Whether Secure Boot makes your system more secure is still up in the air.
What does UEFI do? It lets us move past many of the ancient holdovers from 30 years ago that imposed silly limits on PCs, like 2TB limits on the boot drive, the MBR and associated partitioning scheme (GPT is much cleaner.) It also removes all the 16-bit, 1MB memory window limitations at boot time, moving the processors directly into 64-bit on startup and never leaving. All the archaic stuff moved into a compatibility module that can be turned on and off as you see fit.
I won't buy a UEFI motherboard. Period.
Best of luck to you, I hope you enjoy MIPS. Every x86 board vendor has moved to UEFI.
Why do people think that no one complained about Apple's lock down? They've had a walled garden in place since iOS 2.0 and it's always been a point of contention. Secure Boot just brings the threat of universal lock down that much closer.
Except on Windows RT, where the vendor must not allow for it to be turned off. And like that Secure Boot goes from being system security to platform DRM.
First, Microsoft refuses to sign anything under the GPL. Second, the FSF would have to get every motherboard vendor to accept their key, but at the same time anything signed and released under the GPLv3 would need to include said key. Not that the motherboard vendors would listen to the FSF since their goal is Microsoft compliance and nothing else.
in the Apple case offering a Enterprise SDK server config that people can run the iOS devices against.
This needs clarification. Users have absolutely no control over iOS devices at all, and I'm sure Apple would attack anything the FSF would set up.
So who decides what keys can be added to the bootloader?
Theoretically, the BIOS vendor. Or if you make a Windows RT device, Microsoft. In practice, Microsoft.
The end user, in the case of every x86 board.
Only through an irritating process that, in virtually every functional example is mutually exclusive with the Microsoft keys.
Microsoft requires any system vendor to allow end users to add their own keys (either directly, or by wiping the existing keys and requiring the user to add their own and microsofts back in). No user-modifiable Secure Boot, no Windows 8 for you.
Microsoft. So benevolent. We'll see how long this lasts.
No windwos 8 certification? The manufacturer can do whatever they want, from locking down the loader to only one key of their choice, or not implementing secure boot at all/ Basically, the current state of affairs.
Not a single vendor would dare omit Windows 8 certification.
It is decentralised. It's so decentralised, that it's handled on a per-end-device basis. Because you manage the keys on your device by entering them.
The "decentralization" is a joke. It's so decentralized that the only vendor with any guarantee of getting their key on the system is Microsoft. That's why EVERY LINUX VENDOR is going to Microsoft for a signature. Which, of course, such a supposedly vendor independent system shouldn't result in.
It's totally biased in Microsoft's favor and they know it.
No, it isn't. If you can add your own keys, you can add any keys.
Go show me one system that lets you add one with out forcing you to clear the Microsoft key? Or without having to rebuild the entire key database from scratch and installing it? It puts a nice high, high bar on being able to leverage that security and even more so for any system not approved by Microsoft to use it.
FUD
Please. Why is it that every time this subject comes up we're told to just, y'know, shut the fuck up and trust Microsoft?
On systems where you can. Microsoft is already leveraging it on ARM against the owner of the device. This is completely unlike SSL.
You can also add your own certs.
Through a painful and convoluted process.
Ever work in the real world?
I have, have you? I deal with UEFI and vendor-to-vendor, board-to-board inconsistencies daily. IT hardware also costs many thousands more than consumer level hardware.
Any hardware manufacturer that ruined the above would be committing business suicide.
That's fine. All this has to do is hinder the adoption of other platforms and force everything through Microsoft. That's what they've always wanted, really.
1) SecureBoot has no bias towards Windows or OpenSource. The only "issue" is how to manage the certs.
Secure Boot has a definite bias towards Windows, Microsoft implemented the whole thing.
2) SecureBoot was ratified over 4 years ago. Why did they take so long to complain?
Because Microsoft is a UEFI promoter, no Linux companies have representation at that level.
3) SecureBoot is just a dumb system that makes sure the executing boot code has a trusted signature.
It's all about the key distribution.
4) Linux seems to have bad relations with BIOS makers.
No, it has "relations" with BIOS makers that focus on Windows to a ridiculous degree thanks to their Monopoly on the desktop.
Linux was having ACPI issues and eventually MS has to step in and help them by showing the work-aroundw that MS figured out because hardware manufactures not following the specs. MS learned that companies don't always follow specs.
Linux implemented ACPI to spec. Microsoft's own ACPI compiler will accept ACPI code that breaks the spec but works for Windows. MS didn't have to "step in and help them," people had to reverse engineer and lie about being Windows to get the correct ACPI parameters because Microsoft has so fucked up the standard.
If anything, the FSF should push to have how UEFI handles its signature database, and who handles signing, fixed so that it isn't so wholly Microsoft centric. You can tell because it puts key acquisition and installation in the hands of the system vendors, and the only one they'll independently acquire with any regularity is Microsoft's. And as a result everyone goes to them for signing.
If key handling were decentralized and standardized across all vendors, and adding your own key wasn't mutually exclusive with other keys (as it effectively is now,) then it probably wouldn't be such a problem. Hell, if they included a system-specific key installed on each platform and a hardcopy of the key, that would probably eliminate most of the concerns expressed here.
Unfortunately, doing this would likely require them becoming a promoter ($200,000) and contributing code out the ass to see it happen. As it stands the only OS vendor at that level in the UEFI Foundation is Microsoft. All the Linux vendors are Contributor or lower and can't possibly have a voice as loud as Microsoft. Net result a perfectly good security concept gets twisted into a Microsoft-specific hazard.
Wayland is one of the doomed projects that were supposed to replace X, but amounted to nothing
Are you from the future or something, cause Wayland just hit 1.0 for the protocol and isn't done yet. I suspect, rather, that you're just bashing Wayland because there's something you don't like about it but can't actually explain what it is.
You do realize if they just used the intel compiler they wouldn't need their own customized assembly versions of standard (i.e. simple) library functions, right?
Well, that would impose a dependency on the Intel compiler to get the performance.
Impressive would have been fixing GCC to optimize simple functions on its own.
That would be nice, but these aren't the GCC developers.
Looks like the eglibc fork was a good thing for the project. Rather than having one maintainer that resists and fights an architecture for personal reasons, the project is now being proactive in integrating a new ARM architecture.
Now if we could only get away from having so many Android-only bionic-targeting blobs.
That you run Debian in a chroot to get at its power is evidence enough of Android's inherently crippled nature. It runs on the Linux kernel, but shares virtually nothing with the common Linux environment encountered everywhere else. Not surprising, given that Android was proprietary to start then opened to the world. An entirely custom stack that continues to be developed behind closed doors and just results in a duplication of effort.
But it puts Google entirely in the driver's seat, which is where they want to be.
I can avoid using it for only so long, Microsoft is forcing the issue, ramming a walled-garden tablet UI down all of our throats. I don't think I'll get around to liking a crippled walled garden capable only of single full screen tasks
But yes we will eventually be forced to use it. Whether we want to or not.
He also fails to mention that the certificate can be revoked and lasts no more than 120 days. This isn't side loading, it's abusing a convoluted system by which you can use VS2012 to test and debug formerly-Metro software.
It's nowhere near like you can do on X86 using desktop applications, or even on Android with its checkbox. It's slightly less dickish than iOS with its mandatory $99 fee before you can so much as test on hardware.
Computer hobbyists in the '80s complained that IBM and Microsoft had taken over "their" world.
True, they were roughly 30 years early. If anyone will take over "our" world it will be Apple, as they drive closed, DRM-centric platforms into the hands of millions and marginalize platforms that aren't owned by them.
Indeed, things have changed. It's all about huge interface elements that waste space, as little configurability as possible (even if it throws away features that enhance usability) and catering to the lowest common denominator (i.e. people who aren't actually using Linux.)
No, they're practicing what they preach. If you don't like it, then perhaps promoting the Linux distro you prefer would be a good idea. The average person isn't even aware that Linux exists.
It's because Dell's consumer customers are balls-to-the-wall Microsoft, even if they don't realize it.
Of course. When you have a monopoly like Microsoft does, consumers don't have a choice. Microsoft absolutely doesn't have a monopoly in the server space.
PC manufacturers targeting the consumer mass market aren't going to want to spend a fortune to generate demand for another operating system.
Sure, and they can keep themselves tied to Microsoft's boat and accept as they get dragged down along with them.
Slashdot Mirror
Whether Secure Boot makes your system more secure is still up in the air.
What does UEFI do? It lets us move past many of the ancient holdovers from 30 years ago that imposed silly limits on PCs, like 2TB limits on the boot drive, the MBR and associated partitioning scheme (GPT is much cleaner.) It also removes all the 16-bit, 1MB memory window limitations at boot time, moving the processors directly into 64-bit on startup and never leaving. All the archaic stuff moved into a compatibility module that can be turned on and off as you see fit.
Best of luck to you, I hope you enjoy MIPS. Every x86 board vendor has moved to UEFI.
Why do people think that no one complained about Apple's lock down? They've had a walled garden in place since iOS 2.0 and it's always been a point of contention. Secure Boot just brings the threat of universal lock down that much closer.
Except on Windows RT, where the vendor must not allow for it to be turned off. And like that Secure Boot goes from being system security to platform DRM.
A signer for what? For UEFI?
First, Microsoft refuses to sign anything under the GPL. Second, the FSF would have to get every motherboard vendor to accept their key, but at the same time anything signed and released under the GPLv3 would need to include said key. Not that the motherboard vendors would listen to the FSF since their goal is Microsoft compliance and nothing else.
This needs clarification. Users have absolutely no control over iOS devices at all, and I'm sure Apple would attack anything the FSF would set up.
It's hate language. People who use things like "freetard" don't realize it but they basically end up with a mindset none to different from racists.
No, it isn't!
Theoretically, the BIOS vendor. Or if you make a Windows RT device, Microsoft. In practice, Microsoft.
Only through an irritating process that, in virtually every functional example is mutually exclusive with the Microsoft keys.
Microsoft. So benevolent. We'll see how long this lasts.
Not a single vendor would dare omit Windows 8 certification.
The "decentralization" is a joke. It's so decentralized that the only vendor with any guarantee of getting their key on the system is Microsoft. That's why EVERY LINUX VENDOR is going to Microsoft for a signature. Which, of course, such a supposedly vendor independent system shouldn't result in.
It's totally biased in Microsoft's favor and they know it.
Go show me one system that lets you add one with out forcing you to clear the Microsoft key? Or without having to rebuild the entire key database from scratch and installing it? It puts a nice high, high bar on being able to leverage that security and even more so for any system not approved by Microsoft to use it.
Please. Why is it that every time this subject comes up we're told to just, y'know, shut the fuck up and trust Microsoft?
On systems where you can. Microsoft is already leveraging it on ARM against the owner of the device. This is completely unlike SSL.
Through a painful and convoluted process.
I have, have you? I deal with UEFI and vendor-to-vendor, board-to-board inconsistencies daily. IT hardware also costs many thousands more than consumer level hardware.
That's fine. All this has to do is hinder the adoption of other platforms and force everything through Microsoft. That's what they've always wanted, really.
Secure Boot has a definite bias towards Windows, Microsoft implemented the whole thing.
Because Microsoft is a UEFI promoter, no Linux companies have representation at that level.
It's all about the key distribution.
No, it has "relations" with BIOS makers that focus on Windows to a ridiculous degree thanks to their Monopoly on the desktop.
Linux implemented ACPI to spec. Microsoft's own ACPI compiler will accept ACPI code that breaks the spec but works for Windows. MS didn't have to "step in and help them," people had to reverse engineer and lie about being Windows to get the correct ACPI parameters because Microsoft has so fucked up the standard.
Only if they abuse it, which is why Microsoft is treading carefully.
Which will trend to zero very rapidly. The problem, of course, is not UEFI but the Microsoft-centric architecture behind Secure Boot.
Hard? No.
The problem is how inherently Microsoft-centric and user-hostile it is.
If anything, the FSF should push to have how UEFI handles its signature database, and who handles signing, fixed so that it isn't so wholly Microsoft centric. You can tell because it puts key acquisition and installation in the hands of the system vendors, and the only one they'll independently acquire with any regularity is Microsoft's. And as a result everyone goes to them for signing.
If key handling were decentralized and standardized across all vendors, and adding your own key wasn't mutually exclusive with other keys (as it effectively is now,) then it probably wouldn't be such a problem. Hell, if they included a system-specific key installed on each platform and a hardcopy of the key, that would probably eliminate most of the concerns expressed here.
Unfortunately, doing this would likely require them becoming a promoter ($200,000) and contributing code out the ass to see it happen. As it stands the only OS vendor at that level in the UEFI Foundation is Microsoft. All the Linux vendors are Contributor or lower and can't possibly have a voice as loud as Microsoft. Net result a perfectly good security concept gets twisted into a Microsoft-specific hazard.
Are you from the future or something, cause Wayland just hit 1.0 for the protocol and isn't done yet. I suspect, rather, that you're just bashing Wayland because there's something you don't like about it but can't actually explain what it is.
Well, that would impose a dependency on the Intel compiler to get the performance.
That would be nice, but these aren't the GCC developers.
Looks like the eglibc fork was a good thing for the project. Rather than having one maintainer that resists and fights an architecture for personal reasons, the project is now being proactive in integrating a new ARM architecture.
Now if we could only get away from having so many Android-only bionic-targeting blobs.
The Pi is available, in fits and starts. I got mine many months ago. A co-worker just ordered one and got it in short order.
Whereas many of these silly cheap boards from other sources I have yet to actually see, and I suspect I never will.
That you run Debian in a chroot to get at its power is evidence enough of Android's inherently crippled nature. It runs on the Linux kernel, but shares virtually nothing with the common Linux environment encountered everywhere else. Not surprising, given that Android was proprietary to start then opened to the world. An entirely custom stack that continues to be developed behind closed doors and just results in a duplication of effort.
But it puts Google entirely in the driver's seat, which is where they want to be.
It's not to make you want to use it, it's to push the new UI and APIs, and build up their walled garden.
I can avoid using it for only so long, Microsoft is forcing the issue, ramming a walled-garden tablet UI down all of our throats. I don't think I'll get around to liking a crippled walled garden capable only of single full screen tasks
But yes we will eventually be forced to use it. Whether we want to or not.
He also fails to mention that the certificate can be revoked and lasts no more than 120 days. This isn't side loading, it's abusing a convoluted system by which you can use VS2012 to test and debug formerly-Metro software.
It's nowhere near like you can do on X86 using desktop applications, or even on Android with its checkbox. It's slightly less dickish than iOS with its mandatory $99 fee before you can so much as test on hardware.
True, they were roughly 30 years early. If anyone will take over "our" world it will be Apple, as they drive closed, DRM-centric platforms into the hands of millions and marginalize platforms that aren't owned by them.
Indeed, things have changed. It's all about huge interface elements that waste space, as little configurability as possible (even if it throws away features that enhance usability) and catering to the lowest common denominator (i.e. people who aren't actually using Linux.)
No, they're practicing what they preach. If you don't like it, then perhaps promoting the Linux distro you prefer would be a good idea. The average person isn't even aware that Linux exists.
Of course. When you have a monopoly like Microsoft does, consumers don't have a choice. Microsoft absolutely doesn't have a monopoly in the server space.
Sure, and they can keep themselves tied to Microsoft's boat and accept as they get dragged down along with them.
Are you hairyfeet's sockpuppet account?