Slashdot Mirror
FSF Does Want Secure Boot; They Just Want It Under User Control
Yesterday, we ran a story with the headline "Free Software Foundation Campaigning To Stop UEFI SecureBoot." It's more complicated than that, though, writes gnujoshua: "We want computer manufacturers to implement Secure Boot in a way that is secure. If a user can't disable Secure Boot and they are unable to sign their own software (e.g., bootloader, OS, etc), then we call that particular implementation 'Restricted Boot.' We don't want computer makers to implement Restricted Boot. We want them to implement Secure Boot and to provide a way for individuals to install a fully free OS on their computers. Many computer makers are implementing UEFI Secure Boot in this way, and we want to continue encouraging them to do so." The complete text of the statement they'd like people to sign reads: "We, the undersigned, urge all computer makers implementing UEFI's so-called "Secure Boot" to do it in a way that allows free software operating systems to be installed. To respect user freedom and truly protect user security, manufacturers must either allow computer owners to disable the boot restrictions, or provide a sure-fire way for them to install and run a free software operating system of their choice. We commit that we will neither purchase nor recommend computers that strip users of this critical freedom, and we will actively urge people in our communities to avoid such jailed systems."
What problem does Secure Boot solve, other than Microsoft's "other OS" problem?
I want to delete my account but Slashdot doesn't allow it.
They may say they're committed, but let's hope they put their money where their mouth is the next time a machine they really want comes to market.
The Amarri pray for god, the Caldari pray for profit. the Gallente pray for peace, but the Minmatar pray their ships hol
I notice the language they use, such as calling the thing they are against 'Restricted Boot', and calling it 'jailed systems'. All quite expected, but I find it patronizing for them to have to call it by weaselly words.
So then they're fine with the way Windows 8 handles it? Because that's exactly what Microsoft demands of computer manufacturers who want to be certified for Windows 8.
Windows RT is a whole different matter, but Windows RT also accounts for about 0% of the tablet market right now. Why is the FSF making all this noise now, when Apple has been happily locking down the iPad since 2010? Microsoft is just joining the party, and it seems a little late for FSF to get self-righteous about it.
But more power to them I guess. It seems like a tough fight, however, when users have a great deal of choice between tablets (both locked and unlocked), even with the locking down of certain hardware.
This behavior sounds like a lawyers wet dream to me. Talk about an attempt to form a monopoly. Anybody selling a system that prevents the user from using free software or OSs deserves a big, fat, nasty, very expensive, tour of courts all over the world.
Our great lord and saviour.
The humble masses bow to the great unwashed one.
Think about it a moment. The ultimate piece of malware would be one that can make your computer run software of someone else's choice, prevent you from running software other than the malware, and block you from removing the malware from the system or preventing it from running. Every piece of malware out there tries to do this, with varying degrees of success. Look at the malware that tries to disable anti-virus/anti-malware software.
Now, Restricted Boot would give someone else control over what software could boot on the machine, and prevent you from changing that list of authorized software. You cannot authorize software you want to run to run, nor can you remove authorization from software you do not want to run. You can't influence what runs at boot, you can't alter it's operation. In short, you've bought into every malware author's wet dream: a system where they can do anything they want and the user can't do a thing about it.
And if you think "Oh, but all the system software would be signed by Microsoft, so how would the malware authors get the keys to authorize their software?", think about this: Microsoft certificates have already been compromised. The bad guys have already gotten access to what they need to sign software with legitimate Microsoft keys. The certificates used by the Flame malware were only some of the most recent. And I'd note this older bulletin describing a situation where Verisign issued legitimate certificates issued to Microsoft to black-hats with no association with Microsoft. The bad guys obtaining the private keys to sign software isn't a theoretical discussion, it's already actually happened.
So the FSF is basically asking people to sign a petition that asks manufacturers to do what they are already doing and plan on doing ? The current requirements for windows 8 is that users must be able to disable secure boot in the bios and do key management (addition/removal) of keys as well. I don't know of any manufacturer that is planning on doing anything different since that would mean that their systems would not be windows 8 certified.
In fact, I don't think microsoft bans having other keys besides their key in the bios by default.If, for example, the FSF or some coalition (e.g. RedHat, Ubuntu, Debian, etc.) were to come up with some workable way key signing infrastructure, they could petition UEFI/mobo developers to include their keys in shipped products as well. The question is how do you freely allow people to get bootloaders signed without making it easily for malware authors to do the same.
"When you sit with a nice girl for two hours, it seems like two minutes. When you sit on a hot stove for two minutes, it
Why do people think that no one complained about Apple's lock down? They've had a walled garden in place since iOS 2.0 and it's always been a point of contention. Secure Boot just brings the threat of universal lock down that much closer.
Well to be fair both the FSF and EFF have been heavily involved after Apple demonised their customers calling them criminals for for jailbreaking Apples Phones(not theirs). Ignoring the fact that those are *electronic* devices and Apple is nowhere near a monopoly (I now its not a good answer for apple users), but again the same groups are not just focused on Microsoft. As for the FSF a quick Google gives this http://www.defectivebydesign.org/blog/1256, although the jailbreak DMCA exemption for the iPhone...and not the tablet, have been big news on most technology sites.
Anything in a computer that calls itself 'Secure' isn't. Secure Boot is a false sense of security that will lead people to think they are safe. Secure Boot is Microsoft's Security against competition.
The FSF has had this petition up for several months. It was there long before the first machines with Secure Boot became publicly available. Why is it being covered on Slashdot now? Two articles in two days about something that was covered already seems like a waste of time.
Being categorically against Secure Boot is akin to be categorically against digital encryption and signing in general just because they are tools that are sometimes used to create DRM. DRM is bad. Secure Boot without user/owner key control can make it worse. The FOSS community should embrace Secure Boot but fight for key control.
Used properly, Secure Boot will make FOSS systems more secure. It is much better to add security measures *before* they are needed rather than after. We have generally been ahead of the curve security-wise for decades. Embracing Secure Boot (with user key control) will help us stay ahead of the curve. If we instead shun Secure Boot there is a very real danger that we will lag behind.
We don't see the world as it is, we see it as we are.
-- Anais Nin
To replace the key and the boot-loader you have to disable "Secure Boot" in the firmware (Disabling by software is not allowed), then update the key (Means flashing a new version of the firmware) and the boot-loader and then reactivate "Secure Boot".
Now think of Average Joe or your grand mother and tell me how someone like them will accomplish this.
Replacing the keys doesn't require reflashing the firmware, you just need go into the UEFI setup screen and add or delete the keys you're interested in. If the key gets compromised, you just go to the setup, add the new key, boot and update the bootloader and go into the setup and remove the old key. Or, even easier, you update the boot-loader on a working system, then go into the UEFI setup and remove the old key and add the new key. The procedure you outlined is unnecessarily complex even assuming that you have to reflash the firmware to get new keys.
"When you sit with a nice girl for two hours, it seems like two minutes. When you sit on a hot stove for two minutes, it
TFS has a headline which says "FSF Does Want Secure Boot". It would appear that this is not the case. The FSF would apparently prefer if secure boot were not implemented at all, but if it must be there, they ask that it be done in a way which allows straightforward user installation of a non-DRM OS.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Here is an example of a motherboard from one of the market leaders (ASUS, ASRock, Gigabyte, MSI, Biostar),
that lets you do whatever you want with SecureBoot (rtfm for the feature set)...
http://usa.asus.com/Motherboards/AMD_Socket_FM2/F2A85V_PRO/
And LOOK, you can turn off SecureBoot and/or make any and every key and/or signature whichever way you want it to be.
Precisely according to the UEFI spec as it requires. Read the docs, it's all there. You have full control.
Now, MS has EVERY right to lock their own ARM's and mobos and such proucts down, and they will do exactly that.
But public mobo makers like these big leaders, and third-party chinese ARM'ers and tablet'ers, never will do that with their open non-OEM lines, because they will lose business. Have you ever bothered to look at Chinese dual-sim phones running Android 4.1 and 4.2 for $250 or less? Totally open and unlocked and doing a brisk business.
So this whole thing is TOTALLY and FALSELY blown out of proportion.
The Linux fanboys and handwavers simply didn't bother to read the UEFI spec where it mandates this detailed level of control be given to the user. They didn't consult the hardware makers to ask. And they didn't review the boards on the marketplace.
The lockdown approach presented by the handwavers only applies to people insisting on buying MS-Windows products, for which they'd never want to run any other OS in the first place... precisely because they're self-defined MS-Windows fans, so they never about this, and can enjoy their chains in a blissful stupor.
Everyone else is simply not going to buy MS products.
It's that simple.
If you don't like the secureboot idea, THEN DON'T BUY PRODUCTS THAT INCLUDE IT. Seriously, not that difficult of a concept to understand.
A recent talk he gave really spelled out the problems that are down the road of Secure/Restricted Boot in the future...alot of which isn't so much the booting or signing of keys, but poor implementation from every potential manufacturer. And then theres the kowtowing to M$, but that seems smaller a issue at least for now.
http://faif.us/cast/2012/sep/27/0x32/
or
http://lcna2012.sched.org/event/8bcbfc40b64d03fe8f6cdc55f19b056c
I believe the real story here is the fact that slashdot managed to correct the extremely exaggerated story they presented yesterday.
Writting "it's more complicated" is nice, but hardly a good apology.
Nevertheless, in days like these, let's take a moment to congratulate slashdot on a summary that's actually correct.
It's too often, that I find a different story, if I read beyond the summary.
Knowing most "users" out there, any option which exists to let a 'user' configure something will most likely result in a virus configuring it on behalf of the ignorant user. Disabling Restricted Boot should require some physical action to prevent software from doing it.
That's the real question. Is the ability to disable secure boot on X86 just a temporary concession to corporations that would refuse to buy new computers without it? Once XP and Windows 7 work their way out of the corporate infrastructure, will Windows certified X86 machines still be required (or even allowed) to support disabling secure boot. If there's some promise to that effect, then fine. But I don't know of any.
Also, if ARM ever supplants X86 in corporate settings, then all bets are off. There is no viable commodity marketplace for non-microsoft, non-apple X86 systems. We Linux users are lucky that commodity hardware can run our preferred OS. If the commodity X86 market were ever to dry up, leaving only locked down ARM stuff, we'd be out of luck. Yeah, there'd be stuff built for Android, I guess, but that assumes that Android succeeds at commodity levels in all the form factors we want to run Linux on. And that all those Android vendors don't lock down their systems too...
I guess there'd always be the niche Linux only hardware vendors. But they tend to build high-margin non-commodity stuff. I personally like running Linux on 'outdated' hardware that does everything I need it to do for a few hundred bucks. There exists a market for that stuff today, and OEM's even make money selling it. That could go away pretty easily.
Posted from my Android phone. Oh, I can change this? There, that's better...
What happens when the Master key is found/hacked/whatever?
I mean, the big hacking groups, you know, the real criminal ones with the money, are probably salivating at the idea of finding an exploit or getting their hands on the master key. Its really only a function of time, and even money that it happens in the next few years. Hell, they could probably throw enough money at someone within MS with access to the master key and have it within a few days if they knew who would be open to taking a bribe.
Still, i'm pretty much with the camp that thinks this is all useless security theater. I haven't seen a virus in years that did anything to the BIOS or pre-OS loading stage. They usually just rely on people's stupidity to click "yes" to everything and boom, their OS is compromised anyway.
Direct link to the petition / statement referred to in the summary: http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/statement/
Only takes a few seconds to sign it!
What if computers were shipped with the Secure Boot disabled, and then a BIOS setting would allow it to be enabled? Then Linux users could use it normally, and Windows users could switch it on. You would have no option to disable it once it was enabled so it would remain "secure" for the Windows folks.
J
So the bios will run a crc function on the boot code and compare to list of allowed boot loaders and refuse if nt found ?
BECAUSE IT'S PAID FOR.
Not everybody gets their upgrades paid for by someone else. Or from a warez torrent.
--
The real hackers left ages ago. They were casted to void.