3 ms·

> Framing Secure Boot as some kind of Secure Boogeyman is not conducive, brings the discussion into tinfoil scenarios without any potential practical outcome (n

> Framing Secure Boot as some kind of Secure Boogeyman is not conducive, brings the discussion into tinfoil scenarios without any potential practical outcome (nobody is going to remove SB or DG) So, we're literally at the point where we have to disable parts of chip (the Device Guard / Secure Core / Pluton) in order to boot _any_ non-MS OS scenario, and you are still claiming that this is scaremongering ? At which point it stops being a "tinfoil" discussion ? > As long as Linux vendors or people can get or enroll their own keys and disable any potential presets, it's a step up in security for everyone. Microsoft _already_ promised that there would be a way so that non-MS OS manufacturers would be able to sign their software so that it would NOT REQUIRE fiddling with the system firmware in order to boot them, even with Secure Boot enabled. This is what the UEFI CA was for. You just insert a SUSE USB pendrive, use the firmware boot manager (or even Windows own' "boot from USB device" option in the Settings panel!) and that's it. Your system is no more compromised by this CA than by allowing MS OSes in the first place. This CA is MS, too. They vet everything they sign. They blacklist stuff that could have been used to compromise devices. They have forced GRUB among many other distributions to align to their whims in order to be signed. Removing this key and relenting on this promise (which actually they have already done several times) means that there is NO WAY for a non-MS operating system to transparently boot on Secure Boot hardware. You have to fiddle with the system firmware, battle with a lot of Scary Boot Prompts that will drive many users away (even advanced ones!), and with the easiest option likely being to disable Secure Boot altogether which per your own words will reduce the security level of users. Not to mention of the unfair advantage MS has since their OSes will still boot transparently on these hardware, no matter what the firmware settings, no matter if the device came with no OS or even a Linux distro to begin with. I have already claimed that MS revoking a distro's signatures is basically a death sentence for that distro. Here we have an article about a manufacturer revoking _all_ distro's signatures, and you claim that "this is not a conductive discussion" ? Give me a break.

Avamander 4y ago
> So, we're literally at the point where we have to disable parts of chip (the Device Guard / Secure Core / Pluton) part in order to boot _any_ non-OS scenario, and you are still claiming that this is scaremongering ? Yes, because the same way you have to enable booting from an USB stick. > At which point it stops being a "tinfoil" discussion ? See my last sentence in my previous comment. > Not to mention of the unfair advantage MS has since their OSes will still boot transparently on these hardware, no matter what the firmware settings, Making a fresh install of Windows is equal in complexity, but it is preinstalled more often certainly. > Removing this key and relenting on this promise (which actually they have already done several times) means that there is NO WAY for a non-MS operating system to transparently boot on Secure Boot hardware. That's not a case with Secure Boot alone, it's a case with Device Guard. Device Guard you can disable. It's a toggle like all the rest, no promises broken. > I have already claimed that MS revoking a distro's signatures is basically a death sentence for that distro. Here we have an article about a manufacturer revoking _all_ distro's signatures, and you claim that "this is not a conductive discussion" ? Yes, because what you've said is not correct.
- AshamedCaptain 4y ago
  > Yes, because the same way you have to enable booting from an USB stick. NO. It's not the same way. On most if not all devices I can boot from a USB stick literally from the Windows settings panel itself (search for Advanced Startup)! No need to even see how the system firmware looks like. Even on hardware as "locked down" as x86 MS tablets, I can hold Volume Down key during boot to boot from a USB stick. Again, enabled by default , and no need to even look at the system firmware ! From that point on, _if the UEFI CA signature is installed_, the distro's setup experience takes over, which is already under the control of the distro itself. > Making a fresh install of Windows is equal in complexity, but it is preinstalled more often certainly. "Equal in complexity" to what ? Most distros and even Windows install can be done with your eyes closed and hitting the enter key repeatedly, specially if you are just overwriting whatever was on the computer before. Installing OSes are typically designed to be as easy as possible. We've had decades of improvements here, both for Windows and non-Windows. Changing settings and disabling secure boot on the system firmware is NOT designed to be as easy as possible. In fact, many times it is explicitly designed to be as scary as possible, precisely for security reasons! (with the intentional addition of Scary Boot Prompts). But worst of it, this part of the experience is NOT controlled by the OS vendor ! That by itself is already suficient to have a completely unfair situation. No matter how much effort you spend on making your OS install flow as smooth as possible, your user still has to fight the system firmware... but only if you're a non-MS OS! > That's not a case with Secure Boot alone, it's a case with Device Guard. Device Guard you can disable. It's a toggle like all the rest, no promises broken. The promise is that there would not need to be a toggle to switch. That's what's been broken! > Yes, because what you've said is not correct. And it is not correct because ..... ?
  - phendrenad2 4y ago
    So what do you want exactly? For hardware to ship with signatures for every known variant of Linux, BSD, QNX, RedoxOS, Solaris, and OS/2 Warp? I'm honestly asking: what is the alternative you're proposing? If you're just saying "it's not easy enough", well, that's a matter of opinion.
    - 4y ago

Avamander 4y ago

> So, we're literally at the point where we have to disable parts of chip (the Device Guard / Secure Core / Pluton) part in order to boot _any_ non-OS scenario, and you are still claiming that this is scaremongering ? Yes, because the same way you have to enable booting from an USB stick. > At which point it stops being a "tinfoil" discussion ? See my last sentence in my previous comment. > Not to mention of the unfair advantage MS has since their OSes will still boot transparently on these hardware, no matter what the firmware settings, Making a fresh install of Windows is equal in complexity, but it is preinstalled more often certainly. > Removing this key and relenting on this promise (which actually they have already done several times) means that there is NO WAY for a non-MS operating system to transparently boot on Secure Boot hardware. That's not a case with Secure Boot alone, it's a case with Device Guard. Device Guard you can disable. It's a toggle like all the rest, no promises broken. > I have already claimed that MS revoking a distro's signatures is basically a death sentence for that distro. Here we have an article about a manufacturer revoking _all_ distro's signatures, and you claim that "this is not a conductive discussion" ? Yes, because what you've said is not correct.

AshamedCaptain 4y ago
> Yes, because the same way you have to enable booting from an USB stick. NO. It's not the same way. On most if not all devices I can boot from a USB stick literally from the Windows settings panel itself (search for Advanced Startup)! No need to even see how the system firmware looks like. Even on hardware as "locked down" as x86 MS tablets, I can hold Volume Down key during boot to boot from a USB stick. Again, enabled by default , and no need to even look at the system firmware ! From that point on, _if the UEFI CA signature is installed_, the distro's setup experience takes over, which is already under the control of the distro itself. > Making a fresh install of Windows is equal in complexity, but it is preinstalled more often certainly. "Equal in complexity" to what ? Most distros and even Windows install can be done with your eyes closed and hitting the enter key repeatedly, specially if you are just overwriting whatever was on the computer before. Installing OSes are typically designed to be as easy as possible. We've had decades of improvements here, both for Windows and non-Windows. Changing settings and disabling secure boot on the system firmware is NOT designed to be as easy as possible. In fact, many times it is explicitly designed to be as scary as possible, precisely for security reasons! (with the intentional addition of Scary Boot Prompts). But worst of it, this part of the experience is NOT controlled by the OS vendor ! That by itself is already suficient to have a completely unfair situation. No matter how much effort you spend on making your OS install flow as smooth as possible, your user still has to fight the system firmware... but only if you're a non-MS OS! > That's not a case with Secure Boot alone, it's a case with Device Guard. Device Guard you can disable. It's a toggle like all the rest, no promises broken. The promise is that there would not need to be a toggle to switch. That's what's been broken! > Yes, because what you've said is not correct. And it is not correct because ..... ?
- phendrenad2 4y ago
  So what do you want exactly? For hardware to ship with signatures for every known variant of Linux, BSD, QNX, RedoxOS, Solaris, and OS/2 Warp? I'm honestly asking: what is the alternative you're proposing? If you're just saying "it's not easy enough", well, that's a matter of opinion.
  - 4y ago