4 ms·

>I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That's besides the point. It's that Microsoft - a softwar

>I don't get it. My reading is that MS will sign Linux distros for a lifetime fee of $100 per vendor. That's besides the point. It's that Microsoft - a software vendor - is suddenly the authority over distributing and signing keys for what amounts to a hardware lock mechanism that prevents you from doing whatever the fuck you want with your computer, all in the name of a false pretext of security. This is insanity. >Also, as far as I can tell a user (or an OEM) can just go into their UEFI settings and turn off secure boot, then install and boot completely unsigned anything. The problem is with what you've conveniently placed into parentheses - if the OEM decides to not give you the ability to turn it off, you're fucked. A hardware vendor should not have the ability to tell me what the fuck I can run off it. I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮

cooldeal 14y ago
>all in the name of a false pretext of security How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run. It's funny because many of same people attacking Microsoft here turn around and claim that Microsoft software is insecure and recommend you switch to OS X/Linux! >if the OEM decides to not give you the ability to turn it off, you're fucked In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway.
- fpgeek 14y ago
  > In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway. On x86, for now. Don't forget that the exact opposite is required on ARM. And there's no reason why Microsoft can't change the requirements for Windows 9 (when it will be harder to do something about the situation because Microsoft's keys will be widely used).
  - cooldeal 14y ago
    >And there's no reason why Microsoft can't change the requirements for Windows 9 First of all, the requirements are only recommendations in order for the OEMs to slap a Windows sticker on it. They can't require or not require anything of the OEMs, because they're legally barred from doing so. They could do anything for Windows 9, if they last that long in the Post-PC era. It's a moot point. And ARM is a red herring, it's a totally new platform and MS could be subsidizing the hardware and/or OS license fees in exchange for App Store revenue (like Kindle Fire), so they lose out if the user swaps the OS. Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on?
    - fpgeek 14y ago
      > Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on? Some people are interested in dual-booting Windows and "something else" (Android, Ubuntu, ...) on ARM devices. Historically, dual-booting has an important source of Linux users. Microsoft's current policies for ARM prevent that (absent bootloader hacks, of course). Beyond that, if subsidies are really the underlying issue, why not permit customers to "buy off" the bootloader lock (i.e. pay to get permission to install their own keys as well)? Or at least move to that policy after the initial uproar? I think that the reason is that there are more than subsidies at stake here. I think the simplest explanation is that Microsoft wants to establish different default expectations for the "Post-PC era".
  - InclinedPlane 14y ago
    > And there's no reason why Microsoft can't change the requirements for Windows 9... Right, and there's no reason why Microsoft can't suddenly start eating babies as a matter of corporate policy next year. This is just FUD.
    - fpgeek 14y ago
      Well, there are a wide variety of legal, PR and other reasons why Microsoft couldn't start eating bablies as a matter of corporate policy. More to the point, Microsoft doesn't have a current policy about eating babies with ARM CPUs. They do have a current policy about locking the bootloaders of ARM devices.
- krakensden 14y ago
  > How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run And not all rootkits modify the kernel image. And if there is a bug in the bootloader (and there is always a bug in the bootloader), you're back to square one anyhow.
lloeki 14y ago
> I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮ It worked for Apple on iOS devices. Macs are fully open, despite having TPM devices and a potential trusted boot chain for some time.

cooldeal 14y ago

>all in the name of a false pretext of security How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run. It's funny because many of same people attacking Microsoft here turn around and claim that Microsoft software is insecure and recommend you switch to OS X/Linux! >if the OEM decides to not give you the ability to turn it off, you're fucked In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway.

fpgeek 14y ago
> In order to qualify for the Windows Logo, OEMs are REQUIRED by Microsoft to give the user the ability to turn it off or add their own keys. As such, UEFI software will have this feature anyway, so I seriously doubt any OEM would not do that, since they aren't saving anything and only the tech savvy will mess with the settings anyway. On x86, for now. Don't forget that the exact opposite is required on ARM. And there's no reason why Microsoft can't change the requirements for Windows 9 (when it will be harder to do something about the situation because Microsoft's keys will be widely used).
- cooldeal 14y ago
  >And there's no reason why Microsoft can't change the requirements for Windows 9 First of all, the requirements are only recommendations in order for the OEMs to slap a Windows sticker on it. They can't require or not require anything of the OEMs, because they're legally barred from doing so. They could do anything for Windows 9, if they last that long in the Post-PC era. It's a moot point. And ARM is a red herring, it's a totally new platform and MS could be subsidizing the hardware and/or OS license fees in exchange for App Store revenue (like Kindle Fire), so they lose out if the user swaps the OS. Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on?
  - fpgeek 14y ago
    > Why is ARM such a big issue when there are about 200 different kinds of Android ARM tablets out there that you can install Ubuntu on? Some people are interested in dual-booting Windows and "something else" (Android, Ubuntu, ...) on ARM devices. Historically, dual-booting has an important source of Linux users. Microsoft's current policies for ARM prevent that (absent bootloader hacks, of course). Beyond that, if subsidies are really the underlying issue, why not permit customers to "buy off" the bootloader lock (i.e. pay to get permission to install their own keys as well)? Or at least move to that policy after the initial uproar? I think that the reason is that there are more than subsidies at stake here. I think the simplest explanation is that Microsoft wants to establish different default expectations for the "Post-PC era".
- InclinedPlane 14y ago
  > And there's no reason why Microsoft can't change the requirements for Windows 9... Right, and there's no reason why Microsoft can't suddenly start eating babies as a matter of corporate policy next year. This is just FUD.
  - fpgeek 14y ago
    Well, there are a wide variety of legal, PR and other reasons why Microsoft couldn't start eating bablies as a matter of corporate policy. More to the point, Microsoft doesn't have a current policy about eating babies with ARM CPUs. They do have a current policy about locking the bootloaders of ARM devices.
krakensden 14y ago
> How is it false? Rootkits are a real danger, because they can be undetectable by any antivirus you can run And not all rootkits modify the kernel image. And if there is a bug in the bootloader (and there is always a bug in the bootloader), you're back to square one anyhow.

lloeki 14y ago

> I'll admit that this is getting into slippery slope territory, but I can see a lot of OEMs using this "feature" because, hey, it worked for Apple - it can't be that bad⸮ It worked for Apple on iOS devices. Macs are fully open, despite having TPM devices and a potential trusted boot chain for some time.