3 ms·

If it is indeed possible for Linux to create a signing tool, won't hackers/pirates be able to do the same? Doesn't that defeat the purpose? Or will the signing

• watmough 15y ago
  If I understand, the binaries need to also be signed by the private keys belonging to the 'owner' of the firmware / machine. This presumably means Intel and/or Microsoft. The implication is that, to get on the machine in trusted mode, you have to be approved by Microsoft and/or Intel, or else you are stuck running in untrusted mode, which may in future make you a second class citizen, and in an extreme case might prevent you from say, accessing your own banking records (spinning a hypothetical). If as a condition of an OEM agreement, Microsoft and Intel force a lock-down of the boot firmware, then the potential controversy is that other operating systems are excluded from ever running in trusted mode on that hardware. It just occurred to me that this is similar to how the iPhone works. I can sign locally, but only Apple can sign my app for wider distribution... unless the recipient phone is jail-broken in which case that phone will quite easily be detected as untrusted and could easily in future be denied access to the network, or app store. There's clearly a reason the baseband is also encrypted and signed.
• mjg59 15y ago
  It's easy to write a signing tool, but you'd still need to have the private half of an appropriate key to do anything useful with it.