OpenBSD's De Raadt Slams Red Hat, Canonical Over 'Secure' Boot

An anonymous reader writes "OpenBSD founder Theo de Raadt has slammed Red Hat and Canonical for the way they have reacted to Microsoft's introduction of 'secure' boot along with Windows 8, describing both companies as wanting to be the new Microsoft."

Comments

A bit over the top

[jmorris42]

We have been hearing various people who should know better that "Redhat is the next MIcrosoft" and variations on that theme now for at least a decade. Guess Ubuntu should take it as a sign that they have 'made it' that the same is now being said of them.

Not saying I agree with either of their solution to the Kobayashi Maru (otherwise known as Secure Boot) problem, but calling them 'traitors' is a bit much. Especially since I can't rightly say I have a better plan and neither does Mr. deRaadt.

Re:A bit over the top

[Hatta]

Especially since I can't rightly say I have a better plan and neither does Mr. deRaadt.

The better plan is to sue Microsoft for abuse of their monopoly.

Re:A bit over the top

[UnknownSoldier]

> but calling them 'traitors' is a bit much.

Not really. They valued convenience over freedom. That is the antithesis of GPL / BSD. Once you start compromising your values for freedom it becomes easier to justify the convenience.

To paraphrase Ben Franklin: "Those Who Sacrifice Liberty For Security Deserve Neither"

At some point this short-sightedness will come back to haunt them.

Re:A bit over the top

[jmorris42]

> The better plan is to sue Microsoft for abuse of their monopoly.

The old consent decree is long since expired. Good luck starting up a new round of lawsuits, Microsoft discovered lobbists after the last round so the DOJ isn't going to be bothering them again. So your plan is do nothing for years while a court case winds its way through the system and more then likely ends up going nowhere. Boy I'd love to take that plan to the stockholders meeting.

Re:A bit over the top

[Anonymous Coward]

I think in this case, the additional words are important:

"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."

I give up liberties all the time, for various reasons.

Re:A bit over the top

[drinkypoo]

The better plan is to sue Microsoft for abuse of their monopoly.

You mean, so that they can be found guilty again and let go without so much as a hand-slap again? Yes, that would be a wonderfully immense waste of taxpayer dollars.

Re:A bit over the top

[cpu6502]

Desktop and laptop PCs are still 88% dominated by the Microsoft OS. Requiring other OS makers to buy a license from Microsoft is very clear evidence of using their monopoly power to stifle competition. Opera won their lawsuit in the EU with lesser charges. (MS didn't block Opera... just made it difficult to compete against the free OS-embedded IE.) In this case MS is actively blocking Chrome, Ubuntu, Kolibri and other OSes.

I guess I just found another reason to buy a Win7 PC instead of the Win8 version with blockeboot.

Re:A bit over the top

[Mad Merlin]

Especially since I can't rightly say I have a better plan and neither does Mr. deRaadt.

The better plan is to sue Microsoft for abuse of their monopoly.

Perfect, then we can wait a decade for the case to go anywhere, only to have it thrown out in the end and all computers made within the past decade remain unusable.

Re:A bit over the top

[pixelpusher220]

I guess I just found another reason to buy a Win7 PC instead of the Win8 version with blockeboot.

On this at least, we fully agree :)

Any idea how Win7 will be treated by UEFI should we want to install it onto 'newer' hardware in the future?

Re:A bit over the top

[UnknownSoldier]

Do you want to tell that to all the people that died for WW1 or WW2 ?

It is unfortunate that people have to die, but sometimes that is the only way to get others to listen -- that certain concepts, such as freedom are MORE important then one man's life.

Re:A bit over the top

[cpu6502]

>>>Any idea how Win7 will be treated by UEFI should we want to install it onto 'newer' hardware in the future?

Disable the SecureBoot and install Win7 normally. The only problem I worry is that Win7 might not have the necessary modem, printer, wifi, etc drivers for newer i9 or i11 computers?

Re:A bit over the top

[AdamWill]

"Requiring other OS makers to buy a license from Microsoft is very clear evidence of using their monopoly power to stifle competition"

It certainly would be. The only problem is that they're not doing that at all.

The industry as a whole agreed to ratify the basic Secure Boot mechanism as part of the UEFI standard. Secure Boot as described in the UEFI standard does not say anything at all about who should sign code and issue keys and any of that stuff. All it does is say 'here is a mechanism called Secure Boot by which the system firmware can maintain a list of keys and refuse to run code which is not signed by one of those keys'.

So once that's in the UEFI standard, we have a world where there is this thing called Secure Boot which operating system developers and hardware vendors can *choose* to implement. Or not. The UEFI standard says nothing about whether it ought to be used, what keys ought to be included, or anything like that.

So Microsoft, as an operating system vendor, decides they want to use this Secure Boot thing. They're going to sign their operating system, and require vendors who want to pre-load that operating system on their systems to ship Microsoft's key. So that their operating system will run. This is what the Microsoft Windows 8 certification requirements for x86 state: you have to turn Secure Boot on by default and include our key.

What the certification requirements explicitly do _not_ state is this: 'you can't include any other keys'. They definitely don't say that. They just say 'you have to include Microsoft's key'. There's no restriction at all on shipping any number of other keys. Additionally, the certification requirements explicitly require that the user be able to enrol their own keys, and also disable Secure Boot if they so desire.

So...Microsoft's requirements for OEMs are that they enable Secure Boot by default (but allow it to be disabled) and ship Microsoft's key (but they can also happily ship any number of other keys, if they choose).

It's logically impossible to construe this as "Requiring other OS makers to buy a license from Microsoft". It doesn't do that, at all. Other OS makers can have their OS signed by themselves or anyone else they like, and ask hardware manufacturers to ship that key. Microsoft does nothing to prevent this. Or they can choose not to sign their OS at all, and ask users to disable Secure Boot. Microsoft does nothing to prevent this. Or they can _choose_ to have Microsoft sign their OS so it'll work without them needing to get any other key loaded into firmware; Microsoft didn't _have_ to provide public signing services, but they are doing so to avoid a PR shitstorm. If Microsoft really wanted to be evil, why would it provide public signing services at all? Wouldn't it be more effective just to say 'no, we won't do that'?

I find it highly unlikely that you could build a convincing case of monopoly abuse over Secure Boot for x86, when the actual facts of the matter are taken into account. They just don't support the accusation strongly enough. If Microsoft could be shown to be exerting pressure to prevent alternative signing groups from existing or getting their keys loaded onto hardware, then maybe...but AFAIK no-one has shown such.

(disclaimers: I am not a lawyer and this is not legal advice or a legal opinion. Furthermore, though I work for Red Hat, I am not directly involved in any RH evaluation of this issue, I am not involved in RH legal in any way, and this is entirely a personal opinion and not in any way representative of Red Hat. It is not Red Hat's official position on the issue of the legality or otherwise of Microsoft's actions. I specifically leave open the possibility that Red Hat as an entity might take a completely opposite view of the case.)

Re:A bit over the top

[pixelpusher220]

Might want to check your history:

MS trial

The DOJ announced on September 6, 2001 that it was no longer seeking to break up Microsoft and would instead seek a lesser antitrust penalty. Microsoft decided to draft a settlement proposal allowing PC manufacturers to adopt non-Microsoft software.

Who was president in Sept 2001 again?

Re:A bit over the top

[cpu6502]

Actually the announcement came from a federal court of appeals in late 2000. QUOTE: "The D.C. Circuit Court of Appeals overturned Judge Jackson's rulings against Microsoft. This was partly because the Appellate court had adopted a "drastically altered scope of liability" under which the Remedies could be taken......" In other words they decided not to breakup the company.

Late 2000..... before President Shrub arrived on the scene. But hey! Why let "facts" get in the way of good-ole FOX or NBC style distorted reporting?

Re:A bit over the top

[Baloroth]

Of course, the DOJ decision was after this little tidbit:

The D.C. Circuit Court of Appeals overturned Judge Jackson's [original judge who issued the breakup order] rulings against Microsoft. This was partly because the Appellate court had adopted a "drastically altered scope of liability" under which the Remedies could be taken, and also partly due to the embargoed interviews Judge Jackson had given to the news media while he was still hearing the case, in violation of the Code of Conduct for US Judges.[17] Judge Jackson did not attend the D.C. Circuit Court of Appeals hearing, in which the appeals court judges accused him of unethical conduct and determined he should have recused himself from the case.

(bracketed bit inserted by me)

Re:A bit over the top

[Nethead]

It wasn't the gas tanks that were bad on the Pintos, it was bolts behind the tank that were too long. Ford recalled and fixed them. I know, I had a '74 Pinto that was recalled back in the day, with mag wheels!

What Ford didn't/couldn't fix was the horrid way the car shook between 64 and 72MPH. They didn't have to fix that because the national speed limit was 55MPH.

Re:A bit over the top

[cpu6502]

Now here's an essay for you to read..... written by the Free Software Foundation:
(snip)

In theory, there should be no problem. In practice, the situation is more complicated. As currently proposed, Secure Boot impedes free software adoption. It is already bad enough that nearly all computers sold come with Microsoft Windows pre-installed. In order to convince users to try free software, we must convince them to remove the operating system that came on their computers (or to divide their hard drives and make room for a new system, perceptually risking their data in the process).

With Secure Boot, new free software users must take an additional step to install free software operating systems. Because these operating systems do not have keys stored in every computer's firmware by default like Microsoft does, users will have to disable Secure Boot before booting the new system's installer. Proprietary software companies may present this requirement under the guise of "disable security on your computer," which will mislead new users into thinking free software is insecure.

Without a doubt, this is an obstacle we don't need right now, and it is highly questionable that the security gains realized from Secure Boot outweigh the difficulties it will cause in practice for users trying to actually provide for their own security by escaping Microsoft Windows.

It's also a problem because the Windows 8 Logo program currently mandates Restricted Boot on all ARM systems, which includes popular computer types like tablets and phones. It says that users must not be able to disable the boot restrictions or use their own signing keys. In addition to being unacceptable in its own right, this requirement was a reversal from Microsoft's initial public position, which claimed that the Windows 8 program would not block other operating systems from being installed. With this deception, Microsoft has demonstrated that they can't be trusted. While we are interpreting their current guidelines, we must keep in mind that they could change their mind again in the future and expand the ARM restrictions to more kinds of systems.

The best way out of all of this (other than having all computers come pre-installed with free software) would be for free software operating systems to also be installable by default on any computer, without needing to disable Secure Boot. In the last few weeks, we've seen two major GNU/Linux distributions, Fedora and Ubuntu, sketch out two different paths in an attempt to achieve this goal.

Fedora's approach

There is much to like about Fedora's thinking, as explained by Matthew Garrett......... Unfortunately, while it is compliant with the license of GRUB 2 and any other GPLv3-covered software, we see two serious problems with the Microsoft program approach.

1) Users wishing to run in a Secure Boot environment will have to trust Microsoft in order to boot official Fedora. The Secure Boot signing format currently allows only one signature on a binary -- so Fedora's shim bootloader can be signed only by the Microsoft-vouched key. If a user removes Microsoft's key, official Fedora will no longer boot, as long as Secure Boot is on.

2) We reject the recommendation that others join the Microsoft developer program. In addition to the $99 expense being a barrier for many people around the world, the process for joining this program is objectionable. A nonexhaustive list of the problems includes: restrictive terms in multiple of the half-dozen contracts that must be signed, a forced commitment "to receive targeted advertisements and periodic member email messages from Microsoft," and a requirement to provide notarized proof of government-issued identification and a credit card.

Ubuntu's approach

Their approach has the same issue as Fedora's official method. Users have to trust Microsoft in order to boot official Ubuntu CDs. Their certification program amplifies this problem, because it means no one can sell certified Ubuntu machines without trusting Microsoft.

Re:A bit over the top

[vux984]

), but it doesn't change the fact Canonical and Redhat were forced to buy a license *from Microsoft* or else their OSes would not run.

That is not true.

Their OSes will run just fine provided any of the following are done:

a) the user logs into UEFI and disables secure boot

b) the user logs into UEFI and installs a distro key

c) the user logs into UEFI and installs their own key and signs the distro themselves.

d) the distro provider works with the manufacturer to have their key pre-loaded the same as microsofts.

Microsoft (currently) does prevent or even hinder any one of those alternatives on x86.

Canonical and Red Hat noted that a & b require at least a nomimal effort by the end user. (c requires a fair bit of effort for the end user) And that d required a substantial effort on their part.

So they chose "e) sign our distros with the MS key" that Microsoft already took the effort to have preloaded so that our users don't need to take the nominal step of disabling secure boot or of installing their own keys.

"That is called restraint-of-trade and it is VERY clearly a violation of the Sherman Antitrust "...

No its not.

"now they are actively blocking other OSes from Opera/Google/other OSes from running (unless they beg MS for a license)"

You don't need a license from microsoft. The end user can disable secure boot. The end user can install their own keys. The distro can approach the hardware manufacturer and have their own keys preloaded along side microsofts.

Microsoft isn't preventing anyone from doing anything, and you do not need to interact with microsoft at all to install other OSes.

Please COMPREHEND the above before replying or commenting on the subject further.

Re:A bit over the top

[drinkypoo]

Who? What?

Re:A bit over the top

[vux984]

What about ARM?

What about it?

Microsoft doesn't have a monopoly in ARM devices (tablets and smartphones). Their competitors in Apple and even many Androids have restricted boot to their signed binaries.

We all agree that its not the situation we want, and we all agree we should demand the right to the keys to our devices (which we currently have on x86).

But it is absurd to suggest Microsoft is abusing its monopoly position in the ARM device market.

Re:A bit over the top

[Taco Cowboy]

You said this:
 
 

Microsoft (currently) does prevent or even hinder any one of those alternatives on x86

 
Then you turned around and said this:
 
 

Microsoft isn't preventing anyone from doing anything, and you do not need to interact with microsoft at all to install other OSes.

 
Please elucidate what are you trying to get at
 
Thanks !

Re:A bit over the top

[vux984]

And if you read that document the FSF advocates options b) and c) in my previous post. (installing their own keys, signing their own code). This is something users are free to do without having to trust in microsoft nor interact with microsoft, nor "beg" for licenses from microsoft.

In other words, the FSF, unlike you, recognizes that users can install other OSes without Microsoft.

Re:A bit over the top

[Anonymous Coward]

I guess I just found another reason to buy a Win7 PC instead of the Win8 version with blockeboot.

That'll show Microsoft.

Re:A bit over the top

[AdamWill]

Yeah, that's why I limited my post specifically to x86. The ARM requirements are much stricter: Secure Boot must be enabled and must not be disable-able, and the user must not be able to enrol their own keys. I don't believe the requirements reject the possibility of other keys being preloaded, but in practice I doubt we'll see that.

As other responders have pointed out, though, there's a different problem with alleging monopoly abuse when it comes to Windows RT / ARM, which is that Microsoft doesn't have any kind of monopoly on any kind of ARM client device. It doesn't have a tablet or phone monopoly. Consumer ARM devices are often sold heavily locked down; Microsoft isn't doing anything new there. (Most Android phones / tablets, and all Apple ones, are locked down in similar fashion).

Re:A bit over the top

[AdamWill]

Yes. Either the UEFI spec or the Microsoft requirements (I forget which) state that if the user removes all keys, the machine should go to 'secure boot disabled' state. So if the specs are actually followed, you should be able to remove the Microsoft key from any hardware you buy and that will automatically kick the system into 'secure boot disabled' state. Or you could just disable it directly.

Re:A bit over the top

[bill_mcgonigle]

the fact Canonical and Redhat were forced to buy a license *from Microsoft* or else their OSes would not run

So the fact that they chose to pay Microsoft $80 rather than establish vendor relationships with every motherboard and BIOS manufacturer (as Microsoft did) creates a situation of force?

"Oh that's okay... it's a free market. I love the megacorps". You Corporate loving sellout.

ah, this was just an excuse to lash out at somebody, wasn't it?

Re:A bit over the top

[elashish14]

Guess Ubuntu should take it as a sign that they have 'made it' that the same is now being said of them.

Maybe we should hold off on that until they turn a profit....

Re:A bit over the top

[Sir_Sri]

And that supposes you could claim ARM as a separate market from x86. MS could probably pretty easily argue that there is a tablet market, and that they have offerings in that market where you have to use restricted boot, and some where you don't. At that point you'd have to show they are intentionally making it hard to get the ARM only version, which if they have any brains (and they might not) they won't.

Re:A bit over the top

[AdamWill]

"That's a nice 3-page essay (double-space I presume), but it doesn't change the fact Canonical and Redhat were forced to buy a license *from Microsoft* or else their OSes would not run."

That's still not a fact. We were not forced to buy a license. We had several options, which Matthew outlined way back at the start of this whole saga, in this blog post:

http://mjg59.dreamwidth.org/12368.html

Specifically, the paragraph headlined "Getting the machine booted". It mentions the other options, including "the possibility of producing a Fedora key and encouraging hardware vendors to incorporate it" and "producing some sort of overall Linux key". There is also the obvious negative possibility of simply not signing anything at all; this would require users to disable Secure Boot in the firmware before installing Linux, but it doesn't prevent them from doing so.

Both Fedora (note, Fedora, not RH; RH does not necessarily always follow what Fedora does) and Ubuntu had several choices and _chose_ to go with the Microsoft signing service as the 'least bad' option (well, Ubuntu will also be self-signing, for OEM preloads). The fact that we are _choosing_ to get our releases signed with the Microsoft/Verisign key does not imply that we were _forced_ to do so. We _choose_ to do so on the basis that it'll provide the maximum possible success rate of Fedora installs with the minimum amount of work. We could have chosen to self-sign, or not to sign at all, and ask users to disable Secure Boot or import our key. We decided not to do so.

"Problem si that peope like YOU seem to think corproatuions never od anything wrong"

This is an absurd stretch. You appear to be implying that anyone who suggests that a corporation might ever do anything at all that is _not_ wrong, must therefore believe that a corporation can _never_ do anything wrong. This is clearly ridiculous and false. You also mistake my opinion that Microsoft's actions are _not illegal_ for an opinion that they're _right_. These are not the same thing at all. I have carefully refrained from stating in public any personal opinion on the Rightness or Wrongness, from an ethical/moral standpoint, of Microsoft's actions. This is intentional. What I have said several times is that I don't believe the actions can successfully be characterized as _illegal_. Not everything that's wrong is also illegal. But if something is wrong/bad but not illegal, then you can't defeat that something through the courts. This sub-thread was prompted by someone saying that RH and Canonical should have chosen to prosecute or sue Microsoft. My point is that this is hardly a viable option if the suit would fail.

Re:A bit over the top

[jonwil]

Microsoft may have discovered lobbyists but their lobbyists didn't save them from EU rulings (Windows N with no media player, the "Browser Choice" screen etc). There is no reason to think the EU wouldn't be interested in investigating other abuses of monopoly power by Microsoft (including anything to do with secure boot)

Re:A bit over the top

[vux984]

Clearly, my bad. I'd hope the sentiment was clear from the over all post, but for the sake of correcting it, the "does" in the first quoted sentence should be "does not" or "doesn't".

Re:A bit over the top

[pixelpusher220]

"However, the appeals court did not overturn the findings of fact [of Jackson's ruling]. The D.C. Circuit remanded the case for consideration of a proper remedy under a more limited scope of liability."

So they disagreed with his 'method' but not his findings.

To which Shrub decided to publicly not ask for much.

Re:A bit over the top

[vux984]

But it's a simple point of fact to state that it is using a monopoly position in one area of a market to abuse another.

How on earth do you see the two linked?

To "abuse a monopoly position" would require that one need a monopoly in order to do something else. Ie... only Microsoft could abuse its desktop monopoly to force internet explorer onto every desktop. Opera can't put its browser on every desktop no matter how badly it wants to because it doesn't have that desktop monopoly.

So how does having a desktop monopoly facilitate Microsoft's move on ARM? Apple has locked down all its ARM devices.HTC, Samsung, Motorola are all selling ARM devices with locked bootloaders...

Indeed it seems any player in the market can and routinely does lock down the bootloaders on its smartphones and tablets.

So explain to me, how exactly does Microsoft's desktop monopoly enable them to do something other manufacturers can't do? Because it seems to me that Microsoft is no different than the already established players in the ARM smartphone and tablet players.

Re:A bit over the top

[bws111]

Nope. They valued their customers over fighting some stupid pissing contest.

What exactly are their chioces?

1) Do nothing
2) Whine about how unfair it is
3) Label their product with: Not compatible with any PC with a Windows logo on it
4) Create their own signing infrastructure, sign their binaries, work with all motherboard and system provides to get their key installed
5) Sign their binaries using an already-trusted key
6) Tell their users to disable Secure Boot
7) Tell their users to create and install their own key, and sign the binaries with it

Options 1, 2, and 3 do nothing to advance Linux, the companies, or freedom. They pretty much just relegate Linux to the 'hobby' sector forever.
Options 4 and 5 are the easiest for the end user, with option 4 costing quite a bit more for very little benefit
Options 6 and 7 are inconvenient for the user, and provide no benefit to the user over options 4 and 5

Now, exactly what 'freedom' has been lost by the companies actions? Do you still get the ability to install the binaries wherever you want? Yes. Do you still get the source code? Yes. Can you still install and run your modifications? Yes.

The only thing that changes is that if you want to modify and run the bootloader you must do option 6 or 7. Making everyone use those options is OK, but making only people who want to modify the boot loader jump through those hoops is somehow a loss of freedom? Do explain.

Re:A bit over the top

[occasional_dabbler]

Utter f*cking rubbish. I just installed W8 preview alongside Ubuntu 12.04 (yes, a sweet combination, Ithankyou). Of course the Winstaller doesn't nicely search out the other OSs but it was a couple of clicks on a bootable Ubuntu CD to fix this.

Re:A bit over the top

[betterunixthanunix]

I find it highly unlikely that you could build a convincing case of monopoly abuse over Secure Boot for x86,

Oh yeah? It was not that hard to build a convincing case for monopoly abuse when it came to Netscape and IE. Remember the process required to remove IE from a system? I suspect that all it would take is to show a court what a user has to do to remove Microsoft's key from their Windows 8 system, and the case would be made right then and there.

Re:A bit over the top

[betterunixthanunix]

Microsoft (currently) does prevent or even hinder any one of those alternatives on x86.

I see what you did there...

(For the record, I own an ARM desktop)

Re:A bit over the top

[lister king of smeg]

well thats great for all of you in Europe and the UK, but for us over here in north America are still screwed up the @SS#013.

Re:A bit over the top

[Anonymous Coward]

I think you're failing to understand the implications of your own argument. The reasons some of those courses of action are difficult is precisely because Microsoft makes the decisions which every one else has to react to. That's because of their monopoly power. Only a court can decide if it is an abuse of their monopoly power, but personally I think it is. You're so used to the current situation, you think it's 'normal'. It's not normal at all, dude.

Re:A bit over the top

[chriscappuccio]

This is a pathetic response. Companies with resources like Red Hat and Canonical should take the effort to register keys directly from BIOS and/or motherboard manufacturers. The time to get these arrangements is now, when UEFI is in its infancy, not later when Microsoft changes their policies and keys. Some computer manufacturers will choose to not enter agreements, others won't allow you to disable Secure Boot. The right approach is for people who care to support manufacturers that aren't imbeciles. The problem with this approach is that it'll be less convenient for some Red Hat and Canonical customers. Even if Microsoft remains 100% trustworthy, the largest open source operating system companies should not be taking a back seat to Microsoft. Something is really wrong when your company buys control to run on the world's computers from Microsoft for $10.

Re:A bit over the top

[Anonymous Coward]

What monopoly is being abused here, and how exactly is it being abused? Given that both RedHat and Canonical have been given access for the price that effectively amounts to processing cost (and that doesn't even go to MS), and that end users can disable secure boot on non-ARM devices, you'll have a hard time convincing the court that competitors are being hampered there. On ARM, on the other hand, Microsoft simply does not have any monopoly.

Re:A bit over the top

[cheesybagel]

What would you think if Microsoft was the only presently available registrar in the Internet and that you had to convince every single hardware vendor in order to get an additional registrar?

Re:A bit over the top

[cheesybagel]

Ugh I guess this is the time to stick to playing old games and eventually only run Windows in a VM inside Linux.

Re:A bit over the top

[cheesybagel]

It is you who do not comprehend. The default installed key should not be controlled by Microsoft. At best if there was a default installed key it should be controlled by a 3rd party which does not conceive or sell OSes Even that bastardization called AACS used in Blu-ray is controlled by a consortium of companies. Not a single vendor. IMO there should be no access control which is not explicitly controlled by the user since it only provides a false sense of security. For all we know Microsoft or someone with their key could still sign malicious software and it will still run on your machine. It would not be the first time there is an issue with certificates. But if they want to add this crap they certainly picked the best way for them to control the market at will.

Re:A bit over the top

[cheesybagel]

They should have tried going with the Linux key. Even if not all hardware vendors supported it at first and support was miserable it was a better option than this crap.

Re:A bit over the top

[blind biker]

You don't need a license from microsoft. The end user can disable secure boot. The end user can install their own keys.

Until that day when the user can't. Even Canonical admitted that this is not just a possibility in the future, but quite likely.

Re:A bit over the top

[cheesybagel]

Not unattended nor without messing with the BIOS configuration. It is just one more barrier added by the incumbent to distort the playing field.

Re:A bit over the top

[cheesybagel]

I would pick 4) and 6). I will try to do 6).

Re:A bit over the top

[kenorland]

So how does having a desktop monopoly facilitate Microsoft's move on ARM?

Microsoft is shipping the same operating system that they have a monopoly on on x86, now on a new more energy efficient platform. And in order to gain a monopoly on that new platform, they lock it down there.

Apple has locked down all its ARM devices.HTC, Samsung, Motorola are all selling ARM devices with locked bootloaders...

None of these companies have a desktop monopoly, hence it doesn't matter what they do.

Because it seems to me that Microsoft is no different than the already established players in the ARM smartphone and tablet players.

That is true only when they ship a product unrelated to Windows and Office. When they ship Windows and Office, or anything related to it, on any hardware, their monopoly on that software, of course, matters and makes their actions different from anybody else's.

Re:A bit over the top

[kenorland]

You don't need a license from microsoft. The end user can disable secure boot. The end user can install their own keys.

In reality, half the time the only thing that will work is booting with Microsoft's key, if not for any other reason than because that's the only thing vendors will test with. And in the future, more on more of the hardware will become unusable unless you boot with Microsoft's key.

Re:A bit over the top

[sjames]

Now, can you kindly tell me how any of that would be relevant if I should want to install Linux on an ARM based tablet? Where (at MS's insistence) the user cannot turn off secure boot?

Re:A bit over the top

[metacell]

If Microsoft is defeated in EU courts, it could still help you a little back home, if nothing else by serving as an example.

Re:A bit over the top

[sjames]

Yes, the FSF advocates that Free software take the hit rather than paying tribute to MS. But that *IS* still taking a hit.

Re:A bit over the top

[metacell]

So how does having a desktop monopoly facilitate Microsoft's move on ARM?

I'm not so familiar with the facts of the case, so I'm only speaking hypothetically, but Microsoft could use their monopoly on desktop OS:es as leverage when they negotiate with OEM manufacturers, and get them to lock down ARM devices.

Re:A bit over the top

[metacell]

Where I live, you're allowed to drive faster than the speed limit when overtaking another vehicle. Is that true in the USA too?

Also, there are situations where you need to drive faster than the speed limit to avoid accidents. For example, if another vehicle is out of control and heading right at you.

So a car that starts behaving uncontrollably at 9MPH over the national speed limit seems to cut it a bit close. I certainly wouldn't want want to ride on a highway in a car like that.

Re:A bit over the top

[complete loony]

I think the best possible solution would involve hardware manufacturers to not include *any* keys with the computer. UEFI needs a standardised way to look for a new key from boot media, and prompt the user to import it. Though of course we all know how effective click through warnings are...

Re:A bit over the top

[shutdown -p now]

Sure. You want Windows 8 Hardware Certification Requirements, client and server systems, System.Fundamentals.Firmware.UEFISecureBoot; specifically:

17. Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:

It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx), which puts the system into setup mode.

If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system is operating in Setup Mode with SecureBoot turned off.

The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults.On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled.

18. Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems.

So the switch is indeed forbidden on ARM, but is explicitly required on x86.

The point is not really moot, because both Fedora and Ubuntu have only made arrangements to run on x86 with the Microsoft singing key; it won't let them run on ARM, and they're not planning anything to change that. So in that respect they haven't compromised on any freedoms for the users to be able to modify and replace any OS code, they just made it more convenient for the most common case of running stock kernel/bootloader.

Windows ARM tablets may or may not become more common, that is yet to be seen - this perch is mostly Apple's right now, with Android trying hard to squeeze some of it for itself. Either way, being locked down like that is common for most ARM devices, so nothing new there - Win8/ARM tablets are simply not real PCs in that sense, much like iPads are not real Macs.

Re:A bit over the top

[vux984]

so I'm only speaking hypothetically, but Microsoft could use their monopoly on desktop OS:es as leverage when they negotiate with OEM manufacturers, and get them to lock down ARM devices.

Apple, Samsung, HTC, Motorola, all have locked down bootloaders on devices... clearly you don't need a desktop monopoly for leverage here.

Re:A bit over the top

[Paradigma11]

posting to undo mderation.

Re:A bit over the top

[vux984]

And in order to gain a monopoly on that new platform, they lock it down there.

How does locking it down gain them a monopoly in a new market?

If people want an android arm device they buy one...
If they want an apple arm device they buy one...

The fact that you can't install ios or android on your arm tablet that came preloaded with windows 8 is hardly going to gain them a monopoly.

None of these companies have a desktop monopoly, hence it doesn't matter what they do.

Microsoft isn't leveraging its monopoly at all though. If they told OEMs they could only sell Windows 8 ARM devices if they wanted to sell windows 8 desktops -that- would be an example of leveraging their marketshare.

Requiring that windows 8 arm 'appliance' devices be locked down, the same as most any other arm appliance device is not an abuse of monopoly.
 

Re:A bit over the top

[metacell]

It increases the cost of business for Canonical/RedHat to negotiate with all the OEM manufacturers and get them to include their key.

If you're Microsoft and already have deals with all OEM manufacturers, the cost may be negligible, but if you're Canonical/RedHat and your OS comes pre-installed on less than 1% of desktops, it may not be practically possible.

This is true for anyone who wants to enter the market for desktop operating systems and potentially compete with Microsoft. In economical terms, the SecureBoot system raises the barrier of entry for the desktop OS market.

Because of Microsoft's history of anti-competitive behaviour, I'm also worried about what they'll do next. Once they have control over the SecureBoot system, they could work to make it mandatory, citing piracy as reason. They could also pressure the OEM manufacturers, inofficially, to say "no" when a competitor asks them to include their OS keys. They could make it slow and costly for competitors to get new OS versions signed. Smaller Linux versions, without the backing of a corporation, won't be able to afford signing or getting OEM manufacturers to include their keys.

I don't know what'll happen, but having control over SecureBoot seems like too much power to place in the hands of any company.

Then there's the risk that the state will abuse the system once it's in place. SecureBoot controls what OS can be run, and the OS can control what software can be run, using a system of checksums and signing keys. In fact, the technology for that is already in place in Windows Vista onwards, but for the moment, you only get a warning when you try to run an unknown executable. If the state decides to outlaw certain software (such as encryption, hacking tools or P2P file sharing programs), SecureBoot combined with Windows enables them to enforce that law. If that ever happens, it'd be very good for Microsoft, since it severely reduces competition in the OS market, and gives even more power to the company who handles the signing of their competitors' OS:es.

Re:A bit over the top

[vux984]

Not unattended nor without messing with the BIOS configuration. It is just one more barrier added by the incumbent to distort the playing field.

No, its there to stop root kits.

The barrier to other OSes is a problem, but to use a car analogy, its like buying a car and the wheels have a lug nut lock because theft of wheels has been a growing problem.

The aftermarket rim vendors get upset because its a barrier to easily installing new wheels. And this is true. and its just a matter of unlocking the nut to change the wheel. Sure, its one extra step, and thus a 'barrier' but its dishonest to claim the OEM did it to lock out aftermarket wheels. -- The owner the car was given the key for crying out loud.

Re:A bit over the top

[metacell]

So the fact that they chose to pay Microsoft $80 rather than establish vendor relationships with every motherboard and BIOS manufacturer (as Microsoft did) creates a situation of force?

Establishing relationships with all the manufacturers would have been very expensive, if at all possible. Instead, they had to let Microsoft sign their keys, which gives Microsoft power over their competitors.

Re:A bit over the top

[vux984]

Yes its a "hit" but its a necessary one and a reasonable one, and microsoft isn't doing it with malice towards other operating systems, but merely to check the spread of rootkits etc against windows.

Hell, the fact that Microsoft is even allowing linux distros to be signed against their key suggests how far they are willing to go to accomodate easy 'other os'.

I'm not saying distros should take advantage of it in general... installing the distro key manually i think is the better solution overall; but it is nice to have this as an option, especially for LiveCDs.

Re:A bit over the top

[metacell]

Yes, you chose to let Microsoft sign your OS, but Microsoft created the conditions which caused that choice to be the least damaging for your business.

Re:A bit over the top

[vux984]

Until that day when the user can't.

Yes, i agree completely with you on this. However, that doesn't mean we should object to -this-. We should object to -that-. We should even start objecting to -that- now, and get regulation in place to ensure -that- can't happen.

But there is nothing wrong with -this-.

Re:A bit over the top

[vux984]

Now, can you kindly tell me how any of that would be relevant if I should want to install Linux on an ARM based tablet?

Yes MS's insistence there is an issue that we can all agree is undesireable, but the point is it has nothing to do with their desktop monopoly. They aren't leveraging their monopoly to make that happen.

Most of the exisiting non-Microsoft ARM devices are also locked down*... clearly one doesn't need a monopoly to leverage to make that happen.

(* And its just as undesirable that ipad's and many android tablets are locked out..)

Re:A bit over the top

[sjames]

They are, however trying to leverage that monopoly in order to control other markets.

Consider, Wham-o produces Wham-OS and insists that any tablet using it must be locked to Wham-OS forever. What do you suppose the odds are that the manufacturers would just blow them off and produce a Linux pad instead? Now what are the odds that MS will get the blow off for Windows RT (which is confusingly marketed as Windows 8 but not Windows 8 but instead, Oh, what in the hell is it anyway?)

Meanwhile, either way, I do not appreciate the lock-down on any platform. Hardware should never be designed to reject the owner's explicit commands where it is technically possible to carry it out.

Re:A bit over the top

[metacell]

The loss of freedom is that Canonical/RedHat now has to go through their competitor (Microsoft) every time they do an OS upgrade. It gives Microsoft power over them. Microsoft can change their mind at any time and make it more difficult to get new OS versions signed, or just threaten with it to make their competitors step in line.

Microsoft can also change their mind at any time and require their OEM manufacturers to make SecureBoot mandatory (i.e, not possible for the user to turn off).

Re:A bit over the top

[TheRaven64]

One of the common examples of anticompetitive behaviour that antitrust cases cover is using a monopoly in one area to gain one in another. The fact that Microsoft doesn't have a monopoly in ARM operating systems does not help them defend against this sort of complaint, because the argument would be that they are using their monopoly on x86 operating systems to gain one on ARM operating systems.

To test whether this is a valid complaint, the court would propose the thought experiment: imagine that Microsoft is a new startup producing their first OS and makes the same requirement. Would manufacturers agree to it? If not, then Microsoft has violated antitrust regulations. I would imagine not, because being able to install a different OS after market would minimise buyers' risk (see any discussion of HP TouchPads and count the people saying 'well, if I don't like WebOS I can always install Android...').

Re:A bit over the top

[sjames]

Actually, it is not necessary at all. Why not default to boot anything and just support secure boot? Suggest that users sign their freshly installed OS and turn it on? Ideally, UEFI itself would have that as an easy to find option and it would sign whatever the currently installed OS is.

From there, the user may choose to set a password on changing the root key/signing a new OS or not.

Of course, since users do silly things like lose passwords and such, there must be a way to purge the key and the password to start over. Because that is necessary (since users will be really ticked if losing the password means they own a paperweight), the secure boot really doesn't do all that much that's useful anyway. It's all downside.

Re:A bit over the top

[TheRaven64]

WW2 I might agree with, but WW1? What exactly was the cause there? The soldiers on both sides had far more in common with each other than with their leaders. I suppose that reducing excess population in the lower classes counts as a cause, but it's not one that I'd encourage people to be willing to die for...

Re:A bit over the top

[sjames]

See my comment hjere. They most certainly ARE leveraging their desktop monopoly to even get manufacturers to care about Windows RT at all, much less enough to produce a locked down product when otherwise a tablet that has more options would likely sell better.

Re:A bit over the top

[kenorland]

The situation is not at all analogous to other ARM-based devices. Google isn't asking device manufacturers to lock down their hardware, they choose to do it. And neither Google nor Apple have OS monopolies, nor are they offering the same OS on desktops and tablets. And Android vendors are moving towards giving you the option of installing other software.

Microsoft is seeing the writing on the wall, namely that people are ditching their desktops and laptops for tablets. So they are trying to leverage their (near) desktop monopoly into a tablet monopoly, namely by trying to flood the market with Surface tablets and locking down the hardware so that you can run nothing other than their software on it. Yes, that is an attempt to gain a monopoly; if that situation had existed for x86 hardware, we wouldn't have Linux or any open operating systems.

Furthermore, if there is nothing to be gained from it, as you argue, why doesn't Microsoft leave it up to vendors, just like they do with x86 hardware?

Re:A bit over the top

[justforgetme]

Ok, you see, this exactly is a problem. This isn't a monopoly abuse in the classical sense it just is a move to establish the big enterprise at the cost of the smaller solutions. The thing is Microsoft paves the "way" to signed bootloaders in a way that is very unfriendly to homebrew since software can't (AFAIK) auto install it's certs into the pre boot process. This leaves two options: 1) manual installation of the certs by the end user which isn't very straight forward and could even become impossible 2) pre installation of all available certs by the manufaturer (now guess for how many reasons manufacturers aren't going to auto install keys for all available linux/hurd/bsd distros, yep there are many).
Which leaves independent guys that release some spin of some distro out of the game completely since they do not have the manpower to ring up all manufacturers and `demand` the inclusion of their signatures on the manuf's devices' uefi rom and makes it much more difficult for guys trying to do mobile device gnuxes hanging there not knowing how to actually respond.

So yeah. It hasn't anything to do with monopoly or any other 80s board game. It's just the fat bully pushing around the nerds.

Re:A bit over the top

[metacell]

Is that a legal requirement for monopoly abuse? That the monopolist does something someone without a monopoly couldn't normally do?

Re:A bit over the top

[ifrag]

auto install keys for all available linux/hurd/bsd distros

Couldn't everyone just leech off the "shim" boot loader that Redhat is going to have? Once you are in Grub I'd think you could boot whatever else you wanted (either that or I don't understand how they are implementing this). Is this somehow going to be made technically impossible by Redhat?

Of course this creates a much unwanted dependency on something which other distributions might not be able to include legally in their builds.

Re:A bit over the top

[justforgetme]

Of course this creates a much unwanted dependency on something which other distributions might not be able to include legally in their builds.

You are answering to yourself there. Even if possible - which, IMO, if secureboot is correctly done it shouldn't be - it would be counter productive and locking you in into redhat's bootloader choices.

Re:A bit over the top

[r_a_trip]

Valve is porting Steam to Linux. So the future might not be so dire.

Re:A bit over the top

[jellomizer]

The executive branch has the power to unforce or not unforce a law. Also the ability to pardon people from crimes.

Re:A bit over the top

[jedidiah]

What Microsoft has is a monpoly on the companies that are likely to make such ARM tablets. They have an already existing pathalogical relationship with "the industry". They can bully "the industry" around and make something appear democratic when it's really just Microsoft pushing everyone around.

"The industry" doesn't want to lose the ability to sell the predominant platform. It's the same stick that has always been there and the same stick that's gotten Microsoft sued by various national regulators for decades.

Re:A bit over the top

[RaceProUK]

I see what you mean. After all, I couldn't find any of the N versions on any of the major web stores.

Re:A bit over the top

[jbolden]

Given that Microsoft sells keys at essentially cost to competitors how is this "abuse"? Doing stuff you don't agree with is different from abusive practice.

Re:A bit over the top

[jbolden]

How many bootloaders are there? I'm thinking in 18 years of using Linux I've seen about 5. These certs are $99 each. So say $500 solves the problem for every loader.

Re:A bit over the top

[mister_playboy]

Where I live, you're allowed to drive faster than the speed limit when overtaking another vehicle. Is that true in the USA too?

No, it is still illegal. Everyone does it in practice, of course.

Re:A bit over the top

[jbolden]

Requiring other OS makers to buy a license from Microsoft is very clear evidence of using their monopoly power to stifle competition.

They aren't requiring them to buy a license nor is it from Microsoft. They are requiring other OS makers to file a little paperwork and pay a trivial processing fee. There is no attempt to stifle competition as is demonstrated by the fact that when RedHat and Ubuntu applied for keys they got them.

Re:A bit over the top

[bws111]

Wait a second. I thought that the 'freedom's that are so important to FOSS are the freedoms of the USERS. Who care's about Red Hats freedom, other than Red Hat? They already gave up a bunch of their own freedom (to protect the freedom of their users) when they started distributing GPL code. This is no different - their action is not impacting the freedom of their users at all, it is just making it easier for them to use Red Hat's product.

Second, they don't have to go to Microsoft 'every time they do an OS upgrade', they need to go to Microsoft every time they update the bootloader.

Many, many, companies do business with competitors. Microsoft and IBM are competitors, yet IBM uses Windows internally and sells it to their customers, and Microsoft buys their xbox chips from IBM. Apple and IBM used to be competitors, yet Apple bought their processors from IBM. People figured out how to keep a competitor they are doing business with from having power over them a long time ago - it is called a contract. I highly doubt Red Hat was stupid enough to enter a deal with Microsoft that didn't specify that Microsoft can't 'just change their minds' or 'make it more difficult to get a new OS signed'.

How is anything Red Hat does supposed to keep Microsoft from changing their mind and requiring that Secure Boot can't be turned off?

Re:A bit over the top

[Hatta]

Microsoft isn't preventing anyone from doing anything, and you do not need to interact with microsoft at all to install other OSes.

Microsoft doesn't have to prevent anyone from anything in order for their behavior to be anti-competetive. Microsoft never prevented anyone from using any browser they wanted, and it was still found that preloading IE gave them an unfair advantage. Similarly, preloading Microsoft's key onto every motherboard gives them another unfair advantage.

Re:A bit over the top

[Scragglykat]

You mean like when they were sued for forcing everyone that used their OS to use their browser engine? Oh wait, that's Apple on iOS... Microsoft only included the browser, didn't include it AND force you to use it.

Re:A bit over the top

[jbolden]

Its been a while since I've done this but... I don't think that's true. If you partition a drive prior to Windows installation it won't grab those other partitions. Unless you explicitly tell it to Windows doesn't resize partitions. So when you lay out your drive /var, /home, swap... just leave one for Windows.

Re:A bit over the top

[jbolden]

First off I'm not sure that any significant percentage of the population actually changes OSes on Arm devices. If they don't like the device they return it to the store.

However, in terms of the thought experiment ... we know that they would agree to it, since we've had ARM devices produced by small firms with locked down OS configurations. The marketing approach is a little different where the OS company is tangential and the manufacturer is being hired so the device can be rebranded.

Re:A bit over the top

[jbolden]

That is called restraint-of-trade

No it isn't. To commit restraint of trade you actually have to restrict trade. No judge is going to see a $99 processing fee as restricting trade.

Re:A bit over the top

[bws111]

What makes you think Red Hat (or any other Linux distributor) is against Secure Boot, or was not involved in the discussions? Red Hat is a 'contributor' to the Trusted Computing Group after all.

The only thing they are "scrambling" to work around is Microsoft's decision on what the conditions are for a hardware manufacturer to get a Windows certification. I don't know what you think Red Hat can do to influence how Microsoft licenses their own product.

Re:A bit over the top

[bws111]

Why is a bootloader 'signed' by the Linux foundation any different than one signed by Red Hat? In either case, no-one (user or other distributor) can modify the code and still have it be recognized as signed.

Re:A bit over the top

[jbolden]

Smaller Linux versions, without the backing of a corporation, won't be able to afford signing or getting OEM manufacturers to include their keys.

The cost is $99 to get Microsoft to sign your key. Individuals can easily afford to get a key signed for the custom OS they want to run on their own machines all by themselves. The fee isn't a million dollars. It is essentially free. This whole thing about the money is IMHO simple hysteria about nothing.

_____

SecureBoot controls what OS can be run, and the OS can control what software can be run, using a system of checksums and signing keys.

Absolutely true. But most powerful software packages include languages. So for example you mentioned encryption. Most encryption algorithms can be implemented in a few lines of any scripting language: Powershell, Visual Basic for Applications, AppleScript, Perl, SQL are all plenty powerful. You can do most encryptions in under a page in any of those languages.

Similarly P2P. There are well known Python P2P clients for the major services in like 80k and that's including the hash table data.

You cannot lock down computers to the degree you are talking about and have them still be computers.

Re:A bit over the top

[TheRaven64]

However, in terms of the thought experiment ... we know that they would agree to it, since we've had ARM devices produced by small firms with locked down OS configurations

Not the same thing. Manufacturers have locked down the OS because they want to, although that's rare - a lot of Chinese-manufactured ARM devices triple boot WinCE, Android and Ubuntu. Much more commonly, they've done so because their customers (i.e. the mobile networks) have required it. Doing something because your customer requires it is very different from doing it because your supplier required it. The former makes a sale for you, the latter may lose sales for you.

Re:A bit over the top

[jbolden]

I don't see how this is leveraging a monopoly. I agree with you analogy:

a) Wham-o's system is great. They have copyright so they get secure boot.
b) Wham-o's system is so/so or worse. No one produces
c) Wham-o's system is good. Maybe the lockdown has some effect but not much. Very few end users change OSes on their Arm devices.

The fact that Microsoft has more credibility than Wham-o is different than a monopoly. If Exxon stepped forward and and announced they considered 8" tablet factors crucial to the future of gas drilling, were going to spend a fortune developing and marketing a new OS.... it would carry the same weight

Re:A bit over the top

[jbolden]

No guys who create root kits created the conditions that caused this choice. I think Microsoft has a pretty track record of not wanting to be in the security business. They've been dragged there against their will under protest.

Re:A bit over the top

[Aaden42]

Nope MS won't sign for anything that doesn't maintain chain of trust. If they sign a shim, it's only allowed to chain to a signed bootloader that only chains to *signed* kernels that only load signed kmods. If you try to submit anything for signing to MS that would allow loading unsigned code anywhere along the path, it gets rejected.

Re:A bit over the top

[jbolden]

I agree there is a bit of a difference here between a supplier and a customer. But if we agree this was something manufacturers were willing to do, because a customer asked, then it didn't require monopoly power to get the manufacturers to do it. It is not "monopoly" power if manufacturers want to use Microsoft's OS and Microsoft is a jerk about it. Its only monopoly power if somehow Microsoft is using their desktop monopoly to force ARM vendors to do something.

Re:A bit over the top

[justforgetme]

You are not thinking man....

It's not the money its the time and effort it takes to convince every device manufacturer to include your signature on their devices' roms. Have you ever tried doing something like that? Because if you had you would not be playing so smarty pants.

Re:A bit over the top

[jbolden]

You don't convince every device manufacturer to include your cert, that's free but a ton of work. You just pay Microsoft 5 bootloaders x $80 each = $400 for them to sign the key.

Re:A bit over the top

[cpu6502]

That's a nice 3-page essay your wrote (if it was double-spaced), but it doesn't change the fact Canonical and Redhat were forced to buy a license *from Microsoft* or else their OSes would not run.

That is called restraint-of-trade and it is VERY clearly a violation of the Sherman Antitrust Act. As I stated MS already got in trouble with the EU merely for giving-away Explorer for free & thereby gaining an unfair advantage over Opera/Google/other browsers..... now they are actively blocking other OSes from Opera/Google/other OSes from running (unless they beg MS for a license). I expect the EU to slap them down again

.

Re:A bit over the top

[Requiem18th]

Even if it does have the drivers the devices could refuse to work on a computer without secure boot, I'm pretty sure that's how optical drives are going to work in the future.

Re:A bit over the top

[tlhIngan]

This leaves two options: 1) manual installation of the certs by the end user which isn't very straight forward and could even become impossible 2) pre installation of all available certs by the manufaturer (now guess for how many reasons manufacturers aren't going to auto install keys for all available linux/hurd/bsd distros, yep there are many).
Which leaves independent guys that release some spin of some distro out of the game completely since they do not have the manpower to ring up all manufacturers and `demand` the inclusion of their signatures on the manuf's devices' uefi rom and makes it much more difficult for guys trying to do mobile device gnuxes hanging there not knowing how to actually respond.

Given that Microsoft has made the option to disable secure boot mandatory for Windows certification, if you want to run another OS, disable it and it works just like it did before - boot from MBR, MBR boots partitoin loader, etc. like a traditional PC.

Windows requires secure boot. Linux could boot the old way standard. If you wanted to boot Windows, enable secure boot and go right ahead.

RedHad/Canonical are making things more convenient by having a signed loader so you don't have to keep going into the EFI to change the option. Given Windows' secure boot requirement, Grub or whatever is used won't be able to load WIndows anyways (the OS selector will have to be in EFI, like on a Mac).

Though, that brings up an interesting question - will Macs (which use EFI) be able to boot Windows 8? Macs don't use secure boot at all...

(And the Windows 8 boot process probably verifies the files it loads so modifying the filesystem to break secure boot that way probably won't work unless the files are signed).

Re:A bit over the top

[metacell]

Forced by whom? There hasn't been any outrage or criticism over the fact that root kits can be installed through the boot loader. There are far more (and far more criticised) holes when the OS has started up, including remote exploits.

Re:A bit over the top

[PoopMonkey]

Actually, it is not necessary at all. Why not default to boot anything and just support secure boot? Suggest that users sign their freshly installed OS and turn it on? Ideally, UEFI itself would have that as an easy to find option and it would sign whatever the currently installed OS is.

Because the majority of users won't do that. Do you honestly think that users, who click yes to anything without reading what software will do, who run "this cute thing" someone emails them, will take the time to sign their OS? It's that whole horse and water thing.

Re:A bit over the top

[jbolden]

There hasn't been any outrage or criticism over the fact that root kits can be installed through the boot loader

Of course there have been. Heck when I was at Comdex in 2000, Y2K had now passed and the number one issue for discussion was the lack of kernel security i.e. how to have an application or piece of data determine it was running under a genuine kernel. Kernel security, which allowed for trusted computing was one of the 3 major innovations for Longhorn (what would eventually be Vista). This has been a serious flaw in Windows for over a decade.

A kernel can't figure out if it is virtualized or not.
A program can't figure out if it is running against a pure kernel or not.
A piece of data can't check the status of the program accessing it.
A piece of hardware, especially a TCPI chip can't figure out if the process accessing it is compromised.

You want to fix this problem the first thing you need to do is allow kernels to know if they are running against real hardware or not. And hardware needs to know that the kernel is trusted.

Re:A bit over the top

[metacell]

I thought that the 'freedom's that are so important to FOSS are the freedoms of the USERS.

That too. I was just using the context of Benjamin Franklin's statement on giving up freedom to gain a little temporary security.

Once the system is in place, there are a number of players who'll be tempted to extend it and make it mandatory, which may hurt users' freedoms.

* Microsoft has an incentive to use SecureBoot to lock out competitors and squash small Linux distributions before they can get big. They can stay friends with RedHat and Canonical so they have someone to point to when someone claims they have a monopoly, while still never allowing them to become a threat. Much like when they bought shares in Apple.
* The media industry wants to outlaw file sharing programs as soon as they have a chance to succeed. SecureBoot, together with the ability to only run approved programs in Windows Vista and up, will provide the means to enforce such a law.
* The government may decide to outlaw hacking tools or encryption, or insist on backdoors they can eavesdrop through.

Implementing SecureBoot is like installing a mandated lock that someone else controls on every computer. Even if you're (initially) given the key to your own computer, you know it's not good and will be abused in one way or other.

Re:A bit over the top

[metacell]

Smaller Linux versions, without the backing of a corporation, won't be able to afford signing or getting OEM manufacturers to include their keys.

You're right. I didn't realise it was that cheap. But once you have to go through Microsoft to get your key signed, you give them a lot of power, and they may change their mind at any time.

But most powerful software packages include languages.

That's a good point. But someone may still try to lock down personal computers for the >90% of users who are non-technical, and the technical users will also be hurt by it (for example, by not being able to install any OS they want). The ease with which a technical user could circumvent DRM, didn't stop the music companies from forcing it on users, and it didn't stop Microsoft from investing a lot of money into DRM.

Re:A bit over the top

[metacell]

Ok, it may be a big thing with security experts, but so far it's mostly theoretical, and there are far bigger issues with Windows security.

Re:A bit over the top

[Requiem18th]

I think you are answering your own post. UEFI provides 4 ways to install another OS, a, b, c and d.

And they all suck so much that they have to choose "e" which is not even in the standard. UEFI provisions are so bad that the two major distributions with the most clout would rather pay the competition than use any of them. That says everything you need to know about UEFI provisions.

Re:A bit over the top

[sjames]

Not really. It's more like "Nobody's ever heard of WhamOS and they want WHAT?" vs. "Windows is everywhere, we really have to support Windows". That's the deal. If not for the fact that "Windows is everywhere" (in part due to other illegal leveraging of monopoly), they wouldn't likely get serious consideration on ARM if they demanded lock-down. It's far more likely that vendors would play hardball and tell them they'll support Windows RT on their open hardware or not at all. And if MS wasn't leveraging a monopoly on the desktop (and confusion about Windows RT), they would quickly cave.

Re:A bit over the top

[sjames]

If they'll click yes to everything, why do you think they'll suddenly start clicking NO when it comes to signing and securing?

Re:A bit over the top

[jbolden]

You're right. I didn't realise it was that cheap. But once you have to go through Microsoft to get your key signed, you give them a lot of power, and they may change their mind at any time.

They might. But once they become a jerk about being the signing authority its harder for them to remain the signing authority. They are going to have a strong interest in there not being easy circumvention, which will be hampered if they create a market for circumvention.

That's a good point. But someone may still try to lock down personal computers for the >90% of users who are non-technical,

You mean with things like blocking P2P? Same problem though... how to you avoid people sharing VBA scripts online? Circumvention becomes too easy because non-technical people are motivated. Though I agree it makes things harder. Certainly encryption was harder in the 90s when it was only semi-legal than today.

The ease with which a technical user could circumvent DRM, didn't stop the music companies from forcing it on users, and it didn't stop Microsoft from investing a lot of money into DRM.

Absolutely and DRM is being used by publishers today. But that's a different issue than the type of total lockdown you were describing. There have always been some degrees of copy protection of IP on personal computers, from the late 70s onwards.

and the technical users will also be hurt by it (for example, by not being able to install any OS they want).

The barriers you are talking about like a minor change to the bios are far less than the difficulty of installing another OS that is unsupported by the vendor. Linuxes are easy to support because the hardware vendors are friendly. If they remain friendly there will be keys for Linux. If they become unfriendly, the keys won't be the complexity. You are going to have to do much worse stuff than change setting in the UEFI to get Linux to run. Take a look at forum posts from the mid 1990s about what life is like when hardware vendors were mostly indifferent, not even hostile, to Linux installs.

Re:A bit over the top

[vux984]

And neither Google nor Apple have OS monopolies, nor are they offering the same OS on desktops and tablets.

Fair enough, but:
ios is related to OSX
Android is related to ChromeOS

So what about Windows 8 ARM vs Windows 8 x86? Are they really the same OS? The ARM version is missing major features, and the two editions can't run any of the same programs due to the architecture difference. Is the ARM OS really the "same"? Or could it be considered a different product?

Microsoft is seeing the writing on the wall, namely that people are ditching their desktops and laptops for tablets.

Yes, yes, but people who still need computers will still buy computers. There's a lot of people out there with a laptop that just need a tablet... but there's a lot of people out there who need an actual computer.

So they are trying to leverage their (near) desktop monopoly into a tablet monopoly, namely by trying to flood the market with Surface tablets and locking down the hardware so that you can run nothing other than their software on it.

I agree they may well be trying to flood the tablet market with locked down surface tablets, but I don't see them leveraging their desktop monopoly to do it.

Yes, that is an attempt to gain a monopoly

No more so than ipad's are apple's attempt to gain a monopoly.

if that situation had existed for x86 hardware, we wouldn't have Linux or any open operating systems.

I don't necessarily disagree. But Microsoft isn't leveraging their existing monopoly to try and lock down the tablet market. They probably are trying to lock down the tablet market, but they aren't using the desktop monopoly to do it.

Furthermore, if there is nothing to be gained from it, as you argue, why doesn't Microsoft leave it up to vendors, just like they do with x86 hardware?

Same reason Apple does it?

Re:A bit over the top

[bws111]

None of that answers the question "what do you think Red Hat can do about it"? Red Hat not supporting SecureBoot is not going to make SecureBoot go away, it is going to make Red Hat go away. How is that good for anyone?

Much of your post seems to be plain old paranoia. There is no legal requirement for hardware to support SecureBoot, and it is extremely unlikely that there will ever be such a law. Red Hat's deal with Microsoft is simply a convenience. They are in no way 'dependent' on Microsoft, and neither is any other vendor. Canonical is NOT using Microsoft, they are running their own signing service, and so can any other vendor.

Implementing SecureBoot is not "like installing a mandated lock", most importantly because THERE IS NO MANDATE. There is, instead, ONE company that says 'if you want to get a discount on licenses for our software, or use our logo on your product, implement SecureBoot'. Now, certainly many hardware manufacturers will choose to do that (market forces and all), but not ALL of them will (or have to). In addition, you have a few other companies saying 'hmm, our customers would probably like to run our software on hardware that has our competitors logo - I guess we better enable that'. Do they have to do that? Of course not, but they are pretty stupid if they don't.

Re:A bit over the top

[mcgrew]

Dude, there's no point in bringing up facts when conversing with a Repuiblican. They don't want truth, they want "truthiness". The Republicans would have you believe that it's Obama's fault the economy crashed shortly before he was elected, or that it must have somehow been Clinton's fault, or that Obama should have been able to clean up a mess that took Bush eight years to make in only three!

"Bush is a Republican! He can do no wrong!"

Bush is the very worst President I've seen in my lifetime, and I've seen some real stinkers from both parties in my sixty years. You are correct; it was Bush who let MS off with a slap on the wrist, it was Bush who ignored FBI field agents and the previous administration's warnings and got our country attacked, and it was Bush's tax cuts for the rich, wars in Afghanistan and Iraq, gasoline more than quadrupling in price (both Bush and Cheney were oil men, you don't need tinfoil to be suspicious, they profited personally from that expensive gasoline), and the Republican Senate voting to overturn Glass-Stegall with a veto-proof majority during Clinton that crashed the economy. We should call this recession the "Republican recession", except that ever since Coolige, we've had recession with every Republican President, and a good economy with most Democratic administrations.

Just be glad Ryan and Blago are in prison, I'd hate to see one of them in the White House! Either one (especially Blago) could possibly be worse than Bush. I fear Romney could almost be as bad.

I'll be modded down by the wingnuts from both parties but I don't care, I'm at karma cap anyway and it needed to be said.

Re:A bit over the top

[vux984]

Because they can't just click "yes".

They have to reboot the PC, press delete or f12 or whatever at the appropriate second, go into uefi ("bios") and locate the secure boot setting and choose to enable it. Save changes, and reboot.

And that's if the key is already pre-loaded. If its not... its more complicated.

If the OS could turn secure boot on or off from a popup on your windows desktop then it wouldn't be secure boot at all.

Re:A bit over the top

[bws111]

One more thing I forgot. As another poster has already pointed out, Benjamin Franklin did not say what you think he did. He said "those who give up essential Liberty..." (emphasis mine). If you think that being able to easily run an unsigned bootloader on any random piece of hardware you come across is an essential liberty, that just shows that you already enjoy all of the essential liberties and are just plain spoiled.

Re:A bit over the top

[sjames]

Actually, there's no reason the OS shouldn't be able to turn Secure boot ON using ACPI. There is good reason the OS shouldn't be able to turn it OFF.

Re:A bit over the top

[vux984]

Is that a legal requirement for monopoly abuse? That the monopolist does something someone without a monopoly couldn't normally do?

Pretty much, yes, that's essentially the definition of "abuse of monopoly power".

Re:A bit over the top

[vux984]

Actually, there's no reason the OS shouldn't be able to turn Secure boot ON using ACPI. There is good reason the OS shouldn't be able to turn it OFF.

You make a good point there. I haven't heard that this is possible, but there's no fundamental reason why it couldn't or shouldn't be. Provided that once its on, it can't be turned off the same way.

Although it still requires that the Microsoft key be preloaded, and then I assume the OS could also check that a given key is there. Clearly the OS shouldn't be able to load a key in either.

I still think ts simpler and not unreasonable to ship enabled.

I figure a large number of users would just cancel that box because it would inevitably say something like "once you click yes you can't change it back again from inside the OS", and that would be too "scary" to enable.

Re:A bit over the top

[jbolden]

This isn't just security experts.

This is the entire entertainment industry -- we'd like to be able to sell content to customers and control how it is displayed per the license
A good chunk of the software industry. -- we'd like to be able to sell software and not have to worry about piracy
A huge percentage of enterprise -- we'd like to be able to have the same sorts of tracking with electronic documents we used to have with physical documents

As I mentioned when Microsoft still was planning Longhorn/Vista to a major upgrade the 3 components were: new interface (Aero which did happen), WinFS (ended up being a minor update SQL server) and trusted computing. The fact that Apple has been doing great with trusted computing is probably spurring Microsoft on.

The threat to Linux is not the UEFI Bios being locked down. The Linux community has a 20 year record of handling that kind of nonsense with no problem.
The threat to Linux is that Linux runs fine on these new protected computers but the data whether it be websites, or movies or school classes rejects the environment.

Microsoft is not going to lock people out of using alternative OSes on x86 hardware, in the same way they haven't stopped people from buying Word Perfect. The days of "DOS ain't done till Lotus won't run" are long over at Microsoft. What is a much more realistic threat to Linux of creating trusted kernels is trusted kernels lead to trusted programs.

Re:A bit over the top

[AdamWill]

That's...not an accurate analogy at all. That was problematic under the concept of bundling - Microsoft using its monopoly on _desktop operating systems_ to, in effect, force the creation of a monopoly in _web browsers_.

'Signing keys in the system firmware' is not a 'market', it's a boring technical detail. The analogy just doesn't apply at all. It doesn't make any sense to say 'Microsoft is abusing its monopoly in desktop operating systems to create a monopoly in signing keys'. It's just a silly sentence.

Re:A bit over the top

[jbolden]

I agree. That's why I changed the analogy to Exxon with a credible claim of being willing to spend billions. I do think Exxon could get manufacturers to support closed hardware for them.

Microsoft is perfectly free to abuse the fact they are a Dow stock and have instant respect.
They aren't free to abuse the desktop monopoly.

Re:A bit over the top

[mcgrew]

So yeah. It hasn't anything to do with monopoly or any other 80s board game.

Your youth is showing!

Re:A bit over the top

[vux984]

replying to you your "see your comment here" post:

No, I disagree. Here they are leveraging brand name recognition, but that is not abuse of monopoly.

The difference between WhamOS and Microsoft is name recognition, not desktop-monopoly. Same as Apple made ipad's rather than creating a shell corporation called Turnip and selling Tpads through it.

Leveraging brand name recognition is not 'abuse of monopoly'.

Its really no different than microsofts foray into consoles with the xbox. (Which I also note is locked down.)

Re:A bit over the top

[AdamWill]

The analogy just doesn't work at all. A signing key isn't some kind of product for which there is a market, in the ordinary sense, like a web browser is. The reason the IE situation was monopoly abuse is that it involved Microsoft leveraging their monopoly on desktop operating systems to artificially elevate themselves into a monopoly position in a separate, pre-existing market - the market for web browser software. Signing keys for bootloaders aren't a pre-existing product with a pre-existing market. They're a technical detail of the boot process.

Re:A bit over the top

[AdamWill]

"Canonical is NOT using Microsoft, they are running their own signing service, and so can any other vendor."

Canonical are self-signing OEM preloads (if you go and buy a system from an approved vendor with Ubuntu pre-installed...as, really, not many people do). The regular Ubuntu images you can download from the Ubuntu site, for end-user installation on an existing PC that likely shipped with Windows, will be signed with a Microsoft/Verisign key.

Re:A bit over the top

[sjames]

There's no need for the Microsoft key at all if the REAL reason for this is to protect the user from viruses and trojans. The system could create a key pair on the spot, sign the OS, set the public key as the root and discard the private key. That would be far MORE secure than using a microsoft key (as demonstrated by stuxnet having a valid signature).

Of course, MS wouldn't have any of that because protecting the user is actually far down on the list of reasons they want this.

I'm fairly sure the user would just click OK because I have yet to hear of a warning message sufficiently dire to prevent click through. Often the person not only can't tell you what the warning was, they don't even remember clicking anything. By nagging and pestering for every trivial thing for so long, Windows has trained them at a sub-conscious level.

Re:A bit over the top

[vux984]

And they all suck so much that they have to choose "e" which is not even in the standard.

e) cost the distro $100 bucks, and made even the slight effort of disabling secure boot disappear.

That says everything you need to know about UEFI provisions.

Yes it does. It tells me that Red Hat couldn't figure out a way of getting its key installed on every motherboard built for less than $100 bucks. You know what? I can't either. And if I spend more than an hour trying to think of a better solution, it's going to cost more than $100 of my time...

Re:A bit over the top

[sjames]

Unless Exxon was planing to hand those billions to the tablet manufacturer, they wouldn't get the time of day. OTOH, if Exxon wanted to buy a few tens of thousands of tablets to run their new OS on, the manufacturer would likely create a new SKU just for them and call it a custom order. They would NOT pay Exxon for the privilege of selling a tablet with ExxOS on it to 3rd parties if they had to lock it down first. Again, if Exxon wanted to sell ExxOS at all, they would cave.

Re:A bit over the top

[sjames]

If MS wasn't muddying the waters about just what Windows RT is, then it would be just brand recognition. However, they ARE playing the usual dirty tricks with threats to inter-operability that make this more than just brand recognition.

Re:A bit over the top

[kenorland]

So what about Windows 8 ARM vs Windows 8 x86? Are they really the same OS? The ARM version is missing major features, and the two editions can't run any of the same programs due to the architecture difference

Microsoft's market power these days is largely due to Microsoft Office and the continued incompatibilities they are creating. Windows 8 on ARM will deliver Office. In additional, it will allow major third party vendors to port their software fairly easily.

Same reason Apple does it?

Apple doesn't have vendors, they are just a bunch of control-freaks through-and-through. FWIW, I think Apple (and any other vendor) should also be required to allow installation of alternative operating systems. But despite delusions of grandeur, Apple is still a bit player in the market.

Re:A bit over the top

[Hatta]

Microsoft is abusing its monopoly in desktop operating systems to create barriers to entry for other operating systems. The boring technical detail of how it's done is irrelevant.

Re:A bit over the top

[jbolden]

Like I said it has to be credible. So Exxon announces they are bringout a touch version of Aros (hobby OS). They'll be spending $150m / mo in development for the next 2 years. Which translates into an OS design staff of 15k top developers. They start working with hardware manufacturers who are concerned with ExxOS will sell. Exxon guarantees them another $2b in marketing expenses during the first year. They will also use their ties with the auto industry to help move these devices with new car buyers. They want Exxon only machines to run ExxOS.

Yeah I think they would get the time of day.

Re:A bit over the top

[vux984]

There's no need for the Microsoft key at all if the REAL reason for this is to protect the user from viruses and trojans. The system could create a key pair on the spot, sign the OS, set the public key as the root and discard the private key.

Secure boot affects all kernel mode drivers. Your "solution" prevents driver updates, not to mention most hardware upgrades. It also prevents easily installing Windows 9 down the road...

I'm fairly sure the user would just click OK because I have yet to hear of a warning message sufficiently dire to prevent click through.

Do you have any idea how often I boot up a 6month+ old computer and half the OOBE popups are still there nagging for an answer. The owner just clicks close or later on them rather than making a decision. This is not uncommon at all.

A LOT of users will click "later" or just close window and defer the decision to the future indefinitely if the software gives them that option.

Re:A bit over the top

[sjames]

In other words, if Exxon PAID them to lock out the competition, they would get the time of day. Somehow, paying to lock out competition sounds like a questionable practice though.

Re:A bit over the top

[jbolden]

Now not pay them. Just

1) Build an OS that would be good
2) Help them sell their products

Microsoft does both (1) and (2) (at least arguably).

Re:A bit over the top

[sjames]

My proposal wouldn't affect drivers at all, each link in the chain is free to handle trust any way it sees fit. So, the boot loader is trusted by the BIOS because it is signed by the root key (created on the spot when the user said OK). The OS kernel is trusted by the bootloader because it is signed by the key the bootloader holds (The MS key). The driver is trusted by the kernel because it is signed by the key the kernel holds (The MS driver key which may be the same as the one that signed the kernel, or it could be another).

If the functionality is supported and desired, the kernel could optionally ask the BIOS what it thinks of the driver, but that doesn't happen in the implemented system.

All of that is why secure boot is claimed to be largely smoke and mirrors.

Re:A bit over the top

[sjames]

Perhaps point 1, but a valuable service in point 2 is a payment, just not one in cash.

Re:A bit over the top

[KingMotley]

Microsoft has is a monpoly on the companies that are likely to make such ARM tablets

Microsoft has a monpoly on Google, Samsung, and Apple? I am sure they would like to know that, please write them a letter to let them know of their new owners.

Ooops, I thought you meant a monopoly. You did say monpoly, which is vastly different. Monpoly must mean you hold 1% of the market. In that case you are right. Microsoft has 1% of the tablet market, and they are evilly wielding that 1% marketshare to force everyone else to do their bidding, lol.

Re:A bit over the top

[Requiem18th]

That's still an advantage for Microsoft, whether you chose to ignore it or not, but the real problem for me is what it implicates for smaller distributions but we all know that they don't matter.

Re:A bit over the top

[jbolden]

I understand and I agree. The ability to be a commanding presence is worth real money, Exxon would have to pay cash to get that same kind of buzz, that Microsoft gets by virtue of who they are. And as you mention that marketing money is just like a cash subsidy. My point 10 up is that that legal. What Exxon can do, Microsoft can do. Its only the things Exxon could not do, that Microsoft is forbidden from doing.

Re:A bit over the top

[vux984]

I'd suggest that most people using smaller distros will be tech savvy enough to go into uefi to disable secure boot.

Re:A bit over the top

[raque]

This is just another version of screaming "NAZI".

The differences between secure booting a computer and stoping the Axis powers should be perfectly clear. The Axis didn't need to "Listen", they needed to be stopped regardless of the sacrifice.

Re:A bit over the top

[vux984]

My proposal wouldn't affect drivers at all, each link in the chain is free to handle trust any way it sees fit

Right, pardon me. It would still impact the upgrade path to Windows 9 potentially though.

And I'm not sure what it really accomplishes in terms of making other OSes easier to support? Your new dell comes shipped with windows 8 preloaded and secureuefi disabled, and on the first boot the system offers to secure itself and enable uefi?

a) So their is an opportunity to infect the system prior to UEFI being enabled, especially if you use it at all prior to enabling it.

Self signing your already infected and rooted system is counter productive.

b) It doesn't make installing other OSes any easier for end users -- unless the user takes delivery of the system, and immediately installs linux before enabling secure boot. Once they've clicked yes to the prompt, they are back to going into uefi to manually install keys or disable it.

Re:A bit over the top

[betterunixthanunix]

This is not some insignificant technical detail; if we were talking about changing the location where the bootloader is stored, you might be able to push that argument. This is an attempt by Microsoft to leverage its control of one market (the PC operating system market) to control another market (the market for personal computers) in a way that is detrimental to competitors. Further, the point of the signed bootloader is not to fight bootloader rootkits; the point is to create harder to crack DRM systems, by preventing people from subverting the OS (which is what a rootkit does, and thus the security against certain malware is nothing more than a coincidental side effect here).

The analogy holds: Microsoft tried to use its Windows dominance to break into the web browser market by changing a "technical detail" about how desktop icons are rendered and how files are displayed as icons; likewise, here Microsoft is trying to break into the "media friendly computers where everything must go through an app store" market by changing a "technical detail" about the bootloader.

Re:A bit over the top

[lsatenstein]

The better plan is to sue Microsoft for abuse of their monopoly.

You mean, so that they can be found guilty again and let go without so much as a hand-slap again? Yes, that would be a wonderfully immense waste of taxpayer dollars.

On the desktop, W7 will remain, as W8 will be a poor reason to upgrade. In fact, it will mean that independent software developers will all have to pay a MS tax, and suffer from poor profit margins. When these developers move to Linux, because no such tax exists, the trickle of migrations starts to happen, as it will, and MS will have to reconsider it's position on the desktop and in corporate world. As for tablets, Apple is number one, Samsung is number two, or vice-versa outside of the USA, and MS will fall below RIM in sales. RIM will come out of its slump with something very interesting and worthwhile new offerings.

Re:A bit over the top

[sjames]

As long as Windows 9 can be booted from the same bootloader as Windows 8, SecureBoot in UEFI wouldn't get involved.

The most common time to install Linux on a computer is when it is brand new, out of the box. Most often before it ever boots into Windows.

But the most key point in this is that the option exists to sign whatever you choose with a 1 time key, quickly and easily so that other OSes are not unfairly disadvantaged by an overly complicated procedure. Ideally, there would be a simple "install OS" option in the UEFI that would take care of clearing out the old key and signing the new OS. More ideally, it should be reachable from the screen that tells you it won't boot because of a bad/missing signature. That procedure should only be available by booting the system, never through an API to the OS. As for attacks on the system, if the user isn't aware that they haven't just installed a new OS, they cannot be made secure by any technical means short of applying 1000VAC to the mainboard.

An hour's thought could have come up with any number of better approaches if the real goal was actually securing the system for the user, or for that matter if all of this garbage was actually meant for the user's benefit at all.

Re:A bit over the top

[justforgetme]

Yeah, well sorry I pulled that number out of thin air...
Snarkyness bit me in the a** there!

Re:A bit over the top

[justforgetme]

RedHad/Canonical are making things more convenient

Yes.

But the rest of Your comment really doesn't make any sense to me. Sorry, I just can't understand how You can be seeing this as "OK" when there are very apparent barriers to independence put up by this move.

Also, the secure boot disabling clause only applies to x86 machines.

Re:A bit over the top

[justforgetme]

You just pay Microsoft 5 bootloaders x $80 each = $400 for them to sign the key.

OK, You got me. I don't understand, explain.

Re:A bit over the top

[jbolden]

There are 2 layers here. The first layer is inclusion of signing authorities. There are not going to be many of those in hardware: Microsoft , probably a few Asian ones, someone like Verisign and that's it. And those will be the only people the hardware will accept as authorities by default. The end user will be able to add their own keys to the BIOS but that needs to be hard enough that people who don't understand that this is like giving up the root password don't do it casually.

The way most Linuxes will get on is not by becoming a signing authority, for which the standards are very very high, but asking a well respected signing authority to sign their kernel. Microsoft, as a signing authority has already agreed to help here. So what will happen is RedHat will submit the kernel to Microsoft and Microsoft will sign the RedHat kernel. When the hardware tries to load it will identify itself as signed by Microsoft, provide a number (encrypted checksum) which proves that this exact binary was provided to Microsoft and signed. The hardware doesn't know who RedHat is, all it knows is that Microsoft confirmed that this kernel is legit. Microsoft isn't confirming that the kernel "works" but they are confirming this exact binary did come from RedHat and not some 3rd party. The purpose of this signing system is not to stop RedHats, or Ubuntu or anything like this but rather rootkits and possibly piracy. Microsoft has been clear they are not interested in creating complications for Linux, you want a kernel with special permission, pay $80 and Microsoft will sign it.

Now what Canonical is doing is trying to avoid even that, creating a shim system for Linux users so that the boot-loaders get authenticated not kernels. That way Linux users run only with protected boot-loaders but unprotected kernels while Windows users have the extra layer of security which Linux people don't want. And Microsoft is fine with that strategy. So assuming Canonical is successful they are going to sign each boot-loader and you will need to pay once per boot-loader not even once per kernel.

Re:A bit over the top

[fredthomsen]

this is slashdot... as soon as any linux distro reaches a large distribution, it is the next micro$oft...

Re:A bit over the top

[quintesse]

Monopoly is waaay older than that, it's at least from the 30s possibly even older! ^^

Re:A bit over the top

[GigaplexNZ]

They are using Office to try to leverage into the ARM tablet market (you can't get the ARM version without Office preinstalled), but I don't think it's going to work well due to the poor touch support. It also has nothing to do with Secure Boot, so targeting Office won't fix the underlying problem TFA is complaining about.

Re:A bit over the top

[metacell]

None of that answers the question "what do you think Red Hat can do about it"? Red Hat not supporting SecureBoot is not going to make SecureBoot go away, it is going to make Red Hat go away. How is that good for anyone?

I'm not blaming Red Hat. They're a for-profit company and can't be expected to act any other way. I'm just trying to make people aware of the problems with SecureBoot.

Now, certainly many hardware manufacturers will choose to do that (market forces and all), but not ALL of them will (or have to). In addition, you have a few other companies saying 'hmm, our customers would probably like to run our software on hardware that has our competitors logo - I guess we better enable that'. Do they have to do that? Of course not, but they are pretty stupid if they don't.

Historically, Microsoft has been able to convince their partners to exclude competitor's products.

For example, back in the days of OS/2, Microsoft used a licensing scheme where OEM manufacturers paid them per computer they shipped, not per copy of Windows. That meant OEM manufacturers had no reason to offer OS/2 on their computers, since they already had a Windows license for each one of them (and customers who specifically wanted OS/2 had to pay for both OSes).

Back in the days of Netscape, Microsoft changed the license terms of Windows NT Workstation to limit the number of simultaneous network connections, while at the same time bunding IIS Server with Windows NT Server. That meant anyone who wanted to run a web server on Windows, had to buy Windows NT Server, and then there was no reason to buy another web server software. It also meant a customer had to pay extra if they specifically wanted Netscape's web server software. (This was one of the things they were found guilty of in the US DoJ's anti-trust case.)

Microsoft has also been found guilty of explicitly asking their partners to stop bundling competitor's products, and using late deliveries as a way to pressure them.

Of course, I can't know that Microsoft will continue to use these kinds of methods to limit the number of OSes included in SecureBoot, since I can't see into the future. But I'd be very surprised if they didn't try.

Those who really want to run an alternative OS, will still be able to do it. But Secureboot could be used to make it too much hassle, too expensive, or too scary for the majority of users. You only need to make the competitor's option a little less attractive to nudge the market in the right direction.

There are US senators who have tried to outlaw P2P filesharing software, or make the software authors responsible for preventing piracy, since at least 2004 (CNet, Afterdawn). They're currently not close to succeeding, but the boundaries are constantly being pushed back. So far, we've seen web sites become responsible for what their users upload, then for what they're linking too, then search providers like Google became responsible for listing infringing material in their search results, and so on.

There have also been major attempts to mandate encryption with government backdoors in the United States (Clipper).

Re:A bit over the top

[metacell]

I know what Benjamin Franklin said, and that he's usually misquoted. But in the world of today, computers are essential for our liberties.

Today, when a government tries to suppress freedom of speech, censoring the Internet is probably its most important tool. The revolt in Syria was instigated on Facebook, and the regime tried to stop it by shutting down the Internet. China blocks foreign sites where their citizens can get the wrong ideas (including social networks), censors search results, and pressure foregin companies into censoring their services for Chinese users. People try to get around it by using proxies and P2P networks like Tor and Freenet, which are then outlawed, but it's hard to enforce the ban. If standard PC motherboards come equipped with the option to only run approved software, it'll be a useful tool in any oppressive governments' hands.

Trying to control what people can do with their computers is not really any different from trying to control a country's printing presses. The Internet is the equivalent of books and newspapers in the 21st century.

Re:A bit over the top

[metacell]

This is the entire entertainment industry -- we'd like to be able to sell content to customers and control how it is displayed per the license
A good chunk of the software industry. -- we'd like to be able to sell software and not have to worry about piracy
A huge percentage of enterprise -- we'd like to be able to have the same sorts of tracking with electronic documents we used to have with physical documents

I agree that those are important reasons for marketing to want SecureBoot, and use it as a sales argument. I just don't think it has practical importance in most cases, since there are so many ways to hack into a computer once the OS is up and running (and unlike installing a rootkit at boot, many of them can be executed remotely).

The threat to Linux is not the UEFI Bios being locked down. The Linux community has a 20 year record of handling that kind of nonsense with no problem.

I don't doubt the Linux developers will find a way to get around the technical problems. But Redhat apparently thought something as simple as disabling SecureBoot manually, would be enough to scare away some of their customers.

The threat to Linux is that Linux runs fine on these new protected computers but the data whether it be websites, or movies or school classes rejects the environment.

Well... isn't that easier than getting around hardware locks? Content can only be protected by encrypting it, and if legitimate users are to be able to access it, the decryption keys need to be stored in cleartext on their computers.

The only situation where I can see difficulties, is where the decryption is done directly in specialised hardware (such as accelerated video playback hardware).

Or are there difficulties I haven't realised? Are you talking about legal problems, such as patents being used to prevent third party software from accessing the data?

Microsoft is not going to lock people out of using alternative OSes on x86 hardware, in the same way they haven't stopped people from buying Word Perfect.

They don't make it impossible to run something, they just make it expensive or difficult enough to nudge the majority of users in the right direction.

For example, when Microsoft saw Netscape as a threat, they changed the licensing terms for Windows NT Workstation to make it impossible to run web servers on it. You could still run web servers on Windows NT Server, but when you bought NT Server you got a web server for free, so you didn't need Netscape's. Nobody was actually prevented from running Netscape's web server; Microsoft just made sure it didn't make financial sense for most users. (This was one of the practices the DoJ found to be anti-competitive.)

Re:A bit over the top

[vux984]

As long as Windows 9 can be booted from the same bootloader as Windows 8, SecureBoot in UEFI wouldn't get involved.

Otherwise it would get involved.

The most common time to install Linux on a computer is when it is brand new, out of the box. Most often before it ever boots into Windows.

No. People buying windows PC dedicated to installing Linux on first boot know will how to go into UEFI to turn of secure boot, and will be comfortable with that. They won't have any trouble.

The people Red Hat and Canonical are looking to help don't buy a dedicated computer for Linux, they either try linux using a liveCD on their windows PC, or they decide to try linux on an older used PC they have... that previously ran windows. Those are the people secureboot impacts on.

But the most key point in this is that the option exists to sign whatever you choose with a 1 time key, quickly and easily so that other OSes are not unfairly disadvantaged by an overly complicated procedure.

One major problem with this, as I have already said, is that it does nothing to authenticate that the bootloader you are self-signing has not been tampered with.

Ideally, there would be a simple "install OS" option in the UEFI that would take care of clearing out the old key and signing the new OS.

But it would still require users go into UEFI. If we assume users can go into uefi without trouble, disablign secure boot is a non issue.

An hour's thought could have come up with any number of better approaches if the real goal was actually securing the system for the user,

I'm not sure how much time you've put into it, but your suggestions so far fall short if the 'it-just-works' scenario that's actually in place with preloaded windows 8.

Re:A bit over the top

[jbolden]

I just don't think it has practical importance in most cases, since there are so many ways to hack into a computer once the OS is up and running (and unlike installing a rootkit at boot, many of them can be executed remotely).

Trusted computing also gets rid of most of those problems too. UEFI doesn't do anything there, but the technology needed to take UEFI to the next level would help quite a bit with hacking exploits. Mainframes don't get hacked nearly as easily because the security model is very different.

I don't doubt the Linux developers will find a way to get around the technical problems. But Redhat apparently thought something as simple as disabling SecureBoot manually, would be enough to scare away some of their customers.

And I think RedHat's right. There is a difference between:

a) Will scare some customers.
b) Will make something completely impossible.

(a) and (b) aren't the same thing.

Well... isn't that easier than getting around hardware locks? Content can only be protected by encrypting it, and if legitimate users are to be able to access it, the decryption keys need to be stored in cleartext on their computers.

that's now how it is done. Here is an example. A long message is broken into a string of smaller messages (like like 1mb each). Each small message gets an AES encryption with the AES key stored RSA encrypted along with the block. The RSA private key is on the TCPA chip which can decrypt but will only unlock that set of keys based on the checksum of the kernel performed by the UEFI. Outside the TCPA chip the RSA private key is unknown. And the TCPA chip will only perform decryptions to an authorized kernel. The AES keys are known to the system but they are one time use.

Note that if I release the document to say 30 people, those 30 people correspond to me signing each small message with 30 different AES keys. Or one time a group key can be loaded on the TCPA chip and everyone can share a group key. Private keys are never stored on the computer because the computer as a whole cannot be trusted.

For example, when Microsoft saw Netscape as a threat, they changed the licensing terms for Windows NT Workstation to make it impossible to run web servers on it. You could still run web servers on Windows NT Server, but when you bought NT Server you got a web server for free, so you didn't need Netscape's. Nobody was actually prevented from running Netscape's web server; Microsoft just made sure it didn't make financial sense for most users. (This was one of the practices the DoJ found to be anti-competitive.)

I used to run Netscape's webserver. I have to tell you IIS was a lot better. It wasn't licensing that got me to switch but Active-X, the speed of configuration, the ease of management.... But I do get your point that's a good example. And I agree that Microsoft will nudge not compel. And that was my point, a total lockout is compel.

Re:A bit over the top

[badkarmadayaccount]

What about ARM?

Re:A bit over the top

[vux984]

What about ARM?

What about it? WinRT (arm) is to Windows 8 (x86) what ioS is to OSX.

Is the boot loader locked on your iThing?
How many boot loaders are locked on arm Androids?

I agree they shouldn't be, but Microsoft isn't breaking new ground here by locking its ARM devices down. And they aren't leveraging their desktop monopoly to do it.

Expected

[Daniel_Staal]

I love OpenBSD, and run it on my firewall at home, but anyone who's followed De Raadt over the years has to be 100% expecting this.

Including the over-the-top language.

Re:Expected

[masternerdguy]

So he's pretty much your Richard Stallman?

Re:Expected

[Anubis350]

I'm pretty sure Richard Stallman is *everyone's* Richard Stallman, and one is enough :-p

Re:Expected

[Anonymous Coward]

I've posted exactly one thing on the OpenBSD mailing list (I forget what... something technical and innocuous anyway) and I've been flamed by Theo De Raadt. I think you could make money selling T-shirts that said, "I've been flamed by The De Raadt". I've got a lot of respect for what he's accomplished, but flaming seems to be his customary mode of interaction.

I've also, on occasion, had the opportunity to interact with RMS via email. He has always been extremely generous with his time, gracious and polite, even when he disagreed with me. The guy takes a lot of heat for having strong views, but he genuinely seems like a really nice guy.

Really, I can't imagine two people who are more different in character.

Re:Expected

[lister king of smeg]

After writing emacs, what else was there for him to need to write?

how about a kernel?
to harsh?

Re:Expected

[shutdown -p now]

After writing emacs, what else was there for him to need to write? :D

A decent editor would be a good start. But he was late to that party. ~

Re:Expected

[cheesybagel]

De Raadt is a pretty nasty person to deal with but it is at times like these that I really respect the guy. He may be obnoxious but he has his principles and anything that either reduces the security of the system or removes the ability of the user to control the system is anathema to him.

Re:Expected

[sander]

Well, no, he actually write a lot of quality code day in and day out, something neither ESR nor Stallman have done for decades, if ever.

Re:Expected

[FranTaylor]

If it's so easy, show us the kernel you wrote

Re:Expected

[lister king of smeg]

i haven't but i haven't set that as one of my primary goals. Hurd was one of their(gnu)/his(rms) primary goals that was never fully achieved. it is there for a failure. I was at least partially joking when i made my comment. no need to get so up tight dude

From the article:

[Fwipp]

Responding to a query from iTWire about what OpenBSD, widely recognised as the most security-conscious UNIX, would be doing to cope with "secure" boot, De Raadt said: "We have no plans. I don't know what we'll do. We'll watch the disaster and hope that someone with enough power sees sense."

Is not wanting to "be the new Microsoft" worth being unprepared for a "disaster?"

Re:From the article:

[Omnifarious]

That's my take on things. Secure boot, at this moment is 'do a deal with the devil or give up on being on those systems'.

I have no idea how Microsoft ended up being in the position to dictate this state of affairs, and hardware manufacturers should be ashamed of themselves. The law should be that you have the keys to your own hardware.

Maybe someone will sue over it and reverse it that way.

But I don't think of RedHat or Canonical as doing something evil over this, just trying to survive.

Re:From the article:

[nukenerd]

He is not "begging user to turn off secure boot", because, and this is the point, we will not be able to, the way things are going.

As for leaving me "vulnerable to a root kit", I will deal with that my own way, not Microsoft's way, thanks very much. Microsoft's way would be like leaving your house security in the hands of crooks.

Re:From the article:

[socceroos]

Mark my words. Anyone who wants to get in to your SecureBoot enabled device will (read: governments now, crackers later). This is an abuse of monopoly and an attempt to seize more control of the user's device.

Re:From the article:

[AdamWill]

"He is not "begging user to turn off secure boot", because, and this is the point, we will not be able to, the way things are going. "

What's 'the way things are going'? What support do you have for this assertion? Microsoft's Windows 8 compliance requirements specifically state that the user of a system must be able to disable Secure Boot. Microsoft are actually _requiring_ OEMs make it possible to disable Secure Boot.

Re:From the article:

[lister king of smeg]

for now they require it on X86 and X64 systems but it is locked on arm. but what about windows 9? will it be removed because like the start menu because "so few people were using it".

Re:From the article:

[lister king of smeg]

red hat may have lots of money but microsoft has a shit ton more and the all of the people in power in their pocket. canonical has been running in the red for years and is pretty much run off of shuttelworths bank account and donations of time and money not going to be in a challenger to MS in court any time soon.

Re:From the article:

[Mike Buddha]

Great FUD bro. Tell it again.

Re:From the article:

[AdamWill]

It's possible. All things are possible. But it seems unwarranted to assume it as a foregone conclusion.

Re:From the article:

[lister king of smeg]

not really all that far fetched Microsoft would love to be the only os on pc's. they have actively smeared Linux and spread fud, they brought xp back form the dead to keep Linux off of mass marketed net-books, and tried to kill it by proxy with sco, they have accused it of being a cancer and communist, they have likened Linux users to pirates and malicious hackers. they have also baselessly accused Linux of patent infringement. Why would they not try to lock down PC's? and they tried to do the same thing before with palladium.

Re:From the article:

[metacell]

Is malware ever inserted by modifying the bootloader these days? I haven't heard about it since the day of boot loader viruses, and they spread through floppy disks..

Re:From the article:

[Just Some Guy]

Is not wanting to "be the new Microsoft" worth being unprepared for a "disaster?"

Yes, when it involves completely selling out the ideals you've dedicated your life's work to. OpenBSD was founded on openness. They don't allow binary blobs into the OS for maintenance, security, and freedom reasons. What's a signed bootloader, where De Raadt et al would be contractually forbidden from releasing the signing key required for end users to build it for themselves, if not a binary blob?

It would be convenient for OpenBSD to distribute a signed bootloader. And proprietary video drivers. And closed network drivers. Those are short-term conveniences at the cost of a lot of freedom, though, and OpenBSD realizes that and avoids them.

So the onus is on you to come up with a plan that preserves OpenBSD's goals while simultaneously respecting Microsoft's empire-building wishes. If you were Theo, what would you do that he's not?

Re:From the article:

[AdamWill]

"What's a signed bootloader, where De Raadt et al would be contractually forbidden from releasing the signing key required for end users to build it for themselves, if not a binary blob?"

All packages for Fedora and Ubuntu, and I'd be massively surprised if the case wasn't the same for OpenBSD, are signed with a project key. Obviously, that private key isn't released to end users. You can't precisely duplicate a Fedora, Ubuntu or (probably) OpenBSD binary package, technically, because you can't sign it with the same key.

No-one before has said this constitutes an issue with freedom or openness. Why is a bootloader binary built from completely free and reproducible source code, but signed, different?

Re:From the article:

[Just Some Guy]

All packages for Fedora and Ubuntu, and I'd be massively surprised if the case wasn't the same for OpenBSD, are signed with a project key.

But that doesn't prevent you from creating your own packages. In fact, they explain how to make your own self-signed packages should you want to build your own internal package repository. It just stops you from releasing a package that looks like it's coming from OpenBSD.

This isn't analogous to the Secure Boot fiasco where it's significantly harder for end users to get their own signing keys, and therefore can't create their own signed bootloader that would act like the one that OpenBSD would be distributing.

Re:From the article:

[AdamWill]

"This isn't analogous to the Secure Boot fiasco where it's significantly harder for end users to get their own signing keys"

No, it isn't. It'll be trivial for anyone to generate a key and sign some code with it. mjg59 is working on tools to do this even now.

What you might find trickier is to get other people to trust your key, but that's just the same with packages, isn't it?

You will be able to build a bootloader chain and sign it with a key you control, just as you can build a package and sign it with a key you control.

IIRC - Theo

[Gunfighter]

Isn't Mr. De Raadt known for being a bit... shall we say, "pointed" on these sorts of things?

Re:IIRC - Theo

[wmbetts]

That's a nice way to put it.

Re:IIRC - Theo

[Anonymous Coward]

Isn't Mr. De Raadt known for being a bit... shall we say, "pointed" on these sorts of things?

In the sense that a wild, angered porcupine is "pointed", yes.

Re:IIRC - Theo

[Tom]

Yes, he is. He's also very passionate and has a sharp mind. I've had the pleasure of discussing POSIX compatability of SELinux with him after a conference at which we both spoke. He is very persistent on things that most others consider nitpicking and philosophical, but there is a strong consistency to his views that I admire. And he is usually right in the factual points he makes.

So what's the plan, Theo?

[Chemisor]

Ok, Theo, let's hear your solution then. I, for one, would really love the ability to secure boot a Linux system, knowing that every component is still exactly as it was when I last checked it and nobody has sneakily installed malware that secretly emails spam to all my friends and my financial details to carding sites. Trusted hardware root and signed executables are good things. So tell us then how we are supposed to get them? You obviously do not believe that we should be using Microsoft's key to sign the bootloader. What should we use? Keep in mind that while you have no difficulty installing your own keys in the BIOS, to a typical user (you know, those poor shmucks who get infected most often) that's deep voodoo. Also keep in mind that while Microsoft has the pull to get its key loaded by default into all the TPM chips manufactured, Ubuntu does not. Neither does BSD.

Re:So what's the plan, Theo?

[ceoyoyo]

The BIOS key comes printed in the manual. As a user, if you install the OS, you have to type that number in. Users who cannot enter numbers from a manual when prompted don't generally install OSes.

Re:So what's the plan, Theo?

[snikulin]

A manual could get lost. What's about printing the key on M/B itself, like they do it with MAC ID? It better be some kind of bar code (RSA-4096 wold be tough to type in). Or (and?) BIOS/EFI could have a dedicated page where it shows the whole key in a hand-help scanner friendly format. But in this case the snapshot could leak to the internets.

Re:So what's the plan, Theo?

[nukenerd]

The BIOS key comes printed in the manual.

Not if the manual is as crappy as some that I have seen. And when you buy a PC from the high street, there is no guarantee that you will be forwarded the motherboard manual.

Re:So what's the plan, Theo?

[ceoyoyo]

If the key required to install ANY operating system is in the manual, you'll be given the manual. Or print it on the motherboard itself as someone else suggested.

Re:So what's the plan, Theo?

[Anonymous Coward]

I, for one, would really love the ability to secure boot a Linux system, knowing that every component is still exactly as it was when I last checked it and nobody has sneakily installed malware that secretly emails spam to all my friends and my financial details to carding sites.

Has this ever been an issue with you on Linux? If secure boot does not allow you to run Python, a lot of scripts won't run. If it does allow you to run Python, a malicious Python script might still get you.

Re:So what's the plan, Theo?

[lister king of smeg]

Has this ever been an issue with you on Linux? If secure boot does not allow you to run Python, a lot of scripts won't run. If it does allow you to run Python, a malicious Python script might still get you.

Since when does any Linux have auto run for anything enabled by default, and any you download you would have to set the executable bit on anyway. not an issue.

Re:So what's the plan, Theo?

[shutdown -p now]

The point of secure boot is not to have a key for the "BIOS", it's to have the key for the bootloader. BIOS is assumed to be secure in that arrangement, which is why it's given the task to verify the integrity of the OS. So your proposal makes zero sense.

What would actually make sense is if the OS signature hash is provided with the OS when you buy it, such that you can add it to the UEFI by typing it in. But then you can already do that with UEFI secure boot - Win8 hardware cert requirements actually suggest precisely this: "It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK". For hardware that has the "Designed for Windows" logo on it, it is required to have the key for Win8 preloaded, which kinda makes sense, and does not preclude you from installing another OS by adding its own key. Nor does it preclude OEMs from selling machines with a different OS preinstalled and its key preloaded.

Re:So what's the plan, Theo?

[cheesybagel]

How about doing it like SSH? The first time you install something with a new key it tells you "the key *blah* is unknown to the system. Do you want to proceed? yes/no". If you say "yes" it memorizes the key.

Re:So what's the plan, Theo?

[metacell]

I, for one, would really love the ability to secure boot a Linux system, knowing that every component is still exactly as it was when I last checked it and nobody has sneakily installed malware that secretly emails spam to all my friends and my financial details to carding sites.

You seriously believe email spammers and credit card stealers modify the boot loader?

99.9% of malware is spread through e-mail or web pages that exploit vulnerabilities in the OS, or by trojans. They can hide in almost any executable on the machine.

Re:So what's the plan, Theo?

[metacell]

If you verify everything you download before running it, why do you need SecureBoot?

Re:So what's the plan, Theo?

[metacell]

How about doing it like SSH? The first time you install something with a new key it tells you "the key *blah* is unknown to the system. Do you want to proceed? yes/no". If you say "yes" it memorizes the key.

That's the best damn suggestion I've seen in this discussion.

Re:So what's the plan, Theo?

[lister king of smeg]

exactly

Re:So what's the plan, Theo?

[aaaaaaargh!]

How about putting legal and moral pressure on hardware manufacturers to change the implementation of the "Secure Boot" system to something more reasonable?

Which OSes become bootable ought to be uniquely decided by the users during installation without any complex fiddling and there should be the same procedure for any OS. For example, require the computer to have a hardware switch that when set to INSTALL ON will allow a new OS to be installed and when set to INSTALL OFF does not allow any changes to the bootloader. That's how it should work, and it's technically feasible.

Re:So what's the plan, Theo?

[aaaaaaargh!]

+1

Please mod parent up!

Re:So what's the plan, Theo?

[bws111]

Right, all hardware (PCs, phones, tablets) manufacturers should be forced to go to the expense (passed on to the users of course) of finding space for and installing a switch that 99.99% of their customers will never touch just so YOU can have what YOU want. While we're at it, why don't we put legal and moral pressure on hardware manufacturers to stop using integrated circuits? I mean, the use of those things makes it SO much harder to hack the processor to change the pipelining like I want.

Grow up. No-one is required to produce a product to your liking, ever.

This stinks!

[deltaromeo]

This whole Microsoft / Secure Boot situation is outrageous, it should never be allowed to be implemented, linux distro's should not be having to get anything signed by Microsoft. Hopefully some judge someday will see sense and kill it and also force Microsoft to carry positive mentions of other OS's in their advertisements in a similar fashion as the Apple / Samsung tablet ruling.

Re:This stinks!

[luther349]

guess you missed all the we can add are own keys they can get there own keys or it can be disabled. they are just going with the simple way for the stupid users.

Re:This stinks!

[SgtChaireBourne]

Not in ARM. While everyone is distracted about the atrociousness of what M$ is trying to pull on the x86 with UEFI, an attempt several order of magnitude worse is being made on ARM. The intent, if M$ is given its way by OEMs, is to prevent 'secure' boot from being disabled. ARM is not some fringe architecture, it is the architecture found on today's (and tomorrow's) tablets and phones.

Re:This stinks!

[bws111]

OK, so ARM is the architecture on today's (and tomorrow's) tablets and phones. And how many of them are running Windows? Microsoft does not get to dictate what all ARM manufacturers do, only the ones that preload Windows 8 (which currently is 0% of the market). If you want to avoid the evil Microsoft's edicts, buy a device that doesn't have Windows on it (like an Apple or Andriod device). After all, Apple and Google clearly would never support something as evil as secure boot, would they?

Re:This stinks!

[SgtChaireBourne]

Yes, it could backfire and shut Windows out of ARM. Right now, Windows has no presence on ARM, thankfully, and the Vista 8 'Secure' Boot requirements for ARM might well keep it that way -- if we are lucky.

Re:Canonical deserves it

[Desler]

Let's change the entire interface to be more like Win7

Since when did Windows 7 have overlay scroll bars, global menus, and the title bar buttons on the left?

Like RMS, Theo De Raadt is right when everyone

[RLiegh]

else is wrong.

Sadly, MS has the power to take control of our computers away from us --and with secureboot they're doing exactly that. This is a direct attack on personal computing and the freedoms of the end-user to control the software on their computer.

RMS and Theo De Raadt are both right on this --but neither one of them has the influence needed to avert this attack, so it doesn't matter.

The era of personal, general-purpose computing is over.

Re:Like RMS, Theo De Raadt is right when everyone

[Anonymous Coward]

But the fact that some geniuses were laughed at does not imply that all who are laughed at are geniuses. They laughed at Columbus, they laughed at Fulton, they laughed at the Wright Brothers. But they also laughed at Bozo the Clown.

The world over is glad that the era of personal, general-purpose computing is over, because it has enabled the some of the fastest, innovative computing services we have ever seen.

Re:Like RMS, Theo De Raadt is right when everyone

[Anonymous Coward]

Spot on.

The only two Free distros/OSs that do have the influence have both acquiesced. He is right to call them out.

Re:Like RMS, Theo De Raadt is right when everyone

[AdamWill]

"Sadly, MS has the power to take control of our computers away from us --and with secureboot they're doing exactly that."

By...specifically requiring that you have the ability to turn Secure Boot off, and enrol your own keys?

The Microsoft Windows 8 certification requirements specifically require both these things. The UEFI spec does not. A manufacturer who complies only with the UEFI spec has *more* freedom to restrict your ability to control the hardware than a manufacturer who also complies with the Windows 8 certification requirements.

Re:Like RMS, Theo De Raadt is right when everyone

[metacell]

Microsoft has to play nice to get other companies to play along, and to avoid accusations of monopoly practices. Once SecureBoot is in place, and Microsoft's competitors have to go to them to have their own bootloaders signed, Microsoft is free to change their mind.

Re:Like RMS, Theo De Raadt is right when everyone

[Just Some Guy]

"There will be a mechanism to turn off this method of booting on x86 hardware."

What's OpenBSD supposed to do on ARM, where Microsoft has mandated that Secure Boot can't be disabled? From the Microsoft "Windows Hardware Certification Requirements", page 116:

MANDATORY: Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of Pkpriv. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure MUST NOT be possible on ARM systems.

OpenBSD is on a lot more platforms than just x86.

Re:Like RMS, Theo De Raadt is right when everyone

[bws111]

If you want to run OpenBSD on ARM, do it on a device that didn't come preloaded with Windows (ie virtually all of the devices out there today).

Re:Like RMS, Theo De Raadt is right when everyone

[AdamWill]

If they have to play nice to avoid accusations of monopoly practices now, why would they not attract accusations of monopoly practices if they cease to play nice in future?

Re:Like RMS, Theo De Raadt is right when everyone

[rastoboy29]

Really?  You give up that easily?

How about we Slashdotters use our influence in the companies we work for to not buy hardware with this crap on it?  If companies don't buy it, the manufacturers will play ball with *us*, not MS.

WE are the customers.

Re:Like RMS, Theo De Raadt is right when everyone

[metacell]

Oh, they would. But by then it'd be too late. If their competitors tried to take it to court, it'd take the better part of a decade to reach any kind of decision. See, for example, Netscape.

Volume manufacturing?

[dutchwhizzman]

I wouldn't be surprised if the mass production of pre-installed systems will be helped with some sort of system that installs "enterprise/OEM" keys into the OS or the BIOS so fully automated installs can take place.

Now where have we seen this done before and what happened because of it?. I doubt this whole "secure boot" thing will last very long before software pirates will have found a way around it again. Once that happens, so will the malware authors and the wohle exercise will be useless again, just like all the other copy protection and anti malware schemes implemented by MicroSoft in their desktop operating systems.

Re:Volume manufacturing?

[Antique Geekmeister]

Virtualization works very well against it.

External intermediate nonce & public key &

[tlambert]

You ship the TPM with a per-TPM public key in it, and a USB dongle with a certificate on it signed with the per-TPM secret key for the per-TPM public key, and then you require the presence of the dongle to intermediate the installation of the OS of your choice onto the machine. You allow installation of other public keys signed with the private key, and you have another public key and separate private key to permit per-device self-signing of whatever code you want, but only on a per-device basis.

Then you have your BIOS/EFI/UEFI/Coreboot/u-boot refuse to do anything other than go into "install mode" if the dongle is inserted so that the dongle will be removed after installation for normal operation so that it can't be abused by malware.

After that, all vendors are responsible for securing their own OS past the point of it being loaded into memory.

1 thing I admire about him

[Anonymous Coward]

He has courage. You have to admire him for being so forthright, right or wrong. It takes balls to act as he does in today's "politically correct society" (what a bunch of hooey) - which in my opinion, is just being as honest as he can despite profanities and what-not.

I state that, because there's truly only 1 thing I personally respect in debates: When people are shown incorrect with facts versus their points. Undeniable reputably backed hard facts that are on the subject at hand, only.

Otherwise, things like ad hominem attacks are nothing but rubbish crap, period.

Thus, when Mr. DeRaadt's undeniably shown to be full of utter crap on statements he's made (we all make mistakes mind you) and moreso, consistently? Then his detractors have actually made a solid point.

When Mr. DeRaadt hasn't been utterly disproven beyond a doubt on his ideas, despite his "let it all hang out" attitude (which to a degree I respect a great deal for the reasons stated above but admittedly, other times not), he has made HIS point, disproving his detractors.

It's as simple as that.

In other words, what I have noted is that when the media or other groups attack a person on illogical grounds, ala ad hominem attacks? They fear them (and often for quite selfish and often nefarious reasons that aren't for the good of others, only themselves. Just an observation from over 1/2 a century of my life now.)

Re:1 thing I admire about him

[AdamWill]

People like to throw 'ad hominem' around way too much, because it sounds all clever, I guess. It doesn't work all the time.

An 'ad hominem argument' is an error when you're formally debating a specific argument with another person, and you try to win by attacking the person. 'You say that this apple is green, but I say that you smell and your mother is French, therefore the apple is red and I win!' That's a true case of an 'ad hominem argument' which is flawed.

You can't just go around yelling 'ad hominem' every time anyone says something bad about another person, though. AC's whole point, such as it is, is that he stopped being involved with OpenBSD because he thinks Theo is a dick, and he encourages other people not to get involved in OpenBSD because he thinks Theo is a dick. You can't really lob 'ad hominem' at someone, as if it means something, when their entire _point_ is that a person is being a dick. You have to actually engage with the argument that the person is a dick, and try to contradict it.

Re:1 thing I admire about him

[Anonymous Coward]

I know exactly what ad hominem attack ("to the man") means. I've taken formal logic courses at the collegiate academic level (philosophy of logic). Have you?

You can't just go around yelling 'ad hominem' every time anyone says something bad about another person

Fact of logic regarding ad hominem/to the man attacks: Anyone that attacks the person, rather than their points on the subject at hand that person is asserting, is guilty of a blantantly illogical off topic ad hominem attack and a fail. Period.

Re:1 thing I admire about him

[AdamWill]

Not 'period', in precisely the case I explained above. If the whole point of what they're saying is 'X is an asshole and therefore I refuse to associate with X', complaining that it's an ad hominem argument is utterly missing the point. The point being that not everything is, in fact, formal logic. It doesn't make sense to apply the rules and standards of formal logic to every statement any person makes. OP was not attempting to demonstrate a fact via formal logic, he was expressing his personal opinion that he doesn't like Theo. Trying to apply the rules of formal logic to such a statement is ridiculous.

Re:Canonical deserves it

[oakgrove]

You're replying to a not so cleverly disguised false flag waving anti-Linux troll. Just thought you'd like to know.

Microsoft Certification and BIOS

[RudyHartmann]

From what I understand, Windows 8 will run on most contemporary hardware. I installed it on a 3.8GHz P4 system and it ran fine. But it looks like if you want Microsoft Certification, then you need a BIOS that contains the UEFI code. But what if a manufacturer doesn't care about Microsoft Certification and elects to install Windows 8 on a PC with a UEFI BIOS? Then Linux or other operating systems should have no problems dual booting with Windows 8. I conclude that market conditions may cause some PC OEM's to eschew this BIOS extension altogether. Especially if it annoys their potential customer base.

Re:Microsoft Certification and BIOS

[RudyHartmann]

From what I understand, Windows 8 will run on most contemporary hardware. I installed it on a 3.8GHz P4 system and it ran fine. But it looks like if you want Microsoft Certification, then you need a BIOS that contains the UEFI code. But what if a manufacturer doesn't care about Microsoft Certification and elects to install Windows 8 on a PC with a UEFI BIOS? Then Linux or other operating systems should have no problems dual booting with Windows 8. I conclude that market conditions may cause some PC OEM's to eschew this BIOS extension altogether. Especially if it annoys their potential customer base.

Darn, I meant "But what if a manufacturer doesn't care about Microsoft Certification and elects to install Windows 8 on a PC without a UEFI BIOS? " Then they will be able to dual boot Windows 8 without Microsoft issuing a UEFI license.

Re:Microsoft Certification and BIOS

[AdamWill]

You might want to learn what the hell UEFI is before sounding ridiculous.

UEFI is not a 'BIOS extension'. BIOS and UEFI are completely different standards for firmware for PCs. UEFI is intended to _replace_ BIOS.

UEFI is also not the same thing as Secure Boot. Secure Boot is one feature of recent versions of the UEFI specification.

"From what I understand, Windows 8 will run on most contemporary hardware. I installed it on a 3.8GHz P4 system and it ran fine."

Windows 8 does not require Secure Boot to be enabled to run, indeed, or else it wouldn't work on old hardware.

"But it looks like if you want Microsoft Certification, then you need a BIOS that contains the UEFI code. But what if a manufacturer doesn't care about Microsoft Certification and elects to install Windows 8 on a PC with a UEFI BIOS?"

This section is completely incomprehensible. I can't even begin to guess at what you were trying to say. But...the certification requirements do require a UEFI firmware with Secure Boot included and enabled by default. It's difficult for a manufacturer to 'not care about' certification because they have to compy with the certification requirements in order to buy copies of Windows from Microsoft at OEM discount prices. If they don't comply their only option is to buy copies from resellers at retail prices, which obviously hinders their ability to compete with manufacturers paying OEM rates. I highly doubt any major manufacturer will sell systems pre-loaded with Windows 8 but without complying with the Microsoft certification requirements.

Re:Microsoft Certification and BIOS

[AdamWill]

Please stop confusing UEFI and Secure Boot. It makes it impossible to communicate with you.

Re:Microsoft Certification and BIOS

[RudyHartmann]

Hey, Adam. Do you actually have any friends? You have such a nice disposition.

Re:Microsoft Certification and BIOS

[AdamWill]

Yeah, I know. Instead of posting nothing but useless snarks, like a nice guy like you does, I spend several hours of my leisure time in here providing useful factual information to people, with occasional snark-y language in the middle.

Boy, I'm such a giant douche.

Re:is installing Linux on Apple hardware a solutio

[greg1104]

Given that Apple is actively adding Secure Boot Chain to their own devices, I wouldn't place a bet on them as the safe hardware platform here. Normally I buy used Lenovo laptops to put Linux on them. If Microsoft's Secure Boot starts to be more of an issue, I'd probabaly switch to a Linux hardware rebranding company like Emperor Linux to make sure I didn't end up with a problem system.

Re:There's nothing wrong in running a company

[Anonymous Coward]

Also canonical never made secret in being a wannabe apple, not exactly microsoft...

Strange: I'm running Ubuntu (Xubuntu actually), but not on Canonical hardware.

Losing Influence

[wzinc]

Microsoft is quickly losing influence; I don't think their secure boot stuff is going to be that big of a deal. I would say they have a chance with Windows Server, but 2012 has Metro, so I think they'll be declining on all sides now. They don't seem to care about what people actually want; they just want to push some new thing.

Personally, I never liked Windows, but with Metro even on Server, I'll be seriously pushing Linux at work.

Re:Losing Influence

[BlueCoder]

Window 8 is about turning windows into an embedded platform like an iphone. Both securing the systems and letting them like a cut of all software through their software store. You'll be installing windows 8 with a smile on your grandmothers and parents computers. Of course you wouldn't be caught dead using it. All enthusiasts have all long jumped ship on windows except for gaming.

With windows 8 and Microsoft taking a cut I expect it to motivate a PC games dedicated Linux distribution and more development on hypervisors to run multiple Linux versions without a performance hit. Valve in particular will probably lead the effort.

Re:Why I Left OpenBSD

[Anonymous Coward]

It is official; Netcraft now confirms: *BSD is dying
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming close on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.

You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.

FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.

Let's keep to the facts and look at the numbers.

OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.

Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.

All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a cockeyed miracle could save *BSD from its fate at this point in time. For all practical purposes, *BSD is dead.

Fact: *BSD is dying

Theo ranting, film at 11

[Anonymous Coward]

Theo, ranting, is why he got kicked off the NetBSD project. Theo, ranting, is why OpenBSD's drivers for Broadcom chipsets stink. (Look up how the original author tried to resolve the licensing problems of sticking his GPL drivers in an OpenBSD kernel and was ignored, then screamed at by Theo for making the issue public.) Theo, ranting, is why OpenBSD doesn't properly handle booting from software RAID. Theo, ranting, is why the OpenBSD installer works like the UNIX crap I learned to loath back in 1985 and can't store the state of what you've already selected or go back, you just have to start over from scratch. Theo, ranting, is why OpenSSH has no built-in support for chroot cages. Theo, ranting, is why OpenBSD has no virtualization server capability. Theo, ranting, is why OpenSSH still stores both host keys and by default, user private keys in clear text with no expiration, and has no plans to fix this. Theo, ranting, is why the "compatiblity chart" is a list of chipsets that don't match the actual chipsets published by the manufacturer, and usually are from chipsets at least 4 years old.

Theo, ranting, usually means you're doing something right for your actual client base rather than for his ivory tower. There's a reason OpenBSD is used only by fanboys who run it on "hobby" systems and don't get any work done. And yes, I've dealt with the crap for years: I *wrote* the first SunOS ports of SSH-1, SSH-2, and OpenSSH. (Theo's fan club did not write SSH: they ported Tatu's previously GPL work into OpenSSH, and screwed up the license. Surprisingly little of the actual codebase is due to OpenBSD hosted development.)

Re:Theo ranting, film at 11

[MaoTse]

linux open source drivers for Broadcom chipsets also stink
perhaps because Broadcom policy stinks ?

OBSD team is like the last warrior, sometimes for way too much

but most drivers actually benefit a lot because of OBSD release process
and sometimes linux pragmatic way of doing you is just to be laughed at ...

I won't address your later comments - they're seem to be much too personal ;-)

Re:Theo ranting, film at 11

[zyche]

No, this isn't 'Interresting', rather mod as 'Blathering'.

Well, there is no point denying that Theo isn't the most malleable person. But, as has been said here on /. before: while he comes through as whining most of the time, he's also correct most of the time. Many people tries to interpret his statements from the common commercial viewpoint (like in, how to develop a successful software product and make PROFIT, or at least achieve world domination), but rather his goal is quite simple: develop a free, fast and secure Unix OS. That's all. No grand plans of IPOs or commercial success. Theo is quite happy getting by on selling those CDs, living in his little house, and occasionally traveling around the world climbing mountains and hacking Unix. You gotta read goal.html and observe him and the project for a few years to really understand that.

Theo, ranting, is why he got kicked off the NetBSD project.

While this is true, the history also proved him correct on many things (Charles Hannum was on the core team that did the kicking).

Theo, ranting, is why OpenBSD's drivers for Broadcom chipsets stink. (Look up how the original author tried to resolve the licensing problems of sticking his GPL drivers in an OpenBSD kernel and was ignored, then screamed at by Theo for making the issue public.)

That whole mess sucked. The OpenBSD developer that made the port (which was supposed to be a re-implemenation) f*cked up big time and imported GPL-files into the tree. The only thing positive in the whole affair is perhaps Theo's unconditional backing of his developer.

Theo, ranting, is why OpenBSD doesn't properly handle booting from software RAID.

It does (I believe the kernel must be on a non-RAID slice/disk, but that's no different to most other implementations).

Theo, ranting, is why the OpenBSD installer works like the UNIX crap I learned to loath back in 1985 and can't store the state of what you've already selected or go back, you just have to start over from scratch.

Actually, the very minimalistic installer is often hailed as one of the best and fastest in the industry. I don't think that there are that many installers where you can do the install by repeatedly pressing enter (and writing the hostname once) in that short time. And well, it's doesn't remember the state, but then again, you can restart it (a shell script) and start over without rebooting - that can't be said about many others.

Theo, ranting, is why OpenSSH has no built-in support for chroot cages.

This seems to disprove that. Unless you have different definition of 'chroot cage'.

Theo, ranting, is why OpenBSD has no virtualization server capability.

In many aspects virtualization contradicts the goal of security. Also, most VM solutions are proprietary, thus does not run on OpenBSD.

Theo, ranting, is why OpenSSH still stores both host keys and by default, user private keys in clear text with no expiration, and has no plans to fix this.

Yes, in clear text. Do you propose they should be encrypted? And where should the crypto key be placed? Perhaps... on disk? Hashed? If you are paranoid - use whole disk encryption. Because physical security is the key issue here as I see it. The keyfile is supposed to be user-readable only...

What is a reasonable default expiration time? No, there is no plan because the feature doesn't improve anything.

Theo, ranting, is why the "compatiblity chart" is a list of chipsets that don't match the actual chipsets published by the manufacturer, and usually are from chipsets at least 4 years old.

Uhmm, wha

Re:Theo ranting, film at 11

[rubycodez]

misinformed you are, OpenBSD and wares written by the OBSD team are used in routers, appliances and controllers worldwide.

The BSD have surpised GNU/Linux in wireless chipset support, having drivers sooner.

The OpenBSD's simple installer too hard for you? don't cry here about your lack of ability to work such a simple thing. Plenty of youtube videos on how to do it if it really puts you out so much to read the excellent docs.

The OBSD team won't pursue virtuaization because it can't be done securly on x86 architecture. This was proven in 2009, when the most boastful of the hypervisor vendors, VMWare, had exploits uncovered.

You did not write any ssh code, you are a poseur.

I don't get it

[future assassin]

whats to stop manufacturers from not including secure boot in their hardware. No way there isn't a big market for some Chinese manufacturer to jump onto this and have the Linux world use their hardware.

Re:I don't get it

[Desler]

The loss of 10s of millions of sales?

Re:I don't get it

[DaMattster]

whats to stop manufacturers from not including secure boot in their hardware. No way there isn't a big market for some Chinese manufacturer to jump onto this and have the Linux world use their hardware.

What's to stop manufacturers from not including secure boot in their hardware? Threats of litigation by Microsoft.

Re:I don't get it

[lister king of smeg]

it won't prevent malware drive by downloads form being installed only root kits and that is until someone('s) shows of an exploit at the black-hat/def-con conference in Las Vegas next year and kills even that. and if the corporate IT department is worth a damn they will know that. and as for Linux admins wanting that in particular wanting it when have any of those been a problem for them? what it will do is be a pain in the ass for them to run installs of linux on those system because of the lack of signed distros.

Re:I don't get it

[AdamWill]

They have to include it to get Windows 8 certification, which they need if they want to buy their copies of Windows 8 from Microsoft at OEM discount prices.

If they don't want to pre-load Windows, or they're happy buying copies at retail prices, there's no particular reason they have to include Secure Boot support, unless they feel it's a selling point.

Re:Why I Left OpenBSD

[Anonymous Coward]

http://www.trollaxor.com/2010/06/why-i-left-openbsd.html
Copy and paste from this retard.

Re:External intermediate nonce & public key &a

[Anonymous Coward]

Even better, just have a fucking pushbutton on the side of the box.

You want to install your own bootloader? Great, it will try to write its key - and you hit the little button to commit that. A virus sneaks onto your machine? Good luck reaching out of the CPU to toggle a physical contact.

Re:is installing Linux on Apple hardware a solutio

[Desler]

Yes, doing it to iOS devices with their ARM chip. There was nothing from Apple even remotely hinting of doing so with their x86 hardware. Nice FUD, though.

Open source != free software

[betterunixthanunix]

Remember when we used to make fun of the sort of people who would insist that we should say "free software" and not "open source?" I think by this point in time, we can finally acknowledge that they were right: open source is about software development, not respecting or protecting user freedom.

Re:Open source != free software

[Requiem18th]

Are you including yourself in this "we" that used to make fun of us who insisted in "free" over "open"? Because if you aren't then you are just using a rethorical device to sound more convincing. I don't like that, even if it favours my case.

If you do then WOW!. I mean WOW!, it is the first time I see someone change opinions on the internet in a long long time. I'm amazed. The inhability of people to change their minds has been a source of frustration of mine for so long.

Re:Open source != free software

[betterunixthanunix]

Well it is not just this one article that changed my mind; I think the real turning point for me was GPLv3, which caused me to take a closer look at the issues. Since then, I have come to understand just how deep the difference really is; there is something fundamentally different between the philosophies of "free" and "open." The change is not merely "on the Internet;" we are talking about accepting a different way to view the world.

More motivation to hack/root all bios from now on

[BlueCoder]

I'm more surprised that bios replacement isn't already more prominent. It's not all that complicated to reverse engineer hardware initialization, it's just that it isn't necessary. Hardware will always be rootable. And software will always be able to implement emulation and man in the middle on such hardware. It will just require more active participation from the hardware owner, no virus or software installation will be able root the system without you actively participating.

Re:Why I Left OpenBSD

[phantomfive]

but the more I got involved in developing for OpenBSD the more I was dissuaded from doing so. Part of the issue was this focus on security.

Wait, the thing that bothered you about OpenBSD development is that it was focused on security? Friend, I'm gonna say you should have done a little more research before deciding to join that project.

Re:Illogical ad hominem attack != valid debate

[lister king of smeg]

Nobody can tell me that people like yourself, that act the meek worm online with innuendo and implications with no backing is now playing psychiatric pro (which you clearly are not) is not the worst offender of all via implication and innuendo possible

Theo i see you are your cordial self as always

Re:You lost me at...

[unixisc]

Why is this a Microsoft story, as opposed to a BSD story (somehow, OpenBSD tag doesn't translate into BSD) or a Linux story (since Red Hat & Canonical are involved)? Why doesn't /. automatically tag any OpenBSD stories BSD, and Red Hat & Canonical story Linux?

Re:More motivation to hack/root all bios from now

[peppepz]

With "Secure" Boot, hardware must no longer allow BIOS to be freely flashed, it must only be replaced with a new cryptographically signed BIOS image. That must be true for both the main one and the option ROMs. Otherwise the "secure" boot mechanism would be meaningless. (Not that it has much meaning anyway...)

Business Friendliness

[peppepz]

This is why I disagree when people call business-friendly licenses "pragmatic". Businesses are always more "pragmatic" than you, and this is how they behave when they hold the knife by the handle: while they sponsor GNOME conferences, or proclaim open source friendliness, they've locked us all out of our computers.

In this situation, it's more pragmatic to require distributors of free software to also distribute the keys needed by the user to run modified versions of the software. A requirement that the authors of GPLv3, with foresight, chose to adopt, with no lack of criticism for being too "extremist".

Re:is installing Linux on Apple hardware a solutio

[cheesybagel]

Apple has had something similar to this for so long they still only sold PowerPCs back then.

Replace SecureBoot?

[catmistake]

idk... so I'm asking. Say I purchase hw with Windows 8 preinstalled... and I don't want to fuck with any of this BIOS key bullshit, nor run Windows 8, nor any Windows on bare iron (because I am, in fact, sane), but only free software: can I simply reflash the OEM placed SecureBoot with another non-SecureBoot BIOS? What of coreboot (LinuxBIOS)? Can I still use that? If so, why doesn't Canonical, RedHat and the BSDs make something along these lines as an option in their plans? Who forced the top Linux distros to whiddle down options to a single non-choice option?

Re:Replace SecureBoot?

[LaughingRadish]

Coreboot requires a lot of work to get ported to a new motherboard. I'm trying to wrap my head around how to build and run it just for QEMU and am not getting very far. Keep in mind that Coreboot just sets up the hardware. You also need a payload to accomplish what the BIOS and/or EFI used to do. There is SeaBIOS that replaces the bios, OpenBIOS that provides a Sun-like OpenFirmware, and FILO which is sort of like LILO or Grub in firmware. An overarching deficiency though, is there is no built-in equivalent of the setup menu. I haven't yet figured out what the equivalent is.

Re:Replace SecureBoot?

[LaughingRadish]

Coreboot, as it is now, certainly does ask too much from the average user. Its ultimate goal is to load a free UEFI implemenation.

Re:Replace SecureBoot?

[AdamWill]

"can I simply reflash the OEM placed SecureBoot with another non-SecureBoot BIOS?"

Not easily. UEFI implementations with Secure Boot support are supposed to only be flashable with signed images, to prevent exactly this kind of workaround being done transparently by malware.

Of course, at least _some_ implementations are highly likely to be cracked, as locked bootloaders on phones often are.

Over the top? maybe... Still a valid poit? Definit

[sirlark]

There is nothing (apart from cost and practicality) stopping other vendors/distros/organisations from negotiating with hardware manufacturers to have their keys pre-installed, but consider this. Microsoft's action are restraining trade. Microsoft is using their dominant market market position to have hardware manufacturers ship with UEFI enabled by default, with microsoft keys enabled by default. They are saying to the manufacturers, if you want to label your hardware windows complaint you must do X, where X affects other vendors by making their product more difficult to use. Microsoft doesn't need to pay for this 'service' from the manufacturers, the manufacturers are forced to comply in oder to sell their products (because of window's dominant market share). Isn't this is already anti-trust, but against the manufacturers. Other vendors who don't have the market share have two choices:

1. Don't use secure boot, and provide instructions for user's to disable secure-boot, and re-enable it in the case of dual booting. And before anyone shouts boohoo, it only affects a bunch of hobbyist geeks with home servers, think of the industry/corporate servers that would very much benefit from being able to market secure-boot. This option is abusive because it makes Microsoft's products appear siginificantly better, essentially preventing other vendors from effectively and practically providing the same STANDARDS COMPLIANT feature
2. Approach the manufacturers and ask for their own keys to be included on the firmware, but without the market dominance factor, they will probably be asked to pay. There's nothing wrong with being forced to pay I guess, but the amount shouldn't be ludicrous. Also, opening up the firmware to keys from anyone who is willing to pay kind of defeats the point. Hardware manufacturers should only be shipping firmware with bona fide keys. Who decides keys are bona fides? There's a tricky question. UEFI appears to support the idea of trust agility, in that users can add or remove keys from the system, but practically, we'll end up in the same situation as we are in now. Geeks and pros haves secure machines, end users have security holes in the firware cause some mob organisation ponies up for a key becasue there's profit in it. Otherwise, if you want a central authority to decide which keys are 'secure', then it's a slippery slope. Who is big enough to warrant a free key. Smaller distros and research OS's lose out, effectively killing competition.

Both options sound like anti-trust to me. In my mind it would be better for manufacturers to ship with NO keys, and if you want to install an OS, then the OS installation instructions just have to include the extra step explaining what needs to be done. Again, for Joe Schmo who buys his whole PC retail, this doesn't affect him, because some IT guy in a backroom does the installation. The machine comes with one key, for whatever OS Joe wants installed. Practically speaking, this means that everyone will preinstall windows whether or not the customer wants it, same as now. Nothing would stop larger or smaller *nix distro users from installing the approriate keys. Microsoft's advantage would be that the retail industry does work for them for free, same as now. I'm not saying it's right. I'm saying it's not a catastrophe. Microsoft pays for this advantage in a way, through marketing, lobbying, etc. Cananonical and red hat could negotiate similar advantages directly for example with dell/hp/best-buy ... it's probably not worth their while.

Re: They see me trollin'

[cant_get_a_good_nick]

2) pre installation of all available certs by the manufaturer (now guess for how many reasons manufacturers aren't going to auto install keys for all available linux/HURD/bsd distros, yep there are many).

It will be difficult to boot the Hurd on these machines? Think of the poor 4 people this will inconvenience...

two problems

[Chirs]

1) They can only install other OSes on x86 machines. On ARM they cannot. There will be no rooting your Win 8 phone/tablet.

2) As they point out, making non-technical people boot into the bios and disable secure boot is a significant barrier to allowing them to install other OSes.

Re:two problems

[AdamWill]

" There will be no rooting your Win 8 phone/tablet."

You mean 'Windows RT phone/tablet'.

This sounds like nitpicking, but it's really not, because using the correct names is important: if you take care to use them correctly, then things are clear. 'Windows 8' is for the traditional PC architecture - x86/x86_64. 'Windows RT' is for ARM. I'm always careful of this distinction - when I say 'Windows 8' I mean specifically Windows 8, not Windows RT. i.e., I'm not talking about ARM.

Re:two problems

[vux984]

1) They can only install other OSes on x86 machines. On ARM they cannot. There will be no rooting your Win 8 phone/tablet.

Same as you can't root your iphone or ipad (without jailbreaking it)
Same as a bunch of androids.

Indeed, same as you can't root your xbox 360...

Win 8 ARM or "Win RT" is a different product in a different market, and that market has different norms. I am not suggesting they are good norms, but lets not paint microsoft as doing anything to change the norms. They certainly aren't leveraging its desktop monopoly to bring about changes in the ARM device market.

2) As they point out, making non-technical people boot into the bios and disable secure boot is a significant barrier to allowing them to install other OSes.

Yes. Putting a lock on the front door to keep thieves out also serves as a significant barrier to your neighbor getting in while you are away on vacation to turn the stove off... and yes if you want your neighbors to get in you have to go get an extra key cut and trust your neighbors with it, and so forth.

Yes. Security is a "barrier". But its not an unreasonable one.

Manufacturers on board

[phorm]

Hell, it wouldn't cost the manufacturers much. For *years* BIOS's had flags to booting in a 9X compatible way, then XP. SATA drive controllers still tend to have an option to emulate IDE, mostly for the benefit of older OS's.

So why not just have a checkbox in the BIOS "All generic boot key", disabled by default, and have a general key for Linux/BSD. Easy enough for most who will use Linux to still make the system bootable, and it allows the system to be locked down by default.

Re:Why Allow Red Hat and Canonical?

[udippel]

So, uhm, what else can this bootloader load? Say Windows but modified in a malicious way? Certainly it would seem that GRUB should be able to do that, if nothing else?

I must say I dont really see this making much sense from any kind of security perspective.

[My probably first reply to an AC here.]

All right. I'd mod you insightful if you were no AC. But you are a dreamer. Microsoft isn't really interested in Security. If they were, they'd already thrown in the towel and had de-registered themselves as company.
The intention is to effectively close the market to competitors. Think, and think hard: Which percentage of the computer-buying population would actually even consider fiddling with some boot options to make anything else but Windows running? As of today, you can throw in a Ubuntu-CD and just give it a try (actually, many did, and most revert to Windows). As of tomorrow, you simply can't do this this simply.
Oh, sorry, wrong example here: Ubuntu == Canonical.

As Ex-Sysadmin I can tell you that you'd be fired for the next malware problem, any next malware problem, if only you dared to remove the Secure-Boot-Lock. Because pointy-haired bosses do not think that thinking is required for their jobs.

A push button is insufficiently secure

[tlambert]

The point of a dongle is physical separation. A push button would let someone left alone with the computer for a few seconds install malware that looks sufficiently like the default system that there is little likelihood of the user noticing.

So for example, you could have a nominally secure OS, like Chrome OS, where it's hard to get a key logger onto it because of the way the TPM is used, and you could install a fake version of the OS that has a built in keylogger which looks and acts sufficiently like the OS that's supposed to be there that the user can't tell the difference.

If you go the push button route, you need to combine it with a mandatory wait interval (on Chrome OS, it's 5 minutes, if you switch the developer switch), on the theory that someone who is not trusted won't be left alone with a machine for longer than 5 minutes, and then this is combined with a user safety screen which beeps and makes you explicitly use the keyboard to get around it and./or wait 30 seconds on each boot to notify you that the push button has been used.

This still isn't great, since if you are left for 5 minutes + 8 seconds with an already booted device, you can get it compromised and rebooted in about 5 minutes and 17 seconds. The binary option, using the dongle, closes that race window entirely.

Re:A push button is insufficiently secure

[rdnetto]

Solution: put the button inside the case, maybe directly on the motherboard.
If you're serious about security, the case is going to be physically locked anyway.

UEFI, so fair you'll pay to get out of it.

[Requiem18th]

I think Redhat's and Canonical's decisions are their own counterargument. As paradoxical as that sounds.

The argument against UEFI is that it gives an advantage to Microsoft, putting them in control of licensing.
The counter argument is that UEFI has provisions for running other OS, that don't rely on Microsoft.
Redhat and Canoncial, Microsoft competitors, chose to contract licensing from Microsoft.

Whatever UEFI provisions are*, they are bad enough that paying Microsoft is the better alternative, so it is still the case that UEFI favors Microsoft.

* UEFI provision are.
1.- User's can disable Secure Boot.
2.- Users can sign their own OS at their expense.
3.- Users can install keys provided by distributions.
3.- Distributions can make deals with OEMs to include their keys.

Re:Over the top? maybe... Still a valid poit? Defi

[AdamWill]

It's a plausible argument. I'm not sure it's really strong enough for legal proof, though. I'm not a lawyer, so I couldn't really say further than that.

"Cananonical and red hat could negotiate similar advantages directly for example with dell/hp/best-buy ... it's probably not worth their while."

Well, for us (RH) it really isn't, because that's not really what we do - we don't sell consumer OSes in retail. Canonical has more ambition in that direction. They do actually have a plan to self-sign for OEM preloads of Ubuntu; only the 'normal' downloadable Ubuntu images, intended for end-user installation onto systems that shipped with Windows, will be signed with Microsoft's key. If you actually go buy a system with Ubuntu pre-installed from a Canonical-approved reseller, so their plan goes, you'll get a copy of Ubuntu that's pre-signed with a Canonical key.

Re: Riiiight.....

[BlueCoder]

If you have the skillset it is easy. It does take work though even if you do have that skillset. The number one motivation to do work is necessity, the second being interest.