6 ms·

From Microsoft's Secure Boot OEM policy[0]: > The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode.

From Microsoft's Secure Boot OEM policy[0]: > The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults. On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled. [0]: https://docs.microsoft.com/en-us/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot https://docs.microsoft.com/en-us/windows-hardware/design/com...

kevin_b_er 9y ago
Translation: The ARM "computers" will only run software Microsoft blesses. Can we call it a computer anymore? It is more like a tablet when Microsoft demands digital restrictions management on the software that runs on the device.
- candiodari 9y ago
  Sadly, I bet companies like Microsoft, Apple and Google see it more along the lines of "the free ride general purpose computing has gotten sharing hardware with our ecosystems should end".
- userbinator 9y ago
  Further to that, you can't patch out the telemetry and other privacy-violating "features", without somehow finding an exploit. In fact, from that perspective this is no different than the typical locked-down iPhone or Android. What's worse than a computer with preinstalled spyware? A computer with preinstalled spyware you can't remove. When the Lenovo/Superfish thing happened, I commented at the time that it was at least something you could remove by reformatting and installing your choice of OS. Ideally we'd all buy computers with our own choice of software already, but if forced to choose, I'd rather buy one with preinstalled spyware I know I can remove, than one which claims to not have such software and be "more secure".
  - y_u_no_rust 9y ago
    It's like a bad ass variant of WinRT (or what it should have been)
  - rootw0rm 9y ago
    booting a hacked kernel is fairly trivial.
- narrator 9y ago
  I think they did this because the anti-trust ruling from the early 2000s does not apply to ARM-based computers, only Intel-based machines. I guess the software lockdown proves that Microsoft hasn't changed and the late 90s Microsoft is still with us.
  - newhouseb 9y ago
    Not that I don't believe you, but is there a source for this (the anti-trust ruling being specific to Intel hardware)? I'd love to read more about the specifics.
    - narrator 9y ago
      If you read the Wikipedia page and the linked ruling, you'll see that the language is very specific to "Operating Systems on Intel Compatible PCs". https://en.m.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.m.wikipedia.org/wiki/United_States_v._Microsoft_C....
      - benaadams 9y ago
        And it expired 8 - 10 years ago > Microsoft's obligations under the settlement, as originally drafted, expired on November 12, 2007. However, Microsoft later "agreed to consent to a two-year extension of part of the Final Judgments" dealing with communications protocol licensing.
- berbec 9y ago
  Forgive my ignorance on this topic, but couldn't one use the windows boot manager to load a Linux distro? Or does Grub still need to signed once it receivables the hand-off?
  - Nullabillity 9y ago
    The whole chain needs to be signed, otherwise the exercise would be pretty pointless.
- kogepathic 9y ago
  > Translation: The ARM "computers" will only run software Microsoft blesses. Can we call it a computer anymore? Why don't people take Apple to task for doing the same thing? You can't take an iPad and install Linux on it, or Windows for ARM. You're locked into running iOS. Apple doesn't even allow downgrading iOS. Same with Android devices that come with a locked bootloader. You can't install anything other OS version/flavour than what the manufacturer dictates. Yes, it's unfortunate that Microsoft has this policy, but why is it that people only complain loudly about locked bootloaders when it comes to Microsoft products? Apply the same standard to Apple and Android products with locked bootloaders. Microsoft isn't the first one to do this, and they won't ship nearly as many devices as other manufacturers who lock down the boot process.
  - alanfranzoni 9y ago
    The op is complaining about calling 'computer' rather than 'tablet' this ms product. The ipad and iphones and android phones are tablet and phones, not computers.
    - nobodyshere 9y ago
      They are all technically still 'computers'. Their form factor doesn't change that.
      - alanfranzoni 9y ago
        This has little to do with the 'technical' meaning of the term. The big _practical_'distinction' nowadays between a 'proper computer' and a 'tablet/phone/etc' is between being open for modification, creation and alteration by the user, or to be a walled garden where only the manufacturer chooses what can be done and installed. The Ipad Pro may be powerful as a computer, but we think about it as a tablet because it uses IOS and its walled garden. The OP is complaining that MS is trying to push its new product into the computer space even tough it's locked down via Windows 10S. It's not true that nobody 'takes on Apple about this' - it's simply that Apple does NOT do that on its COMPUTERS (i.e. the Mac line).
  - 9y ago
- DaiPlusPlus 9y ago
  But this is the main reason why Surface RT bombed in 2012: Microsoft sold it as a "Windows" tablet - the connotation being that users could run Steam and Chrome on it, not specially-compiled apps running in the anemic Windows Store App sandbox. I appreciate things are different now in 2017 with x86 emulation (or dynamic translation) and the ability for most Win32 programs to be repackaged as *.appx - but Microsoft misses the implication to consumers again: users expect the freedom to install and download software from wherever - just like their x86 desktop machines. No-one is asking for an iOS style App Store for Windows and it's starkly visible by how poorly the Windows App Store is still doing. Cynically, I suspect everyone at MSFT is well-aware of this and they fully expect Windows 10-for-ARM to sink for these exact reasons, they're just doing this as a repeat of their protest moves to remind Intel not to take their x86 monopoly for granted, and the addition of x86 support is a particularly bloody (but ultimately harmless) fist to the nose. I'll point out that there is a very obvious use-case for Windows-on-ARM: low-power rackmountable/high-density server hardware for applications like web-servers and IO (not CPU)-bound database servers. No need for a 300W Intel Xeon box, or even a 150W Intel Core i7 - a 20W ARM chip will do. If Microsoft announced a no-shit, just-like-x86 SKU of Windows Server with no artificial restrictions with the same 10 year support period then I guarantee that Dell and SuperMicro would jump at building and shipping ARM servers - but this hasn't happened, instead we got a ridiculously impractical "Windows IOT" SKU which feels more like a toy than the basis for business critical infrastructure. Server applications are much easier to port to ARM than desktop applications, given their lack of dependence on hardware associated with x86, like 3D graphics acceleration - or just users' expectation that a single executable binary should work everywhere. Servers are operated by businesses with professional sysadmins who know how to rebuild open-source applications for their machines or at least know the difference between downloading a program lablled "Thumb-2" vs "x64". Furthermore probably most server applications run on Java or .NET and can be trivially ported over to ARM. The fact we haven't seen a true Windows Server ARM means that we can immediately dismiss consumer-level releases of desktop Windows for ARM for now.
  - earenndil 9y ago
    > I'll point out that there is a very obvious use-case for Windows-on-ARM: low-power rackmountable/high-density server hardware for applications like web-servers and IO (not CPU)-bound database servers ...but why is this better than linux-on-arm? Windows server hasn't been generally very successful.
- whywhywhywhy 9y ago
  So just like the most popular ARM computer on the planet then… This is the norm for ARM, as much as we don’t like it and it will be the same when Apple eventually ships an arm laptop.
appleflaxen 9y ago
what does this mean? it will prevent users from installing an unapproved OS?
- Nullabillity 9y ago
  Yes. Custom Mode is the override that normally allows you to disable their whitelist.
- nolok 9y ago
  Devil's advocate here (but not really): it means it prevents your pc from booting on unsecured code, that it doesn't recognize. It's how you can fight stuff like the kernel root exploit that were starting to plague the windows world. The issue here is that Windows at first was asking not to provide a way to disable it back on x86, we got a compromise (we can disable it, and big distros could get signed). Now Microsoft is trying the same over ARM, so the fight starts again. Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again.
  - geofft 9y ago
    Yes. From a computing freedom point of view, the only way I have freedom over my computing is if I control the code that's running on it. If I'm running code that I don't have source for, I don't quite control it as much as I'd like to. But if someone else is running code that I don't have source for, I sure as heck don't control it! Running a closed-source bootloader on a platform with firmware enforcement of signed bootloaders is not good. But the problem is not the signature requirement, the problem is the closed-source bootloader. The signature requirement is only a problem in the case where (as on Windows-logo machines running ARM) it requires you to run a closed-source bootloader, or even an open-source one that you do not have the ability to make changes to. If you want to ensure your computing freedom, the best thing to do is to have your firmware ensure that you and you alone, or someone you trust and them alone (e.g. a vendor of a free OS that you think is reputable), can boot code on your computer.
    - 9y ago
leggomylibro 9y ago
So does that mean no dual-booting? If so, sorry MS - this is a great step, but no sale yet.
- Nullabillity 9y ago
  It's more insidious than that. The big distros have been signed and will probably work, but recompiling your kernel, using less common distros, or using third-party modules won't.
  - geofft 9y ago
    If they're signing Ubuntu's ARM shim loader the same way they're signing Ubuntu's x86-64 shim loader, you can use it to boot an arbitrary kernel in non-EFI mode. I am using this on my personal laptop to to boot Debian stable with Debian's kernel - grab shimx64.efi + grubx64.efi from Ubuntu, put them in the ESP, and write a little grub.cfg that sets $root and $prefix to the Debian partition and runs `normal`. Since you're exiting UEFI boot services before running unsigned code, Microsoft (apparently?) does not care. Also, if they're signing any Linux distro's shim loader, shim allows a physically present user to enroll their own key or disable secure boot. See method 3 at https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS . (I don't actually know if they are signing any Linux shim for ARM - https://wiki.ubuntu.com/UEFI/SecureBoot/Testing#UEFI.2FSecureBoot.Supported_architectures https://wiki.ubuntu.com/UEFI/SecureBoot/Testing#UEFI.2FSecur... implies no. Which means you can't use any version of Linux on it, unless they change their policy.)
    - Nullabillity 9y ago
      AFAIK that's just another way to switch to Custom Mode.
      - geofft 9y ago
        Which? The first one (the one I'm running on my laptop) doesn't involve custom mode at all - I'm using an MS-signed bootloader to exit boot services and do some stuff, with no changes to SecureBoot or PK or any other variables. I have an actual Secure Boot-enabled platform with only Microsoft keys enrolled. The rest involve changing EFI variables, yes, but my impression is that "Custom Mode" refers to a UI in the BIOS which permits you to change the variables, and those variables are always writable by code running in boot services. The requirements say, "On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: 'Custom' and 'Standard'." Nothing I'm suggesting involves going to firmware setup.
nandhp 9y ago
> Applies to: > Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) x64 > Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) x86 > Windows 10 Mobile ARM > Windows 10 Mobile x86 > Windows Server 2016 x64 It's not clear to me that this document has been updated to reflect this release. Windows 10 Mobile is the successor to Windows Phone 8.1, while the article suggests that this product might better described as "Windows 10 for desktop editions ARM". From The Verge: "HP and Asus' devices will include Windows 10 S, designed to only run apps from the Windows Store, but users will be able to upgrade to Windows 10 Pro free of charge (for now) to get access to the full desktop apps." https://www.theverge.com/2017/12/5/16737288/microsoft-windows-10-qualcomm-arm-laptops-launch https://www.theverge.com/2017/12/5/16737288/microsoft-window...
jchw 9y ago
I'm pretty sure this is from the Windows RT days and doesn't cover the new-ish developments. Whether it holds true or not remains to be seen.
wolfgke 9y ago
> On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled. Looks like we need another golden key: > https://web.archive.org/web/20170306015239/https://rol.im/securegoldenkeyboot/ https://web.archive.org/web/20170306015239/https://rol.im/se...
- djsumdog 9y ago
  old crack-program music. I love it.
  - unixhero 9y ago
    Old? Well it certainly still exists; http://scene.org http://scene.org
andreiw 9y ago
I know people have an axe to grind both with the old lame duck WinRT and the insulting locked down firmware on those devices, but let’s wait for the reviews and tear-downs before tearing into the news?

kevin_b_er 9y ago

Translation: The ARM "computers" will only run software Microsoft blesses. Can we call it a computer anymore? It is more like a tablet when Microsoft demands digital restrictions management on the software that runs on the device.

candiodari 9y ago
Sadly, I bet companies like Microsoft, Apple and Google see it more along the lines of "the free ride general purpose computing has gotten sharing hardware with our ecosystems should end".
userbinator 9y ago
Further to that, you can't patch out the telemetry and other privacy-violating "features", without somehow finding an exploit. In fact, from that perspective this is no different than the typical locked-down iPhone or Android. What's worse than a computer with preinstalled spyware? A computer with preinstalled spyware you can't remove. When the Lenovo/Superfish thing happened, I commented at the time that it was at least something you could remove by reformatting and installing your choice of OS. Ideally we'd all buy computers with our own choice of software already, but if forced to choose, I'd rather buy one with preinstalled spyware I know I can remove, than one which claims to not have such software and be "more secure".
- y_u_no_rust 9y ago
  It's like a bad ass variant of WinRT (or what it should have been)
- rootw0rm 9y ago
  booting a hacked kernel is fairly trivial.
narrator 9y ago
I think they did this because the anti-trust ruling from the early 2000s does not apply to ARM-based computers, only Intel-based machines. I guess the software lockdown proves that Microsoft hasn't changed and the late 90s Microsoft is still with us.
- newhouseb 9y ago
  Not that I don't believe you, but is there a source for this (the anti-trust ruling being specific to Intel hardware)? I'd love to read more about the specifics.
  - narrator 9y ago
    If you read the Wikipedia page and the linked ruling, you'll see that the language is very specific to "Operating Systems on Intel Compatible PCs". https://en.m.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.m.wikipedia.org/wiki/United_States_v._Microsoft_C....
    - benaadams 9y ago
      And it expired 8 - 10 years ago > Microsoft's obligations under the settlement, as originally drafted, expired on November 12, 2007. However, Microsoft later "agreed to consent to a two-year extension of part of the Final Judgments" dealing with communications protocol licensing.
berbec 9y ago
Forgive my ignorance on this topic, but couldn't one use the windows boot manager to load a Linux distro? Or does Grub still need to signed once it receivables the hand-off?
- Nullabillity 9y ago
  The whole chain needs to be signed, otherwise the exercise would be pretty pointless.
kogepathic 9y ago
> Translation: The ARM "computers" will only run software Microsoft blesses. Can we call it a computer anymore? Why don't people take Apple to task for doing the same thing? You can't take an iPad and install Linux on it, or Windows for ARM. You're locked into running iOS. Apple doesn't even allow downgrading iOS. Same with Android devices that come with a locked bootloader. You can't install anything other OS version/flavour than what the manufacturer dictates. Yes, it's unfortunate that Microsoft has this policy, but why is it that people only complain loudly about locked bootloaders when it comes to Microsoft products? Apply the same standard to Apple and Android products with locked bootloaders. Microsoft isn't the first one to do this, and they won't ship nearly as many devices as other manufacturers who lock down the boot process.
- alanfranzoni 9y ago
  The op is complaining about calling 'computer' rather than 'tablet' this ms product. The ipad and iphones and android phones are tablet and phones, not computers.
  - nobodyshere 9y ago
    They are all technically still 'computers'. Their form factor doesn't change that.
    - alanfranzoni 9y ago
      This has little to do with the 'technical' meaning of the term. The big _practical_'distinction' nowadays between a 'proper computer' and a 'tablet/phone/etc' is between being open for modification, creation and alteration by the user, or to be a walled garden where only the manufacturer chooses what can be done and installed. The Ipad Pro may be powerful as a computer, but we think about it as a tablet because it uses IOS and its walled garden. The OP is complaining that MS is trying to push its new product into the computer space even tough it's locked down via Windows 10S. It's not true that nobody 'takes on Apple about this' - it's simply that Apple does NOT do that on its COMPUTERS (i.e. the Mac line).
- 9y ago
DaiPlusPlus 9y ago
But this is the main reason why Surface RT bombed in 2012: Microsoft sold it as a "Windows" tablet - the connotation being that users could run Steam and Chrome on it, not specially-compiled apps running in the anemic Windows Store App sandbox. I appreciate things are different now in 2017 with x86 emulation (or dynamic translation) and the ability for most Win32 programs to be repackaged as *.appx - but Microsoft misses the implication to consumers again: users expect the freedom to install and download software from wherever - just like their x86 desktop machines. No-one is asking for an iOS style App Store for Windows and it's starkly visible by how poorly the Windows App Store is still doing. Cynically, I suspect everyone at MSFT is well-aware of this and they fully expect Windows 10-for-ARM to sink for these exact reasons, they're just doing this as a repeat of their protest moves to remind Intel not to take their x86 monopoly for granted, and the addition of x86 support is a particularly bloody (but ultimately harmless) fist to the nose. I'll point out that there is a very obvious use-case for Windows-on-ARM: low-power rackmountable/high-density server hardware for applications like web-servers and IO (not CPU)-bound database servers. No need for a 300W Intel Xeon box, or even a 150W Intel Core i7 - a 20W ARM chip will do. If Microsoft announced a no-shit, just-like-x86 SKU of Windows Server with no artificial restrictions with the same 10 year support period then I guarantee that Dell and SuperMicro would jump at building and shipping ARM servers - but this hasn't happened, instead we got a ridiculously impractical "Windows IOT" SKU which feels more like a toy than the basis for business critical infrastructure. Server applications are much easier to port to ARM than desktop applications, given their lack of dependence on hardware associated with x86, like 3D graphics acceleration - or just users' expectation that a single executable binary should work everywhere. Servers are operated by businesses with professional sysadmins who know how to rebuild open-source applications for their machines or at least know the difference between downloading a program lablled "Thumb-2" vs "x64". Furthermore probably most server applications run on Java or .NET and can be trivially ported over to ARM. The fact we haven't seen a true Windows Server ARM means that we can immediately dismiss consumer-level releases of desktop Windows for ARM for now.
- earenndil 9y ago
  > I'll point out that there is a very obvious use-case for Windows-on-ARM: low-power rackmountable/high-density server hardware for applications like web-servers and IO (not CPU)-bound database servers ...but why is this better than linux-on-arm? Windows server hasn't been generally very successful.
whywhywhywhy 9y ago
So just like the most popular ARM computer on the planet then… This is the norm for ARM, as much as we don’t like it and it will be the same when Apple eventually ships an arm laptop.

appleflaxen 9y ago

what does this mean? it will prevent users from installing an unapproved OS?

Nullabillity 9y ago
Yes. Custom Mode is the override that normally allows you to disable their whitelist.
nolok 9y ago
Devil's advocate here (but not really): it means it prevents your pc from booting on unsecured code, that it doesn't recognize. It's how you can fight stuff like the kernel root exploit that were starting to plague the windows world. The issue here is that Windows at first was asking not to provide a way to disable it back on x86, we got a compromise (we can disable it, and big distros could get signed). Now Microsoft is trying the same over ARM, so the fight starts again. Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again.
- geofft 9y ago
  Yes. From a computing freedom point of view, the only way I have freedom over my computing is if I control the code that's running on it. If I'm running code that I don't have source for, I don't quite control it as much as I'd like to. But if someone else is running code that I don't have source for, I sure as heck don't control it! Running a closed-source bootloader on a platform with firmware enforcement of signed bootloaders is not good. But the problem is not the signature requirement, the problem is the closed-source bootloader. The signature requirement is only a problem in the case where (as on Windows-logo machines running ARM) it requires you to run a closed-source bootloader, or even an open-source one that you do not have the ability to make changes to. If you want to ensure your computing freedom, the best thing to do is to have your firmware ensure that you and you alone, or someone you trust and them alone (e.g. a vendor of a free OS that you think is reputable), can boot code on your computer.
  - 9y ago

leggomylibro 9y ago

So does that mean no dual-booting? If so, sorry MS - this is a great step, but no sale yet.

Nullabillity 9y ago
It's more insidious than that. The big distros have been signed and will probably work, but recompiling your kernel, using less common distros, or using third-party modules won't.
- geofft 9y ago
  If they're signing Ubuntu's ARM shim loader the same way they're signing Ubuntu's x86-64 shim loader, you can use it to boot an arbitrary kernel in non-EFI mode. I am using this on my personal laptop to to boot Debian stable with Debian's kernel - grab shimx64.efi + grubx64.efi from Ubuntu, put them in the ESP, and write a little grub.cfg that sets $root and $prefix to the Debian partition and runs `normal`. Since you're exiting UEFI boot services before running unsigned code, Microsoft (apparently?) does not care. Also, if they're signing any Linux distro's shim loader, shim allows a physically present user to enroll their own key or disable secure boot. See method 3 at https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS . (I don't actually know if they are signing any Linux shim for ARM - https://wiki.ubuntu.com/UEFI/SecureBoot/Testing#UEFI.2FSecureBoot.Supported_architectures https://wiki.ubuntu.com/UEFI/SecureBoot/Testing#UEFI.2FSecur... implies no. Which means you can't use any version of Linux on it, unless they change their policy.)
  - Nullabillity 9y ago
    AFAIK that's just another way to switch to Custom Mode.
    - geofft 9y ago
      Which? The first one (the one I'm running on my laptop) doesn't involve custom mode at all - I'm using an MS-signed bootloader to exit boot services and do some stuff, with no changes to SecureBoot or PK or any other variables. I have an actual Secure Boot-enabled platform with only Microsoft keys enrolled. The rest involve changing EFI variables, yes, but my impression is that "Custom Mode" refers to a UI in the BIOS which permits you to change the variables, and those variables are always writable by code running in boot services. The requirements say, "On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: 'Custom' and 'Standard'." Nothing I'm suggesting involves going to firmware setup.

nandhp 9y ago

> Applies to: > Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) x64 > Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) x86 > Windows 10 Mobile ARM > Windows 10 Mobile x86 > Windows Server 2016 x64 It's not clear to me that this document has been updated to reflect this release. Windows 10 Mobile is the successor to Windows Phone 8.1, while the article suggests that this product might better described as "Windows 10 for desktop editions ARM". From The Verge: "HP and Asus' devices will include Windows 10 S, designed to only run apps from the Windows Store, but users will be able to upgrade to Windows 10 Pro free of charge (for now) to get access to the full desktop apps." https://www.theverge.com/2017/12/5/16737288/microsoft-windows-10-qualcomm-arm-laptops-launch https://www.theverge.com/2017/12/5/16737288/microsoft-window...

jchw 9y ago

I'm pretty sure this is from the Windows RT days and doesn't cover the new-ish developments. Whether it holds true or not remains to be seen.

wolfgke 9y ago

> On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled. Looks like we need another golden key: > https://web.archive.org/web/20170306015239/https://rol.im/securegoldenkeyboot/ https://web.archive.org/web/20170306015239/https://rol.im/se...

djsumdog 9y ago
old crack-program music. I love it.
- unixhero 9y ago
  Old? Well it certainly still exists; http://scene.org http://scene.org

andreiw 9y ago

I know people have an axe to grind both with the old lame duck WinRT and the insulting locked down firmware on those devices, but let’s wait for the reviews and tear-downs before tearing into the news?