD5 sum never matches the Microsoft MD5 in the first place anyway, and eXPerience doesn't sign his own versions, who the fuck is to tell is the uninfected one?
Uploading an infected torrent is the best way to build a botnet from scratch. QED.
So go ahead, tell me again how I am an agent of the BSA.
Jerk.
--
BMO
actually, i wouldn't buy, even at that price;))>
Subversion of spatial scale luxury decoration ideas.
It's called evernote, and it's done more (and in better ways) via going it's own direction than OneNote ever has. Also it works consistently across platforms and doesn't have gigantic issues sharing/hosting huge files.
Not only sold with hardware, it has to be installed in a specific and arcane manner to be fully license compliant
Good-bye
And you can get a clean copy direct from MS (msft.digitalrivercontent.net)
everyone on the piratebay won't have a rootkit (At least the ones with the same checksum's as the MSDN versions).
Dude, do you live in the middle ages? Windows? Licenses?
http://www.ubuntu.com/
Arguably, the hardware also costs much more than that of your average machine that runs window. Microsoft is more of a software company, Apple is more of a hardware one.
Agreed. Even Bill Gates admitted it. Microsoft would rather you use pirated Windows if it means keeping you away from OS X or *nix. Same with Adobe and their Creative Suite. The primary reason Adobe makes it laughably easy to pirate is primarily because they would rather people pirate it when just screwing around and make it the de-facto industry standard when those pirates have to legitimize when they start using it for a business need. If the aspiring graphic artists are used to Photoshop, they'll buy Photoshop when starting their business rather than jump ship to the GIMP. Microsoft does the same thing. If you're used to using Microsoft's suites at home, you're likely to go with Microsoft solutions in the office as well.