Slashdot Mirror
Linux Foundation Offers Solution for UEFI Secure Boot
Ever since news broke last year that Microsoft would require Windows 8 machines to have UEFI secure boot enabled, there were concerns that it would be used to block the installation of other operating systems, such as Linux distributions. Now, reader dgharmon sends this quote from Ars Technica about a new defense against that outcome:
"The Linux Foundation has announced plans to provide a general purpose solution suitable for use by Linux and other non-Microsoft operating systems. The group has produced a minimal bootloader that won't boot any operating system directly. Instead, it will transfer control to any other bootloader — signed or unsigned — so that can boot an operating system."
The announcement adds, "The pre-bootloader will employ a 'present user'; test to ensure that it cannot be used as a vector for any type of UEFI malware to target secure systems. This pre-bootloader can be used either to boot a CD/DVD installer or LiveCD distribution or even boot an installed operating system in secure mode for any distribution that chooses to use it."
As per subject
This just got me thinking - can windows 8 run in as a virtual machine, in say, VirtualBox or VMWare player? Will current 'virtual' bootloaders be able to boot it?
I worry more about my inability to install Linux on an iPad...
My book: Friendly F#, fun with game development and XNA; my game: Galaxy Wars by VSTeam; my gamedev language: Casanova.
You target MS before Apple? That's like shooting at a vicious pomeranian nipping at your heels while a wolf is leaping for your throat.
"When information is power, privacy is freedom" - Jah-Wren Ryel
cause, no one else except for a small subset of geeks even care
To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots. In this way, it can't be silently installed and used to hand control to a rootkit without the user's knowledge
Doesn't this mean it is unsuitable for server use - or any "headless" operation such as MythTV?
LF became slave of MS and now working under its decisions: "the Linux Foundation will obtain a Microsoft Key and sign a small pre-bootloader". Bad decision.
Never underestimate the dark side of the Source
The solution is simple. Simply do not purchase ANY computer that requires secure boot, or does not allow you do disable it!
Personally, I think this is a "feature" that is going to come back and bite MS in the derriere.. At least I hope so! :-)
When I turn on my PC, it will boot the pre-boot loader, which will then boot grub, which will then boot my initrd which will finally boot Linux. Can we put any more steps in there?
Give me Classic Slashdot or give me death!
That's ridiculous.. they're both wolves, just one is in really sexy sheeps clothing.
So far Apple only really care about and have control over their own products. Microsoft are trying to control everything else, which is something like 90% of general purpose PCs.
which is totally what she said
Maybe it's because UEFI and Secure Boot are not the same thing.
That is correct. AFAIK, Secure Boot is an optional feature of UEFI
I had a sig once. It was lost in the great storm of '09.
Apple is attacking the consumer's expectation of software freedom. You can't go any lower that that without a brain implant.
"When information is power, privacy is freedom" - Jah-Wren Ryel
It's true. Someone said nobody except a small subset of nerds even cares. If all the developers who use MacBooks stopped buying them, it would be a big hit for Apple. Corporations would need to do it to get Microsoft's attention. Of course, Apple may not care at this point. You need a MacBook to develop for iOS, and that seems to be the only platform they really care about these days.
Your Scottish, aren't you?
(sorry, I have a friend who's a Scottsman who loves to make jokes about Scotts and sheep...)
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
This classic took Microsoft years to develop this technology and it takes the open source community less then a year I love the power of the open source community.
http://www.thetechnologygeek.org
I think it's worse than that.
Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Because you can compile with slightly different options and now the signature is different and won't boot. You can't sign the changes because the private keys allowed to sign are not given to you and the BIOS needs updating to accept any new ones, so expect to have to prove your existence and pay a LOT of money to get your keys added in to all the UEFI machines.
Boot sector viruses are the rarest form of virus, require root permissions to infect, and aren't especially hard to remove. And we've handed over a big chunk of freedom and made things worse for everyone to fight this minor annoyance (yeah right). This is worse than the computer equivalent of the PATRIOT act.
"When information is power, privacy is freedom" - Jah-Wren Ryel
No true Scottsman jokes about sheep.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Your solution of any value mostly to newbies who are incapable of going to the BIOS and typing in a new signing key (yes, all BIOS manufacturers worth buying, like ASUS, offer this option). I, for one, will not purchase any computer without secure boot. I like having a trusted hardware root. I like the fact that no malware can get in the boot process without my consent.
Personally I don't care much for the marketshare penis waving. Linux does me just fine
Good thing I wasn't drinking anything when I read this... ;)
Install windows on my workstation? You crazy? Got any idea how much I paid for the damn thing?
Does this fix the Windows 8 ARM tablet problem?
I suspect the vast majority of people who would be interested in your suggestion probably already pirate windows, if they use it at all. The negligible loss of sales you are promoting wouldn't even be an annoyance to MS.
Unfortunately, with the desktop losing a lot of ground, and that being the only really customizable platform (face it, DIY notebooks don't have nearly the variety of options, especially in the most important component - the motherboard), we won't see the option we would have seen a few years ago. Namely bios that will allow you to turn Secure Boot on or off. The vendors that cater to DIYers tend to be a lot more interested in the segment of the market you are discussing.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
And also points out that the vicious pomeranian is taking advantage of the situation by adding insult to injury picking on your heels when you've already got your hands ful dealing with the wolf.
Don't cut the pomeranian any slack just because the wolf happens to be bigger.
Pardon the pun, but dogpiling on someone already under attack is a pretty cheap tactic.
Okay, it's a bit weird that I'm defending Apple here, but before the iPhone most people didn't even install apps on their phones. I did personally, but Apple actually increased people's expectations of their phones. Yes they keep a tight reign on their market, but for those people who actually care, there is Android. I have 3 Android powered devices that I use regularly, and I much prefer them to the Apple alternatives.
Most people don't care about software freedom, and never have. There is no "expectation" from anyone apart from us geeks.
Also I just RTFA and I saw this:
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
This is completely different to what I'd expected after the anger and fear that I've seen here over the Secure Boot thing. It sounds like just another BIOS option. Anyone who wants to try out Linux probably also is aware how to edit BIOS settings. Or they can use a VM if they want to take the easiest route, that will presumably completely bypass Secure Boot too.
which is totally what she said
so we put bootloaders in your bootloaders.
Yo dawg!
I heard you like boot loaders. So we put a boot loader in your boot loader so you can boot up while you boot up!
If we make it, we can break it. Making secure boot just more locks to keep honest people out and more headaches for honest people to deal with.
Perhaps the real question here is why do people continue with Windows, when there are other options that have better general security?
Comment removed based on user account deletion
Why are you fighting secure boot? Secure boot is a GOOD thing. Making sure your BIOS/UEFI and boot loader haven't been tampered with is a GOOD thing. Let's figure a good way to make Linux work with it. I'm glad that Microsoft is taking this attack vector seriously.
I'm Scottish, and it's written Scotsman/Scots by the way.
Anyway, back to the topic at hand; I have to say that I don't know what you're talking about. I'd say that at least 80% of sheep aren't that sexually attractive.
which is totally what she said
Yeah, great. How are non-MS operating systems going to use this mechanism for remotely initiated booting, as in WOL? Does that mean non-MS shops will have night shift "specialists" on-site to press the Any Key whenever required?
Seems to me that MS has finally given Linux the boot :-(
I like my spaghetti with source.
The purpose of Secure Boot is to prevent people from booting non-Microsoft operating systems.
Why on earth would Microsoft sign such a bootloader?
Anyone want to open an over/under line on when this happens?
I'll put $100 on the first patch Tuesday following the heat death of the universe.
Oh, so you're saying the other 20% are asking for it by dressing that way?
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
Also I just RTFA and I saw this:
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
The only problem I have is the layman will not want to "make their computer insecure by disabling secure boot" which only serves to stigmatize alternative OSes as the insecure option while Windows is viewed as "more secure."
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots.
That seems like a LOT more of a pain in the butt than simply turning off the secure boot option. In fact, it would be a deal breaker for any of my Linux machines that must be able to reboot unattended every time. It's a "solution" to a trumped up problem. There are plenty of legit reasons to hate Microsoft, but this isn't one of them.
The bottom line: UEFI secure boot is not going to be enabled on any machine shipping with Linux unless that distro has the keys themselves. That is most likely the only group of Linux users not savvy enough to change a single setting in the firmware. If someone builds their own p.c. it won't have secure boot enabled. If someone decides to replace the MS os they paid for with Linux, it's not even slightly unreasonable to think they would be capable of changing the necessary firmware setting.
Every linux distribution I've EVER tried including the "easy" ubuntu is more complicated to install than changing this setting would be. Silliness...plain and simple.
Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products : people use it by choice, and are free to use alternatives. Maybe a few persons use a Mac at work because their company enforce it, plus of course the iOS developers.
In contrast, millions (billions?) of persons use Windows and Office because they have to (company policy) or because they need to produce Office documents.
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
MS has to allow people to install other OSes in the x86 market. If you thought anti-trust over IE was bad, you'd love to see what happens if MS tried to lock down all computer systems with Windows installed.
They can get away with it in the ARM market because MS is ~1% or less of the market in that space, so they have absolutely zero monopoly power there.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
Give me Classic Slashdot or give me death!
I'm not forced to buy or use MS products any more than Apple products.
Actually, given all the peripherals made for Apple mobile products (with their different-from-everyone-else connectors), and not for their competitors, I feel more pressure towards buying Apple than towards buying MS.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products
Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents? Would you rather live in the Apple "Cupertino controls your entire experience" world or the "Build on top of our platforms to do what you want, just don't muck directly with the licensed software" world of Microsoft?
Wouldn't a simpler solution just be to allow the end-user to sign his bootloader?
Once the boot loader is signed, it's trusted until the next time the system is reinstalled.
The idea is, if something replaces the bootloader, it needs to be re-signed by the user. The process of signing could be convoluted and long enough to keep a user from just blindly clicking "sign" (require special boot media, or a jumper to be set on the motherboard).
This will provide all the security benefits of UEFI secure boot, while retaining the user's control of the system.
I won't use anyone's binary blob, even if it is signed by Microsoft and distributed by the FSF. You Asshats are supposed to stand up for Free Software, bending over to MS and enabling the hardware manufacturers to shrug off pressure from end user complaints by giving them this release valve is BAD. Fuck you all, Each and every one.
...now we have to deal with a dummy/shell of a bootloader, which boots the real bootloader, before the OS will even be told to start booting? Come the fuck on--something needs to be done about this, because this is just bullshit. We shouldn't be forced into such unnecessary extra complexity to use our computers that we bought, just because some shitty crooked company decided they want to make everything that runs *their* (read: almost everything) insecure OS a locked-down fortress with the "claim" (hint: yeah, right) that it is being used specifically to stop the spread of malware. There has to be a better solution. Until then, it looks like I will have to stick with x86 machines unfortunately, as much as I would like an ARM-based laptop, until something good is released without Windows... er, I mean, without these restrictions. The Windows tax was bad enough; now we're paying in the form of our freedom to use our computers in the way we want. Thanks, Microsoft. Cocksuckers.
Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents?
The same problems as we have today with Microsoft, yes. But we are still a very looooooong way from that.
I'm not forced to buy or use MS products any more than Apple products.
Lucky for you. But many people have a job and no choice.
More worryingly, what about when the "security companies" start promulagting the idea that "best practice" is to have secure boot enabled? Many of the security companies make money from the insecurity of Windows, so it is in their interest to make it more difficult to run Linux.
The real "Libtards" are the Libertarians!
Apple builds its own hardware. If they want to secure boot it or lock you into their walled garden, that's their prerogative.
Microsoft doesn't. They are not telling you what you can or can't run. They are telling hardware vendors. Specifically ARM based systems. And they are doing so in a manner that will decrease the value of ARM based hardware.
You might think that Microsoft has created a Windows vs Linux (Android, whatever) distinction on ARM. But who is to say that Windows 9 will get a different boot key than Windows 8? And then again for Windows 10, etc. Microsoft can now jerk the ARM platform manufacturers around any way they want. Maybe even issue a service pack that needs a new boot key and brick all older hardware platforms overnight. The owners of these platforms won't be able to say, "Screw it. I'll just install Ubuntu." The resale value of that hardware will be zero.
ARM just got pwned.
Have gnu, will travel.
Why is it so hard to put every device key in escrow and provide an automated and simple process that allows a user to individually unlock their own device? This escrow could also provide a signing service for any dists on neutral and fair terms that allowed them to replace the bootloader. A locked bootloader is desirable in some regards but it should not be under the control of a single OS vendor.
Apple is attacking the consumer's expectation of software freedom.
The mass market consumer product can have tens of millions, hundreds of millions of users --- and in the case of the Windows PC, a billion or more users --- who quite clearly don't give a s***t about "software freedom" as the geek understands it.
Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
Wouldn't everyone also include Apple? How is Microsoft pushing this on Apple hardware?
I repeat it again, If you want to secure the bios put a jumper before the write pin of the eprom/flash memory/whatever. Those who can't open the case and locate it are surely not qualified for a bios upgrade.
It simply does not work that way. Especailly on ARM phones and tablets. Most vendors support secure ROM which is hard wired in the chip and requires a signed bootloader to proceed. Usually the vendor just offers a fake bootloader (or a fuse bit) that can then run uboot or whatever so you can get ChromeOS or Android up on the device.
For UEFI, the UEFI firmware itself is signed, and the AP(application processor, another word for CPU) will refuse to boot. There ain't shit you can do about it without replacing the AP.
It's not FUD. if a phone or tablet maker wants to have ARM Windows, they will be required by a licensing agreement to enable all of these security features from the processor vendor. And it will be nearly impossible for a non-technical person to run a free OS on them in a general way. Each device will have to be hacked and exploited in a unique way.
And I really doubt enough models will be compromised early enough to make running Linux on a cheap Windows ARM netbook a practical thing. Unless this ChromeOS thing catches on, you simply won't have a way to do a Linux ARM netbook in the next few years. (Android keeps resisting Netbooks, they don't sell very well).
It sucks to be a Linux user that has to piggy-back on hardware industry for a more popular OS. It sucks worse when Linux gets locked out of the hardware access we have been taking for granted.
Just turn secure boot off FFS. You are able to disable it. If you're going to go through all the trouble to use this work around, what is the actual benefit to the system anymore? Just turn it off.
How so? No hardware manufacturer is required to put a "Designed for Windows 8" sticker on the hardware they sell, and it's not illegal to install (or, indeed, even preinstall) Win8 on such hardware.
No.
This policy only affects a subset of Windows PCs.
PCs which were built for other OSes are not affected. Remember all those netbooks runnings Linux? You know how Dell sometimes produces Linux laptops? You remember how Walmart sold a Linux desktop? None of those would be affected.
Stop lying by saying that Microsoft somehow controls all the non-Apple hardware. If Linux fans spent more time improving Linux and less time bitching about Windows, then maybe there would be a bigger market for Linux boxes and manufacturers would produce more of them.
Sorry, that test fails my usability test. Any hardware manufacturer that wants to sell me a motherboard that requires I use this can stick their motherboard. I for one have no interest in a device which can never be rebooted remotely and can never bring itself back automatically after a power failure.
You choose to buy a laptop running Microsoft. You can find some laptops (system76, etc...) that comes with Linux pre-installed. Now, get off my lawn!
Tomorrow is another day...
How about an HTTP link. GIT can do that.
now we need to go OSS in diesel cars
> Why on earth would Microsoft sign such a bootloader?
Probably as there are monopoly/anti-trust implications if they don't.
Also FatPhil on SoylentNews, id 863
The computers I worked on from 1976 to 1991 didn't have a BIOS yet they managed to come up just fine.
now we need to go OSS in diesel cars
UEFI is not a problem! UEFI with SecureBoot enabled by default is a problem.
I have a job and a choice. I use Microsoft where it's appropriate, Linux where appropriate, and I could, if I wanted to, add BSD or Apple in there.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).