Slashdot Mirror
FreeBSD Team Begins Work On Booting On UEFI-Enabled Systems
An anonymous reader writes "The FreeBSD project has begun the process of making it possible for the operating system to run alongside Windows 8 on a computer which has secure boot enabled." Linux distros have taken to using a minimal loader, signed by Microsoft, to enable booting on UEFI systems with secure boot. "Indeed we will likely take the Linux shim loader, put our own key in it, and then ask Microsoft to sign it," says developer Marshall McKusick in the linked IT Wire article. "Since Microsoft will have already vetted the shim loader code, we hope that there will be little trouble getting them to sign our version for us."
I did not know Microsoft won that battle.
“He’s not deformed, he’s just drunk!”
It's UEFI, the Unified Extensible Firmware interface. EUFI is ExtraUterine Fetal Incubation. Very different things.
The motherboards they are shipping now have a simple disable. So there is no immediate fear of being unable to run Linux on the things. BUT you have to go in and disable it in BIOS which is just completely over the head of most computer users these days. You dont have to make it impossible to deter most people from using it, just a tiny hurdle will divert the herd.
Right now they are signing the certificates without a problem. But what will they do in a year or five or a decade? Building a business that relies on getting certs signed by MS doesnt seem wise long term. Of course no one thinks long term anymore... a small change in the law here, an easily fabricated incident using a signed bootloader to compromise a business there, and they could easily revoke these keys.
The other problem is that UEFI is actually really cool tech, we dont want to get rid of it. We want to be able to use it. I should be able to install my own key on my own motherboard so it will only load code that I sign personally. Rather than simply trusting MicroSoft or turning off a great security component that I already paid for and theoretically own.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
My bet would be that Microsoft refuses to sign the loader, saying that they can only sign if the loader's coded to only load binaries signed by a trusted authority (ie. Microsoft) and that allowing a loader that can load untrusted (ie. unsigned or not signed by Microsoft) binaries compromises the security of the boot process.
Conceptually, if the user has access physical access to the computer and the ability to plug shit in, your security is already gone.
Conceptually, 99.99% of computer users don't even need this kind of security in the first place, so why is it being forced on 100% of the new computers?
Conceptually UEFI won't stop a single virus which 100% of computer users face daily, and that IS a problem.
UEFI serves one and only one purpose. It makes it 'easier' to just continue using Windows and more difficult to use any other system.
Linux doesn't need UEFI. Nobody needs UEFI.
Stopped shilling lipstick on a pig.
And that attack vector can completely be negated by having the BIOS read-only by default, while only enabling updates when the user toggles a physical switch when the BIOS needs an update.
Nihil in publicum sputa.
MS has the LICENSE to use BSD code.
They don't owe BSD anything.
Next time you're thinking of whether to license YOUR code using GPL or using something
that allows MS to use your stuff and give nothing back in return... remember this.
Ehud
I don't see much of a problem - it only affects people who wants to dual boot and that is totally last century. Boot Linux and run Windows in a VM.
It is not to do with dual boot, it is to do with booting anything at all. This is a motherboard chip feature. Booting from a live CD will be impossible, and even if you wipe your HD, trying to install anything else will be impossible - if Secure Boot is enabled.
You can disable Secure Boot (FTTB, but I suspect MS will hope to clobber even that in the not too distant future), and I will myself. But it will deter people from trying out Linux tentatively and perhaps liking it. That's how I started, and MS hate people doing that.
Just to clarify: UEFI is not the problem. It's just a replacement for the old BIOS system which addresses the decades of accumulated legacy bodging that is the PC. Secure Boot is a feature that UEFI enables. You can have UEFI without Secure Boot.
Absolutely. Both Apple and Microsoft have long recognized that free operating systems are the biggest threat to their business models. Operating systems do not offer enough ways to stay ahead of competition by innovation, once the basic needs are fulfilled new features become mere gimmicks that might be nice to have but are not essential (see history of OS X).
Both Apple and Microsoft have a well-recorded history of anti-competitive business behavior and have in the past tried by all means to keep the application barrier up. In the 90s Java and Web-browsers were the biggest threats and they successfully averted these by tricky anti-competitive behavior. SCO tried to sue free operating systems out of existence and failed (so far, bogus patent law can change that and new law suits are in the drawer), now GNU/Linux has matured so well that it has become intolerable to Microsoft and Apple. Bear in mind that you can run many Windows programs in Wine already and that GNU/Linux has reached a certain usability threshold putting it roughly on a par with Windows XP in terms of software that end-consumers actually need (and GNU/Linux is much more stable).
The sole and only purpose of the current secure boot specification is to be the entry ticket to completely locked-down machines with completely locked-down whitelisted software that is only runnable and distributable by obtaining a key from Microsoft or Apple respectively and only with their blessings. That's the long-term goal.
The current, more modest goal is to make it hard for end-users to install another OS and hard to set up dual boot systems. Microsoft will then urge (=blackmail) hardware makers to produce more consumer boards that can run only Windows, and Apple will start to make their manufacturers produce OSX-only boards, while at the meantime urging manufacturers to sell more expensive motherboards that are not locked down so they can still claim they allow competition. For Microsoft, this is particularly important, because they need to make money with Windows and the "windows tax" is annoying more and more people. So they want to make sure that a board that runs GNU/Linux or BSD systems is more expensive (a 'pro feature', so to say) than a consumer board that only runs Windows plus the OEM fee for Windows. Microsoft is very desperate to keep their huge share of the dwindling desktop market, because they have already lost the mobile market.
This might all sound exaggerated to you now, but the fact is that these companies plan far more ahead than some people might think.
There is no reason that a traditional PC BIOS can't boot a 3TB drive. The bios just reads the first sector of the drive and runs the code, it doesn't need to care what type of partition table is used. So the 2TB limit of the DOS style partition table is irrelevent to the first stage of booting a PC. AIUI grub2 has no problems being booted by a traditional PC bios and then going on to read a GPT partition table and load linux from it.
The inability to boot windows on a 3TB GPT drive with a traditional PC bios is entirely microsoft's fault.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Or you can have a BIOS that addresses the decades of accumulated legacy bodging that is the PC, without UEFI.
Just put a BIOS that removes all the old cruft of the old BIOS, adds some new features, but is totally minimalistic.
That's what UEFI is - it drops old cruft (mainly ISA, AGP and such, IIRC), ups the minimum requirements (UEFI can assume some level of graphics support, so no more MDA text mode; likewise, it no longer runs in 16-bit mode), and extends functionality (booting off 2TB+ drives). They broke compatibility in a few places, but they did so, in part, to speed up boot times by moving functionality from the BIOS/UEFI to the OS.
UEFI, itself, is a big step forward. The only problem is the "Secure Boot", and honestly, the problem is currently theoretical (at least on x86 - ARM is a different story). Secure Boot itself is fine - as long as the user is allowed to add and remove keys, and can enable/disable it, it's at worst unneeded functionality.