8 ms·

Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access) In other words,

by saulrh 14y ago

Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access) In other words, Microsoft won. Not only have they made Linux significantly more difficult to develop and use, they have managed to actually extract money from open-source developers. This is why MS has such a bad reputation.

InclinedPlane 14y ago
I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That doesn't sound like MS is going to be living high off the hog from those proceeds, it sounds like a reasonable fee to prevent abuse of the system. Also, as far as I can tell a user (or an OEM) can just go into their UEFI settings and turn off secure boot, then install and boot completely unsigned anything. This doesn't seem like the end of the world to me.
- slowpoke 14y ago
  >I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That's besides the point. It's that Microsoft - a software vendor - is suddenly the authority over distributing and signing keys for what amounts to a hardware lock mechanism that prevents you from doing whatever the fuck you want with your computer, all in the name of a false pretext of security. This is insanity. >Also, as far as I can tell a user (or an OEM) can just go into their UEFI settings and turn off secure boot, then install and boot completely unsigned anything. The problem is with what you've conveniently placed into parentheses - if the OEM decides to not give you the ability to turn it off, you're fucked. A hardware vendor should not have the ability to tell me what the fuck I can run off it. I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮
  - cooldeal 14y ago
    >all in the name of a false pretext of security How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run. It's funny because many of same people attacking Microsoft here turn around and claim that Microsoft software is insecure and recommend you switch to OS X/Linux! >if the OEM decides to not give you the ability to turn it off, you're fucked In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway.
    - fpgeek 14y ago
      > In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway. On x86, for now. Don't forget that the exact opposite is required on ARM. And there's no reason why Microsoft can't change the requirements for Windows 9 (when it will be harder to do something about the situation because Microsoft's keys will be widely used).
      - cooldeal 14y ago
        >And there's no reason why Microsoft can't change the requirements for Windows 9 First of all, the requirements are only recommendations in order for the OEMs to slap a Windows sticker on it. They can't require or not require anything of the OEMs, because they're legally barred from doing so. They could do anything for Windows 9, if they last that long in the Post-PC era. It's a moot point. And ARM is a red herring, it's a totally new platform and MS could be subsidizing the hardware and/or OS license fees in exchange for App Store revenue (like Kindle Fire), so they lose out if the user swaps the OS. Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on?
        14y ago
  - lloeki 14y ago
    > I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮ It worked for Apple on iOS devices. Macs are fully open, despite having TPM devices and a potential trusted boot chain for some time.
recoiledsnake 14y ago
Why don't you come up with a solution to avoid boot time undetectable rootkits instead of railing against big bad MS? >they have managed to actually extract money from open-source developers Yes, I am sure Microsoft is laughing all the way to the bank with the $99 that RedHat is going to pay them. I doubt that program will even cover its cost to MS.
- nitrogen 14y ago
  Do it the same, but place certificate signing under the control of a neutral party, and mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates.
  - recoiledsnake 14y ago
    >mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates. Do you realize that Microsoft has done exactly that? There's so much hot air here that facts are getting lost in the blind raging and hating. Of course, they cannot dictate to OEMs because of the antitrust lawsuits, but it's a requirement if they want the PC to be Windows Certified and carry the Windows sticker.
    - InclinedPlane 14y ago
      I'm not a fan of the way secure boot has been playing out, but I don't see any evidence of MS villainy in it. It's crazy how much irrational ill-will is stored out there against anything MS does.
      - fpgeek 14y ago
        I'd say plenty of the ill-will isn't irrational. Microsoft did spend roughly two decades or so earning it, after all.
zokier 14y ago
You know that MS makes more money from Android licencing than they do from their own WP7 sales? They have managed to extract money from open-source for some time now.
boring 14y ago
Actually, the money goes to Verisign for the signing cert - not MS. So its those guys you need to chase after with the pitch-forks ;-)

by saulrh 14y ago

InclinedPlane 14y ago

I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That doesn't sound like MS is going to be living high off the hog from those proceeds, it sounds like a reasonable fee to prevent abuse of the system. Also, as far as I can tell a user (or an OEM) can just go into their UEFI settings and turn off secure boot, then install and boot completely unsigned anything. This doesn't seem like the end of the world to me.

slowpoke 14y ago
>I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That's besides the point. It's that Microsoft - a software vendor - is suddenly the authority over distributing and signing keys for what amounts to a hardware lock mechanism that prevents you from doing whatever the fuck you want with your computer, all in the name of a false pretext of security. This is insanity. >Also, as far as I can tell a user (or an OEM) can just go into their UEFI settings and turn off secure boot, then install and boot completely unsigned anything. The problem is with what you've conveniently placed into parentheses - if the OEM decides to not give you the ability to turn it off, you're fucked. A hardware vendor should not have the ability to tell me what the fuck I can run off it. I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮
- cooldeal 14y ago
  >all in the name of a false pretext of security How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run. It's funny because many of same people attacking Microsoft here turn around and claim that Microsoft software is insecure and recommend you switch to OS X/Linux! >if the OEM decides to not give you the ability to turn it off, you're fucked In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway.
  - fpgeek 14y ago
    > In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway. On x86, for now. Don't forget that the exact opposite is required on ARM. And there's no reason why Microsoft can't change the requirements for Windows 9 (when it will be harder to do something about the situation because Microsoft's keys will be widely used).
    - cooldeal 14y ago
      >And there's no reason why Microsoft can't change the requirements for Windows 9 First of all, the requirements are only recommendations in order for the OEMs to slap a Windows sticker on it. They can't require or not require anything of the OEMs, because they're legally barred from doing so. They could do anything for Windows 9, if they last that long in the Post-PC era. It's a moot point. And ARM is a red herring, it's a totally new platform and MS could be subsidizing the hardware and/or OS license fees in exchange for App Store revenue (like Kindle Fire), so they lose out if the user swaps the OS. Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on?
      - 14y ago
- lloeki 14y ago
  > I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮ It worked for Apple on iOS devices. Macs are fully open, despite having TPM devices and a potential trusted boot chain for some time.

recoiledsnake 14y ago

Why don't you come up with a solution to avoid boot time undetectable rootkits instead of railing against big bad MS? >they have managed to actually extract money from open-source developers Yes, I am sure Microsoft is laughing all the way to the bank with the $99 that RedHat is going to pay them. I doubt that program will even cover its cost to MS.

nitrogen 14y ago
Do it the same, but place certificate signing under the control of a neutral party, and mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates.
- recoiledsnake 14y ago
  >mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates. Do you realize that Microsoft has done exactly that? There's so much hot air here that facts are getting lost in the blind raging and hating. Of course, they cannot dictate to OEMs because of the antitrust lawsuits, but it's a requirement if they want the PC to be Windows Certified and carry the Windows sticker.
  - InclinedPlane 14y ago
    I'm not a fan of the way secure boot has been playing out, but I don't see any evidence of MS villainy in it. It's crazy how much irrational ill-will is stored out there against anything MS does.
    - fpgeek 14y ago
      I'd say plenty of the ill-will isn't irrational. Microsoft did spend roughly two decades or so earning it, after all.

zokier 14y ago

You know that MS makes more money from Android licencing than they do from their own WP7 sales? They have managed to extract money from open-source for some time now.

boring 14y ago

Actually, the money goes to Verisign for the signing cert - not MS. So its those guys you need to chase after with the pitch-forks ;-)