Slashdot Mirror
Free Software Foundation Campaigning To Stop UEFI SecureBoot
hypnosec writes "The Free Software Foundation is on an offensive against restricted boot systems and is busy appealing for donations and pledge in the form of signatures in a bid to stop systems such as the UEFI SecureBoot from being adopted on a large-scale basis and becoming a norm in the future. The FSF, through an appeal on its website, is requesting users to sign a pledge titled 'Stand up for your freedom to install free software' that they won't be purchasing or recommending for purchase any such system that is SecureBoot enabled or some other form of restricted boot techniques. The FSF has managed to receive, as of this writing, over 41,000 signatures. Organizations like the Debian, Edoceo, Zando, Wreathe and many others have also showed their support for the campaign."
Hasn't Ubuntu made GRUB a SecureBoot boot loader? How isn't this sufficient?
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
I like the straight jacket clipart - It reminds me of how this is all just insanity.
Secure Boot is a good thing people! It means I can actually lock out my machines so they'll only boot linux and never windows!
It should be mandated that any restriction on a general purpose computer has to be stated clearly as such on the packing, otherwise it would a intentionally concealed defect.
Richard, it's a nice sentiment, but what are the alternatives? Signing something saying I won't buy a UEFI-enabled system is basically saying I've doomed myself to the stone age. Every company is switching over. Nobody's going to go for that in the long term, anyone signing that is doing it just to make a statement. Eventually, their decrepit pre-UEFI system is going to fry, and they're going to go looking for a new one.
Rather than do something useless like a petition, which have a very low success rate on the internet, why not give us something useful: Like a list of motherboards and builds that do not have UEFI and sport otherwise modern hardware and features?
#fuckbeta #iamslashdot #dicemustdie
The secure boot crap could be an antitrust issue.
German goverment has spoken abit about it
http://www.h-online.com/open/news/item/German-government-advocates-security-in-the-hands-of-users-1753715.html
I'm pretty sure your shift key is broken. Possibly, your comma key as well
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
If anything, the FSF should push to have how UEFI handles its signature database, and who handles signing, fixed so that it isn't so wholly Microsoft centric. You can tell because it puts key acquisition and installation in the hands of the system vendors, and the only one they'll independently acquire with any regularity is Microsoft's. And as a result everyone goes to them for signing.
If key handling were decentralized and standardized across all vendors, and adding your own key wasn't mutually exclusive with other keys (as it effectively is now,) then it probably wouldn't be such a problem. Hell, if they included a system-specific key installed on each platform and a hardcopy of the key, that would probably eliminate most of the concerns expressed here.
Unfortunately, doing this would likely require them becoming a promoter ($200,000) and contributing code out the ass to see it happen. As it stands the only OS vendor at that level in the UEFI Foundation is Microsoft. All the Linux vendors are Contributor or lower and can't possibly have a voice as loud as Microsoft. Net result a perfectly good security concept gets twisted into a Microsoft-specific hazard.
What about severs and web hosts / ECT.
Windows 7 UEFI secure boot??? enterprise use is way to big for that to get locked out.
Where is HP and DELL in this???
Supermicro??
Tyan??
Linux in Medical Devices (do really want MS windows to be the only choice there??)
http://blogs.windriver.com/medical/2011/11/using-linux-in-medical-devices-what-developers-and-manufacturers-need-to-know.html
Desktop motherboard manufacturers know that in the past and in the present that following the dictates of Microsoft is how to survive. But those days are mostly over. I doubt any of the MB manufacturers are going to stand up and fart in Microsoft's face and say NO. But I suspect they know the trend is moving away from Microsoft and with the Linux noises that companies like Valve are making that Microsoft will only get weaker. Thus they will probably pretend to put UEFI onto the motherboard but make it really really easy for anyone with the capability to install linux to turn it off. So I suspect that the motherboards will soon come with UEFI enabled by default (maybe) but that you can either go into the bios and turn it off or short a jumper.
Other options would be to leave a weakness in the system so that it is easily hacked and thus bypassed; this way they can meet the letter of Microsoft's law but not at all the spirit. And of course they don't need to make a hole, they know people will find a hole and they won't bother patching it. But I just don't see the manufacturers coming out and directly attracting Microsoft's rage. Plus companies know that all kinds of businesses will want to put a whole range of products on their systems from oddballs like DOS with many wanting XP, Vista, and Windows 7. It wasn't that long ago that I saw an ATM running OS/2. I suspect the guts of the ATM were newish.
But in the near term Microsoft is going to ask "Who farted?" and the various manufacturers are going to pretend that they didn't.
All that said, Microsoft's worst nightmare would be for a company to start releasing Motherboards/Machines with UEFI disabled as a feature and telling the world that smart discerning high-end customers buy systems without UEFI and that the drones buy what the suits at Microsoft tell them. What microsoft seems to forget that while computer nerds running things like Linux are not a significant market share in and of themselves they are who guides, or outright chooses what systems get picked. Minimally how many slashdoter's are involved by their families when they are picking machines. Without starting a religious war about my personal tastes I can say that when people around me are buying a system I give them a fairly narrow range of choices that if they stray from I won't take their "urgent" calls at 10pm when things are going wrong a month later. "Oh your poorly designed laptop that sucks cooling air in only from the bottom overheated when sitting on the sofa and now you need your data pulled from its carcass? How about no." So while people like us probably only represent 1% of the market we probably influence 30+% of the market. So if we don't like UEFI the manufacturers will soon find that we have a bigger vote than simplistic market surveys might otherwise suggest. So even if they totally cave to MS I suspect cracks will appear fairly quickly.
Let's put on our thinking caps folks. Return Oriented Programing is an exploit engineering technique that uses the existing signed and/or encrypted code to create the exploit code. That means Secure Boot is defenseless to stop this type of exploit. If the application or OS code has mistakes in it then a function pointer on the stack, or in the heap (read/write memory) can be overwritten and be used by exploits via return oriented programming, and SecureBoot won't help one bit -- The code that's running is signed and/or encrypted. So if the Application or OS code isn't secure (which it won't be) then SecureBoot is pointless. What that? It won't be able to infect a boot sector? Well, if you've got malicious code running on your system then there exists an exploit vector that cane simply be re-exploited next time you boot up. See? Pointless.
Ah, but what if the Application and OS code could be written to be secure against stack smashing and undesired code pointer manipulations? Well then, there wouldn't be any exploit vectors that you needed SecureBoot to protect you against. See? Pointless.
Well, I say "Pointless", but what I mean is useless from an end user perspective. I don't mean to gloss over the only real use SecureBoot has: To prevent you from installing your own OSs and Applications, and having control over your own computers.
As for OS's that won't run with UEFI disabled. I have no use for them.
File under 'M' for 'Manic ranting'
I support FSF in most things, but this is an important feature.
Rootkits are a very real problem, and SecureBoot is a good step towards eliminating them.
As long as there is some way for the user to disable it, I'm happy. Although it could be a bit tricky to achieve that without breaking the security model. Perhaps a hardware switch that can only be accessed by removing a few screws from the case...
This post is a little misleading. We think Secure Boot is OK so long as computer makers implement it in a way that it still allows a user to control his or her own computer. What we don't want computer makers to do is implement UEFI in such a way that a user is unable to sign their own software (e.g. bootloader) AND they are unable to turn Secure Boot off -- we call such an implementation Restricted Boot (because we want to emphasize that it instead of providing security, it exists to restrict a user from controlling his or her own device). We hope that computer makers will choose to implement UEFI in a way that truly does provide security and control, and many are implementing Secure Boot in this way.
Joshua Gay
Licensing & Compliance Manager
Free Software Foundation
it always has been: in the community.
when they kicked around ACPI as a standard that intentionally didnt 'just work' on linux, we made it work.
when dvd was a big-two game, the community came together again and made that work as well
when windows mandated the wholly superfluous 'windows' key we simply coopted it to our own desires. Awesomewm, for example.
absolutely tireless effort was spent making sure every iteration of broken windows continued to be supported as a dual-boot option in Grub.
We engineered solutions for their docs, excels, and even the very programs that ran only on windows in the form of Wine.
secure boot could come, and against it will stand a threat that microsoft has consistently underestimated: Hackers. We cannot be lobbied against, or coded around. there is no NDA we recognize or understand. Im not saying UEFI shouldnt be stopped, just that if and when it comes, we have been ready since the dawn of the kernel to make it do what we want it to do.
Good people go to bed earlier.
The article is wrong. I went through the links in the article and donated $10 without a problem.
freetards
I know adding "tard" to the end of thinks magically makes you cleverer than they are. It doesn't
But I love the irony of you defending Microsoft an abusive multiple offending monopolist, a nasty company by every measure, has shenanigans, by recent favourite by this awful awful company is to hirer Mark Penn who unlike you is a professional shit slinger, who has has a department to match “strategic and special projects” http://www.nytimes.com/2012/12/15/technology/microsoft-battles-google-by-hiring-political-brawler-mark-penn.html?_r=0 what a nice man
posting a inflammatory rant off topic doesnt make you look any smarter. I am not defending microsoft, I just happen to notice every time FSF gets worked up there's always a required "donation".
How you magically tie this in to being a YAY GO MS post is beyond me, and your ongoing blather about some nytimes writer is pointless in context
I like you Osgeld, I admire a man prepared to defend a Mega-corporation fearlessly. I love the way you tried so hard to create something nefarious against an organisation that relies on donations...asking for Donations like Freebsd and Wikipedia, or lets be honest these people produce something of value, Richard Stallman is who he is because he created a compiler that produced faster binaries than the competition at a time when they cost thousands of dollors...and gave it away...and yet your painting this organisation in a bad light compared to Microsoft...the shits who can't even pay TAX, the stuff the feeds roads; hospitals; schools. Seriously love what you do for Microsoft.
I was going to mod you up but then I read your final sentence:
We need some form of DRM system that the user can manage to protect their system from physical access or general boot exploits.
Secure Boot is *not* (necessarily) DRM. It all comes down to who controls the keys. If the owner controls the keys then Secure Boot is a good thing. If the owner does not control the keys then Secure Boot is a form of DRM and it is a bad thing. If the user/owner has control and can use Secure Boot to protect their system then it is not DRM.
The big danger of Secure Boot is that, unlike conventional DRM, it can be actually be made secure. This could then be leveraged to make unbreakable DRM. This is the looming threat of Secure Boot.
I agree with you that Secure Boot can be a good thing. IMO the FOSS community should embrace Secure Boot, provided that the user/owner has control of the keys. IMO the fight should not be over whether to use Secure Boot or not, the fight should be over who has control of the keys. This is an easier battle for us to win because there are simple real-world analogies for key control that the general public can understand.
We don't see the world as it is, we see it as we are.
-- Anais Nin
and Adobe too. I just went to find an Acrobat to register
a Gov. complaint, and there is nothing free. When I am too poor.
The bastards are relentless, and winning. And SOOO wrong.
We need an "Occupy Software" also.
John Eadie [JE46] http://www.c-art.com `one of these days the dogs aren't going to eat the dog food' - Bill Joy
Nevertheless, you did exactly that IMO. Please allow me to reiterate for the benefit of others:
Technical solutions as proposed above are irrelevant, because the fundamental problem here is that I SHOULDN'T HAVE TO FIND A GODDAMN EXPLOIT TO RUN MY OWN CODE ON MY OWN COMPUTER!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
see right there is the problem, some odd reason many of you freedom fighters see it as black and white, if I am not 100% dedicated to your cause then I am appalling and hurtful to your cause
my argument though ... is your cause so weak it cant take one simple observation without going off on a witch hunt? (which you have for hours now)
you have offered no evidence why I should actually care, and yet shown so much of why I don't want to be associated with your kind
good day
And OMFG, you can turn off SecureBoot and/or make any key and/or signature whichever way you want it to be.
Precisely according to the UEFI spec as it requires.
MS has EVERY right to lock their own ARM's and such proucts down, and they will do exactly that.
But public mobo makers and third-party chinese ARM'ers and tablet'ers never will.
So this whole thing is TOTALLY and FALSELY blown out of proportion and only applies to people insisting on buying MS-Windows products, for which they'd never want to run any other OS in the first place... precisely because they're self-defined MS-Windows fans. So even they don't care about this.
Everyone else is simply not going to buy MS products.
It's that simple.
http://usa.asus.com/Motherboards/AMD_Socket_FM2/F2A85V_PRO/
....it doesn't do anyone any good to be spreading FUD! If you actually spent some time researching this topic, you will find that what you said isn't entirely true. Take the Dell Latitude 6430u that comes with Windows 8. You can disable secure boot in BIOS. I refer you to page 44 of its owners manual....
Well, I don't have a 6430u, but I just looked at page 44 of the owner's manual. It's written in gobbledygook language with double negatives and obscurity about what exactly is being enabled/disabled.
What's more, one of the controls 'described' on the page has a big warning that it's for one-time use only and "Activate and Disable options will permanently activate or disable the feature and no further changes will be allowed".
Maybe I could navigate that path to freedom if I had plenty of information from elsewhere, but that 'owner's-manual' page looks like it's exploiting complexity and obscurity to hinder the use of freedom.
It's unfair to call 'FUD' when information about available features has been obscured to the point of incomprehensibility.
-wb-