3 ms·

> Microsoft will never create a situation where alternative operating systems can’t be installed. They already went through the antitrust ringer on that issue.

> Microsoft will never create a situation where alternative operating systems can’t be installed. They already went through the antitrust ringer on that issue. They have shipped ARM Surfaces where alternative operating systems could not get installed, enforced with Secure Boot permanently on. Have they been through any such "antitrust ringer" in the past 10 years? > Also, if you have a PC with secure boot enabled, there are popular Linux distributions like Ubuntu that have a signed key Note that there's one key MS uses for Windows and one key they use for everything else. They actually advise OEMs not to install this second key by default ("Secured Core" PCs), and some vendors have followed the advice, such as Lenovo. Resulting in yet another hoop to install non-MS OSes. Even recently, a Windows update added a number of Linux distributions to the Secure Boot blacklist, resulting in working dual boot systems being suddenly cripped. Of course, even _ancient_ MS OSes are never going to be blacklisted.

ZeroWidthJoiner 2y ago
> They actually advise OEMs not to install this second key by default ("Secured Core" PCs), and some vendors have followed the advice, such as Lenovo. Resulting in yet another hoop to install non-MS OSes. True, 3rd party not trusted by default is a "Secured-Core PC" requirement, but so is the BIOS option for enabling that trust [0]. On my "Secured-Core" ARM ThinkPad T14s it's a simple toggle option. > Even recently, a Windows updated added a number of Linux distributions to the Secure Boot blacklist, resulting in working dual boot systems being suddenly cripped. Of course, _ancient_ MS OSes are never going to be blacklisted. Actually they are in the process of blacklisting their currently used 2011 Windows certificate, i.e. the Microsoft cert installed on every pre-~2024 machine, also invalidating all Windows boot media not explicitly created with the new cert. It's a manually initiated process for now, with an automatic rollout coming later [1]. It'll be very interesting to watch how well that's going to work on such a massive scale. :) [0] https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... [1] https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d https://support.microsoft.com/en-us/topic/kb5025885-how-to-m...
- AshamedCaptain 2y ago
  > True, 3rd party not trusted by default is a "Secured-Core PC" requirement, but so is the BIOS option for enabling that trust As I said, yet another increase in the number of hops for no reason. Before you say anything else: until this you could install _signed_ Linux distributions without even knowing how to enter your computer's firmware setup. Now you can't. The trend is obviously there. First, MS forced Linux distributions to go through arbitrary "security" hoops in order to be signed. Then, MS arbitrary altered the deal anyway. Even mjg59 ranted about this. And the only recourse MS offers to Linux distributions is to pray MS doesn't alter the deal any further. Maybe at no point they will make it impossible on x86 PCs, but they just have to keep making it scary enough. And in the meanwhile keep advertising how WSL fits all your Linux-desktop computing needs. While at the same time claim they have nothing against opensource. > Actually they are in the process of blacklisting their currently used 2011 Windows certificate No, they are NOT in the process, and that is precisely what I was referring to. They have not even announced when they are going to even start doing the process. All you quoted is instructions to do it manually. So I'll believe it when I see it. And besides, just clearing the CMOS is likely to get you a nice ancient DBX containing only some grub hashes on it, and the Windows MS signature on DB. Not so much luck for the MS UEFI CA signature, as discussed above. So "recovery" will be trivial for Windows, not so much for anyone else..
delfinom 2y ago
You can in fact disable secure boot on the arm surfaces. The problem is nobody really has put enough effort to port Linux to it. Some people started but haven't gotten very far https://github.com/orgs/linux-surface/projects/1 https://github.com/orgs/linux-surface/projects/1 https://github.com/linux-surface/aarch64-firmware https://github.com/linux-surface/aarch64-firmware https://github.com/linux-surface/aarch64-packages https://github.com/linux-surface/aarch64-packages >, a Windows update added a number of Linux distributions to the Secure Boot blacklist It was due to a bug/and or not being able to detect all manners of dual boot correctly. The goal was not to blacklist old distros, it was to blacklist vulnerable boot managers Microsoft's response and fixes were provided: https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-23h2#august-2024-security-update-might-impact-linux-boot-in-dual-boot-setup-devices https://learn.microsoft.com/en-us/windows/release-health/sta...
- AshamedCaptain 2y ago
  > You can in fact disable secure boot on the arm surfaces. Not all. I know for a fact you could not in the RT/2. This is despite the fact that people _do put effort_. This is how I know, for example, that some Linux workarounds for "funny" ACPI interpretations had to be also "ported" to the ARM architecture in ACPI ARM Linux because Windows is literally making the same "bugs" all over again. Except, this time, Windows hardware is in the _minority_, and there's plenty of ARM ACPI devices that do not require these workarounds... > It was due to a bug/and or not being able to detect all manners of dual boot correctly. Sure. It is also a bug they just applied these blacklists automatically in the first place? It is also a bug that the list of blacklisted bootloaders mostly comprises non-MS oses, despite the fact there are well-known issues in many Windows versions?

ZeroWidthJoiner 2y ago

> They actually advise OEMs not to install this second key by default ("Secured Core" PCs), and some vendors have followed the advice, such as Lenovo. Resulting in yet another hoop to install non-MS OSes. True, 3rd party not trusted by default is a "Secured-Core PC" requirement, but so is the BIOS option for enabling that trust [0]. On my "Secured-Core" ARM ThinkPad T14s it's a simple toggle option. > Even recently, a Windows updated added a number of Linux distributions to the Secure Boot blacklist, resulting in working dual boot systems being suddenly cripped. Of course, _ancient_ MS OSes are never going to be blacklisted. Actually they are in the process of blacklisting their currently used 2011 Windows certificate, i.e. the Microsoft cert installed on every pre-~2024 machine, also invalidating all Windows boot media not explicitly created with the new cert. It's a manually initiated process for now, with an automatic rollout coming later [1]. It'll be very interesting to watch how well that's going to work on such a massive scale. :) [0] https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... [1] https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d https://support.microsoft.com/en-us/topic/kb5025885-how-to-m...

AshamedCaptain 2y ago
> True, 3rd party not trusted by default is a "Secured-Core PC" requirement, but so is the BIOS option for enabling that trust As I said, yet another increase in the number of hops for no reason. Before you say anything else: until this you could install _signed_ Linux distributions without even knowing how to enter your computer's firmware setup. Now you can't. The trend is obviously there. First, MS forced Linux distributions to go through arbitrary "security" hoops in order to be signed. Then, MS arbitrary altered the deal anyway. Even mjg59 ranted about this. And the only recourse MS offers to Linux distributions is to pray MS doesn't alter the deal any further. Maybe at no point they will make it impossible on x86 PCs, but they just have to keep making it scary enough. And in the meanwhile keep advertising how WSL fits all your Linux-desktop computing needs. While at the same time claim they have nothing against opensource. > Actually they are in the process of blacklisting their currently used 2011 Windows certificate No, they are NOT in the process, and that is precisely what I was referring to. They have not even announced when they are going to even start doing the process. All you quoted is instructions to do it manually. So I'll believe it when I see it. And besides, just clearing the CMOS is likely to get you a nice ancient DBX containing only some grub hashes on it, and the Windows MS signature on DB. Not so much luck for the MS UEFI CA signature, as discussed above. So "recovery" will be trivial for Windows, not so much for anyone else..

delfinom 2y ago

You can in fact disable secure boot on the arm surfaces. The problem is nobody really has put enough effort to port Linux to it. Some people started but haven't gotten very far https://github.com/orgs/linux-surface/projects/1 https://github.com/orgs/linux-surface/projects/1 https://github.com/linux-surface/aarch64-firmware https://github.com/linux-surface/aarch64-firmware https://github.com/linux-surface/aarch64-packages https://github.com/linux-surface/aarch64-packages >, a Windows update added a number of Linux distributions to the Secure Boot blacklist It was due to a bug/and or not being able to detect all manners of dual boot correctly. The goal was not to blacklist old distros, it was to blacklist vulnerable boot managers Microsoft's response and fixes were provided: https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-23h2#august-2024-security-update-might-impact-linux-boot-in-dual-boot-setup-devices https://learn.microsoft.com/en-us/windows/release-health/sta...

AshamedCaptain 2y ago
> You can in fact disable secure boot on the arm surfaces. Not all. I know for a fact you could not in the RT/2. This is despite the fact that people _do put effort_. This is how I know, for example, that some Linux workarounds for "funny" ACPI interpretations had to be also "ported" to the ARM architecture in ACPI ARM Linux because Windows is literally making the same "bugs" all over again. Except, this time, Windows hardware is in the _minority_, and there's plenty of ARM ACPI devices that do not require these workarounds... > It was due to a bug/and or not being able to detect all manners of dual boot correctly. Sure. It is also a bug they just applied these blacklists automatically in the first place? It is also a bug that the list of blacklisted bootloaders mostly comprises non-MS oses, despite the fact there are well-known issues in many Windows versions?