4 ms·
I am hopeful that Microsoft would not do such a thing. They seem to be doing rather well at the whole "we're not an evil megacorp, trust us please" thing with
by mises 7y ago
I am hopeful that Microsoft would not do such a thing. They seem to be doing rather well at the whole "we're not an evil megacorp, trust us please" thing with there recent contributions to open source etc. I hope they wouldn't want to throw that away.
- tyingq 7y agoThey did do it on the ARM windows RT laptops, though that line of products is now defunct.
- geofft 7y agoThe more frustrating thing about those machines is that there are two Secure Boot root keys in the MS program, one for Microsoft products (e.g., Windows) and one for everyone else, including both third-party hardware drivers and third-party OSes like Linux distros. But on the ARM Surface devices, Microsoft built them so all of the UEFI binaries were signed by the MS-themselves key, so even if you got an MS-signed key like this article is talking about, it wouldn't let you boot a non-Windows kernel.
- p_l 7y agoFor certain security profiles in Windows 10 and related Windows Server versions, it's required that Secure Boot uses customer keys and MS keys are purged (you have to sign your installs with your own keys). Due to that, any "enterprise level" hardware has to have a way to switch Secure Boot into "SETUP" mode, which cleans all keys and let's you put in your own master keys.