5 ms·

what does this mean? it will prevent users from installing an unapproved OS?

Nullabillity 9y ago
Yes. Custom Mode is the override that normally allows you to disable their whitelist.
nolok 9y ago
Devil's advocate here (but not really): it means it prevents your pc from booting on unsecured code, that it doesn't recognize. It's how you can fight stuff like the kernel root exploit that were starting to plague the windows world. The issue here is that Windows at first was asking not to provide a way to disable it back on x86, we got a compromise (we can disable it, and big distros could get signed). Now Microsoft is trying the same over ARM, so the fight starts again. Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again.
- geofft 9y ago
  Yes. From a computing freedom point of view, the only way I have freedom over my computing is if I control the code that's running on it. If I'm running code that I don't have source for, I don't quite control it as much as I'd like to. But if someone else is running code that I don't have source for, I sure as heck don't control it! Running a closed-source bootloader on a platform with firmware enforcement of signed bootloaders is not good. But the problem is not the signature requirement, the problem is the closed-source bootloader. The signature requirement is only a problem in the case where (as on Windows-logo machines running ARM) it requires you to run a closed-source bootloader, or even an open-source one that you do not have the ability to make changes to. If you want to ensure your computing freedom, the best thing to do is to have your firmware ensure that you and you alone, or someone you trust and them alone (e.g. a vendor of a free OS that you think is reputable), can boot code on your computer.
  - nolok 9y ago
    Oh I absolutely agree with you. But in the windows kernel rooting exploit were really everywhere before that started being deployed. We can blame "everyone runs root all the time" and "disabling uac is a common tip on all windows site because users are used to be super administrator", and they all come back to Windows security model and default being complete shit until Windows 8 ((7 was still super admin as default user right?)), but I certainly won't blame Microsoft for finally cleaning that mess. Go back less than a decade back and most windows system of everyday users would have some kind of crap running as super root, that was terrible.
    - candiodari 9y ago
      I don't get why people focus so much on windows for this these days. I mean, if you can get more freedom there, great, but it's not like it's lacking at all there. Apple and Google, and perhaps the telcos those are the companies that need convincing.
      - nolok 9y ago
        I think you're missing the point. It's not about you, personally. It's about the general users. It's what, 90% of all desktop? And the vast majority of those are an easy target for such things. It's not really surprising that it gets some consideration.
        candiodari 9y ago
        But there are already more mobile computers than non-mobile. Anybody who thinks desktop still matters for the general population is kidding themselves. Especially Apple seems to like the very (VERY) heavy handed walled garden approach. FB is a bit nicer than them, and Google seems most flexible, using "soft" means (e.g. kicking adblockers and emulators out of the app store, or simply not promoting them).
- pjmlp 9y ago
  OEMs are pretty ok with it for Android, so I don't see why they will do otherwise with Windows.
  - nolok 9y ago
    Because they're not only trying to make a strong entry into the desktop computer, they're also about to finally go and fight Intel in servers (because Intel refused to make atom not suck)
  - izacus 9y ago
    Many devices allow bootloader unlocks on Android.
    - pjmlp 9y ago
      Being unknown chinese models, most likely. From the brands people buy from in Europe, only Sony allows it officially, by providing tools on their dev site.
      - greenhouse_gas 9y ago
        And Motorola.
      - vetinari 9y ago
        In Europe, the Samsung models are based on Exynos, which are unlockable via Developer Options menu. Then you can basically flash whatever you want, and if it isn't signed by Samsung, it will blow the Knox fuse, and that's it. Huawei, Xiaomi and HTC allow for unlocking via their webpages. So I would say, that the biggest vendors are covered.
  - djsumdog 9y ago
    Android is shit through and they don't have UEFI. MS mandates UEFI, which means being able to boot a standard Linux image instead of having all these different images scattered all over the place with totally non-standard garbage in them. Having UEFI/ARM devices would be a huge game changer in the Linux world right now.
- awalton 9y ago
  > Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again. Yeah. Unfortunately Google (ChromeBooks) won the space, with virtually the same tactic, with the slight added advantage that they give you a hardware "break your warranty to unweld this hood" switch on most of the devices. I miss the hell out of being able to be in control of the software on all my computers...
  - Dylan16807 9y ago
    Chromebook developer mode is pretty free-range and just requires pressing a key combo during boot.
    - Nullabillity 9y ago
      Which is far more than should be required of users.
      - Dylan16807 9y ago
        So do you want the anti-rootkit safety measures to not exist, or do you have something simpler in mind than pressing two keys?

Yes. Custom Mode is the override that normally allows you to disable their whitelist.

Devil's advocate here (but not really): it means it prevents your pc from booting on unsecured code, that it doesn't recognize. It's how you can fight stuff like the kernel root exploit that were starting to plague the windows world. The issue here is that Windows at first was asking not to provide a way to disable it back on x86, we got a compromise (we can disable it, and big distros could get signed). Now Microsoft is trying the same over ARM, so the fight starts again. Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again.

geofft 9y ago
Yes. From a computing freedom point of view, the only way I have freedom over my computing is if I control the code that's running on it. If I'm running code that I don't have source for, I don't quite control it as much as I'd like to. But if someone else is running code that I don't have source for, I sure as heck don't control it! Running a closed-source bootloader on a platform with firmware enforcement of signed bootloaders is not good. But the problem is not the signature requirement, the problem is the closed-source bootloader. The signature requirement is only a problem in the case where (as on Windows-logo machines running ARM) it requires you to run a closed-source bootloader, or even an open-source one that you do not have the ability to make changes to. If you want to ensure your computing freedom, the best thing to do is to have your firmware ensure that you and you alone, or someone you trust and them alone (e.g. a vendor of a free OS that you think is reputable), can boot code on your computer.
- nolok 9y ago
  Oh I absolutely agree with you. But in the windows kernel rooting exploit were really everywhere before that started being deployed. We can blame "everyone runs root all the time" and "disabling uac is a common tip on all windows site because users are used to be super administrator", and they all come back to Windows security model and default being complete shit until Windows 8 ((7 was still super admin as default user right?)), but I certainly won't blame Microsoft for finally cleaning that mess. Go back less than a decade back and most windows system of everyday users would have some kind of crap running as super root, that was terrible.
  - candiodari 9y ago
    I don't get why people focus so much on windows for this these days. I mean, if you can get more freedom there, great, but it's not like it's lacking at all there. Apple and Google, and perhaps the telcos those are the companies that need convincing.
    - nolok 9y ago
      I think you're missing the point. It's not about you, personally. It's about the general users. It's what, 90% of all desktop? And the vast majority of those are an easy target for such things. It's not really surprising that it gets some consideration.
      - candiodari 9y ago
        But there are already more mobile computers than non-mobile. Anybody who thinks desktop still matters for the general population is kidding themselves. Especially Apple seems to like the very (VERY) heavy handed walled garden approach. FB is a bit nicer than them, and Google seems most flexible, using "soft" means (e.g. kicking adblockers and emulators out of the app store, or simply not promoting them).
pjmlp 9y ago
OEMs are pretty ok with it for Android, so I don't see why they will do otherwise with Windows.
- nolok 9y ago
  Because they're not only trying to make a strong entry into the desktop computer, they're also about to finally go and fight Intel in servers (because Intel refused to make atom not suck)
- izacus 9y ago
  Many devices allow bootloader unlocks on Android.
  - pjmlp 9y ago
    Being unknown chinese models, most likely. From the brands people buy from in Europe, only Sony allows it officially, by providing tools on their dev site.
    - greenhouse_gas 9y ago
      And Motorola.
    - vetinari 9y ago
      In Europe, the Samsung models are based on Exynos, which are unlockable via Developer Options menu. Then you can basically flash whatever you want, and if it isn't signed by Samsung, it will blow the Knox fuse, and that's it. Huawei, Xiaomi and HTC allow for unlocking via their webpages. So I would say, that the biggest vendors are covered.
- djsumdog 9y ago
  Android is shit through and they don't have UEFI. MS mandates UEFI, which means being able to boot a standard Linux image instead of having all these different images scattered all over the place with totally non-standard garbage in them. Having UEFI/ARM devices would be a huge game changer in the Linux world right now.
awalton 9y ago
> Microsoft holds over ARM is mostly nothing though they're newcomers here and there are far manufacturers, so I'm sure they will end up losing their bet again. Yeah. Unfortunately Google (ChromeBooks) won the space, with virtually the same tactic, with the slight added advantage that they give you a hardware "break your warranty to unweld this hood" switch on most of the devices. I miss the hell out of being able to be in control of the software on all my computers...
- Dylan16807 9y ago
  Chromebook developer mode is pretty free-range and just requires pressing a key combo during boot.
  - Nullabillity 9y ago
    Which is far more than should be required of users.
    - Dylan16807 9y ago
      So do you want the anti-rootkit safety measures to not exist, or do you have something simpler in mind than pressing two keys?