4 ms·

"They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed)." This one in particular always pissed me off, and I'm glad it only app

"They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed)." This one in particular always pissed me off, and I'm glad it only applies to pre-built machines that come with Windows 10 preinstalled. If the individual motherboard makers ever decide they need to be "certified for Windows 10" and start auto-trusting a certificate for closed-source commercial software, I'm left with no choice but to either stick with my "old" (not really that old) hardware or switch to another platform like POWER9.

easton 6y ago
You can revoke the keys as a user, it’s just that the system has to trust the Microsoft CA out of the box. If you have purchased a device with Secure Boot capability (including a motherboard), it trusts Microsoft’s CA (since it would be extremely confusing for 99% of users if Windows wouldn’t boot without trusting a key). My Ryzen board trusted Microsoft out of the box, it has to if they want to pass Windows logo certification. You can check yours here: https://partner.microsoft.com/en-us/dashboard/hardware/search/cpl https://partner.microsoft.com/en-us/dashboard/hardware/searc...
- morganvachon 6y ago
  "...it’s just that the system has to trust the Microsoft CA out of the box" That's the entirety of my complaint. Thanks for the link! My board is not on it as I assumed.
  - reanimus 6y ago
    You can remove Microsoft's certs from the trust store used by the board, though. You can choose to keep them to facilitate dual boot with Secure Boot on, but you can also choose to eject them from the trust store. Sure, they're loaded by default, and you can argue that we can't prove the board isn't gonna trust them behind your back -- but that applies to older non-open hardware too. My bigger annoyance is Intel Boot Guard. I want Intel to let us control the firmware more directly -- even if it requires some physical authorization/kills some DRM component in ME or something. But that's not happening anytime soon...
p_l 6y ago
Full compliance with Windows 10 Enterprise certification requires ability to enter Setup Mode, where all certificates are deleted and owner has to reload the whole certificate database from scratch. The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly.
- morganvachon 6y ago
  "The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly." You can do this on any x86/x86_64 hardware made in the past 15 years. Whether your machine has a traditional BIOS, UEFI with SecureBoot off, or UEFI with SecureBoot on, Windows 10 will install with zero complaints. You only get to be "certified by Microsoft" if you follow all of their rules, but you don't have to be certified to install Windows 10 (yet).
  - p_l 6y ago
    "Windows Certified" is part of what drove that. It also covers "will work as advertised", i.e. certain features will operate properly. And secured boot path is, indeed, one of such features.

easton 6y ago

You can revoke the keys as a user, it’s just that the system has to trust the Microsoft CA out of the box. If you have purchased a device with Secure Boot capability (including a motherboard), it trusts Microsoft’s CA (since it would be extremely confusing for 99% of users if Windows wouldn’t boot without trusting a key). My Ryzen board trusted Microsoft out of the box, it has to if they want to pass Windows logo certification. You can check yours here: https://partner.microsoft.com/en-us/dashboard/hardware/search/cpl https://partner.microsoft.com/en-us/dashboard/hardware/searc...

morganvachon 6y ago
"...it’s just that the system has to trust the Microsoft CA out of the box" That's the entirety of my complaint. Thanks for the link! My board is not on it as I assumed.
- reanimus 6y ago
  You can remove Microsoft's certs from the trust store used by the board, though. You can choose to keep them to facilitate dual boot with Secure Boot on, but you can also choose to eject them from the trust store. Sure, they're loaded by default, and you can argue that we can't prove the board isn't gonna trust them behind your back -- but that applies to older non-open hardware too. My bigger annoyance is Intel Boot Guard. I want Intel to let us control the firmware more directly -- even if it requires some physical authorization/kills some DRM component in ME or something. But that's not happening anytime soon...

p_l 6y ago

Full compliance with Windows 10 Enterprise certification requires ability to enter Setup Mode, where all certificates are deleted and owner has to reload the whole certificate database from scratch. The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly.

morganvachon 6y ago
"The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly." You can do this on any x86/x86_64 hardware made in the past 15 years. Whether your machine has a traditional BIOS, UEFI with SecureBoot off, or UEFI with SecureBoot on, Windows 10 will install with zero complaints. You only get to be "certified by Microsoft" if you follow all of their rules, but you don't have to be certified to install Windows 10 (yet).
- p_l 6y ago
  "Windows Certified" is part of what drove that. It also covers "will work as advertised", i.e. certain features will operate properly. And secured boot path is, indeed, one of such features.