6 ms·

The purpose of Microsoft SecureBoot was to initially provide a false sense of insecurity (FUD) about Linux, since it simply needed to be disabled to boot anythi

The purpose of Microsoft SecureBoot was to initially provide a false sense of insecurity (FUD) about Linux, since it simply needed to be disabled to boot anything other than Windows 8+, on machines built from that point forward. The threat was that users would continue to be able to install other operating systems like Linux or Windows 7 or XP, or multiboot these on brand new PC's no differently than IBM had always intended. As a universal bootloader, GRUB had always been able to boot Windows just as well as a Windows bootloader, and still could at the time but only if Microsoft SecureBoot was disabled if relying on UEFI. Windows bootloaders could always also boot Linux under BIOS, but not GPT. Just in time because Linux was getting more functional than ever, which could lead to actual popularity if left unchecked. Without further effort on Microsoft's part this has naturally morphed as intended into the significant open-source team effort needed to finally overcome the obstacle just to get back to boot parity on brand-new PC's having default firmware settings. Along the way looks like multiple revocations will be needed for things other than Windows, but eventually once everything is back on parity again these open-source leaders can dust off their hands and take pride in a job very well done. Looks like not less than about seven years getting there, this is by design. Still could be a moving target for a while, but Revocations-R-Us now. Remember how they said that GPT partitioning had no unaccounted-for sectors like MBR setups always traditionally had between sector 0 and the first sector of the first partition? (these were also one of the optional locations for GRUB to be installed) Well, they were lying and up until recently using GPT when Microsoft quietly moved their mysterious _Microsoft Reserved_ MSR partition to now be the very first possible one starting at sector 34, there had always been gobs of space, as much but usually much more than under BIOS. _Traditionaly_, the almost-nonexistent MSR had appeared (geometrically aligned) whether you wanted it or not in between the first usually hidden (boot or EFI) partition, and the first system volume (default C:) on the HDD. Now MSR exists too close to the beginning of the SSD or HDD to geometrically align with erase blocks or 4K sectors. When the concept of all-sectors-allocated is actually achieved, people have still always needed some out-of-partition sectors anyway, whether for GRUB or things like the old _drive overlays_ of BIOS use. So the MSR is there for that reason, but for Microsoft only not for you. But as always with GPT, sectors 2 through 33 by default still define all your partitions, 4 partitons to a sector. Unless you have more than 8 partitions, sectors 4 through 33 are still blank for everybody no differently than under BIOS. So much SecureBoot.

1996 6y ago
> Well, they were lying and up until recently using GPT when Microsoft quietly moved their mysterious _Microsoft Reserved_ MSR partition to now be the very first possible one starting at sector 34, there had always been gobs of space, as much but usually much more than under BIOS. I don't know how to say that politely, but you have no idea what you are talking about With GPT, you can align your partitions on erase block size- align just to 8192 and you'll get an empty 32M that you can use as a partition later. Align more and you will get more space. But you are the one in control, and nothing will "claim" this space if you don't. Also, it can be done ex post: the MSR can be moved anywhere before the Windows partition (take a binary snapshot then restore it at the new position), and the Windows partition can be resized through Windows itself in a few clicks. Even better: you can "repair" the installation with some simple commands after booting from a Windows install thumbdrive and letting the Windows Boot Manager installed on the EFI partition know about the new geometry of your system - without even updating the EFI boot entry if you kept the same partition UUID!! This is something that could be done by free software tools if someone cared enough to reverse the WBM format - so no, nobody is doing anything nefarious there. You have more freedom and security than even before.
- fuzzfactor 6y ago
  >With GPT, you can align your partitions on erase block size- align just to 8192 and you'll get an empty 32M partition. Align more and you will get more space. Exactly what I was talking about. >Also, it can be done ex post: the MSR can be moved anywhere before the Windows partition, and the Windows partition resized through Windows itself. Can we get a show of hands for how many Windows users have been doing this to their MSR?
  - 1996 6y ago
    > Exactly what I was talking about. No, you were saying that this empty space would be claimed by the MSR, and that it wouldn't work otherwise due to some hostile intent by Microsoft. So I edited to add that nothing would "claim" this space, as out-of-sequence partitions are not done by OS: the gaps will be left empty. > Can we get a show of hands for how many Windows users have been doing this to their MSR? I do, and a lot of people do - because it's technically possible. If you don't know how to, it's your problem, not Microsoft problems. The modern GPT scheme + UEFI boot as used currently by Windows is extremely permissive yet secure: TPM and MOKs allow signed EFI payloads, and you even got a dedicated EFI partition with lots of free space to put them there! Add a LUKS partition and you're just as secure as Windows Secureboot on Bitlocker. But you have to learn on how to use these new things, as it's not your grandpa MBR.

1996 6y ago

> Well, they were lying and up until recently using GPT when Microsoft quietly moved their mysterious _Microsoft Reserved_ MSR partition to now be the very first possible one starting at sector 34, there had always been gobs of space, as much but usually much more than under BIOS. I don't know how to say that politely, but you have no idea what you are talking about With GPT, you can align your partitions on erase block size- align just to 8192 and you'll get an empty 32M that you can use as a partition later. Align more and you will get more space. But you are the one in control, and nothing will "claim" this space if you don't. Also, it can be done ex post: the MSR can be moved anywhere before the Windows partition (take a binary snapshot then restore it at the new position), and the Windows partition can be resized through Windows itself in a few clicks. Even better: you can "repair" the installation with some simple commands after booting from a Windows install thumbdrive and letting the Windows Boot Manager installed on the EFI partition know about the new geometry of your system - without even updating the EFI boot entry if you kept the same partition UUID!! This is something that could be done by free software tools if someone cared enough to reverse the WBM format - so no, nobody is doing anything nefarious there. You have more freedom and security than even before.

fuzzfactor 6y ago
>With GPT, you can align your partitions on erase block size- align just to 8192 and you'll get an empty 32M partition. Align more and you will get more space. Exactly what I was talking about. >Also, it can be done ex post: the MSR can be moved anywhere before the Windows partition, and the Windows partition resized through Windows itself. Can we get a show of hands for how many Windows users have been doing this to their MSR?
- 1996 6y ago
  > Exactly what I was talking about. No, you were saying that this empty space would be claimed by the MSR, and that it wouldn't work otherwise due to some hostile intent by Microsoft. So I edited to add that nothing would "claim" this space, as out-of-sequence partitions are not done by OS: the gaps will be left empty. > Can we get a show of hands for how many Windows users have been doing this to their MSR? I do, and a lot of people do - because it's technically possible. If you don't know how to, it's your problem, not Microsoft problems. The modern GPT scheme + UEFI boot as used currently by Windows is extremely permissive yet secure: TPM and MOKs allow signed EFI payloads, and you even got a dedicated EFI partition with lots of free space to put them there! Add a LUKS partition and you're just as secure as Windows Secureboot on Bitlocker. But you have to learn on how to use these new things, as it's not your grandpa MBR.