3 ms·

I run a project at my high school where students install linux on donated laptops, and use them for a variety of purposes. I read these articles and wonder if

by japhyr 14y ago

I run a project at my high school where students install linux on donated laptops, and use them for a variety of purposes. I read these articles and wonder if this project will come to a screeching halt. Since our donated laptops are usually 3-5 years old, it seems the project will be able to continue for about that long without any UEFI-related problems. It seems we will start having problems when UEFI-based laptops are old enough to start being donated to us. Is my understanding reasonable? It is pretty discouraging to think that this project will continue to evolve, only to hit a brick wall in the next 3-5 years.

deno 14y ago
You can disable secure boot, or if you can’t you’ll be able to install Fedora/RHEL, or sign your own OS (or Ubuntu) with Microsoft key (for a fee).
nicholassmith 14y ago
In 3-5 years time it'll have been solved I'd imagine, there's a lot of devs who'll invest time in over that period.
smacktoward 14y ago
It's bad, but not quite as bad as that. The UEFI spec doesn't explicitly disallow making Secure Boot a toggle-able option, so some OEMs (like Dell: http://www.osnews.com/story/25293/Dell_HP_Respond_to_Secure_Boot_Issue http://www.osnews.com/story/25293/Dell_HP_Respond_to_Secure_...) are planning to ship with it on but let you turn it off in the BIOS options if you want to. So someone technically knowledgeable could switch it off in your laptops before you hand them out to students. Still two big "ifs" there, though: 1) You can turn it off if the OEM gives you the option to, and OEMs are under no obligation to do so; and 2) All of the above is only true for x86 machines; for ARM-based systems, Microsoft is requiring that no option be provided for the user to disable Secure Boot (see http://blogs.computerworlduk.com/open-enterprise/2012/01/is-microsoft-blocking-linux-booting-on-arm-based-hardware/index.htm http://blogs.computerworlduk.com/open-enterprise/2012/01/is-...). So the upshot is that if your hardware comes from a cooperative OEM, and if it runs on x86, the impact on you will be minimal -- just flipping a switch. But ARM systems and systems from uncooperative OEMs will be locked, so you won't be able to assume that any laptop that comes in over the transom will be useful to you anymore. (ARM laptops are uncommon today, but after Windows RT launches they may become more common.) EDIT: Looks like since the last time I looked at this issue MS made it mandatory for OEMs to allow users to be able to turn off Secure Boot on x86, see comments below. So having to worry about which OEMs allow it and which don't isn't an issue. ARM systems still can't let users disable it, though.
- zokier 14y ago
  >1) You can turn it off if the OEM gives you the option to, and OEMs are under no obligation to do so; and Wrong. >Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems. Source: Windows Hardware Certification requirements http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 http://msdn.microsoft.com/en-us/library/windows/hardware/jj1...
  - smacktoward 14y ago
    Well that's a relief! My recollection was based on the last burst of news coverage on the issue late last year; it sounds like Linux vendors like Red Hat worked with Microsoft on the issue between now and then (Red Hat this month: "the Linux Foundation, hardware partners, and Microsoft to collaboratively develop a UEFI secure boot mechanism that allows user/customer choice and ease of use" -- http://www.redhat.com/about/news/archive/2012/6/uefi-secure-boot http://www.redhat.com/about/news/archive/2012/6/uefi-secure-...), so it may be that the ambiguity was present in older MS certification specs but got cleared up later on...
  - japhyr 14y ago
    Does this mean you'd just toggle a BIOS setting to disable secure booting?
    - zokier 14y ago
      s/BIOS/UEFI/ Yes, that is exactly what it means.

by japhyr 14y ago

deno 14y ago

You can disable secure boot, or if you can’t you’ll be able to install Fedora/RHEL, or sign your own OS (or Ubuntu) with Microsoft key (for a fee).

nicholassmith 14y ago

In 3-5 years time it'll have been solved I'd imagine, there's a lot of devs who'll invest time in over that period.

smacktoward 14y ago

It's bad, but not quite as bad as that. The UEFI spec doesn't explicitly disallow making Secure Boot a toggle-able option, so some OEMs (like Dell: http://www.osnews.com/story/25293/Dell_HP_Respond_to_Secure_Boot_Issue http://www.osnews.com/story/25293/Dell_HP_Respond_to_Secure_...) are planning to ship with it on but let you turn it off in the BIOS options if you want to. So someone technically knowledgeable could switch it off in your laptops before you hand them out to students. Still two big "ifs" there, though: 1) You can turn it off if the OEM gives you the option to, and OEMs are under no obligation to do so; and 2) All of the above is only true for x86 machines; for ARM-based systems, Microsoft is requiring that no option be provided for the user to disable Secure Boot (see http://blogs.computerworlduk.com/open-enterprise/2012/01/is-microsoft-blocking-linux-booting-on-arm-based-hardware/index.htm http://blogs.computerworlduk.com/open-enterprise/2012/01/is-...). So the upshot is that if your hardware comes from a cooperative OEM, and if it runs on x86, the impact on you will be minimal -- just flipping a switch. But ARM systems and systems from uncooperative OEMs will be locked, so you won't be able to assume that any laptop that comes in over the transom will be useful to you anymore. (ARM laptops are uncommon today, but after Windows RT launches they may become more common.) EDIT: Looks like since the last time I looked at this issue MS made it mandatory for OEMs to allow users to be able to turn off Secure Boot on x86, see comments below. So having to worry about which OEMs allow it and which don't isn't an issue. ARM systems still can't let users disable it, though.

zokier 14y ago
>1) You can turn it off if the OEM gives you the option to, and OEMs are under no obligation to do so; and Wrong. >Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems. Source: Windows Hardware Certification requirements http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 http://msdn.microsoft.com/en-us/library/windows/hardware/jj1...
- smacktoward 14y ago
  Well that's a relief! My recollection was based on the last burst of news coverage on the issue late last year; it sounds like Linux vendors like Red Hat worked with Microsoft on the issue between now and then (Red Hat this month: "the Linux Foundation, hardware partners, and Microsoft to collaboratively develop a UEFI secure boot mechanism that allows user/customer choice and ease of use" -- http://www.redhat.com/about/news/archive/2012/6/uefi-secure-boot http://www.redhat.com/about/news/archive/2012/6/uefi-secure-...), so it may be that the ambiguity was present in older MS certification specs but got cleared up later on...
- japhyr 14y ago
  Does this mean you'd just toggle a BIOS setting to disable secure booting?
  - zokier 14y ago
    s/BIOS/UEFI/ Yes, that is exactly what it means.