3 ms·

Microsoft Finds Another Excuse to Block GNU/Linux

7 points by darkduck 15y ago

JonnieCache 15y ago
This has been shown to be bullshit already: http://www.winrumors.com/microsoft-clears-up-linux-confusion-over-windows-8-secure-boot-feature/ http://www.winrumors.com/microsoft-clears-up-linux-confusion... * UEFI allows firmware to implement a security policy * Secured boot is a UEFI protocol not a Windows 8 feature * UEFI secured boot is part of Windows 8 secured boot architecture * If desired, Windows 8 utilizes secured boot to ensure that the pre-OS environment is secure * Secured boot doesn’t “lock out” operating system loaders, but is is a policy that allows firmware to validate authenticity of components * OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform * Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows
- phaylon 15y ago
  From what I understand: * If you want "Windows Certified" approval for your hardware, you have to provide and activate this by default. * If it's active, it won't allow uncertified systems (read: Linux) to run without deactivating the option in the BIOS, which doesn't have to be provided. * If it's inactive, it won't run Windows. Since this isn't the first time Microsoft had troubles being fair to their competition, I'd see this less as "bullshit," and more as "people caught on more early this time." With Microsoft's past, why are you surprised people are more careful with its suggestions?
  - cabirum 15y ago
    From the ms blog post: Steven Sinofsky 22 Sep 2011 4:10 PM # @Jose Pedro Of course Windows is usable without secure boot -- just like the post stated
    - phaylon 15y ago
      You're right on that point, sorry I missed that.
- sfgfdhgfdshdhhd 15y ago
  It's not that clear cut. See http://mjg59.dreamwidth.org/5850.html http://mjg59.dreamwidth.org/5850.html . The point isn't that MS is directly saying "don't install other operating systems" (there's no way they would say anything like that nor do they need to these days). Rather it is something that will come about due to the path of least resistance. 1. MS _is_ mandating that OEMs support UEFI secure if they wish to have a Windows 8 logo via certification. If you don't want a logo then no problem right? The point is that is that you will reduce sales by not having a logo as it looks like you don't support Windows as well as your competitors. 2. No one is being told to not include a "change secure boot" option. However every extra option means further testing because the attack surface is bigger - what if it turns out there's a way to flip the secure boot option off thanks to it being exposed. Some vendors in the past did not include an option to turn hardware virtualization on within the BIOS because it was extra work. Why put in the extra effort to have it when most customers would never want to do such a thing? 3. It is even more effort (and carries similar risks) than 2. to include some way of adding additional signing keys so the user can add their own. I can forsee systems being set by default to only boot binaries signed by authorised keys. The path of least resistance means the only keys on the system belong to MS for Windows 8 and above (because that's what is being sold so you would vendors want to make things easy). This system lacks the option to change the keys or the policy because it is extra work. No one has said "ban alternative systems" directly but the end effect is the same. If OEMs didn't care about certification then no problem. If OEMs are diligent and spend extra time and effort then no problem. The problem is taking the options come with negatives that make it easier to skip them.
tzs 15y ago
Why not submit a link to one of the legitimate sites covering this (some even covering it accurately!), instead of a link to a discredited conspiracy theory site?

7 points by darkduck 15y ago

This has been shown to be bullshit already: http://www.winrumors.com/microsoft-clears-up-linux-confusion-over-windows-8-secure-boot-feature/ http://www.winrumors.com/microsoft-clears-up-linux-confusion... * UEFI allows firmware to implement a security policy * Secured boot is a UEFI protocol not a Windows 8 feature * UEFI secured boot is part of Windows 8 secured boot architecture * If desired, Windows 8 utilizes secured boot to ensure that the pre-OS environment is secure * Secured boot doesn’t “lock out” operating system loaders, but is is a policy that allows firmware to validate authenticity of components * OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform * Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows

phaylon 15y ago
From what I understand: * If you want "Windows Certified" approval for your hardware, you have to provide and activate this by default. * If it's active, it won't allow uncertified systems (read: Linux) to run without deactivating the option in the BIOS, which doesn't have to be provided. * If it's inactive, it won't run Windows. Since this isn't the first time Microsoft had troubles being fair to their competition, I'd see this less as "bullshit," and more as "people caught on more early this time." With Microsoft's past, why are you surprised people are more careful with its suggestions?
- cabirum 15y ago
  From the ms blog post: Steven Sinofsky 22 Sep 2011 4:10 PM # @Jose Pedro Of course Windows is usable without secure boot -- just like the post stated
  - phaylon 15y ago
    You're right on that point, sorry I missed that.
sfgfdhgfdshdhhd 15y ago
It's not that clear cut. See http://mjg59.dreamwidth.org/5850.html http://mjg59.dreamwidth.org/5850.html . The point isn't that MS is directly saying "don't install other operating systems" (there's no way they would say anything like that nor do they need to these days). Rather it is something that will come about due to the path of least resistance. 1. MS _is_ mandating that OEMs support UEFI secure if they wish to have a Windows 8 logo via certification. If you don't want a logo then no problem right? The point is that is that you will reduce sales by not having a logo as it looks like you don't support Windows as well as your competitors. 2. No one is being told to not include a "change secure boot" option. However every extra option means further testing because the attack surface is bigger - what if it turns out there's a way to flip the secure boot option off thanks to it being exposed. Some vendors in the past did not include an option to turn hardware virtualization on within the BIOS because it was extra work. Why put in the extra effort to have it when most customers would never want to do such a thing? 3. It is even more effort (and carries similar risks) than 2. to include some way of adding additional signing keys so the user can add their own. I can forsee systems being set by default to only boot binaries signed by authorised keys. The path of least resistance means the only keys on the system belong to MS for Windows 8 and above (because that's what is being sold so you would vendors want to make things easy). This system lacks the option to change the keys or the policy because it is extra work. No one has said "ban alternative systems" directly but the end effect is the same. If OEMs didn't care about certification then no problem. If OEMs are diligent and spend extra time and effort then no problem. The problem is taking the options come with negatives that make it easier to skip them.

tzs 15y ago

Why not submit a link to one of the legitimate sites covering this (some even covering it accurately!), instead of a link to a discredited conspiracy theory site?