4 ms·

They enforce secure boot. Many vendors only have the MS CA implemented to check OS integrity. So you would have to get your OS certified by Microsoft...

josteink 5y ago
Almost all mainstream Linux distros can OOB do UEFI secure boot through a MS-signed shim, or Grub signed by Canonical or Fedora (which is a trusted cert by the MS cert). Secure boot does not prevent a user from installing Linux. That’s just FUD.
- raxxorrax 5y ago
  I don't think making people aware of the logistic problems of having to sign you OS at Microsoft in most practical cases is FUD. Secure boot or TPM can make sense for the cloud, since you might want to check if the provider changed your OS. MS used ransomware to justify secure boot. That is FUD. Boot and Bios trojans have become extremely rare and it doesn't provide enough protection anyway. This is for vendor lock in and nothing else.
- zo1 5y ago
  It may be FUD, but people's concerns are valid. This is clearly another stepping-stone in the direction of removing control of the hardware/computer away from the user (under the guise of Trust, Safety, Privacy and Security). We just don't yet see the bigger, long term end state. But if you ask me, "they" essentially want an un-tamperable and un-recordable pipe between hosted server and the monitor that emits electrons to your eyeballs.
usr1106 5y ago
>Many vendors only have the MS CA implemented to check OS integrity Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common. As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.
- raxxorrax 5y ago
  Wouldn't your own keys stop working with mechanism like remote attestation? From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan? Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time.... Where is the benefit for the user?
  - usr1106 5y ago
    Who uses remote attestation for what purpose? I have never used it. Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.
buran77 5y ago
They enforce Secure Boot on Windows 11. It was always a requirement on Windows 8 and 10 but never actually enforced. There's nothing to stop you from using Windows 10 or Linux on your hardware unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.
- tpxl 5y ago
  > unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11. They didn't force OEMs, but some devices can only run Windows 8.1 with no ability to turn Secure boot off. > ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system.
noxer 5y ago
Can people stop already. Its NOT true. Windows 11 runs perfectly fine without. There is no enforcement at all. All the hardware checks are in the setup/installer which is not needed its just one way to install the OS and ofc it can be circumvented easily if someone really wants the installer/update experience for some reason. Same for TPM. Not even TPM 1.2 is enforced and that was a requirement for windows 10 already. For lazy people with win10 already installed use https://github.com/ArkaneDev/WinPass11 https://github.com/ArkaneDev/WinPass11
- EVa5I7bHFq9mnYK 5y ago
  I looked at the code - it downloads a .reg file from the web and modifies your registry with the content of that .reg file in admin mode. At the moment that .reg file modifies the registry to allow bypassing TPM checks, but at any future time the author can replace that .reg file with something malicious. I wouldn't download that program.
  - noxer 5y ago
    I'm aware of that. It also loads a DLL from windows10 installer. I assume it intentional so the files can be updated if MS would add more checks. It's open source for a reason.

josteink 5y ago

Almost all mainstream Linux distros can OOB do UEFI secure boot through a MS-signed shim, or Grub signed by Canonical or Fedora (which is a trusted cert by the MS cert). Secure boot does not prevent a user from installing Linux. That’s just FUD.

raxxorrax 5y ago
I don't think making people aware of the logistic problems of having to sign you OS at Microsoft in most practical cases is FUD. Secure boot or TPM can make sense for the cloud, since you might want to check if the provider changed your OS. MS used ransomware to justify secure boot. That is FUD. Boot and Bios trojans have become extremely rare and it doesn't provide enough protection anyway. This is for vendor lock in and nothing else.
zo1 5y ago
It may be FUD, but people's concerns are valid. This is clearly another stepping-stone in the direction of removing control of the hardware/computer away from the user (under the guise of Trust, Safety, Privacy and Security). We just don't yet see the bigger, long term end state. But if you ask me, "they" essentially want an un-tamperable and un-recordable pipe between hosted server and the monitor that emits electrons to your eyeballs.

usr1106 5y ago

>Many vendors only have the MS CA implemented to check OS integrity Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common. As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.

raxxorrax 5y ago
Wouldn't your own keys stop working with mechanism like remote attestation? From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan? Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time.... Where is the benefit for the user?
- usr1106 5y ago
  Who uses remote attestation for what purpose? I have never used it. Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.

buran77 5y ago

They enforce Secure Boot on Windows 11. It was always a requirement on Windows 8 and 10 but never actually enforced. There's nothing to stop you from using Windows 10 or Linux on your hardware unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.

tpxl 5y ago
> unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11. They didn't force OEMs, but some devices can only run Windows 8.1 with no ability to turn Secure boot off. > ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system.

noxer 5y ago

Can people stop already. Its NOT true. Windows 11 runs perfectly fine without. There is no enforcement at all. All the hardware checks are in the setup/installer which is not needed its just one way to install the OS and ofc it can be circumvented easily if someone really wants the installer/update experience for some reason. Same for TPM. Not even TPM 1.2 is enforced and that was a requirement for windows 10 already. For lazy people with win10 already installed use https://github.com/ArkaneDev/WinPass11 https://github.com/ArkaneDev/WinPass11

EVa5I7bHFq9mnYK 5y ago
I looked at the code - it downloads a .reg file from the web and modifies your registry with the content of that .reg file in admin mode. At the moment that .reg file modifies the registry to allow bypassing TPM checks, but at any future time the author can replace that .reg file with something malicious. I wouldn't download that program.
- noxer 5y ago
  I'm aware of that. It also loads a DLL from windows10 installer. I assume it intentional so the files can be updated if MS would add more checks. It's open source for a reason.