Linux Foundation Offers Solution for UEFI Secure Boot

← Back to Stories (view on slashdot.org)

Linux Foundation Offers Solution for UEFI Secure Boot

Posted by Soulskill on Friday October 12, 2012 @01:27AM from the sidestep-and-ignore dept.

Ever since news broke last year that Microsoft would require Windows 8 machines to have UEFI secure boot enabled, there were concerns that it would be used to block the installation of other operating systems, such as Linux distributions. Now, reader dgharmon sends this quote from Ars Technica about a new defense against that outcome: "The Linux Foundation has announced plans to provide a general purpose solution suitable for use by Linux and other non-Microsoft operating systems. The group has produced a minimal bootloader that won't boot any operating system directly. Instead, it will transfer control to any other bootloader — signed or unsigned — so that can boot an operating system." The announcement adds, "The pre-bootloader will employ a 'present user'; test to ensure that it cannot be used as a vector for any type of UEFI malware to target secure systems. This pre-bootloader can be used either to boot a CD/DVD installer or LiveCD distribution or even boot an installed operating system in secure mode for any distribution that chooses to use it."

308 comments

Min score:

Reason:

Sort:

BOOT ME IN THE ARSE, BABY !! by Anonymous Coward · 2012-10-12 01:31 · Score: -1, Offtopic

Yeah, baby !!
1. Re:BOOT ME IN THE ARSE, BABY !! by Anonymous Coward · 2012-10-12 01:43 · Score: -1
  
  My butthoal brings David Boises to the Bard
  and your mom is uh effin tard
  and your mom is uh effin tard
  I could do you but your butt is large.
So why even bother with secure boot by Anonymous Coward · 2012-10-12 01:31 · Score: 5, Insightful

As per subject
1. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 01:33 · Score: 5, Interesting
  
  Exactly. Malware authors can use this. So we've come full-circle and only gained a big heap of complexity. Which is the best we could hope for once this idiotic idea got going.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 01:38 · Score: 1
  
  Well, yes, since this is about undoing the damage done by Secure Boot, you're right.
  But the people doing this have no power over vendors' decisions to enforce Secure Boot on their systems.
3. Re:So why even bother with secure boot by Z00L00K · 2012-10-12 01:39 · Score: 1
  
  And it's my computer and if my computer has features that I can't access, disable or modify - like the encryption chip - then I have a problem with that.
  If I need to change key depending on OS - then make it easy - like requesting a password for changing to another chain of keys.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
4. Re:So why even bother with secure boot by Joce640k · 2012-10-12 01:53 · Score: 4, Insightful
  
  Exactly. Malware authors can use this.
  Not if everything in the startup chain has to be correctly signed ... something which a malware author can't do.
  
  --
  No sig today...
5. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 02:00 · Score: 3, Interesting
  
  They didn't seem to have any problem setting up boot sector viruses without UEFI secure boot, so if they can get a signed bootloader, why should they now? And signing the startup chain will remove even MORE user freedoms, it's a chicken-and-egg problem that won't end until the OS is at least as locked down as iOS.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
6. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:02 · Score: 0
  
  Stuxnet/Flame/Whatever was signed by a compromised MS key.
7. Re:So why even bother with secure boot by Just+Brew+It! · 2012-10-12 02:03 · Score: 3, Insightful
  
  RTFA. I think you'd notice if your Windows PC suddenly started displaying a Linux Foundation splash screen and waiting for you to hit Enter before booting the OS.
8. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 02:08 · Score: 4, Interesting
  
  And what will the average noob user do? Hit Enter to use their computer or use a Windows recovery disk* to fix the bootloader? And if they do hit Enter and the computer apparently works fine, what do you think they'll do then?
  *Not sold with many PCs, must be burned from the hard disk
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
9. Re:So why even bother with secure boot by godrik · 2012-10-12 02:14 · Score: 1
  
  I don't want a secure boot. I just want to be able to boot whatever I feel like booting.
10. Re:So why even bother with secure boot by BLKMGK · 2012-10-12 02:15 · Score: 1
  
  Did you miss the part about a present user test? It means someone will be presented a message and asked to approve before boot proceeds. Sounds like a good way to go to me however it will certainly screw up a server reboot lol.
  
  --
  Build it, Drive it, Improve it! Hybridz.org
11. Re:So why even bother with secure boot by smittyoneeach · 2012-10-12 02:16 · Score: 3, Interesting
  
  If you've got a closed system of bits, then enough time, hardware, and interest should yield a way to jailbreak it.
  So the real value would seem to be found in upping the time, hardware, and interest requirements.
  What could well happen is that, in making Windows really painful to integrate with other systems, Redmond kills their sales.
  And wouldn't that just suck Puget Sound dry?
  
  --
  Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
12. Re:So why even bother with secure boot by BLKMGK · 2012-10-12 02:18 · Score: 4, Informative
  
  Not exactly, it was signed with a weak key produced by one of their remote desktop solutions that allowed licensing of components. Microsoft has since revoked those keys and bumped up the minimum allowed key size to stop this in the future. This was NOT a case of someone stealing a Microsoft key left in the parking lot.....
  
  --
  Build it, Drive it, Improve it! Hybridz.org
13. Re:So why even bother with secure boot by just_another_sean · 2012-10-12 02:19 · Score: 4, Funny
  
  Become a Linux user?
  
  --
  Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
14. Re:So why even bother with secure boot by Robert+Zenz · 2012-10-12 02:22 · Score: 0
  
  That would be an interesting virus: "Well, I had a virus, and it installed Linux right over my Windows". On the downside, because of the...uhhhh...technological challenged crowd Linux would become synonymous with Virus...maybe an idea for Ballmer? So that he can finally attest his "Linux is cancer" claim.
15. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:25 · Score: 1
  
  There really wasn't any reason for it. Only the doomsayers thought secure boot would matter, the rest of us knew it would have a workaround before it was publicly released.
  In a setting where many consumers are mildly paranoid about data theft (not enough to do something themselves, just enough to annoy salesmen at best Buy), secure boot is another bullet point in the advertising. For the many who do not care, it means nothing either way. For the rest of us, it means nothing because we know it has already been resolved.
16. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:26 · Score: 0
  
  And if the software is open sourced (it doesn't mention that in the article) the source code is available for anyone to download and modify. How long would it take for the malware/virus/etc authors to remove the splash screen and required input, and still find a way to keep the code signed?
17. Re:So why even bother with secure boot by Megane · 2012-10-12 02:30 · Score: 1
  
  Just make a USB-based watchdog device which periodically sends an enter key press, and is suppressed by a task running on the server. While this could be installed with physical access to the computer, it is unlikely that it could be done remotely. (Then again, if you are lucky enough that your target has the right USB device installed, and you can do a live upgrade of its firmware...)
  
  --
  #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
18. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:30 · Score: 0
  
  An old key from 1990's that used MD5 as the secure hash. Modern public key systems are robust assuming an idiot isn't managing it.
19. Re:So why even bother with secure boot by blueg3 · 2012-10-12 02:30 · Score: 1
  
  I don't want a secure boot. I just want to be able to boot whatever I feel like booting.
  Then... turn off secure boot?
20. Re:So why even bother with secure boot by ByOhTek · 2012-10-12 02:33 · Score: 1
  
  I'm guessing the signing key would have to match or work with some checksum on the boot loader.
  That means that changing the boot loader would cause the existing key to stop working.
  Then again, malware authors/vendors have no problems with using stolen credit cards to get keys from legitimate vendors... So this whole thing is kindof nuts unless the cost for a bootloader key is absurdly high (on the 10s of thousands of dollars, at least).
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
21. Re:So why even bother with secure boot by bmo · 2012-10-12 02:33 · Score: 5, Insightful
  
  Because secure boot has never been about securely booting.
  --
  BMO
22. Re:So why even bother with secure boot by Sloppy · 2012-10-12 02:33 · Score: 1
  
  Because the machine comes that way, yet you also want it to boot.
  
  --
  As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
23. Re:So why even bother with secure boot by godrik · 2012-10-12 02:37 · Score: 1
  
  If it is possible, I'm fine with that. But it is good to know there are alternatives available.
24. Re:So why even bother with secure boot by Hatta · 2012-10-12 02:40 · Score: 4, Insightful
  
  And I'd be really fucking pissed off if my Linux PC required a user present at the console to reboot. Seriously, how is this a fix?
  
  --
  Give me Classic Slashdot or give me death!
25. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:43 · Score: 1, Insightful
  
  I want a secure boot, not so corps can lock me out, but so I can lock out malware. The problem is the exact same tool can be used for both situations. You have to take the good with the bad. Like any tool, it can be abused.
  
  I don't see what is making Windows more painful to integrate into other systems. Windows(non-ARM) does not require SecureBoot.
26. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:45 · Score: 0
  
  This means IT jobs people!
27. Re:So why even bother with secure boot by marcello_dl · 2012-10-12 02:47 · Score: 2, Interesting
  
  Do you really think that the makers of an operating system which requires 3rd party AV to correct its own security shortcomings devised secure boot to protect users from malware?
  For most corporations dealing with IT, your PC, smartphone, electronic device is "territory" to be owned as much exclusively as possible.
  Secure boot has been a FUD operation on free OSes, nothing more.
  I repeat it again, If you want to secure the bios put a jumper before the write pin of the eprom/flash memory/whatever. Those who can't open the case and locate it are surely not qualified for a bios upgrade.
  I made one firmware upgrade in the last 15 years on my machines, and that upgrade was necessary only if I wanted 64bit linux.
  
  --
  ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
28. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 02:49 · Score: 1
  
  A big heap of complexity that will require the consumer to pay a little more PC tax when buying a new machine. The money going to those that control UEFI.
29. Re:So why even bother with secure boot by Miamicanes · 2012-10-12 03:00 · Score: 4, Insightful
  
  >and still find a way to keep the code signed?
  With a certificate bearing the same CN as the original? Low, as long as the bootloader realizes that it's never seen anything signed by s0m3hack3r@foo.to, and presents the user with a dialog that says something like, "You have never booted an OS signed by s0m3hack3r@foo.to, and foo.to is not recognized as a known OSS Organization. Click here to boot into your computer's mini-distro and perform an automated legitimacy lookup (internet access required), or (... options that include 'continue if you trust them' and 'cancel'...)
  For a side trip, boot into a mini Linux burned into flash that can grab an ip via dhcp or connect to wifi with ssid/key stored in flash or entered now & wget a lookup of the CN from the UEFI bootloader's organization. Known malware CNs would be blacklisted & identified as such, others could be further researched using Lynx before either continuing the boot (optionally remembering the CN for future boots) or aborting.
30. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:05 · Score: 0
  
  Counter-productive complexity, too, and market segmentation, stratification. How useful is "User-present" testing for remote or unattended server reboots, for instance? At least allow for user-configurable boot certificates. GPL the code if it isn't already. If you can't because of UEFI requirements, you're working at cross-purposes anyway.
  I applaud the Linux Foundation effort, though, precisely because it make glaringly obvious the stupidity of hiding monopolistic market (and other) megalomania behind promises of "security", which the whole UEFI secure boot premise is of course intended to do. It's a deliberate deception. So this is not wasted effort, or unappreciated, as long as it doesn't take itself *too* seriously and buy in to the fraud.
31. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:05 · Score: 0
  
  Because secure boot has never been about securely booting.
  --
  BMO
  What has it been about then? As you can easily turn it off if you will, it isn't preventing you from installing anything if you are ok with having it off.
32. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:06 · Score: 0
  
  Shill detected.
33. Re:So why even bother with secure boot by TheGratefulNet · 2012-10-12 03:15 · Score: 4, Funny
  
  "system error: secure keyboard not found. hit any key to continue."
  (that was sort of a real error message back in the DOS days. all except the secure part.)
  
  --
  
  --
  "It is now safe to switch off your computer."
34. Re:So why even bother with secure boot by jlv · 2012-10-12 03:16 · Score: 1
  
  As someone up above said "So we've come full-circle and only gained a big heap of complexity".
35. Re:So why even bother with secure boot by spike+hay · 2012-10-12 03:18 · Score: 4, Insightful
  
  The average computer user is not going to be monkeying around in the BIOS. This is about making life more difficult for non-MS OSes, and reverting the mistake that was the open x86 platform.
  
  --
  If you don't understand any of my sayings, come to me in private and I shall take you in my German mouth.
36. Re:So why even bother with secure boot by recoiledsnake · 2012-10-12 03:23 · Score: 3, Interesting
  
  Here we go with the hyperbolics without even RTFA'ing. You can choose to install the key in the store when UEFI is in setup mode so that you don't see the prompt again.
  http://www.linuxfoundation.org/news-media/blogs/browse/2012/10/linux-foundation-uefi-secure-boot-system-open-source
  Or just fricking turn off secure boot.
  
  --
  This space for rent.
37. Re:So why even bother with secure boot by Just+Brew+It! · 2012-10-12 03:25 · Score: 1
  
  It's still better than the alternative (completely invisible rootkit); and it will be immediately obvious to anyone who does have a clue that something has replaced the bootloader.
  This workaround seems like a case of "making the best of a bad situation" to me. If Secure Boot is here to stay, something like this is absolutely necessary.
38. Re:So why even bother with secure boot by bmo · 2012-10-12 03:26 · Score: 1
  
  The other person already answered what it's about. I will answer this:
  As you can easily turn it off if you will,
  Not on ARM you can't.
  --
  BMO
39. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:29 · Score: 1
  
  Do you really think that the makers of an operating system which requires 3rd party AV to correct its own security shortcomings devised secure boot to protect users from malware?
  Which OS do not require AV/antimalware type scanning software to protect userif targeted by malware? The single biggest malware epidemic in modern times in terms of percentage of user base infected (the way to measure user infection risk and infectability of a platform) was Mac OSX Flasback.
  This hasn't happened on Linux, yet, but there is nothing magical about Linux vs OSX and Windows7/8 that prevents it. Versions of Flasback installed silently without user intervention on Unix-permission-based OSX. And Windows 8 btw. doesn't require 3rd party AV software as it is built in.
40. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:37 · Score: 0
  
  On x86, yes. On ARM, M$ made sure that is not an option-- M$ forbids having the option to turn off secure boot on ARM.
  Of course, most ARM board manufacturers don't give a fuck about M$, with their approximately 0% market share in the ARM space, but that could change.
  Having _never_ used M$ windows, and having to pay for a M$ license on every laptop I have bought in the last 20 years really pisses me off. Having M$ sabotage the hardware too-- that is fucking inexcusable.
41. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 03:37 · Score: 1
  
  There is a point where the interest isn't there, and resistance does work.
  Take the PS3 for example. Buy a new one, and there is no way to jailbreak it. Only for a period of a week were PS3s "cracked", and only if someone took the box off of PSN for good. Before that, it went almost four years without anything coming close. to boot, the guy who did the crack is wiped off the face of the planet by Sony.
  I will not be surprised when desktop machines will be the same way, completely locked down to only the latest windows version, and cannot be downgraded. Any cracks would cause the machine to be locked off the internet (like how tampered with consoles are thrown off of XBL).
42. Re:So why even bother with secure boot by DRJlaw · 2012-10-12 03:40 · Score: 5, Interesting
  
  And I'd be really fucking pissed off if my Linux PC required a user present at the console to reboot. Seriously, how is this a fix?
  Because it is a fix for those who cannot or will not use the alternative of entering their own list of acceptable signing keys into the UEFI, which would not require a user present but draws a great hue and cry that it is "too complex" for the average Linux user to accomplish.
  1. Enter your keys into the UEFI key list, walk away; or
  2. Have a user present to acknowledge that they want to boot unsigned/signed-but-not-entered code; or
  3. Don't use a UEFI PC; but not
  4. Prevent the rest of the world from having access to a secure boot chain because you refuse to lift a finger yourself
43. Re:So why even bother with secure boot by mystikkman · 2012-10-12 03:41 · Score: 1
  
  If someone is able to partition their hard disk to carve out a Linux partition, one would expect them to be able to tweak a BIOS setting. Already for many PCs you need to change the boot order in the BIOS to boot a Linux CD.
  >This is about making life more difficult for non-MS OSes, and reverting the mistake that was the open x86 platform.
  Not really, there are some nasty bootkits that load even before Windows and any antivirus can, and then hook themselves to the filesystem to hide themselves.
44. Re:So why even bother with secure boot by mlts · 2012-10-12 03:42 · Score: 1
  
  If there is a way to have secure boot accept one's own keys, or just be turned OFF, it is fine with me.
  However, with a machine that uses a TPM chip and some sort of filesystem encryption, secure boot is redundant, other than the fact that the kernel is pre-signed rather than signed/sealed by the individual chip.
  TPM was done right, where it was shipped disabled. However, it won't take much for the next rev of Windows to force x86 machines to only allow MS keys and remove the ability to turn Secure Boot off, just like the ARM boxes do now.
45. Re:So why even bother with secure boot by mystikkman · 2012-10-12 03:47 · Score: 4, Interesting
  
  Do you really think that the makers of an operating system which requires 3rd party AV to correct its own security shortcomings devised secure boot to protect users from malware?
  You mean the Linux folks designed UEFI Secure boot?
  http://www.rootkit.nl/projects/rootkit_hunter.html
  
  I repeat it again, If you want to secure the bios put a jumper before the write pin of the eprom/flash memory/whatever. Those who can't open the case and locate it are surely not qualified for a bios upgrade.
  I made one firmware upgrade in the last 15 years on my machines, and that upgrade was necessary only if I wanted 64bit linux.
  Secure boot is not about the BIOS, it is about bootkits. You don't know what you're talking about and still get modded +4 interesting, typical Slashdot, really. See below for an example.
  
  TDL4 is the most recent high tech and widely spread member of the TDSS family rootkit, targeting x64 operating systems too such as Windows Vista and Windows 7. One of the most striking features of TDL4 is that it is able to load its kernel-mode driver on systems with an enforced kernel-mode code signing policy (64-bit versions of Microsoft Windows Vista and 7) and perform kernel-mode hooks with kernel-mode patch protection policy enabled.
  When the driver is loaded into kernel-mode address space it overwrites the MBR (Master Boot Record) of the disk by sending SRB (SCSI Request Block) packets directly to the miniport device object, then it initializes its hidden file system. The bootkit’s modules are written into the hidden file system from the dropper.
  The TDL4 bootkit controls two areas of the hard drive one is the MBR and other is the hidden file system created at the time of malware deployment. When any application reads the MBR, the bootkit changes data and returns the contents of the clean MBR i.e. prior to the infection, and also it takes care of Infected MBR by protecting it from overwriting.
  The hidden file system with the malicious components also gets protected by the bootkit. So if any application is making an attempt to read sectors of the hard disk where the hidden file system is stored, It will return zeroed buffer instead of the original data.
  The bootkit contains code that performs additional checks to prevent the malware from the cleanup. At every start of the system TDL4 bootkit driver gets loaded and initialized properly by performing tasks as follows: Reads the contents of the boot sector, compares it with the infected image stored in hidden file system, if it finds any difference between these two images it rewrites the infected image to the boot sector. Sets the DriverObject field of the miniport device object to point to the bootkit’s driver object and also hooks the DriverStartIo field of the miniport’s driver object. If kernel debugging is enabled then this TDL4 does not install any of it’s components.
  TDL4 Rootkit hooks the ATAPI driver i.e. standard windows miniport drivers like atapi.sys. It keeps Device Object at lowest in the device stack, which makes a lot harder to dump TDL4 files.
  All these striking features have made TDL4 most notorious Windows rootkit and it is also very important to mention that the key to its success is the boot sector infection.
  Another bit:
  The original MBR and driver component are stored in encrypted form using the same encryption. Driver component hooks ATAPI's DriverStartIo routine where it monitors for write operations. In case of write operation targeted at the MBR sector, it is changed to read operation. This way it is trying to bypass repair operation by Security Products.
46. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 04:03 · Score: 0
  
  It IS, as long as you don't want to run MS Windows 8 :P
  Of course most technical people have no intention of upgrading to 8 :)
47. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 04:04 · Score: 1
  
  The average user is not going to be installing random operating systems either. I fail to see your point.
48. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 04:08 · Score: 0
  
  The average computer user is not going to be monkeying around in the BIOS. This is about making life more difficult for non-MS OSes, and reverting the mistake that was the open x86 platform.
  Ahh.. they have put a lot of effort into this because of the need to stop the hords of "average computer users" that has been flocking to install Linux? A secure boot process is a good thing for Windows users, you have to stretch really far to instead see this as something they do because they need to defend against Linux.
49. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 04:14 · Score: 0
  
  The other person already answered what it's about. I will answer this:
  As you can easily turn it off if you will,
  Not on ARM you can't.
  --
  BMO
  This is true. If you for some reason want to buy an ARM device including paying for costly Windows and Office license to then install Linux on it, instead of just buying a much cheaper Android device, you can't. But it wasn't Microsoft who started the trend that tablets are consumer devices with integrated hardware and software. This is similar for iPad (which dominates this market, not MS), Kindle Fire, etc. Unless we expect Microsoft to come in and outcompete iPad and win the ARM tablet market these are the ones deserving this attention.
50. Re:So why even bother with secure boot by Cajun+Hell · 2012-10-12 04:15 · Score: 5, Insightful
  
  Take it easy dude. Let's try to remember what this whole thing is for.
  For all the bitching about secureboot, all currently known (yes, this can change) x86 machines which come with it, allow the user to turn it off. Remember the last 4 times you bought a new computer and, in fact, did diddle with stuff in the firmware, maybe to at least check the timings on your expensive Mushkin memory or whatever? Well, then, this whole article and the software it describes, isn't about you because you're going to turn off secure boot, making every aspect fo this boot loader irrelevant. You won't care about pressing enter, because you won't have to press enter.
  This is for users who won't do that. This is for people who are dumber or lazier than your grandma's ditzy bridge partner, for which we do not expect them to follow any directions or do anything "extra" prior to using their computer. They're not installing headless servers. They're not "picky" except in the sense that they don't want to have to read or understand anything longer than one sentence. They can, and will, press enter.
  The people who are opinionated enough to be "pretty fucking pissed" about pressing enter, will also tend to care enough to do what is needed in order to make pressing enter become unnecessary.
  If there are any people left who become furious about pressing enter, but also feel entitled enough to refuse to turn off secureboot, but also feel entitled enough to refuse to install some other secureboot loader, those people can and should go fuck themselves. Or they can go buy a Mac. Or they can boot Windows, and (think about it) they will never notice that they're not running Linux. Just lie to them and tell them Windows 8 is Linux, and they will believe you, and the lie will never have any consequences because behind the blank smile they gave you when you lied, they already forgot what you said.
  
  --
  "Believe me!" -- Donald Trump
51. Re:So why even bother with secure boot by rwise2112 · 2012-10-12 04:22 · Score: 1
  
  RTFA. I think you'd notice if your Windows PC suddenly started displaying a Linux Foundation splash screen and waiting for you to hit Enter before booting the OS.
  Then why can't a malware writer (Sony, etc) develop a similar minimal bootloader which looks like a Windows splash screen or regular BIOS screen with a 'press enter to continue'? A lot of users will not even be phased by that. This shows that secure boot is completely useless if it can be gotten around that easily.
  
  --
  
  "For every expert, there is an equal and opposite expert"
52. Re:So why even bother with secure boot by sexconker · 2012-10-12 04:40 · Score: 1
  
  The other person already answered what it's about. I will answer this:
  As you can easily turn it off if you will,
  Not on ARM you can't.
  --
  BMO
  Secure Boot can be turned off for everything except ARM platforms.
  Secure Boot must be enabled for ARM platforms.
  You can use Secure Boot with whatever bootloader/OS you want as long as you sign it and the UEFI keystore has the key for your OS/bootloader.
  If you want to put Linux on an ARM device that comes with Windows, you can either:
  A) Wait for a hack specific to that device (see the current phone/tablet market, including Android devices with locked bootloaders, recovery images, etc.).
  B) Buy from an OEM that provides a way for you to insert a key of your choosing into the UEFI keystore.
  Secure boot is a good thing. It stops pre-boot malware. If you care about putting a different OS on a Windows device, make sure you buy a device that lets you put in your own key. If you can't find such a device, buy an iPad, Kindle, or Android device. You have choices.
53. Re:So why even bother with secure boot by garyebickford · 2012-10-12 04:45 · Score: 1
  
  So the real value would seem to be found in upping the time, hardware, and interest requirements.
  That's pretty much the same as a description of bank vault locks (from the late 1800s?) - all any lock does is increase the cost, time and complexity to break into a safe. "The more things change, the more they remain the same." :)
  
  --
  It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
54. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 04:47 · Score: 0
  
  Windows Defender.
  No 3rd party AV required.
  You would have had an argument 7 years ago, but not since.
55. Re:So why even bother with secure boot by sumdumass · 2012-10-12 04:58 · Score: 1
  
  There will likely be a silent switch or some automated booting switch built in for re-provisioning server systems that need to come back up without user intervention.
  However, I'm not sure that this secure boot and signing will be able to completely rule out boot sector viruses. If it can get into memory, it can manipulate about anything after that. I imagine something like this might be adapted. But i'm not a coding guru so I could be wrong. I just don't trust microsoft enough to not open a gaping hole somewhere right after the boot loader.
  http://www.gfi.com/blog/how-the-tdl4-rootkit-gets-around-driver-signing-policy-on-a-64-bit-machine/
56. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 05:00 · Score: 1
  
  Apparently it's Microsoft who will be signing this key as well, so, yeah, that's a bad track record already.
  Going by TFA, you just need a key from Microsoft to sign your own bootloader. - That means you can use any of those keys, or a shim signed by any of those keys that by design or accident executes arbitrary code. It's the CA problem - hacking any dinky old manufacturer gets you access everywhere.
  You typically can't call home on every boot either, so good luck revoking disclosed certificates.
  But it's a moot point, because I doubt Microsoft is going to sign a key for the Linux Foundation at all. The entire purpose of their shim is to bypass the restrictions imposed by Microsoft.
57. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 05:27 · Score: 0
  
  Not even necessary, most UEFI implementations have the network stack available with drivers for the onboard ethernet controller. No need for a separate linux distro, all of it can be done in the menu.
58. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 05:43 · Score: 0
  
  it was implied that one would remedy the malfunctioning or non-existent keyboard and then press the any key
59. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 05:50 · Score: 0
  
  "system error: secure keyboard not found. hit any key to continue."
  (that was sort of a real error message back in the DOS days. all except the secure part.)
  Don't joke, ATM PIN entry terminals are secured independently of the rest of an ATM, it's not at all an unreasonable suggestion that PC keyboards be treated the same because they are used in even more sensitive environments, input devices are separated by several feet of cable to the backside of a computer, and hardware key loggers are a dime a dozen.
  Is everyone going to tell me they lock the doors to whichever rooms their computers live when they have guests over?
  Bull crap.
  USB input devices should have been keyed and trusted soon after cheap USB key loggers came to the market. To joke about trusted keyboards ignores a very, very real and present threat, and trusted firmware at minimum is a prerequisite to make it work.
60. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 06:06 · Score: 0
  
  If it's so easy, why not ship PCs with no keys and let the user enter the ones they like? No, PC manufacturers would never tolerate that and neither would Microsoft. Maybe most users will be able to handle it, but when you're talking about millions of users, there are enough dumb ones that it would be a huge problem.
  And yes, there are dumb Linux users. Not all Linux users are as tech-savvy as we are and they shouldn't have to be.
61. Re:So why even bother with secure boot by chihowa · 2012-10-12 06:19 · Score: 1
  
  it was implied that one would remedy the malfunctioning or non-existent keyboard and then press the any key
  This was in the AT and PS/2 days, when keyboards couldn't reliably be hotplugged.
  
  --
  If you want a vision of the future, imagine a youtube comments section scrolling - forever.
62. Re:So why even bother with secure boot by hairyfeet · 2012-10-12 06:32 · Score: 1
  
  Uhhh....MSFT will banhammer this in a week? They DO have the right to blacklist keys ya know, and its obvious this "hack" by the LF will be used for ill, no ends or buts, so any and all Linux keys will end up banhammered and no court in the world will touch them when they trot out malware and a copy of a website where the LF brag about how their workaround "Will let you boot Linux or any other OS". So congrats LF, you just gave MSFT the excuse that will get most if not all Linux distros banned from new hardware, good job!
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
63. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 06:38 · Score: 1
  
  The Linux Foundation bought the key from Microsoft you know. It's not an unofficial workaround.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
64. Re:So why even bother with secure boot by marcello_dl · 2012-10-12 07:10 · Score: 1
  
  LOL, trolling is a lost art. But let's play along.
  Rootkit hunter is GPL exactly like GNU/Linux. I can install, no wait, include in any distro, where I find it useful. Not 3rd party in any way.
  If that's your argument against the billion dollars market of commercial AV for windows.
  > Secure boot is not about the BIOS, it is about bootkits. You don't know what you're talking about.
  LOL it's called secure boot then it must secure the boot process. Who can safely check the boot sector for modifications by viruses? The BIOS. Then the viruses might try to reflash the BIOS. So protecting the BIOS (the firmware in general) is the key to secure boot. A signed bios is safe until encryption is cracked - see blu-ray or root CAs snafus. An unmodifiable bios is safe without bothering with encryptions schemes.
  
  --
  ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
65. Re:So why even bother with secure boot by jp10558 · 2012-10-12 07:25 · Score: 1
  
  I'm sorry, but this is impossible. What about headless servers? Or remote support where you need to reboot the PC? I can't see anyone who knows better buying these "secure boot" (Broken boot IMO) computers.
  
  --
  Opera, Proxomitron-Grypen,GPG 0x0A1C6EE3
66. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 07:44 · Score: 0
  
  More important question; why use linsux?
67. Re:So why even bother with secure boot by mystikkman · 2012-10-12 08:06 · Score: 1
  
  >An unmodifiable bios is safe without bothering with encryptions schemes.
  An unmodifiable bios is still vulnerable to the bootkit I posted the details about. Secure boot is not.
68. Re:So why even bother with secure boot by mea_culpa · 2012-10-12 08:09 · Score: 3, Interesting
  
  You are assuming that BIOS settings will be user accessible in the future.
69. Re:So why even bother with secure boot by bmo · 2012-10-12 08:21 · Score: 1
  
  >Secure boot is a good thing. It stops pre-boot malware.
  So?
  Why is it mandatory on ARM but not x86?
  >buy an iPad, Kindle, or Android device. You have choices.
  This is disingenuous, at best.
  --
  BMO
70. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 08:24 · Score: 0
  
  Right, because we're going to pretend that social engineering isn't the attack vector used for 99% of malware. Because having the system do what the user tells it to is a design flaw. I suppose it would be preferable to correct security shortcomings by keeping the API in flux, fragmenting beyond the stretches of sanity and hiding behind a shroud of obscurity.
  And what's with the third party hate, isn't pretty well everything in FOSS third party (and never mind that Security Essentials is one of the better solutions, and isn't third party)?
  How would Linux, or any other OS prevent fucking around in the bios, exactly?
  FUD Operation on free OSes, you say? FUD how? All you need is to have your keys signed. It won't boot an unsigned OS, nothing prevents any free OS distributor from getting their shit signed..Worse still. is that secure boot isn't even enabled by default. It has to expressly be turned on. In Effect you're whining that this locks down machines that the owners of said machines have expressly locked down.
  I'd say Slashdot in general is a giant FUD operation against Microsoft, among others, and nothing more.
  Yeah yeah, label me shill, whatever.
71. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 09:28 · Score: 0
  
  Linux has stronger security measures than are commonly deployed. When viruses become a problem, we can go overboard on SELinux, or chroot processes, or even adopt Qubes OS. As is, packages are signed by default on most systems, SELinux runs on most systems, Ubuntu has AppArmor (and is getting it into the kernel), and of course Windows' UAC is more than two decades late to the 'sudo' party.
  There's nothing magical about a lot of well-thought-out security measures. Microsoft doesn't seem to be able to manage it though. Windows users don't even know what security looks like.
72. Re:So why even bother with secure boot by Just+Brew+It! · 2012-10-12 09:30 · Score: 1
  
  Please read up on how Secure Boot is supposed to work. The bootloader needs to be digitally signed by whoever is in charge of certifying that the Secure Boot bootloaders are "secure". They're not going to sign something that is obviously designed to trick the end user.
73. Re:So why even bother with secure boot by Just+Brew+It! · 2012-10-12 09:33 · Score: 1
  
  There is supposed to be a BIOS option to disable Secure Boot. This workaround is a last resort for broken BIOSes that fail to include the option (e.g. stripped down laptop BIOSes like those used by the big OEMs), and users who are too lazy to figure out how to change the BIOS option. Given that many servers run Linux, a server vendor who failed to include the BIOS option would be shooting themselves in the foot.
74. Re:So why even bother with secure boot by hairyfeet · 2012-10-12 09:52 · Score: 0
  
  Yes but by then setting it up with a hack that will let ANYTHING run with that key they just rendered themselves another Grokster. remember the courts have already ruled that you don't just have to have the possibility somebody will use it for good, you also have to show some common sense. And YOU KNOW that not 5 days after this key is published with their workaround it'll be tied to a copy of "Windows 8 all version pre-activated" on TPB, after all the LF just gave the pirates a new bootloader hack for free.
  So I'm sorry gameboy but this WILL be banhammered, and if Ubuntu or Red hat publishes their keys (which both have said they won't) then they'll be banhammered too. The whole point of this was to end the flood of pirated Windows and the LF by making a way you could run anything with their key just sided with the pirates. it would be NO different if MSFT sold you a VLK for your org and you promptly published it onto the web. when getting that key I'm sure MSFT told them what security precautions they had to take with that key and this "hack" I'm sure is a breach of contract.
  So if all but Ubuntu and RH get banned because of this shit, instead of just showing some fucking common sense and telling Torvalds to not shit out new kernels every other week? then frankly they deserve to be banned for being so fucking stupid and arrogant. I mean WTF did they think would happen when you publish a key with code that allows ANYTHING to run with it? shit the pirates don't even have to work on Win 8 now, the LF did the heavy lifting. Great going morons, this is why we can't have nice things.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
75. Re:So why even bother with secure boot by sexconker · 2012-10-12 10:05 · Score: 1
  
  >Secure boot is a good thing. It stops pre-boot malware.
  So?
  Why is it mandatory on ARM but not x86?
  >buy an iPad, Kindle, or Android device. You have choices.
  This is disingenuous, at best.
  --
  BMO
  It's mandatory on ARM because Windows has a fresh start with ARM.
  There are billions of x86 devices out there, some which run BIOS and some which run UEFI, and most of which are long since EoLd by the manufacturer.
  It would be impossible to require Secure Boot on x86 because of all the current and legacy shit out there, and it would be confusing to consumers.
  Right now, a consumer knows that they can do whatever they want with a PC, but not with their phone or tablet.
  It's disingenious to say you have a choice between 4 major environments across dozens of OEMs for your toys?
  Why? Which of the following isn't a choice available to you?
  Android
  Amazon's bastard version of Android
  iOS
  Windows 8 RT
  And can you not buy from Sony, Samsung, HTC, Asus, MS, Apple, HP (lol), etc.?
  Give me one fucking fact that is in your favor, please. (Hint: You can't. You're just a fucking troll bmo. Go ahead and log onto those alts.)
76. Re:So why even bother with secure boot by BLKMGK · 2012-10-12 10:59 · Score: 1
  
  Your thread of probability - it grows thin....
  
  --
  Build it, Drive it, Improve it! Hybridz.org
77. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 12:01 · Score: 1
  
  Fair enough but I don't consider secure boot to be a "nice thing." This whole situation is awful and unnecessary, MS has backed the makers of all non-commercial OSes into a corner to deal with a vanishingly rare threat, and if MS thought a secured bootloader could have any impact on piracy they're dumber than I thought.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
78. Re:So why even bother with secure boot by hairyfeet · 2012-10-12 13:00 · Score: 1
  
  Have you NEVER worked on PCs evar? Or even watched the Black hat conference? Hell I just had to clean one last week where the BIOS was hacked and gave the malware writer control over the entire network, its not like Bootloader hacks and BIOS hacks are rare ya know. Hell type in "BIOS malware" or "UEFI malware" into any search engine you get over 5 million hits!
  And then there is the issue of piracy because if you can hack the bootloader then any check will fail, as they can just use the bootloader hack to present the system as a legitimate OEM. Have you never tried the "Win 7 SP1 all versions 32bit" or 64 bit discs? hell they even change the wallpaper to reflect what board it is along with using an OEM sig to match! Passes WGA no problem, updates no problem, I could put a legit Win 7 and the bootloader hacked one side by side and I doubt seriously even a MSFT rep could tell the difference.
  So while the fanboys can waste modpoints because I dare to point out the emperor has no clothes the fact is the LF just started waving their willie in the wind and the courts will gladly hand MSFT the ability to cut it off. Secureboot is the ONLY way found so far to have even a chance of stopping the pirates, its the ONLY way so far of doing anything about BIOS infection and boothacking, and the LF just sided with the pirates and fucked it all up. I wouldn't be surprised if MSFT revokes their key before launch just to keep all the pirates from having a field day and again I don't blame them, its their product and they have the right to get paid for it just as Linux fans have the right to give their work away for free.
  And the fucking sad part is ALL IT WOULD TAKE to get Linux to work without being douchebags and siding with the pirates is tell Torvalds to stop being a dick about the kernel. I mean here it is nearly 2013 and he just shits out new kernel revs like its his personal playtoy without a care in the world, when if he would simply save up the changes and release one every other year they could be signed for the distros and all would be good. But no, being allowed to change shit whenever he feels like it is apparently Torvald's right, just as banning Linux keys is MSFT's right.
  Which brings it all down to the free market as it should be. If enough Linux users buy machines from AMD with the Open Source Coreboot then others will see supporting you is porfitable and will do the same. Wanna guess the odds of that? I'm guessing about the same as me winning 3 powerball drawings in a row while singing during a lightning storm, in other words zipola. Instead they'll be like the asshole a few months ago that bought a Windows machine only to whine when newegg wouldn't take it back after they put Linux on it. Why should anyone care when you won't even buy from vendors like System76 that support you, instead opting for the Windows Tax break?
  You reap what you sow, you pay what you owe, and their bootloader hack will have to go, end of story.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
79. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 13:49 · Score: 0
  
  Sounds impressive until you realize that booting off external known good, read-only media to check obviates all of that. No locking needed and works even when the main, so-called secure OS has the inevitable security holes. The OP is correct, "secure boot" is mainly just a power grab and has little to do with security. M$ could have largely fixed there security problems years ago by providing such media but chose not to.
80. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 14:04 · Score: 0
  
  Not if everything in the startup chain has to be correctly signed ... something which a malware author can't do.
  Since it seems that you didn't RTFA you probably missed that the chained bootloader doesn't have to be signed at all, it just has to be in the same partition and named loader.efi. The only saving grace is that if loader.efi is unsigned it will stop and prompt the user for confirmation before continuing to load/execute it:
  
  The real bootloader must be installed on the same partition as the pre-bootloader with the known path loader.efi (although the binary may be any bootloader including Grub2). The pre-bootloader will attempt to execute this binary and, if that succeeds, the system will boot normally. If the loader.efi fails to load with a security error (because it is unsigned), the pre-bootloader will stop at a splash screen and ask the user to confirm, by selecting a menu option, that they wish to continue booting loader.efi. If this confirmation (which is the “present user” test) is successful, the pre-bootloader will then execute loader.efi without security verification (if the user denies permission to boot, the pre-bootloader will signal failure and the UEFI boot sequence will continue on to the next boot path, if there is one).
  As with all security systems, PKI is only as strong as its weakest link. Even Microsoft has had to revoke some of its certificates over the years because they don't have perfect controls, so it's a given that eventually EFI Secure Boot signatures will leak. Malware writers will then be signing their own bootloaders until the certificates get revoked. So how will EFI Secure Boot machines figure out that a certificate has been revoked and then securely revoke it in their UFI flash (and if a system can do that, what's to stop malware adding its own certificates)?
81. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 20:06 · Score: 0
  
  Why is it mandatory on ARM but not x86?
  I thought it was to nip in the bud potential antitrust problems. That and allow enterprises to downgrade to WinXP / 7
82. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 21:11 · Score: 0
  
  > An unmodifiable bios is still vulnerable...
  If the firmware doesn't detect the changes in the mbr or the hooks that malware tampers with, it is flawed rather than vulnerable/invulnerable. You don't say that a cpu is vulnerable because it executes malware code, after all.
  If the read only firmware is flawed, the system is vulnerable, ok.
83. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-12 22:30 · Score: 0
  
  There was an embedded PC with a custom proprietary Phoenix bios that would refuse to talk to a normal keyboard. It would give the error Invalid or defective keyboard. Some POS system I got cheap. After tearing it down I found it to have a socketed bios and they'd not stripped identifiers from the board. I asked about it on Fidonet and someone offered to send me a eeprom with bios to try. It worked and I used it as a second PC for a time.
84. Re:So why even bother with secure boot by drsmithy · 2012-10-12 22:34 · Score: 1
  
  Do you really think that the makers of an operating system which requires 3rd party AV to correct its own security shortcomings devised secure boot to protect users from malware?
  Which "security shortcomings" does AV fix ?
85. Re:So why even bother with secure boot by GameboyRMH · 2012-10-12 23:52 · Score: 1
  
  So in other words, everyone should bend over and take it now that MS has taken control of all desktop PCs for the purpose of laying another speedbump in front of pirates (who are just more likely to switch to something else?) And Linux should handicap itself to make it more convenient for Microsoft? The Linux kernel changes fast, sometimes there are vulnerabilities in it, Linux shouldn't have to slow itself to a glacial pace on par with commercial OSes to make MS' conquest easier. Microsoft should just ditch the requirement for secure boot by default, and man up and accept that they don't get root on the world's PCs to deal with pirates, just like everybody else.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
86. Re:So why even bother with secure boot by bmo · 2012-10-13 02:01 · Score: 1
  
  So you "nip in the bud" antitrust problems on x86, but create them on ARM?
  Just more of the same for Microsoft.
  --
  BMO
87. Re:So why even bother with secure boot by BLKMGK · 2012-10-13 02:37 · Score: 3, Informative
  
  You seem to be assuming that the root for both key paths will be the same, somehow I doubt a key used to sign apps for a remote desktop application of any flavor is going to be allowed to sign bootloaders. It also seems you do not understand exactly how the other key came about, someone didn't just steal a Private key laying around. It's not "a" key but "THE" key that's required.
  You might also want to figure out that Microsoft is NOT the signing authority for the key being used here. The Microsoft key is being used only because it's a widely distributed key and Microsoft has apparently agreed to allow it's use for others but if they refuse it's possible to have the CA sign another root. Unfortunately that Public key would be far less likely to be as ubiquitous as the Microsoft key. As it stands right now I see no reason why Microsoft wouldn't allow the signing with this key, it has protections built in to prevent malicious usage.
  There will be no myriad of CA signing with the Private key to be hacked, Microsoft will have their Public key distributed far and wide in hardware. They will retain the ability to sign their code and the Root will apparently be able to sign other approved code that will leverage the same Public key. This way Linux kernels COULD be signed and use this key embedded in hardware if desired. Some distro are apparently looking to go that way. However kernels change and are sometimes custom so this shim was created and will be signed by this group to sidestep the hassle. They are getting signed by a key given to them that descends from the Microsoft key. I would bet that a revocation process does exist but I doubt it's a very smooth one.
  Note that Verisign not Microsoft gets the fees from this process, they are the CA handling this.
  
  --
  Build it, Drive it, Improve it! Hybridz.org
88. Re:So why even bother with secure boot by lsatenstein · 2012-10-13 04:57 · Score: 1
  
  And I'd be really fucking pissed off if my Linux PC required a user present at the console to reboot. Seriously, how is this a fix?
  I thought the preloader would have a 1024 byte key which for the next foreseeable future would be good enough for it to run. But if the preloader software suggested by Linux Foundation is just about the 1k size, why not just have it as a boot loader extension. It will be protected in the TPM memory.
  
  --
  Leslie Satenstein Montreal Quebec Canada
89. Re:So why even bother with secure boot by amorsen · 2012-10-13 10:10 · Score: 1
  
  AT keyboards could be hotplugged. I've never killed an AT keyboard controller. When you inserted an AT keyboard plug, the ground would connect before the data lines, and the pins were sturdy enough to not bend and short circuit. At worst you could send a bit of garbage data to the OS and crash it, but since the OS was often DOS or Windows it had probably crashed anyway.
  PS/2 on the other hand was a truly lousy design which did not guarantee anything useful. I have killed the keyboard controller in several motherboards with PS/2 connectors.
  
  --
  Finally! A year of moderation! Ready for 2019?
90. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-14 15:06 · Score: 0
  
  You mean I'll have to go to a website to jailbreak it? j/k (but not really)
91. Re:So why even bother with secure boot by DarwinSurvivor · 2012-10-14 15:23 · Score: 1
  
  First they came for the Arms,
  and I didn't speak out because I wasn't an Arm user.
  Also, *all* windows will require SecureBood, it just needs to be disable-able on non-Arm systems (for now).
92. Re:So why even bother with secure boot by DarwinSurvivor · 2012-10-14 15:26 · Score: 1
  
  And I'd be really fucking pissed off if my Linux PC didn't require a user present at the console to reboot. Seriously, how did they bypass my WDE?
  FTFY
93. Re:So why even bother with secure boot by DarwinSurvivor · 2012-10-14 15:32 · Score: 1
  
  Is everyone going to tell me they lock the doors to whichever rooms their computers live when they have guests over?
  Bull crap.
  I think you need to find some new friends....
94. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-15 15:41 · Score: 0
  
  Yeah, MS is just following the wishes of hardware makers...
  LOL
  What the fuck are you smoking, this is 100% MS and you think Win 9 (If MS survives the 8-apocolypse that is) won't be locked on Intel also you are fucking retarded in addition to being high.
95. Re:So why even bother with secure boot by Sloppy · 2012-10-16 04:37 · Score: 1
  
  Uhr? I'm not suggesting MS isn't responsible. I'm saying that if computers which require SecureBoot are what is for sale, then that's a problem that a person who buys computers needs to deal with, and implementing SecureBoot deals with it. That's the point of implementing SecureBoot: you get to use your computer in spite of its firmware's silly requirement.
  If it weren't required, then there would be no point to this. But it is required, so there is a point to it.
  
  --
  As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
96. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-16 07:09 · Score: 0
  
  "I just had to clean one last week where the BIOS was hacked and gave the malware writer control over the entire network"
  I call bullshit.
  How the fuck is a bootloader virus on my pc going to control my laptop, router and server?
97. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-17 06:27 · Score: 0
  
  This is about control, period.
  They are slowly implementing it and will expand it over time to include all PC's that come with Windows.
98. Re:So why even bother with secure boot by Anonymous Coward · 2012-10-17 06:44 · Score: 0
  
  Windows defender is about as usual and effective as Norton and McAfee are. That means it is worthless.
just let microsoft die by Anonymous Coward · 2012-10-12 01:33 · Score: -1, Troll

we've come this far in our fight against everything microsoft why cave in now? just don't buy products from companies that enforce UEFI.
Apple...You're next.
1. Re:just let microsoft die by GameboyRMH · 2012-10-12 01:35 · Score: 5, Funny
  
  You target MS before Apple? That's like shooting at a vicious pomeranian nipping at your heels while a wolf is leaping for your throat.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:36 · Score: 3, Insightful
  
  cause, no one else except for a small subset of geeks even care
3. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:37 · Score: 0
  
  Damnit you insightful bastard, I just spent my last mod point on another topic.
4. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:37 · Score: 0, Troll
  
  Yeah, you've beat them down from 97% of installs to 90% of installs. You've come so far in this fight. LOLzzz!!!
  
  Anyone who uses Apple? You have nothing to worry about since the loss of marketshare that MS has suffered in the last 20 years is mostly due to Apple products.
  
  Linux is teh failboat.
5. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:45 · Score: 0
  
  That's funny. I've been dual booting OS X and Linux ever since the Intel transtion without any problems. Maybe it's because UEFI and Secure Boot are not the same thing.
6. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:46 · Score: 4, Funny
  
  That's ridiculous.. they're both wolves, just one is in really sexy sheeps clothing.
7. Re:just let microsoft die by somersault · 2012-10-12 01:47 · Score: 1
  
  So far Apple only really care about and have control over their own products. Microsoft are trying to control everything else, which is something like 90% of general purpose PCs.
  
  --
  which is totally what she said
8. Re:just let microsoft die by aaron552 · 2012-10-12 01:48 · Score: 2
  
  Maybe it's because UEFI and Secure Boot are not the same thing.
  That is correct. AFAIK, Secure Boot is an optional feature of UEFI
  
  --
  I had a sig once. It was lost in the great storm of '09.
9. Re:just let microsoft die by GameboyRMH · 2012-10-12 01:49 · Score: 3, Interesting
  
  Apple is attacking the consumer's expectation of software freedom. You can't go any lower that that without a brain implant.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
10. Re:just let microsoft die by Anonymous Coward · 2012-10-12 01:49 · Score: 0
  
  Linux is teh failboat.
  Only if you measure it in terms of raw marketshare.
  Personally I don't care much for the marketshare penis waving. Linux does me just fine, really it's the only OS I regularly use. Because it's not trying to pay 10,000 peoples salaries it wont got away even if the market share stays where it is.
  This idea that linux needs to be on every machine is tiresome. It just needs to work for those who want to use it.
11. Re:just let microsoft die by Nerdfest · 2012-10-12 01:49 · Score: 1
  
  It's true. Someone said nobody except a small subset of nerds even cares. If all the developers who use MacBooks stopped buying them, it would be a big hit for Apple. Corporations would need to do it to get Microsoft's attention. Of course, Apple may not care at this point. You need a MacBook to develop for iOS, and that seems to be the only platform they really care about these days.
12. Re:just let microsoft die by ByOhTek · 2012-10-12 01:52 · Score: 1
  
  Your Scottish, aren't you?
  (sorry, I have a friend who's a Scottsman who loves to make jokes about Scotts and sheep...)
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
13. Re:just let microsoft die by ByOhTek · 2012-10-12 01:54 · Score: 4, Interesting
  
  I think it's worse than that.
  Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
14. Re:just let microsoft die by LordNightwalker · 2012-10-12 01:59 · Score: 2
  
  Personally I don't care much for the marketshare penis waving. Linux does me just fine
  Good thing I wasn't drinking anything when I read this... ;)
  
  --
  Install windows on my workstation? You crazy? Got any idea how much I paid for the damn thing?
15. Re:just let microsoft die by Tubal-Cain · 2012-10-12 02:00 · Score: 0
  
  Don't worry, I got it for you.
16. Re:just let microsoft die by ByOhTek · 2012-10-12 02:01 · Score: 2
  
  I suspect the vast majority of people who would be interested in your suggestion probably already pirate windows, if they use it at all. The negligible loss of sales you are promoting wouldn't even be an annoyance to MS.
  Unfortunately, with the desktop losing a lot of ground, and that being the only really customizable platform (face it, DIY notebooks don't have nearly the variety of options, especially in the most important component - the motherboard), we won't see the option we would have seen a few years ago. Namely bios that will allow you to turn Secure Boot on or off. The vendors that cater to DIYers tend to be a lot more interested in the segment of the market you are discussing.
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
17. Re:just let microsoft die by shentino · 2012-10-12 02:01 · Score: 1
  
  And also points out that the vicious pomeranian is taking advantage of the situation by adding insult to injury picking on your heels when you've already got your hands ful dealing with the wolf.
  Don't cut the pomeranian any slack just because the wolf happens to be bigger.
  Pardon the pun, but dogpiling on someone already under attack is a pretty cheap tactic.
18. Re:just let microsoft die by somersault · 2012-10-12 02:03 · Score: 1
  
  Okay, it's a bit weird that I'm defending Apple here, but before the iPhone most people didn't even install apps on their phones. I did personally, but Apple actually increased people's expectations of their phones. Yes they keep a tight reign on their market, but for those people who actually care, there is Android. I have 3 Android powered devices that I use regularly, and I much prefer them to the Apple alternatives.
  Most people don't care about software freedom, and never have. There is no "expectation" from anyone apart from us geeks.
  Also I just RTFA and I saw this:
  "Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
  This is completely different to what I'd expected after the anger and fear that I've seen here over the Secure Boot thing. It sounds like just another BIOS option. Anyone who wants to try out Linux probably also is aware how to edit BIOS settings. Or they can use a VM if they want to take the easiest route, that will presumably completely bypass Secure Boot too.
  
  --
  which is totally what she said
19. Re:just let microsoft die by somersault · 2012-10-12 02:18 · Score: 4, Funny
  
  I'm Scottish, and it's written Scotsman/Scots by the way.
  Anyway, back to the topic at hand; I have to say that I don't know what you're talking about. I'd say that at least 80% of sheep aren't that sexually attractive.
  
  --
  which is totally what she said
20. Re:just let microsoft die by Anonymous Coward · 2012-10-12 02:30 · Score: 0
  
  That's like saying way back in the 90's, people didn't tend to install a lot of applications from the internet onto their PCs.
  While true of the average user, the reason was people didn't know WHERE to find the stuff, or it just involved a little more work than people were willing to put into it (This coming from a guy who used Lycos and AltaVista... and who downloaded a I forget what game or game demo from HappyPuppy on a 2400 baud modem. The file was about a meg and a half if I recall and it took into the night to download, but at some point the modem got disconnected so I had to start all over).
  You could argue AOL, CompuServ, Prodigy, etc were the "Apple" of the day, as it made it easy for people to find news, games, etc vs what the web was offering up at the time. It's not that the web didn't have it (or BBSes), but you had to be able to find it.
21. Re:just let microsoft die by nschubach · 2012-10-12 02:36 · Score: 1
  
  Oh, so you're saying the other 20% are asking for it by dressing that way?
  
  --
  Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
22. Re:just let microsoft die by nschubach · 2012-10-12 02:39 · Score: 2
  
  Also I just RTFA and I saw this:
  "Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
  The only problem I have is the layman will not want to "make their computer insecure by disabling secure boot" which only serves to stigmatize alternative OSes as the insecure option while Windows is viewed as "more secure."
  
  --
  Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
23. Re:just let microsoft die by Pascal+Sartoretti · 2012-10-12 02:42 · Score: 3, Insightful
  
  Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
  One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products : people use it by choice, and are free to use alternatives. Maybe a few persons use a Mac at work because their company enforce it, plus of course the iOS developers.
  
  In contrast, millions (billions?) of persons use Windows and Office because they have to (company policy) or because they need to produce Office documents.
24. Re:just let microsoft die by Baloroth · 2012-10-12 02:43 · Score: 1
  
  "Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
  MS has to allow people to install other OSes in the x86 market. If you thought anti-trust over IE was bad, you'd love to see what happens if MS tried to lock down all computer systems with Windows installed.
  They can get away with it in the ARM market because MS is ~1% or less of the market in that space, so they have absolutely zero monopoly power there.
  
  --
  "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
25. Re:just let microsoft die by Hatta · 2012-10-12 02:47 · Score: 4, Informative
  
  Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
  
  --
  Give me Classic Slashdot or give me death!
26. Re:just let microsoft die by ByOhTek · 2012-10-12 02:49 · Score: 1
  
  I'm not forced to buy or use MS products any more than Apple products.
  Actually, given all the peripherals made for Apple mobile products (with their different-from-everyone-else connectors), and not for their competitors, I feel more pressure towards buying Apple than towards buying MS.
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
27. Re:just let microsoft die by jader3rd · 2012-10-12 02:52 · Score: 3, Interesting
  
  One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products
  Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents? Would you rather live in the Apple "Cupertino controls your entire experience" world or the "Build on top of our platforms to do what you want, just don't muck directly with the licensed software" world of Microsoft?
28. Re:just let microsoft die by Pascal+Sartoretti · 2012-10-12 03:20 · Score: 1
  
  Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents?
  The same problems as we have today with Microsoft, yes. But we are still a very looooooong way from that.
29. Re:just let microsoft die by Pascal+Sartoretti · 2012-10-12 03:21 · Score: 1
  
  I'm not forced to buy or use MS products any more than Apple products.
  Lucky for you. But many people have a job and no choice.
30. Re:just let microsoft die by whoever57 · 2012-10-12 03:24 · Score: 1
  
  The only problem I have is the layman will not want to "make their computer insecure by disabling secure boot" which only serves to stigmatize alternative OSes as the insecure option while Windows is viewed as "more secure."
  More worryingly, what about when the "security companies" start promulagting the idea that "best practice" is to have secure boot enabled? Many of the security companies make money from the insecurity of Windows, so it is in their interest to make it more difficult to run Linux.
  
  --
  The real "Libtards" are the Libertarians!
31. Re:just let microsoft die by PPH · 2012-10-12 03:27 · Score: 1
  
  Apple builds its own hardware. If they want to secure boot it or lock you into their walled garden, that's their prerogative.
  Microsoft doesn't. They are not telling you what you can or can't run. They are telling hardware vendors. Specifically ARM based systems. And they are doing so in a manner that will decrease the value of ARM based hardware.
  You might think that Microsoft has created a Windows vs Linux (Android, whatever) distinction on ARM. But who is to say that Windows 9 will get a different boot key than Windows 8? And then again for Windows 10, etc. Microsoft can now jerk the ARM platform manufacturers around any way they want. Maybe even issue a service pack that needs a new boot key and brick all older hardware platforms overnight. The owners of these platforms won't be able to say, "Screw it. I'll just install Ubuntu." The resale value of that hardware will be zero.
  ARM just got pwned.
  
  --
  Have gnu, will travel.
32. Re:just let microsoft die by petermgreen · 2012-10-12 03:34 · Score: 0
  
  mmm, I tend to view microsofts actions in the arm market as indicative of what they would do in the x86 market if they thought they could get away with it.
  
  --
  note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
33. Re:just let microsoft die by Anonymous Coward · 2012-10-12 03:37 · Score: 0
  
  How does something like this get modded up? This is factually not true, and nothing but Apple haters spreading fud.
34. Re:just let microsoft die by Anonymous Coward · 2012-10-12 03:49 · Score: 0
  
  Every time I buy a laptop, I am _forced_ to buy M$ windows which I have _never_ used.
  This, for the last 20 yrs. = real money, going to a company whose shite products, I have never fucking used.
  Yeah, a bit bitter.
  Apple is another (evil) company I don't choose to do business with-- at least with Apple, I have the choice.
35. Re:just let microsoft die by jader3rd · 2012-10-12 04:16 · Score: 1
  
  Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
  Wouldn't everyone also include Apple? How is Microsoft pushing this on Apple hardware?
36. Re:just let microsoft die by Anonymous Coward · 2012-10-12 04:59 · Score: 0
  
  oh no, 50% of the remaining aren't the proper gender. 80% of sheep buggerers are straight you know....
37. Re:just let microsoft die by Anonymous Coward · 2012-10-12 05:18 · Score: 0
  
  >Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
  Bullshit. "Everyone" being x86 compatible motherboards that were specifically engineered by OEMs to comply with the published Windows hardware standard. The fact that Linux happens to run on those motherboards doesn't mean anyone's automatically entitled for that happy state of affairs to continue. People are more than welcome to build their own Linux-specfic motherboards using whatever processors they want, e.g. Raspberry Pi.
38. Re:just let microsoft die by Anonymous Coward · 2012-10-12 05:20 · Score: 1
  
  How so? No hardware manufacturer is required to put a "Designed for Windows 8" sticker on the hardware they sell, and it's not illegal to install (or, indeed, even preinstall) Win8 on such hardware.
39. Re:just let microsoft die by Anonymous Coward · 2012-10-12 05:26 · Score: 0
  
  Apple has supported UEFI since the first release of the MacBook Pro back in 2006. It took about 4 months after that until *APPLE* released a means to boot other operating systems. That method (bootcamp) doesn't require any signed bootloaders or anything. In fact, the whole process can be done manually if you don't want to use the Apple-provided tool.
  Please stop conflating UEFI with SecureBoot. They're two different things. It's like complaining that your engine sucks because the valve stems on your tires leak.
40. Re:just let microsoft die by Anonymous Coward · 2012-10-12 05:56 · Score: 1
  
  No.
  This policy only affects a subset of Windows PCs.
  PCs which were built for other OSes are not affected. Remember all those netbooks runnings Linux? You know how Dell sometimes produces Linux laptops? You remember how Walmart sold a Linux desktop? None of those would be affected.
  Stop lying by saying that Microsoft somehow controls all the non-Apple hardware. If Linux fans spent more time improving Linux and less time bitching about Windows, then maybe there would be a bigger market for Linux boxes and manufacturers would produce more of them.
41. Re:just let microsoft die by Anonymous Coward · 2012-10-12 06:31 · Score: 0
  
  Is this how Sheeple are made?
42. Re:just let microsoft die by gagol · 2012-10-12 07:12 · Score: 1
  
  You choose to buy a laptop running Microsoft. You can find some laptops (system76, etc...) that comes with Linux pre-installed. Now, get off my lawn!
  
  --
  Tomorrow is another day...
43. Re:just let microsoft die by Anonymous Coward · 2012-10-12 10:24 · Score: 0
  
  You target MS before Apple? That's like shooting at a vicious pomeranian nipping at your heels while a wolf is leaping for your throat.
  Aah--so you're aware of the horrible abuses of police power in America to kill 'vicious' puppies...
44. Re:just let microsoft die by Anonymous Coward · 2012-10-15 16:54 · Score: 0
  
  Linux owns every single market except desktop and the market for those is slowing shrinking.
  In the very general market of computing device, MS is the bit player.
45. Re:just let microsoft die by Anonymous Coward · 2012-10-15 17:15 · Score: 0
  
  Since when is there Apple "hardware"
  Apple is an OEM(think Dell but with a good OS) and gadget maker.
  All are built COTH.
  Let me guess, you put together your own desktop and now you think you can build hardware?
46. Re:just let microsoft die by ByOhTek · 2012-10-15 22:16 · Score: 1
  
  I have a job and a choice. I use Microsoft where it's appropriate, Linux where appropriate, and I could, if I wanted to, add BSD or Apple in there.
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Frosty pee foam by Anonymous Coward · 2012-10-12 01:33 · Score: -1

Forst!
1. Re:Frosty pee foam by Anonymous Coward · 2012-10-12 01:45 · Score: -1
  
  lolful
Virtualization by sakkathotmagaa · 2012-10-12 01:34 · Score: 1

This just got me thinking - can windows 8 run in as a virtual machine, in say, VirtualBox or VMWare player? Will current 'virtual' bootloaders be able to boot it?
1. Re:Virtualization by GameboyRMH · 2012-10-12 01:37 · Score: 4, Informative
  
  Not yet:
  https://www.virtualbox.org/ticket/7702
  But there's no reason it can't.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:Virtualization by adonoman · 2012-10-12 01:43 · Score: 2
  
  Both VMWare and VirtualBox run Windows 8 fine. UEFI isn't required to run it, just to boot off of 3TB disks. and to boot faster.
3. Re:Virtualization by afidel · 2012-10-12 01:47 · Score: 4, Interesting
  
  Windows 8 doesn't require SecureBoot, otherwise their enterprise adoption would be 0% instead of the likely 1-5%. Windows 8/Server 2012 works under ESXi 5.0 with patches and is supported under 5.1.
  
  --
  There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
4. Re:Virtualization by shentino · 2012-10-12 02:02 · Score: 2
  
  Technically, you bet.
  Legally, like hell.
5. Re:Virtualization by lord_rob+the+only+on · 2012-10-12 02:04 · Score: 3, Informative
  
  I've installed and run Windows 8 correctly in VBOX on my Debian SID. I mean Win 8 final (RTM, not the CTP this version doesn't work).
  It was just a glance at the OS though because I was expecting a real crap, and I wasn't deceived ...
6. Re:Virtualization by Anonymous Coward · 2012-10-12 05:03 · Score: 0
  
  works fine here on VMware Player 5.0
7. Re:Virtualization by shutdown+-p+now · 2012-10-12 05:21 · Score: 1
  
  Windows 8 for Intel architectures does not require or expect UEFI, much less Secure Boot.
  (if it did, then no existing PC could be upgraded to it)
Honestly? by giuseppemag · 2012-10-12 01:34 · Score: 1

I worry more about my inability to install Linux on an iPad...

--
My book: Friendly F#, fun with game development and XNA; my game: Galaxy Wars by VSTeam; my gamedev language: Casanova.
1. Re:Honestly? by Anonymous Coward · 2012-10-12 08:04 · Score: 0
  
  I worry more about the futility of installing Linux on an iPad.
Unsuitable for server use? by Chrisq · 2012-10-12 01:37 · Score: 5, Interesting

From TFA:

To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots. In this way, it can't be silently installed and used to hand control to a rootkit without the user's knowledge
Doesn't this mean it is unsuitable for server use - or any "headless" operation such as MythTV?
1. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-12 01:45 · Score: 1
  
  I'm sure they'll end up making it optional, for the uses you mentioned. Plus hopefully you'll be able to just buy a server without the secure boot crap.
2. Re:Unsuitable for server use? by drinkypoo · 2012-10-12 01:46 · Score: 2
  
  I hope they mean before it boots for the first time... because otherwise, yes, this is crap.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
3. Re:Unsuitable for server use? by GameboyRMH · 2012-10-12 01:47 · Score: 2
  
  On servers you'll just have to disable the secure boot feature, no problem for sysadmins, and anyone running a home server should have the skill to do the same, although this could give MS and advantage on HTPCs and home servers run by noobs.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
4. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-12 01:49 · Score: 0
  
  Yeah doesn't sound like a good idea...
5. Re:Unsuitable for server use? by LordNightwalker · 2012-10-12 02:07 · Score: 4, Informative
  
  From TFA:
  
  To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots. In this way, it can't be silently installed and used to hand control to a rootkit without the user's knowledge
  Doesn't this mean it is unsuitable for server use - or any "headless" operation such as MythTV?
  From TFA:
  
  To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode.
  So they offer a solution for your problem, but user input is required for this as well.
  
  --
  Install windows on my workstation? You crazy? Got any idea how much I paid for the damn thing?
6. Re:Unsuitable for server use? by Chrisq · 2012-10-12 02:10 · Score: 1
  
  From TFA:
  
  To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots. In this way, it can't be silently installed and used to hand control to a rootkit without the user's knowledge
  Doesn't this mean it is unsuitable for server use - or any "headless" operation such as MythTV?
  From TFA:
  
  To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode.
  So they offer a solution for your problem, but user input is required for this as well.
  OK, so what's to stop me installing a compromised version of Windows? If you can disable all warnings then isn't this bypassing any advantage of a secure boot?
7. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-12 02:22 · Score: 0
  
  You know, or push out your own key via ILO.
8. Re:Unsuitable for server use? by LordNightwalker · 2012-10-12 02:23 · Score: 1
  
  OK, so what's to stop me installing a compromised version of Windows? If you can disable all warnings then isn't this bypassing any advantage of a secure boot?
  Well, if you insist on installing a compromised version of Windows and allow it to boot, isn't that your problem? As long as others can't trick you into installing it by sending you some malware, I consider it a non-issue.
  
  --
  Install windows on my workstation? You crazy? Got any idea how much I paid for the damn thing?
9. Re:Unsuitable for server use? by BLKMGK · 2012-10-12 02:28 · Score: 1
  
  Yeah it does, and no I don't expect an option to skip the check else they would never sign it and revoke the key as has already been done in the driver world. If you've got a server or Myth box I would expect you to uncheck the option that requires secure boot and not sweat any of this as it wouldn't help you anyway since its currently only a Microsoft option.
  
  --
  Build it, Drive it, Improve it! Hybridz.org
10. Re:Unsuitable for server use? by ilsaloving · 2012-10-12 02:29 · Score: 1
  
  Then either disable SecureBoot entirely, which makes you no worse off than you are now, or use a distribution that provides proper secureboot keys like Redhat. Companies, et al, who need to have secure operations should like this option very much.
11. Re:Unsuitable for server use? by jader3rd · 2012-10-12 02:54 · Score: 1
  
  this could give MS and advantage on HTPCs and home servers run by noobs.
  Yes, because you can see the big push Windows is giving Media Center this time around; Microsoft is totally going after that market.
12. Re:Unsuitable for server use? by Miamicanes · 2012-10-12 03:14 · Score: 1
  
  You're preventing 'drive by' attacks, which are the ones likely to bite a *slashdot* user.
  As long as Microsoft requires that secure boot keys be unconditionally furnished to end users, it's not a problem. The danger is if they allow vendors to charge extra for them or withhold them. A secure boot key *I* can use to sign my own bootloaders for my own PC is a good thing. It only becomes evil when Dell is allowed to sell $99 PCs w/ad-supported OS that can't be replaced by end users (because within 5 years, a non-locked PC would become an exotic niche item with a $1,800 price premium).
13. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-12 04:00 · Score: 0
  
  I thought this at first. You have to read past the summary section of TFA and get into the technical details to find out it can be put in a 'Setup' mode to enable 'user-absent' booting.
14. Re:Unsuitable for server use? by fast+turtle · 2012-10-12 04:04 · Score: 1
  
  Yea! MS is really going hard for the HTPC market with their WMC dvr software that isn't included unless you buy Win8 Pro. What's that? Another unwanted/unused feature has been added to Pro? Yep. That's the breaks folks. WMC is no longer included in Home where it should completely replace WMP. God Damn Monkey Boy, can't even throw chairs at the right develepers.
  Yes I know just how bad both Media Player and Media Center are but I have found that Media Center works pretty good with just about any Hauppauge Tuner Card with decent drivers. It also handles BD playback, if you have a BD player/burner installed unlike WMP.
  
  --
  Mod me up/Mod me down: I wont frown as I've no crown
15. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-13 03:53 · Score: 0
  
  Are you planning to buy servers with Windows 8 preinstalled?
16. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-15 16:15 · Score: 0
  
  Given that secure boot won't stop the vast majority of attacks, I think you are putting too much faith in this scam.
17. Re:Unsuitable for server use? by ilsaloving · 2012-10-16 03:58 · Score: 1
  
  Of course it won't. But that's how security works. This is just one more tool being made available for people.
  Security is the practice of putting up enough road blocks that an attacker decides breaking in isn't worth the effort.
  There's no such thing as a be all end all silver bullet solution and anyone who tells you otherwise is selling snake oil.
18. Re:Unsuitable for server use? by Anonymous Coward · 2012-10-16 07:49 · Score: 0
  
  Secure boot will not stop drive-bys. Those are the product of MS hiring shitty coders.
Slave of MS by Faisal+Rehman · 2012-10-12 01:40 · Score: 1, Insightful

LF became slave of MS and now working under its decisions: "the Linux Foundation will obtain a Microsoft Key and sign a small pre-bootloader". Bad decision.
1. Re:Slave of MS by shentino · 2012-10-12 02:03 · Score: 1
  
  What choice do they have?
  MS already got out of the anti-trust nuke we lobbed at it and is still grabbing OEMs by the balls.
2. Re:Slave of MS by Anonymous Coward · 2012-10-12 04:36 · Score: 0
  
  UEFI will backfire against MS in two ways:
  1) Impossible to upgrade old machines.
  2) Making OS updates and rescue disk a pain to do or use, not to mention remote administration.
mjg59.dreamwidth.org by bfree · 2012-10-12 01:41 · Score: 4, Informative

Linux Foundation approach to Secure Boot
James Bottomley just published a description of the Linux Foundation's Secure Boot plan, which is pretty much as I outlined in the second point here - it's a bootloader that will boot untrusted images as long as a physically present end-user hits a key on every boot, and if a user switches their machine to setup mode it'll enrol the hash of the bootloader in order to avoid prompting again. In other words, it's less useful than shim. Just use shim instead.

Further UEFI bootloader work
A couple of people have asked whether we're planning on implementing the Linux Foundation approach of simply asking the user whether they want to boot an unsigned file. We've considered it, but at the moment are leaning towards "no" - it's simply too easy to use to trick naive users into running untrusted code. Users are trained to click through pretty much any security prompt that they see, and if an attacker replaces a legitimate bootloader with one that asks them to press "y" to make their computer work, they'll press "y". If that bootloader then launches a trojaned Windows bootloader that launches a trojaned Windows kernel, that's kind of a problem. This could be somewhat mitigated by limiting this feature to removable media, and we're seriously considering that, but there are still some risks associated. We might just end up writing the code but disabling it at build time, and then anyone who wants to distribute with that policy can do so at their own risk.

--
Never underestimate the dark side of the Source
1. Re:mjg59.dreamwidth.org by pscottdv · 2012-10-12 01:46 · Score: 2
  
  In other words, it's less useful than shim. Just use shim instead.
  You forgot to add this:
  
  For [shim] to be useful you'll need it to be signed by Microsoft, so you'll also need a WinQual account.
  
  --
  this signature has been removed due to a DMCA takedown notice
2. Re:mjg59.dreamwidth.org by bfree · 2012-10-12 01:53 · Score: 1
  
  I'm not sure where your second quote comes from? Yes, shim (or the LF thing) needs to be signed by Microsoft, but the idea here of both these options is that one person/group gets the first-stage bootloader signed (i.e. shim) and then others can use it as a blob which can then be told by a physically present user to trust other items which are not signed by Microsoft. The "here" link in my first post provides a good chunk of extra info.
  
  --
  Never underestimate the dark side of the Source
3. Re:mjg59.dreamwidth.org by Anonymous Coward · 2012-10-12 04:04 · Score: 0
  
  From TFA:
  "To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode."
The solution is simple by Anonymous Coward · 2012-10-12 01:44 · Score: 5, Insightful

The solution is simple. Simply do not purchase ANY computer that requires secure boot, or does not allow you do disable it!
Personally, I think this is a "feature" that is going to come back and bite MS in the derriere.. At least I hope so! :-)
1. Re:The solution is simple by Anonymous Coward · 2012-10-12 02:13 · Score: 0
  
  The solution is simple.
  
  do not purchase ANY computer that requires secure boot
  ALL OEM computers that ship with Windows 8 MUST require secure boot. (That covers all the major manufacturers.)
  
  do not purchase ANY computer that does not allow you do disable it
  x86: FOR NOW, Microsoft requires that secure boot can be user-disabled.
  arm: Microsoft requires that secure boot cannot be user-disabled.
2. Re:The solution is simple by BLKMGK · 2012-10-12 02:32 · Score: 1
  
  Pretty sure Microsoft has said that they expect there to be a BIOS option to turn it off. I expect it will be harder to find one that doesn't allow it to be turned off than on that will. I certainly wouldnt buy anything that didn't allow it to be deactivated!
  
  --
  Build it, Drive it, Improve it! Hybridz.org
3. Re:The solution is simple by PPH · 2012-10-12 03:10 · Score: 1
  
  x86: FOR NOW, Microsoft requires that secure boot can be user-disabled.
  arm: Microsoft requires that secure boot cannot be user-disabled.
  Smells like Intel vs ARM instead of Windows vs Linux. I wonder how this will play out in the halls of anti-trust?
  
  --
  Have gnu, will travel.
4. Re:The solution is simple by couchslug · 2012-10-12 03:23 · Score: 1
  
  The solution is simple.
  USE YOUR INFLUENCE to deter the companies you work for from purchasing any computer which requires secure boot.
  
  --
  "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
5. Re:The solution is simple by Anonymous Coward · 2012-10-15 16:26 · Score: 0
  
  Between this and the clusterfuck that is 8, MS is blasting its head off with a shotgun.
So by Hatta · 2012-10-12 01:45 · Score: 4, Funny

When I turn on my PC, it will boot the pre-boot loader, which will then boot grub, which will then boot my initrd which will finally boot Linux. Can we put any more steps in there?

--
Give me Classic Slashdot or give me death!
1. Re:So by GameboyRMH · 2012-10-12 01:50 · Score: 1
  
  Yes you'll have to press a key to approve the Linux bootloader, every time it boots. Not kidding, RTFA.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:So by ledow · 2012-10-12 02:01 · Score: 3, Insightful
  
  Every time it CHANGES. RTFA properly.
3. Re:So by bonniot · 2012-10-12 02:03 · Score: 3, Insightful
  
  Yes you'll have to press a key to approve the Linux bootloader, every time it boots. Not kidding, RTFA.
  I don't think so. From TFA: "To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode."
  
  --
  Watch great movie opening scenes!
4. Re:So by Tubal-Cain · 2012-10-12 02:03 · Score: 1
  
  Well the first 'innovation' on this concept would be to have the pre-bootloader start loading init...
5. Re:So by Anonymous Coward · 2012-10-12 02:04 · Score: 0
  
  initrd is not a bootloader - just ramdisk for vmlinuz!
  grub loads vmlinuz and the initrd. Later it starts to run vmlinuz. Kernel then does a lot of stuff like switch CPU to protected mode. At some point kernel will launch init program/script from initrd. This script/program usualy will load some modules and switch "/" and lauch /sbin/init on target "/".
  btw. initrd can be build in kernel soo you do not need it in grub.conf or grub2.conf if you use grub2.
6. Re:So by ledow · 2012-10-12 02:06 · Score: 1
  
  All of which will happen in a fraction of a second if you don't have boot prompts enabled.
  And all of which is nothing compared to the hoops that most system go through to get from switch-on to full operation on the CPU (real-> protected mode, etc.).
7. Re:So by Anonymous Coward · 2012-10-12 02:12 · Score: 0
  
  You could try the opposite:
  http://www.coreboot.org/Welcome_to_coreboot
8. Re:So by Anonymous Coward · 2012-10-12 02:13 · Score: 0
  
  Which means there's somewhere bit(s) that can be flipped so that the bootloader recognises the malware bootloader as already accepted.
9. Re:So by Bill+Barth · 2012-10-12 02:20 · Score: 1
  
  Which is great unless you have 5000 nodes that you need to PXE.
  
  --
  Yes...I am a rocket scientist.
10. Re:So by Anonymous Coward · 2012-10-12 02:27 · Score: 0
  
  at which point, you can probably afford a signed bootloader or better hardware or something.
11. Re:So by fibonacci8 · 2012-10-12 02:32 · Score: 1
  
  I feel sorry for you having 5000 nodes of Windows 8 machines booting on your network.
  
  --
  Inheritance is the sincerest form of nepotism.
12. Re:So by Talderas · 2012-10-12 02:52 · Score: 1
  
  Then you boot WINE.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
13. Re:So by Anonymous Coward · 2012-10-12 02:53 · Score: 0
  
  If coreboot came with OpenBIOS and supported more boards, it would be the best thing since sliced bread. UEFI is crap compared to OpenBoot/OpenFirmware
14. Re:So by Valtor · 2012-10-12 03:18 · Score: 1
  
  Oops, just posting to remove a moderation made by mistake...
  
  --
  "Sockets are the standard networking API, also useful for stopping your eyes from falling onto your cheeks" zeromq.org
15. Re:So by sootman · 2012-10-12 03:45 · Score: 2
  
  It's bootloaders all the way down!
  
  --
  Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
16. Re:So by Anonymous Coward · 2012-10-12 04:01 · Score: 0
  
  Windows 8 machines == all commodity PCs within the next few years.
17. Re:So by joaosantos · 2012-10-12 04:07 · Score: 1
  
  We are pretending that uefi doesn't have cryptographic functions to help with this?
18. Re:So by Anonymous Coward · 2012-10-12 06:41 · Score: 0
  
  At this point you ask your OEM supplier to pre-install your public key into the firmware for you, so all computers you get from them are ready to go.
19. Re:So by seeker_1us · 2012-10-12 15:14 · Score: 1
  
  You could have to wear special boots?
20. Re:So by Anonymous Coward · 2012-10-15 16:32 · Score: 0
  
  In 5 years windows 7 will still be the dominant Windows OS installed.
  No sane business will ever consider 8.
  8 is going to make Vista look like a success.
For FSCK's sake by Anonymous Coward · 2012-10-12 01:50 · Score: -1

Fuck It, I never post on slashdot anymore but I just have to comment on the stupidity of this.
Essentially, this means that this whole damn "Secure Boot" (as if anyone actually believed it was secure) can be circumvented. So, big deal, the Linux Foundation's version has some safeguards etc, etc.
This damn thing is hardware based, so updates will be few and far between. I predict you'll be able to take any executable and "patch" it to run at boot, the same way people have been patching Console video games to run (or at least, used to in the good 'ol Dreamcast days, Ive not been active in that scene for quite some time).
Goodamn it. All this shit is is extra complexity, less control over your own system, and a really, really, retarded approach to security. At some point, users will have to take responsibility for what they do on a computer. The less companies try to hide that fact, the faster the security mindedness of the average joe will increase. ... I aint even mad tho.
Can Linux binaries be signed? by Anonymous Coward · 2012-10-12 01:50 · Score: 0

I'm ok with the concept of signed code at the hardware level, as long as keys can be totally maintained by the user.
I don't know enough about UEFI though to know what's required to sign binaries. Can Linux be signed? Can software from repositories be signed in a GPG kind of fashion?
If I have to enter a key in the BIOS and sign a kernel with a related key in order to install Linux, I could potentially live with that, and it actually might have a few security uses.
Open Source Community by helix2301 · 2012-10-12 01:52 · Score: 2

This classic took Microsoft years to develop this technology and it takes the open source community less then a year I love the power of the open source community.

--
http://www.thetechnologygeek.org
1. Re:Open Source Community by ledow · 2012-10-12 01:56 · Score: 2
  
  By buying a key from Microsoft.
  Yeah. Nice way to work around this horrendous locking-down technology and promoting openness of hardware and all software (from BIOS up). "Let's buy a key to their proprietary lock-in systems that they can revoke at any time."
2. Re:Open Source Community by somersault · 2012-10-12 02:12 · Score: 1
  
  You should keep reading the article until it no longer means what you currently think it means.
  
  --
  which is totally what she said
3. Re:Open Source Community by Anonymous Coward · 2012-10-12 12:38 · Score: 0
  
  Key is bought from Symantec; Microsoft provided webpage and link for applying. IIRC, key is validated or counter-signed by Verisign. If I had the money, I'd have my own damn key, presuming I could supply and convey the appropriate paperwork and identity confirmation.
No, linux can't be signed by Anonymous Coward · 2012-10-12 01:54 · Score: 1

Because you can compile with slightly different options and now the signature is different and won't boot. You can't sign the changes because the private keys allowed to sign are not given to you and the BIOS needs updating to accept any new ones, so expect to have to prove your existence and pay a LOT of money to get your keys added in to all the UEFI machines.
1. Re:No, linux can't be signed by Anonymous Coward · 2012-10-12 02:08 · Score: 1
  
  I understand all that, but it the user can use any key in the BIOS though a process which _requires_ an actual person with physical access, I still don't see why it can't be done... similarly to how you can add trusted keys for SSL to your browser - something with only advanced users would ever do.
  Allow the user to generate keys and sign his/her own binaries with whatever private key. Make it so rootkits still can't do this because it requires a real person.
  I don't see how this would be any less secure, as only people who know what UEFI is would ever do this. This way there could actually be some point of UEFI with less technical drawback (not counting usability drawbacks, but certain things could be automated).
2. Re:No, linux can't be signed by BLKMGK · 2012-10-12 02:48 · Score: 1
  
  Fully agree! Linux binaries can already be signed, some distro are doing it, so why not allow users to add a key and sign their own? Why not sign a great deal of the boot process while we're at it ala Microsoft? We now have the hardware support it seems...
  
  --
  Build it, Drive it, Improve it! Hybridz.org
Boot sector viruses? Zero fucks given by GameboyRMH · 2012-10-12 01:57 · Score: 2, Insightful

Boot sector viruses are the rarest form of virus, require root permissions to infect, and aren't especially hard to remove. And we've handed over a big chunk of freedom and made things worse for everyone to fight this minor annoyance (yeah right). This is worse than the computer equivalent of the PATRIOT act.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel
1. Re:Boot sector viruses? Zero fucks given by BLKMGK · 2012-10-12 02:54 · Score: 1
  
  When booting a Microsoft OS it's not just the boot loader that's signed. You might want to spend a little time researching the secure boot process...
  
  --
  Build it, Drive it, Improve it! Hybridz.org
2. Re:Boot sector viruses? Zero fucks given by Anonymous Coward · 2012-10-12 04:32 · Score: 1
  
  Its not that we've handed over the freedom, rather, the freedom was taken from us. The extra complexity came from the rat bastard asshole known as microsoft.
3. Re:Boot sector viruses? Zero fucks given by rontosteak · 2012-10-12 06:20 · Score: 1
  
  I was thinking more along the lines of TSA, but you have a point.
No true Scottsman by Dareth · 2012-10-12 01:57 · Score: 5, Funny

No true Scottsman jokes about sheep.

--

I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
1. Re:No true Scottsman by ByOhTek · 2012-10-12 02:03 · Score: 1
  
  OK. I could have been mistaken in thinking they were jokes. They could well have been life (or even previous weekend stories).
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
2. Re:No true Scottsman by JustOK · 2012-10-12 02:06 · Score: 1
  
  Yah, they're always very serious when talking about sheep.
  
  --
  rewriting history since 2109
For newbies by Chemisor · 2012-10-12 01:59 · Score: 4, Insightful

Your solution of any value mostly to newbies who are incapable of going to the BIOS and typing in a new signing key (yes, all BIOS manufacturers worth buying, like ASUS, offer this option). I, for one, will not purchase any computer without secure boot. I like having a trusted hardware root. I like the fact that no malware can get in the boot process without my consent.
1. Re:For newbies by BLKMGK · 2012-10-12 02:38 · Score: 1
  
  Actually, if Linux could offer the users the ability to sign their own kernels and other boot pieces, then put the key into the BIOS it would provide greater security for Linux as well! Obviously the user would have to manage their signing key properly and kernel updates would be a hassle but the added security provided could be just as useful. Why not take advantage of this??
  
  --
  Build it, Drive it, Improve it! Hybridz.org
2. Re:For newbies by Hatta · 2012-10-12 02:49 · Score: 4, Insightful
  
  Yeah, that works great until Microsoft deprecates the option for Windows 9 or 10. They've already done so on Windows 8 ARM tablets, why wouldn't they do it on x86 PCs?
  
  --
  Give me Classic Slashdot or give me death!
3. Re:For newbies by blind+biker · 2012-10-12 02:57 · Score: 1
  
  Your solution of any value mostly to newbies who are incapable of going to the BIOS and typing in a new signing key (yes, some chipset manufacturers, like ASUS, offer this option for now).
  
  FTFY
  
  --
  "The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
4. Re:For newbies by thegarbz · 2012-10-12 03:04 · Score: 3, Funny
  
  Malware getting in the boot process... So we're creating a system of immense complexity, incompatibilities, which creates an all out shitstorm in the IT world, all to target that 0.001% of malware that actually infects the boot process? What popular malware has done this?
  Is it even a credible threat?
  Don't forget to visit the TSA website and drop in a few dollars in the donation form while you're at it.
5. Re:For newbies by Anonymous Coward · 2012-10-12 03:12 · Score: 0
  
  anit trust?
  OEM who don't want to give up the market for Linux severs?
6. Re:For newbies by StormReaver · 2012-10-12 03:20 · Score: 3, Insightful
  
  I like having a trusted hardware root.
  The problem is that Restricted Boot (euphemistically known as "Secure Boot") is not there to work in your best interest. It is there to work in Microsoft's best interest. It is just another tool in Microsoft's arsenal to make sure you can't use your computer in any manner not approved by Microsoft.
  Restricted Boot is not there to protect you. It is there to protect Microsoft from you leaving Microsoft. Any statement to the contrary is smoke and mirrors to confuse you.
7. Re:For newbies by Chemisor · 2012-10-12 03:41 · Score: 3, Insightful
  
  If motherboard manufacturers (not Microsoft) decide to not provide the option any more, we'll stop buying their boards. At this time this is a purely hypothetical and unlikely event, for that very reason. If and when it happens, we can complain and vote with our wallets; until then you're just spreading unjustified FUD.
8. Re:For newbies by Hatta · 2012-10-12 03:56 · Score: 2
  
  we'll stop buying their boards
  And just how much market clout do you think Linux desktop users have?
  If and when it happens, we can complain and vote with our wallets
  Yes, by buying specialty hardware that's likely to cost several times what mass market hardware does. The days of buying COTS hardware and just throwing Linux on it will be over.
  until then you're just spreading unjustified FUD.
  FUD, yes. Unjustified, no. There's plenty of reason to fear what Microsoft will do with secure boot. A lot of uncertainty as to how open source will continue to thrive. And there's a lot of doubt as to whether there's any satisfactory solution.
  
  --
  Give me Classic Slashdot or give me death!
9. Re:For newbies by Anonymous Coward · 2012-10-12 04:05 · Score: 0
  
  Because it's just far too hard for noobs, and noobs are the only thing that matters to any company that wants to make a profit, ie all of them.
10. Re:For newbies by jader3rd · 2012-10-12 04:21 · Score: 1
  
  What popular malware has done this?
  The Sony rootkit.
11. Re:For newbies by phantomfive · 2012-10-12 04:30 · Score: 1
  
  Why? When was the last time you had a problem with a boot sector virus? Is there anything this solves that couldn't be solved using a live-recovery CD? It's not like Microsoft is going to scan every piece of the OS when it boots to make sure it hasn't changed.
  
  --
  "First they came for the slanderers and i said nothing."
12. Re:For newbies by Chemisor · 2012-10-12 04:58 · Score: 1
  
  And just how much market clout do you think Linux desktop users have?
  You must mean Google, who uses Linux throughout the company. I'd say Google has quite a bit of clout.
  
  Yes, by buying specialty hardware that's likely to cost several times what mass market hardware does. The days of buying COTS hardware and just throwing Linux on it will be over.
  I don't think Google will like that either. And you really don't want to make Google angry.
  
  There's plenty of reason to fear what Microsoft will do with secure boot.
  Except Microsoft does not make motherboards. And desktops are not the largest market for motherboards - servers are. This is becoming more and more true as people insist on moving to the cloud. Servers absolutely must be dirt cheap for providers to be profitable, and the vast majority of servers do not run Windows. These days Microsoft is not nearly as powerful as you think. Perhaps you should stop living in the 90s and learn some more about the real world today.
13. Re:For newbies by Hatta · 2012-10-12 05:41 · Score: 1
  
  You must mean Google, who uses Linux throughout the company. I'd say Google has quite a bit of clout.
  Sure, if you can buy a thousand workstations at a time on contract secure boot won't be a problem for you. What about the rest of us?
  And desktops are not the largest market for motherboards - servers are.
  So I'm going to need to buy a server motherboard to run my Linux based HTPC in the future? How is that not a problem?
  
  --
  Give me Classic Slashdot or give me death!
14. Re:For newbies by celle · 2012-10-12 10:40 · Score: 1
  
  "If and when it happens, we can complain and vote with our wallets"
  And that has worked so well in the past. Face it, you guys are a not even a blip on their sales radar. The problem is Microsoft could just tell the OEMs to drop the no-secureboot option and we'd be SOL. For in the kickback paying and board sales dept. Microsoft out votes any of you. What happens if every OEM incorporates secureboot? It's amazing you guys still don't get the message, MS is seeing large cracks in the software space and is now trying to lock up the hardware. The shock is people still trust a convicted monopolist who corrupted a world standards body just recently to stay relevant. This is just more embrace, extend, extinguish crap.
15. Re:For newbies by Anonymous Coward · 2012-10-12 14:13 · Score: 0
  
  So Microsoft is now a deranged girlfriend who threatens to cut off your balls if you leave her?
16. Re:For newbies by Anonymous Coward · 2012-10-17 06:50 · Score: 0
  
  The word popular sure gets abused.
  malware is never popular.
  Windows is not popular.
ARM by Meneth · 2012-10-12 01:59 · Score: 1

Does this fix the Windows 8 ARM tablet problem?
1. Re:ARM by BLKMGK · 2012-10-12 02:55 · Score: 1
  
  I doubt it, chances are they are using a different signing key for that platform - a good
  Idea though!
  
  --
  Build it, Drive it, Improve it! Hybridz.org
Yo dawg, I heard you like bootloades, by Anonymous Coward · 2012-10-12 02:03 · Score: 1

so we put bootloaders in your bootloaders.
That's why I dumped Linux for Xzibix by Anonymous Coward · 2012-10-12 02:05 · Score: 1

Yo dawg!
I heard you like boot loaders. So we put a boot loader in your boot loader so you can boot up while you boot up!
There is a general truth to consider... by 3seas · 2012-10-12 02:06 · Score: 3, Interesting

If we make it, we can break it. Making secure boot just more locks to keep honest people out and more headaches for honest people to deal with.
Perhaps the real question here is why do people continue with Windows, when there are other options that have better general security?
1. Re:There is a general truth to consider... by Anonymous Coward · 2012-10-12 02:21 · Score: 0
  
  Ease of use. Ease of installation(comes preinstalled on most computers). Familiarity.
2. Re:There is a general truth to consider... by jones_supa · 2012-10-12 02:44 · Score: 3, Funny
  
  Perhaps the real question here is why do people continue with Windows, when there are other options that have better general security?
  Because in its current state Windows is secure enough. And after that, the other features matter more (all software and hardware works, it came preinstalled, etc).
3. Re:There is a general truth to consider... by theRunicBard · 2012-10-12 04:17 · Score: 1
  
  Familiarity and that it comes pre-installed as a lot of people have already said. Also: video games. I'm really hoping (but skeptical) that Steam For Linux is successful.
4. Re:There is a general truth to consider... by Anonymous Coward · 2012-10-12 05:29 · Score: 0
  
  Perhaps the real question here is why do people continue with Windows
  Because it comes preinstalled. Because M$ requires it does. And you should remember the Golden rule: he who has the gold makes the rules.
5. Re:There is a general truth to consider... by Anonymous Coward · 2012-10-13 01:50 · Score: 0
  
  Because I need Microsoft Office for my work;Open Office simply does not cut it. I need Camtasis Studio for my work; opensource video editors simply do not cut it. I need antivirus software; nothing good available for Linux.
6. Re:There is a general truth to consider... by Anonymous Coward · 2012-10-15 16:41 · Score: 0
  
  If you NEED Office to do your job, then your job is trivial.
  Why is Linux AV not very good?
  Because it can!
  Name the last Linux drive-by attack.
  Name the last successful Linux virus.
  If you try to equate marketshare with security, prepare to be laughed at.
  12 year olds can own Windows, even if Windows had a 1% market share.
Comment removed by account_deleted · 2012-10-12 02:11 · Score: 1

Comment removed based on user account deletion
Srsly, what is wrong with you people? by erikvcl · 2012-10-12 02:15 · Score: 1, Interesting

Why are you fighting secure boot? Secure boot is a GOOD thing. Making sure your BIOS/UEFI and boot loader haven't been tampered with is a GOOD thing. Let's figure a good way to make Linux work with it. I'm glad that Microsoft is taking this attack vector seriously.
1. Re:Srsly, what is wrong with you people? by Anonymous Coward · 2012-10-12 02:49 · Score: 0
  
  That's just the problem. MS is not letting anything but MS "work with it" (for ARM).
  Getting a key from MS is such an epic fail. It gives MS power over the signing and the ability to revoke at will.
  As such the UEFI is broken.
2. Re:Srsly, what is wrong with you people? by Hatta · 2012-10-12 02:53 · Score: 4, Insightful
  
  Secure boot is a good thing when the owner of the PC has ultimate control over which signatures are valid. But Microsoft has tipped its hand with Windows 8 ARM tablets, and I see no reason not to expect them to lock down secure boot on x86 PCs in the future.
  If this was a vendor neutral initiative, I can see how it would be useful. But this is being done by Microsoft, for Microsoft. This will not end well for open source.
  
  --
  Give me Classic Slashdot or give me death!
3. Re:Srsly, what is wrong with you people? by petermgreen · 2012-10-12 04:08 · Score: 2
  
  Secure boot is only meaningful if the kernel refuses to load untrusted drivers and the signing keys needed to mark code as trusted are kept off the machine you are trying to protect.
  A secure boot setup where the owner is in control is potentially useful for high security setups but also a massive PITA (to get any significant benefit you really need a dedicated machine to act as a signing box). A secure boot setup where someone else is in control of the keys means effectively giving up control of your computer.
  
  --
  note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
4. Re:Srsly, what is wrong with you people? by Anonymous Coward · 2012-10-12 04:10 · Score: 0
  
  Figure a way to make Linux work with it WITHOUT having to buy a key from M$.
  This is extortion, and it that means the puported rationale, secure booting, is a god-damned lie.
  Where are the lawyers, eh?
What's in it for Micro$oft ? by Anonymous Coward · 2012-10-12 02:16 · Score: 0

And what exactly compels microsoft to add this key ?
Or add it and fsck it up so that it 'just happens to fail sir' ?
What's to stop you turning Secure Boot off? by Anonymous Coward · 2012-10-12 02:18 · Score: 0

And then when this is "addressed" by making it not possible to turn off AT ALL, you now have a sanctioned monopoly of Windows Only PCs. Again.
Now, if this happens, you're STILL in a problem. Why are viruses so "bad"? Because they take your data and delete it. Well if I am the virus writer and I already HAVE your computer, you've already lost. If you are worried about your personal information being taken, if I have your computer then Secure Boot doesn't secure the disk drive from being read and you've already lost.
So what, precisely, does the scare of "what's to stop me installing a compromised version of Windows?" got to do with this if you need to be sitting at the keyboard to install a compromised version of Windows?
1. Re:What's to stop you turning Secure Boot off? by Anonymous Coward · 2012-10-12 05:13 · Score: 0
  
  If you have securboot installed, it is possible to "roll back" your OS without a reinstall and know that you're safe. Win8 already supports using Digital signatures to keep track of authorized applications. If your mom clicks on the wrong link and installs something, no need to reinstall, just point back to the last "trusted" snapshot. Win8 will dereference anything not trusted and secure boot makes sure nothing can stop Windows from doing this, without first rendering the computer incapable of booting.
2. Re:What's to stop you turning Secure Boot off? by Anonymous Coward · 2012-10-15 16:10 · Score: 0
  
  The point is that this does not stop userland and kernel malware, which is 99% of all malware.
  You do a rollback and it might go away, so will all your non-MS apps.
  Have a lot of fun!
Wake on LAN: Press any key to continue ... by zapyon · 2012-10-12 02:25 · Score: 1

Yeah, great. How are non-MS operating systems going to use this mechanism for remotely initiated booting, as in WOL? Does that mean non-MS shops will have night shift "specialists" on-site to press the Any Key whenever required?
Seems to me that MS has finally given Linux the boot :-(

--
I like my spaghetti with source.
1. Re:Wake on LAN: Press any key to continue ... by kelemvor4 · 2012-10-12 02:46 · Score: 1
  
  or.. you could just not turn on secure boot on machines where you don't want it.
2. Re:Wake on LAN: Press any key to continue ... by zapyon · 2012-10-12 03:17 · Score: 2
  
  Considering how things usually go, this will only be an option for a limited time. And will not apply to ARM machines as for these MS requires UEFI to be obligatory.
  
  --
  I like my spaghetti with source.
3. Re:Wake on LAN: Press any key to continue ... by couchslug · 2012-10-12 03:26 · Score: 1
  
  "Yeah, great. How are non-MS operating systems going to use this mechanism for remotely initiated booting, as in WOL? Does that mean non-MS shops will have night shift "specialists" on-site to press the Any Key whenever required? "
  Point this out to CORPORATE customers! They have the pull to get motherboard makers attention.
  
  --
  "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Obtaining a Microsoft signature will take a while by swm · 2012-10-12 02:30 · Score: 4, Interesting

the Linux Foundation will obtain a Microsoft Key and sign a small pre-bootloader which will, in turn, chain load (without any form of signature check) a predesignated boot loader which will, in turn, boot Linux (or any other operating system).
The purpose of Secure Boot is to prevent people from booting non-Microsoft operating systems.
Why on earth would Microsoft sign such a bootloader?

The process of obtaining a Microsoft signature will take a while, [...]
Anyone want to open an over/under line on when this happens?
I'll put $100 on the first patch Tuesday following the heat death of the universe.
Why is the linux community struggling with this by kelemvor4 · 2012-10-12 02:41 · Score: 1

To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots.
That seems like a LOT more of a pain in the butt than simply turning off the secure boot option. In fact, it would be a deal breaker for any of my Linux machines that must be able to reboot unattended every time. It's a "solution" to a trumped up problem. There are plenty of legit reasons to hate Microsoft, but this isn't one of them.

The bottom line: UEFI secure boot is not going to be enabled on any machine shipping with Linux unless that distro has the keys themselves. That is most likely the only group of Linux users not savvy enough to change a single setting in the firmware. If someone builds their own p.c. it won't have secure boot enabled. If someone decides to replace the MS os they paid for with Linux, it's not even slightly unreasonable to think they would be capable of changing the necessary firmware setting.

Every linux distribution I've EVER tried including the "easy" ubuntu is more complicated to install than changing this setting would be. Silliness...plain and simple.
1. Re:Why is the linux community struggling with this by cpghost · 2012-10-12 03:06 · Score: 4, Interesting
  
  That seems like a LOT more of a pain in the butt than simply turning off the secure boot option.
  How long will motherboard BIOSes ship with the option to turn off UEFI secure boot? Maybe not tomorrow, but what about 1, 2 or 3 years down the road? That's the real issue here! The problem is that the PC commodity market is about to be turned into a walled garden controlled by, guess who? Microsoft in this case. That's pretty scary stuff actually, and I wouldn't wonder if the regulating authorities (at least in the EU) will sooner or later consider this as anti-competitive behavior.
  
  --
  cpghost at Cordula's Web.
2. Re:Why is the linux community struggling with this by Tapewolf · 2012-10-12 03:16 · Score: 1
  
  That seems like a LOT more of a pain in the butt than simply turning off the secure boot option. In fact, it would be a deal breaker for any of my Linux machines that must be able to reboot unattended every time. It's a "solution" to a trumped up problem. There are plenty of legit reasons to hate Microsoft, but this isn't one of them.
  The worry is that the whole 'disable secure boot' thing might go away, and where will we be then?
  As for the unattended reboots:
  To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode.
3. Re:Why is the linux community struggling with this by kelemvor4 · 2012-10-12 03:34 · Score: 1
  
  That seems like a LOT more of a pain in the butt than simply turning off the secure boot option.
  How long will motherboard BIOSes ship with the option to turn off UEFI secure boot? Maybe not tomorrow, but what about 1, 2 or 3 years down the road? That's the real issue here! The problem is that the PC commodity market is about to be turned into a walled garden controlled by, guess who? Microsoft in this case. That's pretty scary stuff actually, and I wouldn't wonder if the regulating authorities (at least in the EU) will sooner or later consider this as anti-competitive behavior.
  That seems unlikely to me because 1. The work to implement the feature has already been done. 2. Time (and money) would have to be spent to remove it. 3. The companies that ship motherboards would limit their customer base unnecessarily without gaining any benefit.
  
  Basically, they'd have to spend money in order to make less money.
  
  The only scenario I could conceive of where this might happen is an anti-competitive move by MS to pay for or somehow force manufacturers to make the change. This wouldn't be without precedent, but I think something like this would be easily leaked and would lead to some kind of regulatory action as you suggested.
  
  On the other hand, your theory reminds me a lot of the fate of "OtherOS" Linux booting on the Sony PlayStation 3 computer. Perhaps your concern has more merit than I originally thought.
4. Re:Why is the linux community struggling with this by kelemvor4 · 2012-10-12 03:44 · Score: 1
  
  The worry is that the whole 'disable secure boot' thing might go away, and where will we be then?
  As for the unattended reboots: To facilitate repeat booting (and to make the pre-bootloader useful for booting hard disks as well as USB keys or DVDs) the pre-bootloader will also check to see if the platform is booting in Setup Mode and if it is, will ask the user for permission to install the signature of loader.efi into the authorized signatures database. If the user gives permission, the signature will be installed and loader.efi will then boot up without any present user tests on all subsequent occasions even after the platform is placed back into secure boot mode.
  Ah well that's not so bad, then. The linked article which I quoted doesn't go into that much detail and makes it sound worse than it apparently is.
5. Re:Why is the linux community struggling with this by silas_moeckel · 2012-10-12 05:06 · Score: 1
  
  Don't worry MS will either pay for the work, or windows 9 compat logo will require it to prevent piracy and all that. Either way they are hell bent on having everything locked down to insure there revenue stream.
  
  --
  No sir I dont like it.
6. Re:Why is the linux community struggling with this by Tapewolf · 2012-10-12 06:08 · Score: 1
  
  Ah well that's not so bad, then. The linked article which I quoted doesn't go into that much detail and makes it sound worse than it apparently is.
  There are two articles in the summary, the second one - the announcement - has more detail.
7. Re:Why is the linux community struggling with this by Anonymous Coward · 2012-10-13 06:18 · Score: 0
  
  That seems like a LOT more of a pain in the butt than simply turning off the secure boot option.
  How long will motherboard BIOSes ship with the option to turn off UEFI secure boot? Maybe not tomorrow, but what about 1, 2 or 3 years down the road? That's the real issue here! The problem is that the PC commodity market is about to be turned into a walled garden controlled by, guess who? Microsoft in this case. That's pretty scary stuff actually, and I wouldn't wonder if the regulating authorities (at least in the EU) will sooner or later consider this as anti-competitive behavior.
  If they want to get certified for windows 8 they will have to ship with the option enabled.
So what about WOL etc? by Anonymous Coward · 2012-10-12 02:52 · Score: 0

Sounds like a possible good-bye to automatic and unattended linux booting (like wake-on-LAN, timer based booting, etc...)
Why must this be so complicated? by ZorinLynx · 2012-10-12 03:02 · Score: 1

Wouldn't a simpler solution just be to allow the end-user to sign his bootloader?
Once the boot loader is signed, it's trusted until the next time the system is reinstalled.
The idea is, if something replaces the bootloader, it needs to be re-signed by the user. The process of signing could be convoluted and long enough to keep a user from just blindly clicking "sign" (require special boot media, or a jumper to be set on the motherboard).
This will provide all the security benefits of UEFI secure boot, while retaining the user's control of the system.
Sorry FSF, but fuck you. by Anonymous Coward · 2012-10-12 03:05 · Score: 1

I won't use anyone's binary blob, even if it is signed by Microsoft and distributed by the FSF. You Asshats are supposed to stand up for Free Software, bending over to MS and enabling the hardware manufacturers to shrug off pressure from end user complaints by giving them this release valve is BAD. Fuck you all, Each and every one.
Just great. So... by UltraZelda64 · 2012-10-12 03:15 · Score: 1

...now we have to deal with a dummy/shell of a bootloader, which boots the real bootloader, before the OS will even be told to start booting? Come the fuck on--something needs to be done about this, because this is just bullshit. We shouldn't be forced into such unnecessary extra complexity to use our computers that we bought, just because some shitty crooked company decided they want to make everything that runs *their* (read: almost everything) insecure OS a locked-down fortress with the "claim" (hint: yeah, right) that it is being used specifically to stop the spread of malware. There has to be a better solution. Until then, it looks like I will have to stick with x86 machines unfortunately, as much as I would like an ARM-based laptop, until something good is released without Windows... er, I mean, without these restrictions. The Windows tax was bad enough; now we're paying in the form of our freedom to use our computers in the way we want. Thanks, Microsoft. Cocksuckers.
1. Re:Just great. So... by UltraZelda64 · 2012-10-12 03:50 · Score: 2
  
  Oh, I forgot to add: We're still "indirectly" paying Microsoft for this. Someone had to pay Microsoft the fee for all of us non-Windows users to be able to get the key to write code to "unlock" a machine, on *our* behalf, whether we like or would approve of it or not. So really, we're paying two Microsoft taxes now: for a license that grants us privilege to run Windows on an obnoxiously locked-down system, whether we wanted it or not, and again for the "keys" to unlock the computer to actually be useful and allow us to run what we want, as it should at least by default give the option of in the first place.
  So if we choose to run Linux and if in any way it was "unlocked" by the developers by paying Microsoft, we're indirectly supporting Microsoft. As if we haven't already unwillingly been forced to support them just by the fact that we bought a computer with Windows in the first place, which is being specified to require the hardware to work against our wishes. Meanwhile, we lose, as we're forced to support this company not once but twice, and what do we get? A pathetic hack that only adds unnecessary complexity and other problems. The *real* solution? Allow us to disable this "Trusted Computing" bullshit in the EFI firmware. Simple as that.
  This is such a fucked up situation, it's disturbing. Hopefully as ARM gains steam, companies like System76 start releasing ARM-based Linux machines so we can completely bypass this shit. Avoid both Microsoft taxes, as well as Microsoft shitting all over our freedom exclusively for their gain. This reeks "abuse of powers" easily as much as or more than anything they did back during the time of their anti-trust lawsuit back in the 1990s.
where is the windows 7 UEFI boot loader? by Anonymous Coward · 2012-10-12 03:22 · Score: 0

where is the windows 7 UEFI boot loader?
I really don't understand this issue by DrXym · 2012-10-12 03:27 · Score: 1

Why is it so hard to put every device key in escrow and provide an automated and simple process that allows a user to individually unlock their own device? This escrow could also provide a signing service for any dists on neutral and fair terms that allowed them to replace the bootloader. A locked bootloader is desirable in some regards but it should not be under the control of a single OS vendor.
Frankly, my dear, I don't give a damn. by westlake · 2012-10-12 03:38 · Score: 1

Apple is attacking the consumer's expectation of software freedom.
The mass market consumer product can have tens of millions, hundreds of millions of users --- and in the case of the Windows PC, a billion or more users --- who quite clearly don't give a s***t about "software freedom" as the geek understands it.
my company is bothering by Anonymous Coward · 2012-10-12 04:55 · Score: 0

My company is trying to help Microsoft capture that 0% market share. We're spending tons of resources writing and debugging UEFI to do it. While the rest of the company is making boat loads of cash making Android devices.
No, this is really serious by Anonymous Coward · 2012-10-12 05:05 · Score: 1

I repeat it again, If you want to secure the bios put a jumper before the write pin of the eprom/flash memory/whatever. Those who can't open the case and locate it are surely not qualified for a bios upgrade.
It simply does not work that way. Especailly on ARM phones and tablets. Most vendors support secure ROM which is hard wired in the chip and requires a signed bootloader to proceed. Usually the vendor just offers a fake bootloader (or a fuse bit) that can then run uboot or whatever so you can get ChromeOS or Android up on the device.
For UEFI, the UEFI firmware itself is signed, and the AP(application processor, another word for CPU) will refuse to boot. There ain't shit you can do about it without replacing the AP.
It's not FUD. if a phone or tablet maker wants to have ARM Windows, they will be required by a licensing agreement to enable all of these security features from the processor vendor. And it will be nearly impossible for a non-technical person to run a free OS on them in a general way. Each device will have to be hacked and exploited in a unique way.
And I really doubt enough models will be compromised early enough to make running Linux on a cheap Windows ARM netbook a practical thing. Unless this ChromeOS thing catches on, you simply won't have a way to do a Linux ARM netbook in the next few years. (Android keeps resisting Netbooks, they don't sell very well).
It sucks to be a Linux user that has to piggy-back on hardware industry for a more popular OS. It sucks worse when Linux gets locked out of the hardware access we have been taking for granted.
1. Re:No, this is really serious by marcello_dl · 2012-10-12 07:29 · Score: 1
  
  > It simply does not work that way. Especailly on ARM phones and tablets. Most vendors support secure ROM...
  That's like having an unwritable BIOS, that's ok, it's a corner case of my solution, when you lose the jumper :)
  But not in desktops where you might want to reflash the bios for particular hardware support or bugs triggered by particular hardware configuration. If you want secure boot all bootloader signing comes later, first you secure the firmware that does the first stages of booting.
  
  --
  ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
2. Re:No, this is really serious by marcello_dl · 2012-10-12 07:32 · Score: 1
  
  > It simply does not work that way. Especailly on ARM phones and tablets. Most vendors support secure ROM...
  s
  That's like having an unwritable BIOS, that's ok, it's a corner case of my solution, when you lose the jumper :)
  But not in desktops where you might want to reflash the bios for particular hardware support or bugs triggered by particular hardware configuration.
  
  --
  ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Why go thorugh all the trouble? by flimflammer · 2012-10-12 05:11 · Score: 1

Just turn secure boot off FFS. You are able to disable it. If you're going to go through all the trouble to use this work around, what is the actual benefit to the system anymore? Just turn it off.
1. Re:Why go thorugh all the trouble? by Anonymous Coward · 2012-10-12 05:45 · Score: 0
  
  Just turn secure boot off FFS. You are able to disable it.
  Until Microsoft make it mandatory for Windows 9.
  Of course at that point they would also change the signing key so all existing boot loaders would no longer run.
2. Re:Why go thorugh all the trouble? by flimflammer · 2012-10-12 06:56 · Score: 1
  
  If that ever even happened (which honestly, I think hell has a better chance of freezing over), that has nothing to do with this iteration. There is no reason to apply this workaround to this version of secure boot. If you're going to render the whole thing irrelevant anyway and make it inconveniencing to boot, there is no point to leaving it enabled in the first place.
Windows 8 by Anonymous Coward · 2012-10-12 05:15 · Score: 0

I have a cure, if for some reason I get a PC with windows 8 on it I am gonna reformat the HDD and install windows 7, because windows 8 sux.
Can I ask? by Anonymous Coward · 2012-10-12 05:31 · Score: 0

It's so obvious that Microsoft is practicing it's monopoly here, why, oh WHY are there no lawsuits?. I would gladly pitch in to stop the company I hate more than any other.
"present user" test by morgauxo · 2012-10-12 06:15 · Score: 1

Sorry, that test fails my usability test. Any hardware manufacturer that wants to sell me a motherboard that requires I use this can stick their motherboard. I for one have no interest in a device which can never be rebooted remotely and can never bring itself back automatically after a power failure.
Not the issue, this is M$ setting up to attack ARM by Anonymous Coward · 2012-10-12 06:21 · Score: 0

In the Intel case this is no more difficult than setting the BOIS date/time, or boot order, this is NOT the ISSUE ... It is the intended lock in in the ARM market, and these days it is much easier to beat M$ at their own game, just complain to Joaquín Almunia who has succeeded the redoutable Dr Nellie Kroes.
After another few billion EURO fines Balmer will fling another chair, and give in.
MFG, omb
ABOUT DAMNED TIME by Anonymous Coward · 2012-10-12 06:43 · Score: 0

I don't give a damn about all this secure boot bullshit, do you have any idea how many decades I've wanted a bootloader bootloader that can boot from cd or usb? For years now, I've had to swear at fucked up BIOSes that couldn't boot from CD to install or couldn't boot from USB. Most recently (~5 years ago) I had a 1U server that I had to open up and hook up an IDE cdrom in because in an effort to save $30 I ordered it without a CD drive and ASSumed the BIOS could boot from a USB cdrom drive I had sitting around. With something like this, I could have dropped the drive in another machine to add the bootloader or installed the bootloader on a floppy or something and spared a LOT of headaches over the years dealing with shitty BIOSes.
Now most of the BIOSes do pretty well, even with USB cdroms, so I don't know that I'll ever need this, but man, if this had been around back then...
1. Re:ABOUT DAMNED TIME by Skapare · 2012-10-12 09:04 · Score: 2
  
  The computers I worked on from 1976 to 1991 didn't have a BIOS yet they managed to come up just fine.
  
  --
  now we need to go OSS in diesel cars
How about a link that works by Skapare · 2012-10-12 07:21 · Score: 1

How about an HTTP link. GIT can do that.

--
now we need to go OSS in diesel cars
Frickin useless if it cannot boot unattended by Anonymous Coward · 2012-10-12 07:50 · Score: 0

Frickin' useless for home servers and the like.
Re:Obtaining a Microsoft signature will take a whi by fatphil · 2012-10-12 08:50 · Score: 1

> Why on earth would Microsoft sign such a bootloader?

Probably as there are monopoly/anti-trust implications if they don't.

--
Also FatPhil on SoylentNews, id 863
One more option... by Anonymous Coward · 2012-10-12 09:05 · Score: 0

...Or just refuse to purchase any computer, motherboard, or other product that supports UEFI.
If enough people vote with their money, manufacturers will provide the option.
1. Re:One more option... by DarwinSurvivor · 2012-10-14 15:27 · Score: 1
  
  UEFI is not a problem! UEFI with SecureBoot enabled by default is a problem.
Re:Obtaining a Microsoft signature will take a whi by Anonymous Coward · 2012-10-13 01:53 · Score: 0

No it is not. Wherever did you get this idea from!
UEFI by Anonymous Coward · 2012-10-13 11:36 · Score: 0

(gosgog)
Seems to me that some new neck bearded geek just past coding exams and dreamed up this one...ultimately that means a future lifetime career as a member of that undistinguished well known group...CONGRESS! Where they are always trying to pass ridiculous laws.... or like Obama...the ultimate Yoyo, they use EXECUTIVE ORDER.