6 ms·

> Unfortunately that's what it will likely turn out to be in practice. Even Microsoft specifically forbids hardware marked as "Windows compatible" from not all

> Unfortunately that's what it will likely turn out to be in practice. Even Microsoft specifically forbids hardware marked as "Windows compatible" from not allowing user installed keys on x86. I'd like some actual reasoning for "likely".

SquareWheel 9y ago
I know that was true for Windows 8 approved PCs, but didn't they remove that requirement for Windows 10?
- Santosh83 9y ago
  And why exactly are Microsoft being allowed to dictate restrictions upon general purpose PCs manufactured by others? Why do other OS distributors need approval from Microsoft before their OS images can be used under Secure Boot, without the user having to install their own keys? We need to overcome these big usability hurdles, or PCs are going to become just glorified smartphones needing 'jailbreaks' before long. The writing is on the wall for those who can see it, IMO.
  - cwyers 9y ago
    Microsoft dictates what a general purpose PC manufactured by others has to do to be compatible with Windows; vendors that don't care about being able to run Windows can refuse to abide with anything Microsoft says. (Apple doesn't meet Microsoft's standards, for instance.) Linux is an operating system designed to run on computers that meet Microsoft's standards. A Linux distribution could go the Apple route and define a different set of standards a computer has to meet to run that distro, so that only computers made to run that distro could run Linux. ChromeOS is a Linux that has done this. The commodity PC platform is basically a historical accident, where IBM used commodity off-the-shelf hardware, and licensed MS-DOS but neglected to get an exclusive license. So anyone that bought the right hardware and a license to MS-DOS could provide an IBM-compatible PC. Before the ascendance of the IBM compatible platform, you had manufacturers of general purpose PCs building incompatible machines. Now we have a market dominated by compatible machines. There's no ISO standard for general-purpose PCs that makes this happen, or any other independent standard. Windows Hardware Certification is the standard for commodity PCs. EDIT: To clarify, this is only true regarding x86. Linux on MIPS/POWER/etc. is conforming to some other standard, not one set by Microsoft.
    - revmoo 9y ago
      > Linux is an operating system designed to run on computers that meet Microsoft's standards. No, it isn't.
    - digi_owl 9y ago
      This ignores the one piece that was IBM proprietary, the BIOS, that they tried to defend strongly. But back then they didn't have software patents, and Compaq was able to prove that their BIOS was a clean room re-implementation. And from that point the cat was out of the bag. Never mind that IBM after that tried to go proprietary with the PS/2, and it bombed badly.
Santosh83 9y ago
Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and delving into the key management interface? Yes, you can install the few 'blessed' distros like Ubuntu, Fedora or OpenSuSE, but what about distro X? Thus far, an average user need only pop a CD to install Majaro or FreeBSD or FreeDOS. Now...? Install their own keys? Sign their kernels and modules? This reminds me of all the anti-piracy measures. Sure, you can theoretically circumvent all the DRM. But is it practical for 90% of users? No. Sure, DRM is theoretically perfectly fine, as is Secure Boot. As is even ME. The theory is always fine. How it turns out in practice, not so much. We should be asking ourselves if this marked disparity is really just inadvertent.
- Rusky 9y ago
  Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.
  - digi_owl 9y ago
    The line between the two is thin and ill focused...
  - betterunix2 9y ago
    Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
  - 9y ago
digi_owl 9y ago
I seem to recall they initially did not, and there was a massive outcry about it, so they relented. Sounds like one of those things that they will try to sneak back in every odd years or so, and if the masses miss it just once it's game over.
betterunix2 9y ago
For now Microsoft insists on that, probably because they are afraid of antitrust litigation otherwise. The problem is that Microsoft can change their policy at any time; they already have a totally different policy for ARM.

SquareWheel 9y ago

I know that was true for Windows 8 approved PCs, but didn't they remove that requirement for Windows 10?

Santosh83 9y ago
And why exactly are Microsoft being allowed to dictate restrictions upon general purpose PCs manufactured by others? Why do other OS distributors need approval from Microsoft before their OS images can be used under Secure Boot, without the user having to install their own keys? We need to overcome these big usability hurdles, or PCs are going to become just glorified smartphones needing 'jailbreaks' before long. The writing is on the wall for those who can see it, IMO.
- cwyers 9y ago
  Microsoft dictates what a general purpose PC manufactured by others has to do to be compatible with Windows; vendors that don't care about being able to run Windows can refuse to abide with anything Microsoft says. (Apple doesn't meet Microsoft's standards, for instance.) Linux is an operating system designed to run on computers that meet Microsoft's standards. A Linux distribution could go the Apple route and define a different set of standards a computer has to meet to run that distro, so that only computers made to run that distro could run Linux. ChromeOS is a Linux that has done this. The commodity PC platform is basically a historical accident, where IBM used commodity off-the-shelf hardware, and licensed MS-DOS but neglected to get an exclusive license. So anyone that bought the right hardware and a license to MS-DOS could provide an IBM-compatible PC. Before the ascendance of the IBM compatible platform, you had manufacturers of general purpose PCs building incompatible machines. Now we have a market dominated by compatible machines. There's no ISO standard for general-purpose PCs that makes this happen, or any other independent standard. Windows Hardware Certification is the standard for commodity PCs. EDIT: To clarify, this is only true regarding x86. Linux on MIPS/POWER/etc. is conforming to some other standard, not one set by Microsoft.
  - revmoo 9y ago
    > Linux is an operating system designed to run on computers that meet Microsoft's standards. No, it isn't.
  - digi_owl 9y ago
    This ignores the one piece that was IBM proprietary, the BIOS, that they tried to defend strongly. But back then they didn't have software patents, and Compaq was able to prove that their BIOS was a clean room re-implementation. And from that point the cat was out of the bag. Never mind that IBM after that tried to go proprietary with the PS/2, and it bombed badly.

Santosh83 9y ago

Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and delving into the key management interface? Yes, you can install the few 'blessed' distros like Ubuntu, Fedora or OpenSuSE, but what about distro X? Thus far, an average user need only pop a CD to install Majaro or FreeBSD or FreeDOS. Now...? Install their own keys? Sign their kernels and modules? This reminds me of all the anti-piracy measures. Sure, you can theoretically circumvent all the DRM. But is it practical for 90% of users? No. Sure, DRM is theoretically perfectly fine, as is Secure Boot. As is even ME. The theory is always fine. How it turns out in practice, not so much. We should be asking ourselves if this marked disparity is really just inadvertent.

Rusky 9y ago
Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.
- digi_owl 9y ago
  The line between the two is thin and ill focused...
- betterunix2 9y ago
  Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
- 9y ago

digi_owl 9y ago

I seem to recall they initially did not, and there was a massive outcry about it, so they relented. Sounds like one of those things that they will try to sneak back in every odd years or so, and if the masses miss it just once it's game over.

betterunix2 9y ago

For now Microsoft insists on that, probably because they are afraid of antitrust litigation otherwise. The problem is that Microsoft can change their policy at any time; they already have a totally different policy for ARM.