9 ms·
Windows 8 OEM specs may block Linux booting
- daeken 15y agoThis could block Linux from booting, but realistically speaking, does anyone believe that will happen? It seems very, very unlikely to me that you won't be able to disable signing restrictions at the firmware level.
- mjg59 15y agoI'm told that at least one vendor will be providing some systems that don't allow you to disable the requirement.
- jrockway 15y agoI'm told that at least one vendor is going to lose a lot of money when its investors find out about this.
- cosgroveb 15y agoI doubt that investors would be savvy enough to care but it would be a stupid move, nonetheless. Besides, the server is where Linux matters, not consumer hardware.
- catch23 15y agoInvestors are savvier than you'd think. Even on a rumor that the vendor is doing an exclusive lock-in with MS, I'm sure you'd see the stock price dip. Investors spend all their time looking at news reports in their target industry, so I'm sure they'll notice something as big as this.
- thristian 15y agoThat depends... how about if it were presented as "our new models come with a feature that will dramatically lower support costs"?
- idonthack 15y agoWell I'M told they WON'T.
- raphman 15y agomjg59 wrote the original blog post - he might know more than you.
- Hyena 15y agoBut what product will they be putting the lock-in on? It may not matter, as we've seen with mobile OSes which, from the perspective of the median buyer, are locked in.
- jjm 15y agoIt makes somewhat some sense that MS will do this especially since Hyper-V (VM Hypervisor) is now built-in to Windows8. "Want Linux? You need Windows too..." Other options?: - DIY with OEM materials - Apple :-P
- mhd 15y agoDidn't some manufacturer mess up ACPI stuff on purpose so that a non-Windows OS would have power saving / noise trouble?
- karolisd 15y agoDoes this effect dual booting OS X? I doubt the side-effect of blocking Linux boots was anything but a coincidence. But could Microsoft be fearful of Hackintoshes becoming more popular and a increase of OS X running on non-Apple hardware?
- elithrar 15y ago> Does this effect dual booting OS X? I doubt the side-effect of blocking Linux boots was anything but a coincidence. But could Microsoft be fearful of Hackintoshes becoming more popular and a increase of OS X running on non-Apple hardware? I doubt it. Whilst I don't mean to belittle the hard work that goes into the hackintosh projects out there, we're talking about a tiny, tiny group of people that probably have an imperceptible impact on MSFT's bottom line.
- mattgreenrocks 15y agoYep. Compatibility is extremely dicey on Hackintoshes -- the best seem to be running hardware that is chipset identical to those in Macs. I'd be more worried about Apple waking up one day and shipping an update that breaks everything.
- charliesome 15y agoMy Hackintosh runs like a dream. The only post-install hacking I needed to do was setup my graphics card's PCI string properly
- cosgroveb 15y agoHackintoshes a threat to Windows? No offense, but that's laughable. It's been awhile since I put together one but it's such a huge pain in the ass that even most people capable of putting OS X on ordinary hardware won't bother.
- sciurus 15y agoHere is a direct link to Matthew Garret's blog post so that you can skip itworld's paraphrasing. http://mjg59.dreamwidth.org/5552.html http://mjg59.dreamwidth.org/5552.html
- timtadh 15y ago"An OS with a Pkek matching that installed in the firmware may add additional keys to the whitelist." Does this mean you can just add you own key and self sign any code you want?
- keeperofdakeys 15y agoPresumably you have to sign a pkek key with the firmware key. Even then, you don't actually have full control of your OS's kernel, so it may not be easy to insert a key.
- belthesar 15y agoThank you for this. Sensationalist journalism to stir the pot doesn't bring answers, it just confuses more.
- jrockway 15y agoI doubt any major vendor will do this. First off, they don't want to be locked into selling Microsoft-only machines. If they can't pretend Linux is an option, Microsoft can charge them $1000 for a Windows license and there's nothing they can do about it. If they have Linux hanging over Microsoft's head, though, they'll get better pricing on Windows. (Think this won't happen? It already did with XP on netbooks. When Microsoft realized that everyone was happy to get $100 off the price of their laptop to run Firefox under Linux instead of under Windows, they had no choice but to make it nearly free.) If that doesn't work, the need for booting non-standard Windows images will save us. I've never worked for any company that ran a stock Windows install -- everyone rolls their own. If new machines won't boot this image, guess what, that new machine is bought from some vendor that doesn't do this to them. And the only reason most people use Windows at home is because they use Windows at work. If big companies started migrating away from Windows, Microsoft could be in serious trouble. (Yup, Microsoft Word is much nicer than LibreOffice Writer or AbiWord. But you don't know that if you've never used it. Or, you don't care, because you're writing a memo, not a book. And that's $600 Microsoft loses right there.) Next, we're forgetting the all-important server market. Nobody uses Windows as a server OS, so all those servers are going to have to be able to run Grub. Since servers are what make the OEMs money (they actually need that quad core chip, you don't), keeping users of that market happy will be the hardware companies' biggest concern. If Intel chips stop booting Linux, guess what, AMD is the new king of the market. Finally, many of these companies are in markets other than consumer computers, and they won't want to alienate their other partners. If, say, Samsung says "our hardware will only run Windows", then they won't be manufacturing Android phones or Chromebooks anymore. And that's a big deal, because they won't be manufacturing iPhones either, and that means they're out of the mobile market. (Have you ever seen anyone without MVP certification anywhere near a Windows Phone? I didn't think so.) Basically, Windows is important, but not so important that anyone would want to be the first to go Windows-only in hardware. Hardware companies want to provide nice computers at a nice price. End users mostly want to browse the web. This puts Microsoft in a position to do exactly what the market wants, not what it thinks it can bear. When you're at the top, the only place to go is down. And that is where Microsoft is going.
- rfugger 15y ago
- ghshephard 15y agoThe first paragraph is just silly: "After years of trying to cut off Linux growth as a desktop platform on x86 and x64 PCs, Microsoft may have actually figured out a way to stop Linux deployments on client PCs dead in their tracks." I'm quite certain Microsoft has (A) not put any significant effort into cutting off growth as a desktop platform, and (B) If they had, they were almost completely successful, and characterizing it as "trying" implies that they had limited success.
- mattgreenrocks 15y agoShhh, not so loud! Such thoughts would destabilize Slashdot if they got out! Seriously, this seems especially short-sighted, as the perception is that MS is getting thrashed by Apple in the consumer market. I think its more about preventing malware from getting ahold of the boot process, side effects be damned.
- th0ma5 15y agoThat's a chilling thing IMHO when we rely on a single corporation to protect us. As far as the /. like rhetoric, you're using the parent's opinion that MS hasn't been trying, and is indeed seeing a steady increasing competition in desktop screen space (which I've seen in two different Fortune 500 companies first hand within the last 6 years), so if that isn't true, then the rhetoric isn't just rhetoric.
- Hyena 15y agoI don't see this. Apple sells hardware; incidentally, it comes with its own OS. I haven't met many people who bought a Mac for MacOS since Windows XP.
- ukaszg 15y agoAs much as I don't like Apple/OS X, most of my friends do. Everyone got Mac _because_ of OS X. One got it because of low latency, and because he was "sure it won't hang up for a moment because of some background job". He uses it to make music. Others got it for its (OS X's) usability.
- sunyc 15y agochromeos has similar thing, with a developer switch at back basically turns off the signature validation in firmware. what they should worry about is, which CA root to put in there.
- prayag 15y agoI bought a Windows machine from Amazon. The reason that I wasn't able to install Linux was acceptable enough for Amazon to pay for return shipping.
- daeken 15y agoWhat shipping Windows machine can you not install Linux on? Or are you talking about some sort of hardware support issue?
- tree_of_item 15y agoTo everyone saying "I doubt anyone will do this": wasn't the consensus also against Microsoft restricting application distribution to their app store?
- recoiledsnake 15y agoCare to link to some examples of said consensus?
- dpark 15y agoUnless I'm misunderstanding something, this is silly FUD. Microsoft isnt stupid enough (or evil enough, despite what some like to believe) to attempt to force PC oems to effectively block all OSes except Windows. They know this wouldn't work, and there'd be no point in trying to force it. Supporting hardened boot is not the same as requiring it. Microsoft already utilizes this for BitLocker. You can still install Linux on a machine that supports hardened booting and signed images. You just can't enable hardened boot unless you use signed images.
- jonhohle 15y ago> Microsoft isnt stupid enough (or evil enough, despite what some like to believe) to attempt to force PC oems to effectively block all OSes except Windows. Um, Microsoft used to do exactly this. http://www.theregister.co.uk/2001/08/31/jean_louis_gass_233_e/ http://www.theregister.co.uk/2001/08/31/jean_louis_gass_233_... I don't know if they have the muscle or the guts to try something like this again. edit: fixed typo
- dpark 15y agoThere's a rather large difference between contractually forbidding PC OEMs from selling Windows machines bundled with BeOS and technologically blocking non-Windows OSes from executing. It's one thing to say "you can't bundle another OS with mine". It's another thing entirely to say "your hardware can never run any OS except mine".
- beagle3 15y agoThere's actually a very small difference. They both result from signing an agreement between said parties, and basically provide the same benefits to both parties (given that most people won't install an operating system themselves). Except one leaves a choice to the end user, and the other doesn't.
- rkalla 15y ago+1, hardened boot is something we will address eventually with MBR and BIOS viruses on the rise again. Makes sense for MS to push In this direction and Intel/AMD aren't going to lock down that hardware to anything else. Your $200 Dell from Best Buy might, but that will be part of the subsidy from MS. Meh.
- deleted 15y ago[deleted]
- braco_alva 15y agoBut even if this was true, there is still ways around this right? I mean rEFIt does a pretty good job booting up Linux in Mac, so wouldn't this be possible in those PC's as well?
- raphman 15y agonope, rEFIt would need to be signed, too, as it is involved in the boot process.
- lhnn 15y agoWouldn't this draw anti-trust battles? Since complying with EFI signing is against the license of one of the only other major alternatives to Windows, this would not bode well for Microsoft.
- toni 15y agoI was thinking about the same thing. Can the government intervene and label this as anti-competitive?
- dctoedt 15y agoWouldn't this draw anti-trust battles? Could be -- it sounds like a possible "tie-out" (a variation on tie-in). AFAIK There haven't been many tie-out cases, but as antitrust litigator George Gordon [1] put it a few years back, "The term “tie out” is often used to refer to arrangements in which a license prohibits a licensee from dealing in and/or developing competing, noninfringing technologies. [Footnote omitted] Such arrangements have been found to be intellectual property misuse and could form the basis for an antitrust claim as well." [2] If MS were to do something like this, I imagine Gary Reback [3], its nemesis in previous antitrust battles, would be all over it .... [1] http://www.dechert.com/george_gordon/ http://www.dechert.com/george_gordon/ [2] http://www.dechert.com/library/Analyzing%20IP%20License%20-%20GGordon%205-02.PDF#page=9 http://www.dechert.com/library/Analyzing%20IP%20License%20-%... [3] http://www.garyreback.com/garyreback.html http://www.garyreback.com/garyreback.html
- beagle3 15y ago> Wouldn't this draw anti-trust battles? Since complying with EFI signing is against the license of one of the only other major alternatives to Windows, this would not bode well for Microsoft. And who do you expect to pursue this anti-trust? The US government? Oh, I didn't realize you were joking! ha ha, funny. The US government is owned by big corps, MS being one of them. Something really weird has to happen for them to turn against their corporate masters. (And don't compare it to the previous anti-trust case - at the time, microsoft wasn't lobbying and paying, sorry, donating to, politicians from both parties)
- jsz0 15y agoLinux (on the desktop) is probably of little or no concern to Microsoft at this point. They've got bigger problems to worry about. If they want to focus on making computers sold with Windows offer the best possible experience it will benefit the most people. Possibly it will make things harder for Linux users but from Microsoft's perspective if the OEM is shipping Windows there's no reason to consider Linux as part of the equation.
- th0ma5 15y agoMy personal opinion is that it is indeed little concern, but a little concern to many parts of MS, which compared to many other companies may well look like a dedicated anti-linux corporation that outnumbers them.
- kvk 15y agoThe start of a Windows jailbreaking scene?
- bitops 15y agoAgree that its a non-issue. Linux is established, would be a really dumb move to block it like this. In two weeks we'll have forgotten all about it.
- dorian-graph 15y agoIt's TPM like fear-mongering again.
- elehack 15y agoCould it be that the "fear-mongering" and subsequent outrage is a major reason why we didn't have this kind of lock-down 5-10 years ago? I thing mjg's wait-and-see approach is good to do. Not panic yet. But certainly not to forget either - keep an eye out, see how it develops, and be prepared to oppose lock-down through various channels should it come (and hopefully before it is to late).
- thristian 15y agoBut what is "Linux"? If it were a package you could buy in a box from the store, the manufacturer would just sign a contract with OEMs to have a suitable key present in all manufactured computers, but Linux isn't like that. What if I want to compile my own kernel in order to try out an experimental feature, or help test a driver? What if I need to upgrade my boot-loader? The only alternative to 'blocking Linux' is 'allowing anything to run', and if manufacturers were happy to allow that, they wouldn't bother with these features in the first place. I'm sure there'll still be lots of computers that are capable of running Linux - multi-thousand dollar servers and high-end workstations; the kind of computers you buy through your account manager. It seems pretty sensible to block unauthorised OSs on low-end computers — the kind that ship with OS X or Windows Basic, the kind where minimizing support costs is vitally important. Unfortunately, that's the same market segment where I and everybody I know got their start: taking over an old Windows box and putting Linux to see what the fuss was all about.
- rdl 15y agoThis is overblown. However, if this means secure boot hardware is even more widely available, it is a win -- if the keys are under control of the user or his organization, it is a huge security win.
- guard-of-terra 15y agoDoes this also mean that you won't be able to boot Windows 8 on a PC you assembled yourself? Oh, they did not think of that. One more reason to hate MS and want it die everywhere.
- ivanbernat 15y agoIt looks to me like it's designed with tablets in mind, not desktops / laptops.
- gizzlon 15y agoThe articles doesn't say, but this would require an TPM in the machine to be successful.. right? Without a TPM how can the EFI be trusted? You just have to replace it as well as the boot loader and kernel.
- yason 15y agoI've long thought that the only place where I allow Windows is in a virtual machine. This seems to hint in that direction: buy a machine that isn't broken (can boot Linux) and do your Windows duties under VirtualBox or something.
- dramaticus3 15y agoSummary : Machines that have the "Windows 8" logo must have UEFI, which means the bootloader must be signed with a key that's in the BIOS. Additionally the OS can use the keys to check other signed code : device drivers etc. My conclusion : A smart vendor will include a signed program that will manage said keys in the BIOS.
- brokensystem 15y agoI use ubuntu but surely my harddrive is full of malware (boot system compromised). Linux is for hacker playing with backdoors. I like free software and linux, but if I need a secure system, I should have to pay the prize of using windows 8.
- paulja 15y agoThats one way to stop all the shops that slap XP on modern hardware, due to corporate IT policy.
- tbrownaw 15y ago> The two alternatives here are for Windows to be signed with a Microsoft key and for the public part of that key to be included with all systems, or Does it have to be directly signed by that key, or does it work like the CA system that web browsers use? > A system that ships with only OEM and Microsoft keys will not boot a generic copy of Linux. [ from the blog post rather than the article ] Which tells us that either systems will not ship with only those keys, or there will be a simple way to disable this ("Press F2 for setup"), or somebody will be getting sued on antitrust grounds (which maybe would be ignored again in the US, but not the rest of the world) and forced to provide a workaround.
- wedesoft 15y agoIt certainly won't get easier to install a Linux dual-boot. It is already difficult enough as it is: * Windows PCs without installation medium * Windows installation with a full partitition table (four primary partitions) * (intentionally?) corrupted partition tables I.e. installing GNU/Linux requires you to resize partitions with a potentially corrupted NTFS file system and/or delete backup partitions. Alternatively the user uses a Windows image file as Linux file system (Wubi) which is slower and a more fragile solution.
- nagnatron 15y agoI know I'm speaking through my reality distortion field, but who cares about this?
- krschultz 15y agoIt won't happen, and if it does happen, it won't matter. Can you imagine the Anti-Trust problems this would create? Microsoft is still a big fat target for anti-trust lawsuits and this one is pretty blatant. And if it does happen, while we're waiting for the Justice Department to end it I'm pretty sure the Linux hackers will find a way around it. When there is a will, there is a way.
- moontear 15y ago"We will continue to support the legacy BIOS interface, but machines using the UEFI interface will have significantly richer capabilities." == Will not block Linux or any other OS booting. Secondly anti-trust cases would kill MS if they would block any other OS, so they won't. http://blogs.msdn.com/b/b8/archive/2011/09/20/reengineering-the-windows-boot-experience.aspx http://blogs.msdn.com/b/b8/archive/2011/09/20/reengineering-...
- mkup 15y agoThere was a time when Windows Logo was considered prestigious, respectable and trendy thing. With such a practice Microsoft is quickly approaching a time when Windows Logo will be perceived like a hot-iron branding of robbers and other criminals in the medieval era.
- christkv 15y agoIf this makes it into real hardware I expect the EU to reopen their case against Microsoft fairly quickly on anti-competitive grounds. There are to many governmental institutions and businesses dependent on linux for their day to day work for this to go unchallenged.
- dhimes 15y agoIf the UEFI could be made to handle multiple keys, and allow the owner to enter them into the firmware, then this could work. One more step in the setup but a more secure system overall.
- RexRollman 15y agoWhy is this being written like it is solely a "linux" problem? It seems to me that it effects every non-Windows operating system.
- TallGuyShort 15y agoNo one seems to have mentioned the impact this will have on Live systems. I'm frequently called on by Windows users to recover lost data on corrupted systems, which I do using a Live Linux distribution (especially when they have discarded their installation media & access keys, and have no interest in investing money in continuing using Windows if I can give them a free alternative to getting online). How will I be able to do that for people with Windows 8 computers? I'm sure I'll be able to find unsigned hardware for my personal use, but it's the interoperability that concerns me.
- wmf 15y agoTo repair a Windows 8 system, you boot a live Windows 8 PE USB drive.
- pointyhat 15y agoLike I suspected, this entire thread has been turned by zealots into a Microsoft-bashing exercise. I genuinely dispair for people who spend their entire time platform bashing and don't add something constructive to the discussion or tar and feather a side religiously. It paints a very bad picture of the "startup culture" amongst more established organisations.
- ableal 15y agoLWN notice and discussion of "Garrett: UEFI secure booting" at http://lwn.net/Articles/459569/ http://lwn.net/Articles/459569/