7 ms·

Not disagreeing with the general message, but IMHO if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't th

Not disagreeing with the general message, but IMHO if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal. As far as I'm concerned as long as it's possible to re-enable the 3rd Party CA (or disable Secure Boot altogether) it's not tragic considering this only applies to a specific kind of machines ("Secured Core PCs") and not to mainstream ones

jillesvangurp 4y ago
There's a difference between stick in a usb key to fiddle with bios in vendor specific way and then stick a usb key in. It's an extra hurdle. If your instructions read: "turn off secure boot", MS has already won. Some users will, most won't, and many company IT departments would not allow you to on principle (because it's company hardware and they want it secured because it is their problem if it isn't).
- Avamander 4y ago
  > If your instructions read: "turn off secure boot" That's the thing, you don't have to disable that. You just have to re-enable that CA if you have a model that has Device Guard enabled by default. > It's an extra hurdle. Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing.
  - noisy_boy 4y ago
    > Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing. That assertion is a bit too absolute; I am comfortable installing an OS using the USB installer because I have done it many times. I haven't had to change UEFI settings yet and I'm worried that doing something wrong will lock me out (in case of a botched OS install, I can just start over).
    - Avamander 4y ago
      Fair, that fear can be real, but it does sound rare and I think that's what the user manual is for. If we take the model the initial blogpost was about it's nicely documented: https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...
      - noisy_boy 4y ago
        I agree - based on the steps in the link, it is quite straightforward.
  - friendzis 4y ago
    > If you have the skillset to install an OS This is an extremely weird argument. So called Live CDs come from an era where CD drives were ubiquitous and even back then installing an OS (provided you did not want to install two OSes at the same time) was as simple as installing any other piece of software. If anything, with all these secure boot shenanigans it requires more skill to install an OS than when a smartphone was not even a thing. This argument advocates for walled-garden IT. This argument used in support of restrictions under the hood arguments for IT stuff to be hard in principle.
    - Avamander 4y ago
      Yes, the removal of CD/DVD-drives is as much of an obstacle to installing Linux as having to toggle a setting on a Windows-preinstalled machine that someone bought. You are also free to buy a SKU that doesn't come with a Windows license and Windows preinstallation. Also please keep in mind that it's not Secure Boot you have to disable, it's a CA you have to re-enable on machines that came with Device Guard pre-enabled.
      - friendzis 4y ago
        You miss the entirety of the point. Today you have a USB drive, nothing stops SOHO routers by default starting PXE server with latest distros which would be even easier to use. This is an artificial obstacle. You keep arguing all over the place that this is an insignificant obstacle, but do not address the very core of the debate: whether only MS keys being installed by default is for security purposes in the first place and whether it does actually increase security. We are not arguing how many hoops to install Linux (or whatever) is too much. we are arguing whether certain OSes should be easier to install at all.
        Avamander 4y ago
        Don't bring it up as an obstacle if it's not an obstacle, that you're instead concerned about Microsoft's keys. In that case though, it's not "only MS keys" really, it's not enabling one CA. In the end if there's a strong need, Canonical, Red Hat or the likes could start building their own CA and negotiate it to be included, would be very fair and probably wouldn't be affected by this toggle. But they do not seem interested however in the much easier MS UEFI CA-signed Secure Boot, Ubuntu does it fine, but Fedora can't sign DKMS modules and the rest are even worse. So the thing is, the problem of "trust" is very complex and putting in the work is very expensive. Microsoft has chosen to do this to improve their customers' security, they offer others the opportunity to participate and few are actually willing. That's not their fault really. In the end they'd get slapped so hard by antitrust if they ever truly removed that toggle and the option to run other software. (Unlike Apple or other mobile vendors, who can do whatever they wish, with no such uproar over what is way worse than the toggle discussed here.)
  - chrsw 4y ago
    >You just have to re-enable that CA if you have a model that has Device Guard enabled by default. I run Linux on a used ThinkPad I got on eBay and I have no idea what this sentence means.
isodev 4y ago
What matters more in this instance is the rhetoric and messaging being used. Microsoft is using "Secure-core" as a measurement and indicator of security posture while at the same time installing a Linux-based system somehow detracts from that objective. It's not just a matter of technical ability. Organizations and people, in general, will be exposed to this, which is simply not true. For enterprise IT, this will also mean that by default, they will need to justify alternatives, creating extra friction for competing solutions.
- Avamander 4y ago
  > Microsoft is using "Secure-core" as a measurement and indicator of security posture while at the same time installing a Linux-based system somehow detracts from that objective If you read what Secured Core or even Device Guard consists of, Linux actually does detract from it. I use Linux daily on all my machines, I have no sympathy towards Windows at all, but Linux has certainly fallen behind in some aspects - boot integrity and boot anti-tampering is one of those aspects. And that's not all Secured Core provides in the end.
  - R0b0t1 4y ago
    Linux has fallen behind in boot security and anti-tampering because all of the solutions in this area are proprietary and at least initially released under NDA. You're using the effects of this very program to justify itself.
    - Avamander 4y ago
      Firstly, it wasn't a justification, it was a description of the current state. Secondly, no, they aren't all proprietary. If we start from the bottom then Secure Boot is neither proprietary or NDA'd. There are even open-source implementations of Secure Boot. We simply have a significant amount of feet-dragging and misconceptions out there, pointlessly making using just SB alone difficult and not the default, you can see a bunch of it in this thread as well. I won't even get into measured boot to auto-unlock FDE/LUKS or god forbid LIM, those aren't difficult because of some supposedly NDA'd specifications. Damn, enabling IOMMU isn't that difficult either. Nobody else should be blamed for the poor state of those. Lastly, some standard being initially released under NDA or being proprietary (which ones do you actually have in mind?) is a terrible justification to not improve things. Or find alternatives just as good.
AshamedCaptain 4y ago
> if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal. It is trivially easy to boot from a USB pendrive; most computers will do it by default if there's no preinstalled OS, many devices have a hotkey you can press/hold which redirects towards booting from USB, and even Windows itself will outright let you do it from the Settings app. You don't even have to interact with the system firmware setup program. On the other hand, disabling secure boot (or taking ownership of it) is designed to be as difficult as possible, intentionally. Many vendors will actually have a Scary Boot Prompt or the like which makes you double-acknowledge when you change Secure Boot settings, and even reminds you (on every boot) that you have Secure Boot disabled. It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't. This puts a glass ceiling on non-MS operating systems regarding how easy their setup flow can be.
- jaywalk 4y ago
  > It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't Unfair? You're talking about systems that come with Windows pre-installed. Of course these systems are going to be configured for booting Windows out of the box.
  - esoterae 4y ago
    >> It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't >Unfair? You're talking about systems that come with Windows pre-installed. Of course these systems are going to be configured for booting Windows out of the box. I think it more _accurate_ to have said "of course these systems are going to be configured to boot nothing but Windows out of the box", which is ... drum roll please.. anti-competitive. Facially, and blatantly anti-competitive.
  - harry8 4y ago
    You're correct of course. Fair would be you can return the license to microsoft on purchase and claim the entire value of your refund. Microsoft have been engaging in the clearest anti-competitive behaviour for decades and it is grossly unfair on consumers, competitors and the industry as a whole. We really must not conflate "predictable behaviour" or "established behaviour" with "acceptable behaviour" in any part of life including corporate crime.
mjg59 4y ago
This is a brand new ThinkPad. It's not a low-end consumer device, but it's not some niche machine.
- Kipters 4y ago
  It is a niche compared to the millions of consumer laptops that are being sold though, as is the whole category
  - ungamedplayer 4y ago
    All these consumer laptops are niche compared to a 505 timer chip. Apply some basic logic to the conversation.
feanaro 4y ago
We shouldn't allow to inch towards this kind of situation if for nothing else than for not sliding the Overton window in the wrong direction. It's either a neutral organization signing certs which you then have to accept by default, or you get fined. Those are the only acceptable scenarios.
R0b0t1 4y ago
The deal is I want to control the secure boot process so that I can make the OS I choose secure. This is not always an option or possible.
- Kipters 4y ago
  In this case it is an option, you can still disable UEFI Secure Boot, re-enable the UEFI CA and enroll your own keys. The only thing that changes is a default in an option you would need to alter in any case if you wanted to control the boot yourself.

jillesvangurp 4y ago

There's a difference between stick in a usb key to fiddle with bios in vendor specific way and then stick a usb key in. It's an extra hurdle. If your instructions read: "turn off secure boot", MS has already won. Some users will, most won't, and many company IT departments would not allow you to on principle (because it's company hardware and they want it secured because it is their problem if it isn't).

Avamander 4y ago
> If your instructions read: "turn off secure boot" That's the thing, you don't have to disable that. You just have to re-enable that CA if you have a model that has Device Guard enabled by default. > It's an extra hurdle. Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing.
- noisy_boy 4y ago
  > Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing. That assertion is a bit too absolute; I am comfortable installing an OS using the USB installer because I have done it many times. I haven't had to change UEFI settings yet and I'm worried that doing something wrong will lock me out (in case of a botched OS install, I can just start over).
  - Avamander 4y ago
    Fair, that fear can be real, but it does sound rare and I think that's what the user manual is for. If we take the model the initial blogpost was about it's nicely documented: https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...
    - noisy_boy 4y ago
      I agree - based on the steps in the link, it is quite straightforward.
- friendzis 4y ago
  > If you have the skillset to install an OS This is an extremely weird argument. So called Live CDs come from an era where CD drives were ubiquitous and even back then installing an OS (provided you did not want to install two OSes at the same time) was as simple as installing any other piece of software. If anything, with all these secure boot shenanigans it requires more skill to install an OS than when a smartphone was not even a thing. This argument advocates for walled-garden IT. This argument used in support of restrictions under the hood arguments for IT stuff to be hard in principle.
  - Avamander 4y ago
    Yes, the removal of CD/DVD-drives is as much of an obstacle to installing Linux as having to toggle a setting on a Windows-preinstalled machine that someone bought. You are also free to buy a SKU that doesn't come with a Windows license and Windows preinstallation. Also please keep in mind that it's not Secure Boot you have to disable, it's a CA you have to re-enable on machines that came with Device Guard pre-enabled.
    - friendzis 4y ago
      You miss the entirety of the point. Today you have a USB drive, nothing stops SOHO routers by default starting PXE server with latest distros which would be even easier to use. This is an artificial obstacle. You keep arguing all over the place that this is an insignificant obstacle, but do not address the very core of the debate: whether only MS keys being installed by default is for security purposes in the first place and whether it does actually increase security. We are not arguing how many hoops to install Linux (or whatever) is too much. we are arguing whether certain OSes should be easier to install at all.
      - Avamander 4y ago
        Don't bring it up as an obstacle if it's not an obstacle, that you're instead concerned about Microsoft's keys. In that case though, it's not "only MS keys" really, it's not enabling one CA. In the end if there's a strong need, Canonical, Red Hat or the likes could start building their own CA and negotiate it to be included, would be very fair and probably wouldn't be affected by this toggle. But they do not seem interested however in the much easier MS UEFI CA-signed Secure Boot, Ubuntu does it fine, but Fedora can't sign DKMS modules and the rest are even worse. So the thing is, the problem of "trust" is very complex and putting in the work is very expensive. Microsoft has chosen to do this to improve their customers' security, they offer others the opportunity to participate and few are actually willing. That's not their fault really. In the end they'd get slapped so hard by antitrust if they ever truly removed that toggle and the option to run other software. (Unlike Apple or other mobile vendors, who can do whatever they wish, with no such uproar over what is way worse than the toggle discussed here.)
- chrsw 4y ago
  >You just have to re-enable that CA if you have a model that has Device Guard enabled by default. I run Linux on a used ThinkPad I got on eBay and I have no idea what this sentence means.

isodev 4y ago

What matters more in this instance is the rhetoric and messaging being used. Microsoft is using "Secure-core" as a measurement and indicator of security posture while at the same time installing a Linux-based system somehow detracts from that objective. It's not just a matter of technical ability. Organizations and people, in general, will be exposed to this, which is simply not true. For enterprise IT, this will also mean that by default, they will need to justify alternatives, creating extra friction for competing solutions.

Avamander 4y ago
> Microsoft is using "Secure-core" as a measurement and indicator of security posture while at the same time installing a Linux-based system somehow detracts from that objective If you read what Secured Core or even Device Guard consists of, Linux actually does detract from it. I use Linux daily on all my machines, I have no sympathy towards Windows at all, but Linux has certainly fallen behind in some aspects - boot integrity and boot anti-tampering is one of those aspects. And that's not all Secured Core provides in the end.
- R0b0t1 4y ago
  Linux has fallen behind in boot security and anti-tampering because all of the solutions in this area are proprietary and at least initially released under NDA. You're using the effects of this very program to justify itself.
  - Avamander 4y ago
    Firstly, it wasn't a justification, it was a description of the current state. Secondly, no, they aren't all proprietary. If we start from the bottom then Secure Boot is neither proprietary or NDA'd. There are even open-source implementations of Secure Boot. We simply have a significant amount of feet-dragging and misconceptions out there, pointlessly making using just SB alone difficult and not the default, you can see a bunch of it in this thread as well. I won't even get into measured boot to auto-unlock FDE/LUKS or god forbid LIM, those aren't difficult because of some supposedly NDA'd specifications. Damn, enabling IOMMU isn't that difficult either. Nobody else should be blamed for the poor state of those. Lastly, some standard being initially released under NDA or being proprietary (which ones do you actually have in mind?) is a terrible justification to not improve things. Or find alternatives just as good.

AshamedCaptain 4y ago

> if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal. It is trivially easy to boot from a USB pendrive; most computers will do it by default if there's no preinstalled OS, many devices have a hotkey you can press/hold which redirects towards booting from USB, and even Windows itself will outright let you do it from the Settings app. You don't even have to interact with the system firmware setup program. On the other hand, disabling secure boot (or taking ownership of it) is designed to be as difficult as possible, intentionally. Many vendors will actually have a Scary Boot Prompt or the like which makes you double-acknowledge when you change Secure Boot settings, and even reminds you (on every boot) that you have Secure Boot disabled. It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't. This puts a glass ceiling on non-MS operating systems regarding how easy their setup flow can be.

jaywalk 4y ago
> It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't Unfair? You're talking about systems that come with Windows pre-installed. Of course these systems are going to be configured for booting Windows out of the box.
- esoterae 4y ago
  >> It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't >Unfair? You're talking about systems that come with Windows pre-installed. Of course these systems are going to be configured for booting Windows out of the box. I think it more _accurate_ to have said "of course these systems are going to be configured to boot nothing but Windows out of the box", which is ... drum roll please.. anti-competitive. Facially, and blatantly anti-competitive.
- harry8 4y ago
  You're correct of course. Fair would be you can return the license to microsoft on purchase and claim the entire value of your refund. Microsoft have been engaging in the clearest anti-competitive behaviour for decades and it is grossly unfair on consumers, competitors and the industry as a whole. We really must not conflate "predictable behaviour" or "established behaviour" with "acceptable behaviour" in any part of life including corporate crime.

mjg59 4y ago

This is a brand new ThinkPad. It's not a low-end consumer device, but it's not some niche machine.

Kipters 4y ago
It is a niche compared to the millions of consumer laptops that are being sold though, as is the whole category
- ungamedplayer 4y ago
  All these consumer laptops are niche compared to a 505 timer chip. Apply some basic logic to the conversation.

feanaro 4y ago

We shouldn't allow to inch towards this kind of situation if for nothing else than for not sliding the Overton window in the wrong direction. It's either a neutral organization signing certs which you then have to accept by default, or you get fined. Those are the only acceptable scenarios.

R0b0t1 4y ago

The deal is I want to control the secure boot process so that I can make the OS I choose secure. This is not always an option or possible.

Kipters 4y ago
In this case it is an option, you can still disable UEFI Secure Boot, re-enable the UEFI CA and enroll your own keys. The only thing that changes is a default in an option you would need to alter in any case if you wanted to control the boot yourself.