6 ms·

"Booting our CDs will rely on a loader image signed by Microsoft's WinQual key...the UEFI specification only allows an image to be signed by a single key." Thi

• rplnt 14y ago
  Some other organization could (should) take over but we see how that works with DNS - not so well.
• maxerickson 14y ago
  Microsoft is requiring companies that want a 'Works with Windows 8' sticker to, um, work with Windows 8. The logo program doesn't stop manufacturers creating similar unstickered hardware or putting more than one key in the stickered hardware.
  • andrewaylett 14y ago
    That's orthogonal: the issue here is that if you want to sign a bootloader (or anything else) then you can only do it with a single key. While there's nothing stopping Win8 stickered machines containing two keys, you can be sure that not all of them will, so you need to sign your code with a Microsoft-derived key if you want it to work everywhere. That means you can't sign it with your own key.
  • sounds 14y ago
    Although I would like to agree with you, I'm not convinced. The reason Ubuntu (and Red Hat) aren't pushing to get their key included in the hardware is clear from the article: "Microsoft's WinQual key, for much the same reasons as Fedora: it's a key that, realistically, more or less every off-the-shelf system is going to have, as it also signs things like option ROMs, and the UEFI specification only allows an image to be signed by a single key." The Microsoft WinQual key monopoly is there because option ROMs (and other drivers) are only given one slot for a signature. After Microsoft signs the ROM, the manufacturer _can't_ add a Red Hat or Ubuntu signature to the drivers for their hardware. This means even if you convinced all the manufacturers to include, say, a Ubuntu key, you still couldn't verify option ROMs were secure. Only Microsoft's key would work for that - thus, Microsoft's key will be the only one installed by the manufacturers. Your next solution - creating unstickered hardware - is not a solution. There are a few manufacturers offering a linux option (Dell, Lenovo), and a few who sell only linux hardware (system76.com). In a UEFI secure boot world, there would be < 1% of hardware that wasn't locked to Microsoft's key, while 99%+ would be locked. I know users are supposed to be able to access a BIOS screen to disable secure boot, but that makes installing Linux much more painful than installing Windows 8. Why cede the advantage to Microsoft? The best way to fight this, I believe, is to put your time and resources into coreboot.org and the FSF.
    • maxerickson 14y ago
      I'm not arguing that unstickered hardware solves anything, I'm arguing that it is hard to construe the sticker program as anti-competitive. As long as the stickered hardware can boot anything, then it is a reach to say that it is harming anyone (I don't find the confusion and unnecessary difficulty arguments very compelling, people that have difficulty twiddling the bios are going to run into problems anyway). I don't understand the details of the option rom stuff, but my superficial impression is that no other entity is particularly motivated to run a meaningful program for signing such code. And it's still an open question if Microsoft can run such a program and have it end up meaning anything.
      • sounds 14y ago
        I don't have to convince you that "it is harming anyone" (your words). You have to convince me that Microsoft's UEFI Secure Boot requirements aren't a threat to Software Freedom (as defined by the FSF). Otherwise, Microsoft, Secure Boot-enabled laptops, and anything with a Windows 8 sticker will continue to get lots of bad press.
        • maxerickson 14y ago
          The context of my comment was someone labeling the practice anti-competitive. That's where harm comes into the picture. I'm sure that the stuff will continue to get bad press, the idea of centrally controlled hardware is offensive to a large chunk of the people that bother to think about it.
          • beagle3 14y ago
            Anti-competitive includes future harm. The way bundling IE was found anticompetitive by US and EU courts. Specifically, it is illegal to leverage monopoly in one market to gain entry to others - because history has shown that this is always abused and eventually harms society.
        • cooldeal 14y ago
          >Otherwise, Microsoft, Secure Boot-enabled laptops, and anything with a Windows 8 sticker will continue to get lots of bad press. The iPad and iPhone got loads of bad press about the lockdown, the 30% cut of all in app payments and rejecting things like Android magazine apps and a bunch of other stuff. And Apple still can barely keep up with the demand. I think consumers have been conditioned by iOS not to think about openness.
  • Gormo 14y ago
    > The logo program doesn't stop manufacturers creating similar unstickered hardware Effectively, it does. Microsoft routinely audits OEMs' products for logo/MDA compliance, and if any product offered under the same brand name fails the audit, then the entire company could lose all of its MS 'discounts' (that they've already likely baked into their cost accounting.) In other words, if MS audits you, and any of your products fail the audit, then your unit cost for Windows licenses goes up significantly across all of your product lines. It's very difficult for an OEM to simultaneously offer some products which are covered by the MS logo agreement and some which aren't. Source: I used to work for a large OEM, and dealt with MS logo compliance on a daily basis.
• adambyrtek 14y ago
  I'm surprised that Microsoft pushes this in such a blunt way. They could have at least created a semi-independent non-profit to take care of signing. It seems like EFF or some other organization should push for antitrust investigation on this issue.
  • wmf 14y ago
    Those who benefit from such an independent organization aren't willing to pay for it.
• beagle3 14y ago
  I'm willing to put a few K$ towards the cause of starting an antitrust inquiry against Microsoft for this (and the related ARM landgrab). Any lawyer (or otherwise knowledgeable non-armchair HNers) knows how I can go about that? Given that the EU and China antitrust authorities also need to okay things these days, I believe that the we should bring the legal fight to MS, rather than receive the technical battle and fight it on our turf.
  • cooldeal 14y ago
    It's my opinion that you should look deeper into the issues than just skimming it before throwing thousands of dollars away. First, Microsoft has mandated(as much as they can mandate to OEMs without violating antitrust!) that in order to receive Windows 8 logo certification, the OEM must provide a way for a physically present user to turn off UEFI secure boot in the setup menu and for that user to be able to add remove signing keys(including removing Microsoft's key!) at their will. Coming to ARM and Windows RT, perhaps your antitrust inquiry might want to look at the elephant in the HN discussion - Apple - first, instead of being laughed out of the courtroom about picking on a platform with 0% marketshare compared to a platform which does the same thing with ~80% marketshare and >90% profit share. Coming to actual meaningful things that can be accomplished for F/OSS desktop, you might want to consider reading the Red Hat blog post about secure boot. OEMs are willing to add signing keys of other players, but no one is interested in starting or running an operation that can sign F/OSS kernels with their key(after checking if that it's not malware). Perhaps your few K$ might be better spent on such a nonprofit organization or division of the Linux foundation instead of throwing it at lawyers? Just my thoughts.
    • beagle3 14y ago
      > Microsoft has mandated(as much as they can mandate to OEMs without violating antitrust!) And similarly, everyone can install the browser of their choice on Windows. But it was still an antitrust violation, because it was, in effect, leveraging a monopoly in one market (Operating Systems) to produce gains in another (Browsers). This is along the same lines, except it is using a monopoly in the Operating Systems market to farther same monopoly. > picking on a platform with 0% marketshare compared to a platform which does the same thing with ~80% marketshare and >90% profit share. There's a huge difference here; Apple makes both the software and the hardware. Microsoft makes software and forces hardware makers to comply. And no one would even care about that requirement, if it weren't for their desktop OS monopoly. Again, leveraging monopoly in one market to farther gains (limit competition) in another. It's not the 0% marketshare I care about. It's the monopoly abuse. And I don't think anyone has a reasonable legal complaint against Xbox360 not running Linux even if it were 90% of the console market. Apple sells (Hardware+Software) they make themselves. Xbox360 is (Hardware+Software) Microsoft makes themselves. This is NOT the situation in the PC or non-apple phone or non-apple tablet market. > OEMs are willing to add signing keys of other players, but no one is interested in starting or running an operation that can sign F/OSS kernels with their key(after checking if that it's not malware). Microsoft charging $100 for certifying something is not malware is a joke. As was mentioned earlier in this thread, it is much more likely that they are after pirate OEM Win7 activations. If I was a malware distributor, I would make sure that I submit - directly and indirectly - hundreds of bootloaders and kernels, many of them exploitable through buffer overflows or similar tactics. I've been burned too many times with hardware that supposedly worked but turned out to only work well under windows (With bad ACPI kernel tables, and other such stuff), to trust the theory that everything will work out well. The only way to fight this is legally. > Perhaps your few K$ might be better spent on such a nonprofit organization or division of the Linux foundation instead of throwing it at lawyers? Just my thoughts. I don't think so. EFF and ACLU, perhaps. edit: added note about xbox360