5 ms·

It makes Linux more complicated to deploy, for one. And if they ever change their mind and don't allow it on x86 any more, Linux is basically exiled from the PC

It makes Linux more complicated to deploy, for one. And if they ever change their mind and don't allow it on x86 any more, Linux is basically exiled from the PC OEM market.

easton 5y ago
It shouldn't, as Microsoft made sure that the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key that is trusted by the major OEMs. And you can trust your own keys, per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms#security-requirements https://docs.microsoft.com/en-us/windows-hardware/drivers/br...
- dataflow 5y ago
  > per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. Yeah but then you can't boot into Windows? Who is actually going to go into the firmware settings to switch settings on and off for every single boot to the other OS?
  - blibble 5y ago
    you can boot debian/redhat/... out of the box without disabling it, as the shim used as part of the boot process has been signed by MS if you want to sign your own kernels: the shim will also let you do that relatively easily ("machine owner keys") if you want to own your entire boot process you can replace the platform key and sub-keys with your own, and then trust whoever you want (even adding MS' keys if you wish, so Windows can boot in secure mode)
    - kelnos 5y ago
      I'm pretty sure we don't want to be in a world where we can only use one of a few Microsoft-approved Linux distros without it being a pain the the ass to deal with.
      - blibble 5y ago
        we've been in that world for about 10 years now if you don't like it... turn off secure boot, or enroll your own keys (the mok approach takes about 30 seconds)
- imglorp 5y ago
  What if I'm not a major distro? Why should I have to go to some company to let me use my hardware they didn't even make? What happens if one day my distro starts to anger the gatekeeper, or worse, start to compete with them? This is all wrong. Stop supporting them.
- dane-pgp 5y ago
  > the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key Those distros also all use systemd. Do you think they'll sign an image that doesn't include it? We're heading down a path where developers need permission to innovate, and the switching cost of running something non-standard becomes too high for even the most technical users.
  - IntelMiner 5y ago
    systemd has nothing to do with secure boot. Gentoo for instance supports it and offers, and maintains OpenRC https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst...
    - swiley 5y ago
      Note that you must add your own keypair for that, as Gentoo is a source based distribution so there isn't anything for Microsoft to sign.
- selfhoster11 5y ago
  You're thinking at the wrong level of abstraction. Sure, Microsoft is permitting it now, but what about later?
geofft 5y ago
Ah, yes, the golden era of the '90s and '00s, when Linux was easy to deploy and PC manufacturers supported you running Linux. We made it work and we'll make it work again.
- selfhoster11 5y ago
  DRM such as Secure Boot wasn't viable in those times, nor was interconnectivity expected. This round could be very different if they wanted it to.
brutal_chaos_ 5y ago
I think for x86 you are (at least very close to) correct, but I've been seeing a serious shift towards ARM chips and (my pipe dream) soon RISCV. X86 may just need to fall to the wayside at this point. Maybe PineBooks could be released with ARM chips too! (RISCV as well, but peripherals need to be a real thing(TM) first). Heck, the Pi400 is a good start in that direction (though obviously isn't enterprise ready yet).
- userbinator 5y ago
  The openness situation for ARM is even worse. Case in point: the countless Android devices out there.
  - swiley 5y ago
    It's really a Qualcomm problem more than an Android problem. Everyone seems to think Qualcomm==Arm though because in the USA it pretty much does.
    - userbinator 5y ago
      Not just Qualcomm but the vast majority of ARM SoCs used in Android devices, and in general, have no public documentation.
- SwimSwimHungry 5y ago
  Honestly, I vastly prefer OpenPOWER over ARM from a consistency in implementation perspective. Not to mention, at least with POWER9, no mandatory binary blobs or opaque management engine chips that can't be properly audited.
  - selfhoster11 5y ago
    OpenPOWER is extremely expensive though. There is no universe in which I would pay several times the price for a high-powered x86 gaming PC/workstation just to have an open-source CPU and hardware like Talos. It has to be both open and affordable.
avereveard 5y ago
And just wait until all executables signing becomes mandatory with Microsoft and few selected partners holding all the keys. Window 11 will set the tone, and Windows 12 will kill the indies, we will have to go trough Microsoft, steam, ea, origin of whatever stores will be able to pass the bar.
- CamperBob2 5y ago
  The Steam folks are as worried about this as anyone. They have more to lose than we do, and the same amount of influence at Microsoft (read: none at all.)
deleted 5y ago
[deleted]

It makes Linux more complicated to deploy, for one. And if they ever change their mind and don't allow it on x86 any more, Linux is basically exiled from the PC OEM market.

easton 5y ago

It shouldn't, as Microsoft made sure that the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key that is trusted by the major OEMs. And you can trust your own keys, per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms#security-requirements https://docs.microsoft.com/en-us/windows-hardware/drivers/br...

dataflow 5y ago
> per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. Yeah but then you can't boot into Windows? Who is actually going to go into the firmware settings to switch settings on and off for every single boot to the other OS?
- blibble 5y ago
  you can boot debian/redhat/... out of the box without disabling it, as the shim used as part of the boot process has been signed by MS if you want to sign your own kernels: the shim will also let you do that relatively easily ("machine owner keys") if you want to own your entire boot process you can replace the platform key and sub-keys with your own, and then trust whoever you want (even adding MS' keys if you wish, so Windows can boot in secure mode)
  - kelnos 5y ago
    I'm pretty sure we don't want to be in a world where we can only use one of a few Microsoft-approved Linux distros without it being a pain the the ass to deal with.
    - blibble 5y ago
      we've been in that world for about 10 years now if you don't like it... turn off secure boot, or enroll your own keys (the mok approach takes about 30 seconds)
imglorp 5y ago
What if I'm not a major distro? Why should I have to go to some company to let me use my hardware they didn't even make? What happens if one day my distro starts to anger the gatekeeper, or worse, start to compete with them? This is all wrong. Stop supporting them.
dane-pgp 5y ago
> the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key Those distros also all use systemd. Do you think they'll sign an image that doesn't include it? We're heading down a path where developers need permission to innovate, and the switching cost of running something non-standard becomes too high for even the most technical users.
- IntelMiner 5y ago
  systemd has nothing to do with secure boot. Gentoo for instance supports it and offers, and maintains OpenRC https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst...
  - swiley 5y ago
    Note that you must add your own keypair for that, as Gentoo is a source based distribution so there isn't anything for Microsoft to sign.
selfhoster11 5y ago
You're thinking at the wrong level of abstraction. Sure, Microsoft is permitting it now, but what about later?

geofft 5y ago

Ah, yes, the golden era of the '90s and '00s, when Linux was easy to deploy and PC manufacturers supported you running Linux. We made it work and we'll make it work again.

selfhoster11 5y ago
DRM such as Secure Boot wasn't viable in those times, nor was interconnectivity expected. This round could be very different if they wanted it to.

brutal_chaos_ 5y ago

I think for x86 you are (at least very close to) correct, but I've been seeing a serious shift towards ARM chips and (my pipe dream) soon RISCV. X86 may just need to fall to the wayside at this point. Maybe PineBooks could be released with ARM chips too! (RISCV as well, but peripherals need to be a real thing(TM) first). Heck, the Pi400 is a good start in that direction (though obviously isn't enterprise ready yet).

userbinator 5y ago
The openness situation for ARM is even worse. Case in point: the countless Android devices out there.
- swiley 5y ago
  It's really a Qualcomm problem more than an Android problem. Everyone seems to think Qualcomm==Arm though because in the USA it pretty much does.
  - userbinator 5y ago
    Not just Qualcomm but the vast majority of ARM SoCs used in Android devices, and in general, have no public documentation.
SwimSwimHungry 5y ago
Honestly, I vastly prefer OpenPOWER over ARM from a consistency in implementation perspective. Not to mention, at least with POWER9, no mandatory binary blobs or opaque management engine chips that can't be properly audited.
- selfhoster11 5y ago
  OpenPOWER is extremely expensive though. There is no universe in which I would pay several times the price for a high-powered x86 gaming PC/workstation just to have an open-source CPU and hardware like Talos. It has to be both open and affordable.

avereveard 5y ago

And just wait until all executables signing becomes mandatory with Microsoft and few selected partners holding all the keys. Window 11 will set the tone, and Windows 12 will kill the indies, we will have to go trough Microsoft, steam, ea, origin of whatever stores will be able to pass the bar.

CamperBob2 5y ago
The Steam folks are as worried about this as anyone. They have more to lose than we do, and the same amount of influence at Microsoft (read: none at all.)

deleted 5y ago

[deleted]