7 ms·

Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel, and it is more secure. UEFI doesn't require USB or secure boot or a compil

by Rusky 9y ago

Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel, and it is more secure. UEFI doesn't require USB or secure boot or a compiled language or Python or proprietary code. It would be nice to have something simpler than UEFI to replace the legacy PC boot process, but the point IMO is that we want to replace the legacy PC boot process. It's not as straightforward as "simple, stable interfaces that have been around for long enough to be mature, well-understood, and relied upon by everyone." It's a de-facto standard with a lot of room for things to go wrong, and they do.

userbinator 9y ago
Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel Unfortunately that's what it will likely turn out to be in practice. It's a de-facto standard with a lot of room for things to go wrong, and they do. ...as opposed to an even more complex standard? The saying about "known unknowns" and "unknown unknowns" comes to mind... there is literally tons of documentation out there about all the "legacy" devices in a PC, but far less about the newer proprietary bits.
- johncolanduoni 9y ago
  > Unfortunately that's what it will likely turn out to be in practice. Even Microsoft specifically forbids hardware marked as "Windows compatible" from not allowing user installed keys on x86. I'd like some actual reasoning for "likely".
  - SquareWheel 9y ago
    I know that was true for Windows 8 approved PCs, but didn't they remove that requirement for Windows 10?
    - Santosh83 9y ago
      And why exactly are Microsoft being allowed to dictate restrictions upon general purpose PCs manufactured by others? Why do other OS distributors need approval from Microsoft before their OS images can be used under Secure Boot, without the user having to install their own keys? We need to overcome these big usability hurdles, or PCs are going to become just glorified smartphones needing 'jailbreaks' before long. The writing is on the wall for those who can see it, IMO.
      - cwyers 9y ago
        Microsoft dictates what a general purpose PC manufactured by others has to do to be compatible with Windows; vendors that don't care about being able to run Windows can refuse to abide with anything Microsoft says. (Apple doesn't meet Microsoft's standards, for instance.) Linux is an operating system designed to run on computers that meet Microsoft's standards. A Linux distribution could go the Apple route and define a different set of standards a computer has to meet to run that distro, so that only computers made to run that distro could run Linux. ChromeOS is a Linux that has done this. The commodity PC platform is basically a historical accident, where IBM used commodity off-the-shelf hardware, and licensed MS-DOS but neglected to get an exclusive license. So anyone that bought the right hardware and a license to MS-DOS could provide an IBM-compatible PC. Before the ascendance of the IBM compatible platform, you had manufacturers of general purpose PCs building incompatible machines. Now we have a market dominated by compatible machines. There's no ISO standard for general-purpose PCs that makes this happen, or any other independent standard. Windows Hardware Certification is the standard for commodity PCs. EDIT: To clarify, this is only true regarding x86. Linux on MIPS/POWER/etc. is conforming to some other standard, not one set by Microsoft.
        revmoo 9y ago
        > Linux is an operating system designed to run on computers that meet Microsoft's standards. No, it isn't.
        digi_owl 9y ago
        This ignores the one piece that was IBM proprietary, the BIOS, that they tried to defend strongly. But back then they didn't have software patents, and Compaq was able to prove that their BIOS was a clean room re-implementation. And from that point the cat was out of the bag. Never mind that IBM after that tried to go proprietary with the PS/2, and it bombed badly.
  - Santosh83 9y ago
    Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and delving into the key management interface? Yes, you can install the few 'blessed' distros like Ubuntu, Fedora or OpenSuSE, but what about distro X? Thus far, an average user need only pop a CD to install Majaro or FreeBSD or FreeDOS. Now...? Install their own keys? Sign their kernels and modules? This reminds me of all the anti-piracy measures. Sure, you can theoretically circumvent all the DRM. But is it practical for 90% of users? No. Sure, DRM is theoretically perfectly fine, as is Secure Boot. As is even ME. The theory is always fine. How it turns out in practice, not so much. We should be asking ourselves if this marked disparity is really just inadvertent.
    - Rusky 9y ago
      Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.
      - digi_owl 9y ago
        The line between the two is thin and ill focused...
      - betterunix2 9y ago
        Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
      - 9y ago
  - digi_owl 9y ago
    I seem to recall they initially did not, and there was a massive outcry about it, so they relented. Sounds like one of those things that they will try to sneak back in every odd years or so, and if the masses miss it just once it's game over.
  - betterunix2 9y ago
    For now Microsoft insists on that, probably because they are afraid of antitrust litigation otherwise. The problem is that Microsoft can change their policy at any time; they already have a totally different policy for ARM.
- tscs37 9y ago
  >Unfortunately that's what it will likely turn out to be in practice. It should be mentioned that part of the Microsoft Certification requirements for UEFI is that you can install your own keys (which I did and do recommend); """ On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". [...] It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. [...] """ So unless the vendors don't want the Microsoft Windows Certified Badge and be able to preinstall Windows, they will offer those options. >but far less [documentation] about the newer proprietary bits. http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.0 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.0 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.1 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.1 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.2 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.2 I'm currently using the above links to write a small kernel, which compared to using BIOS is rather easy since it provides a very convenient trampoline to get basic services in the kernel setup without hassle. The legacy devices out there are usually very poorly documented too. The page for PS/2 keyboard IO on OSDev.org is several dozen pages explaining how to properly drive the keyboard controller or a floppy drive or a harddisk. And they're largely incomplete and only cover the most common cases.
  - bitwize 9y ago
    It should be mentioned that as of Windows 10, Microsoft removed the requirement to allow you to install your own keys.
    - tscs37 9y ago
      No, the current requirements still include this. On ARM platforms it has been removed for ages now. The quote in my previous comment has been directly pulled from the UEFI requirements on the microsoft website.
betterunix2 9y ago
"Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel," Unless you're on ARM, right? What makes you think Microsoft will always be so kind to x86 users? What makes you think there will never be pressure from the music/movie/gaming industries to make PCs "more secure" by locking down bootloaders etc?

by Rusky 9y ago

userbinator 9y ago

Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel Unfortunately that's what it will likely turn out to be in practice. It's a de-facto standard with a lot of room for things to go wrong, and they do. ...as opposed to an even more complex standard? The saying about "known unknowns" and "unknown unknowns" comes to mind... there is literally tons of documentation out there about all the "legacy" devices in a PC, but far less about the newer proprietary bits.

johncolanduoni 9y ago
> Unfortunately that's what it will likely turn out to be in practice. Even Microsoft specifically forbids hardware marked as "Windows compatible" from not allowing user installed keys on x86. I'd like some actual reasoning for "likely".
- SquareWheel 9y ago
  I know that was true for Windows 8 approved PCs, but didn't they remove that requirement for Windows 10?
  - Santosh83 9y ago
    And why exactly are Microsoft being allowed to dictate restrictions upon general purpose PCs manufactured by others? Why do other OS distributors need approval from Microsoft before their OS images can be used under Secure Boot, without the user having to install their own keys? We need to overcome these big usability hurdles, or PCs are going to become just glorified smartphones needing 'jailbreaks' before long. The writing is on the wall for those who can see it, IMO.
    - cwyers 9y ago
      Microsoft dictates what a general purpose PC manufactured by others has to do to be compatible with Windows; vendors that don't care about being able to run Windows can refuse to abide with anything Microsoft says. (Apple doesn't meet Microsoft's standards, for instance.) Linux is an operating system designed to run on computers that meet Microsoft's standards. A Linux distribution could go the Apple route and define a different set of standards a computer has to meet to run that distro, so that only computers made to run that distro could run Linux. ChromeOS is a Linux that has done this. The commodity PC platform is basically a historical accident, where IBM used commodity off-the-shelf hardware, and licensed MS-DOS but neglected to get an exclusive license. So anyone that bought the right hardware and a license to MS-DOS could provide an IBM-compatible PC. Before the ascendance of the IBM compatible platform, you had manufacturers of general purpose PCs building incompatible machines. Now we have a market dominated by compatible machines. There's no ISO standard for general-purpose PCs that makes this happen, or any other independent standard. Windows Hardware Certification is the standard for commodity PCs. EDIT: To clarify, this is only true regarding x86. Linux on MIPS/POWER/etc. is conforming to some other standard, not one set by Microsoft.
      - revmoo 9y ago
        > Linux is an operating system designed to run on computers that meet Microsoft's standards. No, it isn't.
      - digi_owl 9y ago
        This ignores the one piece that was IBM proprietary, the BIOS, that they tried to defend strongly. But back then they didn't have software patents, and Compaq was able to prove that their BIOS was a clean room re-implementation. And from that point the cat was out of the bag. Never mind that IBM after that tried to go proprietary with the PS/2, and it bombed badly.
- Santosh83 9y ago
  Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and delving into the key management interface? Yes, you can install the few 'blessed' distros like Ubuntu, Fedora or OpenSuSE, but what about distro X? Thus far, an average user need only pop a CD to install Majaro or FreeBSD or FreeDOS. Now...? Install their own keys? Sign their kernels and modules? This reminds me of all the anti-piracy measures. Sure, you can theoretically circumvent all the DRM. But is it practical for 90% of users? No. Sure, DRM is theoretically perfectly fine, as is Secure Boot. As is even ME. The theory is always fine. How it turns out in practice, not so much. We should be asking ourselves if this marked disparity is really just inadvertent.
  - Rusky 9y ago
    Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.
    - digi_owl 9y ago
      The line between the two is thin and ill focused...
    - betterunix2 9y ago
      Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
    - 9y ago
- digi_owl 9y ago
  I seem to recall they initially did not, and there was a massive outcry about it, so they relented. Sounds like one of those things that they will try to sneak back in every odd years or so, and if the masses miss it just once it's game over.
- betterunix2 9y ago
  For now Microsoft insists on that, probably because they are afraid of antitrust litigation otherwise. The problem is that Microsoft can change their policy at any time; they already have a totally different policy for ARM.
tscs37 9y ago
>Unfortunately that's what it will likely turn out to be in practice. It should be mentioned that part of the Microsoft Certification requirements for UEFI is that you can install your own keys (which I did and do recommend); """ On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". [...] It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. [...] """ So unless the vendors don't want the Microsoft Windows Certified Badge and be able to preinstall Windows, they will offer those options. >but far less [documentation] about the newer proprietary bits. http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.0 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.0 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.1 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.1 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.2 http://wiki.phoenix.com/wiki/index.php/Category:UEFI_2.2 I'm currently using the above links to write a small kernel, which compared to using BIOS is rather easy since it provides a very convenient trampoline to get basic services in the kernel setup without hassle. The legacy devices out there are usually very poorly documented too. The page for PS/2 keyboard IO on OSDev.org is several dozen pages explaining how to properly drive the keyboard controller or a floppy drive or a harddisk. And they're largely incomplete and only cover the most common cases.
- bitwize 9y ago
  It should be mentioned that as of Windows 10, Microsoft removed the requirement to allow you to install your own keys.
  - tscs37 9y ago
    No, the current requirements still include this. On ARM platforms it has been removed for ages now. The quote in my previous comment has been directly pulled from the UEFI requirements on the microsoft website.

betterunix2 9y ago

"Secure boot doesn't mean the user isn't allowed to replace the bootloader or kernel," Unless you're on ARM, right? What makes you think Microsoft will always be so kind to x86 users? What makes you think there will never be pressure from the music/movie/gaming industries to make PCs "more secure" by locking down bootloaders etc?