Slashdot Mirror
The Linux Foundation's UEFI Secure Boot Pre-Bootloader Delayed
hypnosec writes "The Linux Foundation's plans for releasing a signed pre-bootloader that will enable users to install Linux alongside Windows 8 systems with UEFI have been reportedly delayed. The Foundation proposed a signed pre-bootloader that will chain-load a bootloader which, in turn, will boot the desired operating system, thus keeping Linux installations for novice users as simple as it was before. Further, this particular component is meant for small-time Linux distros which otherwise wouldn't have the required expertise or resources to develop their own system to tackle the secure boot issue. This was going as per plans up until Linux kernel maintainer James Bottomley disclosed that he has been having rather bizarre experiences with Microsoft sysdev centre. Bottomley said, 'The first time I sent the loader through, it got stuck (it still is, actually). So I sent another one through after a week or so. That actually produced a download, which I've verified is signed (by the MS UEFI key) and works, but now the Microsoft sysdev people claim it was "improperly" signed and we have to wait for them to sort it out. I've pulled the binary apart, and I think the problem is that it's not signed with a LF [Linux Foundation] specific key, it's signed by a generic one rooted in the UEFI key. I'm not sure how long it will take MS to get their act together but I'm hoping its only a few days."
Update: 11/21 14:22 GMT by U L : See the Original weblog post, and one interesting tidbit: Microsoft banned bootloaders licensed under the GPLv3 and "similar open source licenses."
At least in Europe they'd succeed.
Somehow, thay can sign town of apps and drivers on a regular basis, but signing teeny tiny code for FSF got screwed... It only validate, in my opinion, this whole secure boot shit was meant to give alternative OS a hard time.
Tomorrow is another day...
Does that mean the user has to actually be present to press a key? That renders secure boot unuseable on remote-admined or unattended servers, the very place you would most want to have a secure boot chain.
So, instead of signing with a scrap key that vendors will ignore they signed essentially with the original one, so that this bootloader will work on any PC that follows the standard? This is so awesome I don't even know at what to laugh first.
I wish LF just released this bootloader and defuse all this "secure boot" crap. Of course they will play nice and allow Microsoft to save their face... Microsoft incompetence is just appalling. They will probably end up signing malware by accident at some point, but at least you won't be able to run Linux on your PC, so mission accomplished.
We have to ask Microsoft for permission now before they give us a key that lets us install Linux on our own machines?
This is seriously not good, lads. They still have the monopoly so we should sue them till the last toothpick in their Redmond HQ are belong to us.
As of now we know that Win8 is vulnerable to a huge chunk of malware designed for older versions of Windows. This "UEFI Secure Boot" does not prevent it at all. I suspected earlier that UEFI Secure Boot wasn't designed to make PCs more secure but rather to lock down PCs, so novice users trying to check out some Linux distribution will have tough time doing so. This fiasco makes me sure that this was the case and makes me wonder why antitrust authorities don't do anything about this. This is potentially more harmful than MSIE case after all.
Given the number of server side linux installs on x86 machines the PC manufacturers are not going to shoot themselves in the foot and not supply machines that linux can be (pre)installed on. They'll probably have a Windows compatable line and a Linux compatible line. At least for servers. For desktops and laptops things could get a bit tricky I suppose, but then I was under the impression all this secure boot crap could be switched off in the BIOS anyway?
Microsoft has also banned any GNU GPLv3 licences for these binaries.
'When you get to this stage, you also have to certify that the binary " to be signed must not be licensed under GPLv3 or similar open source licenses". I assume the fear here is key disclosure but it's not at all clear (or indeed what "similar open source licences" actually are).'
AccountKiller
So the Linux Foundation, quite rightly, are trying to make available a signed bootloader which will then anyone boot whatever we want without having to disable secure boot - have I got that right? What stops someone monkeying around with the next level of abstraction?
systemd is Roko's Basilisk.
Freedom is getting fucked harder and harder every day.
I know that new laptops shipping with Windows 8 preloaded have to allow the user to disable secure boot.
Now that some laptops are out there, does anyone know if disabling secure boot will still let you run Windows, ideally even after its partition has been resized? Or will the preinstalled Windows just refuse to boot if secure boot has been switched off?
Sounds like another anti-trust case. I will be putting Unbuntu on my next machine and if I can't do it I will be asking for my money back and getting pi, though I might getting a pi anyway as they are much cheaper than a 'nomal laptop / netook'.
is my surprised face:
Help stamp out iliturcy.
Which part of "Microsoft Product" did they not understand?
Stop buying MS hardware! Prices will drop...
The free software and open source software advocates merely need to stop buying hardware dependent on and designed for proprietary operating systems. There are options that are becoming very popular. The major issue right now is there are a lot of people too cheap to realize the difference between a $400 POS laptop with Microsoft Windows which has higher specs and your typical higher quality laptops smaller companies are shipping with Linux. Even if the hardware is lower spec'd at a higher price doesn't mean it is a rip off. What your getting is significantly better in a number of different areas.
As an example your not going to be dealing with wireless issues related to digital restrictions. HP, Dell, Lenovo, and Toshiba ship laptops that prevent the replacement of incompatible wireless cards with third party options. This is because they make money off selling replacement cards to users whose wireless cards have died after the warranty period.
There are other good examples such as the loss of support because manufacturers have discontinued the proprietary drivers/firmware for your hardware.
While System76, ZaReason, and most others are shipping good quality hardware they do need to improve in certain areas. Right now pretty much every typical user is being disadvantaged by bad policies or simply the lack of a policy that advocates the use of chipsets which are free software friendly where such chipsets are available. A quick search will turn up a lot of customers who are running into issues because of these non-free drivers/firmware dependencies. And from what I'm reading nobody cares. People are just being shafted.
The only company which seems to be making a difference in this area is ThinkPenguin. ThinkPenguin is funding a number of major and minor distributions, the Free Software Foundation, and investing in the manufacture of hardware which is free software friendly. This amongst many other projects to bring better support for hardware to users around the world. And this irregardless of the distribution. If you want to run Ubuntu one day and switch to Trisquel the next you actually can (Trisquel is a distribution that doesn't ship drivers/firmware/and other software dependent on non-free software- there are many other distributions with similar policies). Even Debian doesn't ship with non-free drivers/firmware any more. They have released a derived kernel even which removes pieces from the mainline kernel.
Ultimately it is the actions of people using such distributions which funds the ecosystem which improves support for hardware that works with Linux rather than against it.
Standardizing on a binary application interface is not the answer. Supporting free software is.
And I'm not a loony. I'm not saying get rid of all the non-free stuff. There being distributions which support bad hardware will help in introducing people to free software. What I'm saying is be conscious of the negative effects of your actions when purchasing hardware down the road. Encourage distributions to inform users of the technical (and optionally ethical) issues of using such hardware. If you can avoid hardware dependent on non-free code do so.
Linux will not take off without wider availability of such hardware because the average user isn't going to stat up a terminal window to install some proprietary driver. They aren't going to apply some hack because the manufacturer refuses to fix a bug. The source code needs to be maintained (not just included) in the mainline kernel and/or similar. That is what leads to the best hardware which works out of the box. And this is not to say that the code itself is necessarily better. However it certainly doesn't hurt it when anybody can submit fixes, improvements, etc.
The way of breaking that monopoly is to replace UEFI on machines with CoreBoot (http://www.coreboot.org/Welcome_to_coreboot). This still does not support enough hardware but given a bit of support from Linux friendly companies (e.g. Clevo, IBM etc) it could be done. To see CoreBoot in action have a look at the Samsung ChromeBook with CoreBoot (http://www.youtube.com/watch?v=RypqMqtTPs8).
Microsoft as gatekeeper to PC hardware is a non-starter. You can not have one company determine who will and will not use a PC. When I mean use I mean loading the operating system of the user's choice. That is using a computer, running the programs and operating system that the owner of the computer wants. One company determining how a user will use their computer best example of a monopoly.
It has been proven recently that the whole WinTel PC thing and the associated lock in is on its way out as UEFI Secure Boot would be as well. ARM and Linux is where everything appears to be heading. Look at all the Android tablets and phones, Chromebook, Raspberry Pi, Beagleboard etc. Even Apple is rumored to be looking at ARM for newer laptops and are throwing their own cores together.
It's only a matter of time...
MS can do all the lock-down they want on the hardware they make and sell. But for them to be in charge of locking down 3rd party hardware and software that I buy from other vendors is just nuts. Especially as the 800 lb gorilla in the room means that I will have almost no choice of vendors that don't restrict my use. I want my computer to be mine, not Microsoft's and not Apple's.
I don't see how anyone could have seen this coming.
"I've pulled the binary apart, and I think the problem is that it's not signed with a LF [Linux Foundation] specific key, it's signed by a generic one rooted in the UEFI key."
Please, "leak" that one immediately. It would tear huge holes in "Secure Boot".
The preceding comment is my own, and in no way construes an opinon of the Emperor of Mankind.
Last I heard, Apple had clawed it's way back to the top in some fashion... maybe the most profitable PC vendor? Anyway, they are pretty big and successful. Do they have this sticker? I doubt it. I'm thinking that a bunch of stickers all over your product detracts from the styling. A PC covered in gaudy do-dads looks like shit next to a PC with nice clean styling.
It only stops a changed boot process booting. But if once booted, the OS then changes the drivers, you're open again.
And though this may be "the worst to remove", multiply the effort by the probability of catching one and you're being penny wise and pound foolish.
Bootloader signing must be controlled by a neutral third party. Not Microsoft. Anything less is simply anticompetitive and will end badly.
Reading between the lines, you can clearly hear Microsoft management waffling around muttering "Uh, we need to find a way to fuck open source harder"
Technically, yes, but the reason they don't want to is because if they did, they would be forced to distribute signing keys to everyone who ever installed that binary, which would sort of ruin the security of the system, as a rootkit developer could just grab a key too.
Even if MS assured everyone that cooperating was in its own long term best interest, and even if we all believed that, believing that they would actually cooperate is foolish. Have we not all heard of The Scorpion and the Frog?
When running in secure mode the system will run only code signed by your distro. If you want to run arbitrary code you need to install your own keys and sign your code or else disable secure boot.
Why would Microsoft, which is not distributing the Linux bootloader, be worried about the Linux bootloader license?
You are correct in that the bootloader cannot be GPLv3, because the GPLv3 does not allowed the distribution of signed-binaries that cannot be recompiled from source and signed again...but the fact is, this has _nothing_ to do with MS, which cannot possible be required to do anything at all.
MS was handed something to sign, it signed it. If there are distribution limitations on the thing signed, that is not MS's problem, because MS IS NOT DISTRIBUTING IT. There is absolutely no theory of law under which MS would be required to give up their incredibly valuable signing keys because a third party was in violation of yet another third party's license.
Now, it's certainly possible for MS to be nice and telling people that by saying 'Oh, and developers might want to check to see if the license their code is under is anything like the GPLv3 because that added restrictions on signed binaries that the developer cannot meet, as we have the keys and we sure as hell aren't giving them to random users, so the developer will be in violation of that license.'
But what MS is doing is clearly something else. There's no reason to make people 'certify' anything, especially that's it not under 'GPLv3 or similar open source licenses', which is fairly clearly worded in such a way to try to scare people away from using the GPL at all, when the GPLv2 has no such problems.
MS is using a specific issue with a specific OSS license in specific circumstances to try to scare people away from licenses 'similar' to the GPLv3.
Quick poll: Who here would assume the GPLv2 is 'similar' to the GPLv3 if you didn't read this site and didn't know 'signed binaries' was one of the big GPLv3 changes?
If corporations are people, aren't stockholders guilty of slavery?
Please lease explain again why we need to go through Microsoft to run the software
we want on the hardware we bought?
I can understand why so many hardware vendors jumped into Microsoft's ploy.
To be able to sell hardware certified for Windows 8, they need to implement
Secure Boot and be able to put a little sicker on their product. However, I
don't trust all hardware vendors to also implement the means for users to add
their own keys or to disable Secure Boot altogether.
Regardless, if Microsoft goal is truly to prevent malware from contaminating
the system's boot process, why do they care about the license of the
bootloader? For me, this clearly demonstrates that Microsoft isn't just doing
this to thwart some malware, but that they have ulterior motives. Making it
more difficult for users to run anything other than the software they sell looks
like a pretty good thing from their business point of view.
What clowns thought that giving Microsoft, I mean, Microsoft, the keys to PC bootloader was a good idea?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
MS was handed something to sign, it signed it. If there are distribution limitations on the thing signed, that is not MS's problem, because MS IS NOT DISTRIBUTING IT.
They are distributing it to you when they give it back to you after signing. At that point, the GPL3 specifies that MS must also give you the key.
When you distribute it further, you must then pass that key on to anyone you distribute to.
The Linux Foundation pre-bootloader will boot anything (including unsigned OS's) so they use the "present user" test to ensure that they don't become a vector for installing malware (and thus get the key revoked).
The "proper" RHEL/Fedora/SuSE distros will have their own signed bootloader which will only boot distro-signed OS code. These will presumably support automated installs.
As noted above, the Linux Foundation pre-bootloader will use a "present user" test, but will then install anything.
The RHEL/Fedora/SuSE bootloaders will not have a "present user" test, but will only load distro-signed OS code.
It's signed by a key "rooted" in the generic key. If leaked, Microsoft would just revoke that key.
They are distributing it to you when they give it back to you after signing.
Erm, no, they are not. That is not how signing works. They get a binary, they give you a signature back, which you then embed in the binary. They do not give you an actual binary back, that would be stupid and pointless.
At that point, the GPL3 specifies that MS must also give you the key.
And that wouldn't be true even if they gave you the binary back. MS is not magically bound by the GPL because you copied a file to them and then downloaded it back from them.
Hey, look, everyone, I can bind MS to the GPL by writing a GPL program, compiling it, putting the binary on SkyDrive, downloading a copy back, and now MS is bound to distribute the source of that binary for 7 years! Mwhahahaha!
Uh, no. Just no. If the copyright holder asks someone else to make a copy and to distribute it back to them (Or to anyone else), that copy is ipso facto legal and does not require MS agreeing to any sort of license. That is, in fact, the entire premise of what 'copyright' is...the right to authorize copies being made.
This, of course, pretending that putting a copy into a machine of someone else's and having it make a copy means that other person made the copy. This is not actually true. If MS owns a signing machine, and the way that signing machine works is to make copies, and I put something in it, I made the copy, not MS.
tl;dr: Getting a binary signed does not involve distributing copies. And even if it did, legally those copies were made by the person who put the binary in the signing machine not MS. And even if MS counted as the one making the copies, they're obviously allowed to do that upon request of the copyright holder so don't need to agree to the GPL to make copies.
If corporations are people, aren't stockholders guilty of slavery?
No, this is not a 'helpful message'. In fact, it's extremely unhelpful, because it does not explain what the problem is, and does not explain what 'similar licenses' are. As I said, the GPLv2 is a 'similar license' to GPLv3 by almost anyone's definition, but it's fine to use.
A message saying 'Note: The GPLv3 section X.Y prohibits redistribution of signed binaries without the signing key. As you will not receive a copy of the signing key, you cannot comply with that. Thus you will need to use a different license like the GPLv2 or the Ms-RL(1) if you wish to redistribute signed binaries. Other OSS licenses may have similar restrictions, please read them carefully. Click to continue.' is a 'helpful message'.
Saying 'Click to certify that this is not licensed under GPLv3 or similar open source licenses.' is not a helpful message, and is pretty clearly there to cause FUD.
It doesn't explain the issue, it doesn't bother to mention the problem is specific to GPLv3 and GPLv2 is fine, and it doesn't even explain things enough to let you check the GPLv2 or other licenses.
And there is no reason anyone needs to 'certify' anything, MS legally doesn't give a damn whether or not you follow the GPLv3 or not, and is no more liable for your GPL violation because they signed a program than if you compile GPL-violating binaries using their compiler.
1) Note I would have no problem with MS plugging their own OSS license as an alternative to the GPLv3, and I actually find it somewhat funny they failed to mention whether their own open source license would be a 'similar open source license'. I guess it would have looked really bad if they had mentioned the Ms-RL but not the GPLv2, and FUD was more important than reassuring their own developers that it was okay to use their own services. ;)
If corporations are people, aren't stockholders guilty of slavery?
I get the feeling they just don't want anything to do with the ensuing shitstorm that would come down from signing GPL3 code and giving it to someone else to distribute.
It would be incredibly stupid to blame MS for that. Now, of course, there will always be idiots on the anti-MS side who will blame them for anything...but, uh, those people will blame them for anything, so who the hell cares what they think? And refusing to sign binaries for a random reason looks just as bad to those people, so there is no actual way for MS to win.
In the real world, MS did not write the GPLv3, so can't possibly be blamed that the GPLv3 is incompatible with their binary signing system. (Which existed long before the GPLv3) Some people might decry the entire code signing system, which is, in fact, the reason the GPLv3 has that clause in it, and that's fine, but no one can complain that MS isn't giving out their own private signing keys, that would just be stupid and make the entire system pointless.
The real question is: Why does MS care enough to make people certify anything? Heck, MS has no reason to even know the license of the code it's signing.
In fact, legally speaking, they'd probably be better off refusing to know anything about what they were signing except what it does. The second they start trying to be the license police, they find themselves in dubious legal waters if they miss a violation. They're signing that binary code does specific, safe, things, not that someone has the right to redistribute it.
But MS using that opportunity to spread FUD about the GPLv3 and 'other similar open source licenses' and making people 'certify' they aren't using them (Instead of actually explaining what is going on, and not making people 'certify' anything, which is nonsense.) looks bad to those of us who aren't rabid anti-MS but do still remember MS's history.
Call us the 'MS-wary', and we remember this is exactly the sort of bullshit attacks on OSS that MS liked to do. MS and OSS are on fairly good terms right now, and there's generally cooperation...but this is either FUD, or it is accidentally indistinguishable from FUD, and is not acceptable, and needs to be changed.
Hey, why do they single out 'open source' licenses anyway? Surely there are commercial licenses that would have problems with signing. Somehow those are not mentioned.
If corporations are people, aren't stockholders guilty of slavery?