11 ms·
FSF recommendations for free OS distributions considering Secure Boot
- CJefferson 14y agosigh While the FSF seems happy with the root Fedora is taken, it is interesting that every suggestion they make will make user's life harder. I realise that they want to make software more free, and that this is broadly all Microsoft's fault, but I'll be honest as the years go by, I just get... tired. I just want to be able to install Linux as easily as Windows, and have it just work. I don't want to have to install extra keys.
- deleted 14y ago[deleted]
- sp332 14y agoCrypto multiplies, or even exponentiates, the effort you take to secure something vs. the effort an attacker makes to break it. But if you put 0 effort into logging in to your computer (no password, or the same simple password for every website, etc.) it will be broken easily, because 0 to the power of anything is still 0. If your computer has restricted boot, your only options are to make some effort at keeping your computer secure, or let someone else make the decision of what to run on your computer. If you're looking for convenience at the expense of security, you should push back against Secure Boot being enabled by default (which Win8 "certification" mandates).
- ben0x539 14y agoThat's kinda backwards. It's not the FSF that is pushing Secure Boot to begin with, but it is the FSF that is pushing for everybody to be able to install their Linux as easily as Windows and not only Fedora or Ubuntu users.
- krupan 14y agoPlease direct all your sighs of discontent at Microsoft, not the FSF.
- rdl 14y agoI would prefer not to be "protected by a GPL licensed bootloader" from having a machine actually boot successfully under default conditions. Pretty much ok with Fedora and Ubuntu making the best of a somewhat bad situation. I wish they'd just fix the standard to allow multiple signatures on code and extensions, though. With that, Secure Boot would be basically all positive.
- icebraining 14y agoI would prefer not to be "protected by a GPL licensed bootloader" from having a machine actually boot successfully under default conditions. But Fedora's solution achieves both, so there's no need to leave GRUB2 for UEFI.
- earl 14y agoIt's amazing. I read the first 3 paragraphs and the eff can't even acknowledge how much of a problem malware is for many computer users. For the thousandth time: I know a computer user who almost had a $300k sum stolen because his laptop was owned. He has had to resort to having a second laptop used exclusively for accessing his business bank accounts in order to feel some security. He's not dumb: he makes more money than virtually anybody reading this and has an undergrad in math. The computer security model for most users is incredibly broken. The alternate to secure boot is something like an ios app store for all apps. Users simply want to be able to run their computers without having to be constantly paranoid about spyware and malware. Microsoft is at least trying to do this, but the eff pretty much dismisses these very real concerns. edit: for the record, I spelled fsf as eff before having my first cup of coffee.
- cletus 14y agoI've had similar thoughts. I can make a fairly strong case that the best platform for me to access sensitive information from is iOS (specifically my iPad). It's sandboxed and comparatively secure. Using Windows these days just seems like asking for trouble on the spyware/malware front. Some of it is your machine getting owned, other times its just missing a checkbox on a program install that installs a browser bar that does God knows what. My Macbook Air is pretty much my computer of choice these days (with very little third party software). Soon Apple will require sandboxing on the Mac App Store too. Linux of course also being a much better choice than Windows from a security point of view. On the browser front I can't see myself using anything other than Chrome. Part of this is feature-related and the whole one process per tab thing but it's also the most security-conscious browser IMHO (disclaimer: I work for Google but not on Chrome).
- gouranga 14y agoWe've got 135 on site users, 25 mobile users and about 500 windows machines and VMs floating around. We haven't had any machines "owned" at all...
- simonbrown 14y ago
- tzs 14y ago> Their stated concern is that someone might ship an Ubuntu Certified machine with Restricted Boot (where the user cannot disable it). In order to comply with GPLv3, Ubuntu thinks it would then have to divulge its private key so that users could sign and install modified software on the restricted system. > This fear is unfounded and based on a misunderstanding of GPLv3. We have not been able to come up with any scenario where Ubuntu would be forced to divulge a private signing key because a third-party computer manufacturer or distributor shipped Ubuntu on a Restricted Boot machine. That's because like pretty much everyone who is not the FSF, Ubuntu has not actually carefully read the part of GPLv3 that deals with software that requires signing in order to install. Almost everyone just seems to skim through that section, sees something about having to provide keys, and then moves on. They don't read the definitions that define the terminology used in that section, and so have no clue whatsoever about what they have just read means. I can kind of excuse it when it is just random end users or individual software developers who don't understand the license they are using...but one of the leading Linux companies!? Another place you see this problem is in discussion of the incompatibility between Apple's App Store and GPLv3. There are people who still think the signing requirements have something to do with it. They do not. The problem is Apple's terms and conditions, which Apple requires end users to agree to before being allowed to use the store, count as additional terms under GPL (both v2 and v3) that are incompatible with GPL. The GPLv3 restrictions on distributing signed code without the signing keys would only apply to GPLv3 code that Apple ships bundled with iOS devices.
- rlpb 14y ago> That's because like pretty much everyone who is not the FSF, Ubuntu has not actually carefully read the part of GPLv3 that deals with software that requires signing in order to install [...] I can kind of excuse it when it is just random end users or individual software developers who don't understand the license they are using...but one of the leading Linux companies!? Please give them more credit. Apparently, they have even discussed it with the FSF. From https://lists.ubuntu.com/archives/ubuntu-devel/2012-June/035448.html https://lists.ubuntu.com/archives/ubuntu-devel/2012-June/035...: Edit: failing to quote this sensibly. In response to: "Have you talked to the FSF about their position on this? They're the sole copyright holder of grub 2, so any position they'd publicly take would be pretty relevant in terms of potential legal action." The reply: "I haven't been privy to all the mails on this, but in the ones I saw, the responses were distinctly equivocal at best. They certainly didn't say that we were safe, rather the reverse."
- voodoochilo 14y agothe funny thing is that if everybody has this uefi stuff installed and active then the criminals will only target this "uefi technology" because there's no money to be made in attacking minorities' technologies. if everybody has it, everybody is an attractive victim. so, this whole uefi-brings-security-to-the-masses-argument is void given sufficient time.
- AmazingBytecode 14y agoWait, users can install new keys on their machines? What's the issue then?
- gpvos 14y agoPlease read more thoroughly. 1) If the user can, but is scared away by a disingenuous message saying "Do you want to make your computer less secure by installing a non-Microsoft key (y/n)?", that would still be bad. 2) They can't on ARM-based machines that have a Windows certification.
- recoiledsnake 14y ago>They can't on ARM-based machines that have a Windows certification. You cannot install an alternative OS on an iPad either which comes with a locked bootloader. Why is this such a big deal on Windows RT tablets only?
- abecedarius 14y agoFirst, Microsoft originally promised otherwise. "Pray I don't alter it any further." Second, I and others have complained about Apple's lockdown for years. There's more leverage right now in pressuring others not to follow their example.
- jtsagata 14y agoI don't own or plan to own an iPad. So the locking of the iPad is not affecting me directly. It is sad and silly imho that people is buying locked machines, but that's their right to do. Now ARM boot restrictions from Microsoft directly affects me, as soon i can't buy any ARM based machine, given the way the markets work. And in the future it is a big possibility that i can't buy any other PC and put any OS that i like without pay directly or indirectly money to Microsoft. And i can see some foreign governments to use this technology to control the OS that her citizens runs, and install backdoors. So yes UEFI secure boot is a treat to my freedom and not only my freedom to run the OS of my choice.
- deleted 14y ago[deleted]
- cs702 14y agoOne possible solution to this problem is for the FSF itself -- or perhaps another non-profit organization with similar goals but a more flexible stance -- to get in the business of issuing Secure-Boot keys, backed by a public written policy of non-discriminatory key issuance. Such an organization could work with non-mainstream operating systems to get hardware vendors to adopt its keys. For example, Ubuntu and Red Hat could use keys issued by it. All non-mainstream operating system projects would be able to request keys from this organization and boot without having to resort to tinkering in UEFI hardware from multiple vendors. One can dream.
- sounds 14y agoJust assuming that the current UEFI working group agreed to this, the first problem arises when one of the key holders is compromised. As a possible scenario: what if the Windows 8 private signing key leaked because it was used in Terminal Server somehow - do you want the FSF revoking the Microsoft signing key, thus invalidating UEFI signed drivers (necessary for boot) from hundreds of OEM's? We can shortcut all this by supporting www.coreboot.org
- cs702 14y agosounds: coreboot.org is a worthwhile cause but unfortunately, for better or worse, whether we like it or not, most hardware vendors have decided to adopt UEFI.
- tapoxi 14y agoI have a CR-48 and it already solves this problem. Joe User get a secure, verified boot path by default. If you want to bypass this and use your another operating system, load your own keys, or generally prove that you know what you're doing, you: 1. Flip the machine over. 2. Remove battery. 3. Flip the "developer's mode" switch.
- cooldeal 14y agoHow is that much different from flipping this switch in the bios settings? http://www.windowsfordevices.com/images/stories/samsung_secureboot.jpg http://www.windowsfordevices.com/images/stories/samsung_secu... Also, anyone having physical access to your Chromebook can flip that switch and compromise your machine. While you can set a bios setup password to guard against someone flipping the secure boot switch.
- stcredzero 14y ago> Also, anyone having physical access to your Chromebook can flip that switch and compromise your machine. Gain physical access to Any machine, and all security bets are off. > While you can set a bios setup password to guard against someone flipping the secure boot switch. Actually, that's a good point. But what if the attackers has physical access and simply reflashes the BIOS?
- cooldeal 14y ago>Gain physical access to Any machine, and all security bets are off. That's not guaranteed. For example, see Droid Milestone's locked bootloader and XBox 360 (recently broken with a cpu bug). >But what if the attackers has physical access and simply reflashes the BIOS? Security is all about raising the bar, reflashing takes a lot more time and effort than flipping a hardware switch and inserting a USB key. Also, a physical switch is harder to implement in a consistent manner for low margin OEMs(who all buy the firmware from the same source), thus a software setting is better. For example, including such a switch on a tablet like the Microsoft Surface Pro will increase the costs and restrict design.
- jtsagata 14y agoDo we really need UEFI? I believe that there is simpler ways to achieve this. For example: a. User turn ON a switch to enter "OS Install mode" b. User install the OS of his choice. During installation the installer read a motherboard specific key from the BIOS and sign his bootloader/kernel/drivers using that key. c. User turn OFF the "OS installation switch". System is save (at least as long as the OS in choice is not a Redmnond one) Is there any fundamental problems with this approach?
- wtracy 14y agoIt seems that UEFI is supposed to protect against malicious actors who have physical access to your machine. Of course, you're also assuming that securing the end-user is the actual goal of UEFI. ;-) I can see legitimate situations where a corporation would want to ensure that their employees aren't tampering with their hardware. Of course, I think it's fairly obvious by now that one of the main reasons that MS is pushing UEFI at this point is to prevent Android from being installed on "Windows" hardware.
- jtsagata 14y agoIf someone have physical access to my machine he/she can install keys if the BIOS supports that anyway. And even if it doesn't i have many more things to worry anyway. UEFI don't protect me from stealing the machine or the HD data or installing mallicius software. Of course, i totally agree with you on that the reall reasons is for MS and hardware manufactures is trying to control MY hardware.
- sseveran 14y agoIf this is such a huge deal and users don't like it then there should be a market for machines that are not Windows Logo certified and run Linux. Given that there does not seem to be such a large market maybe those people that want to install linux on their desktop would be willing to pay more for the opportunity to do so. Sandboxing has become increasingly popular and Microsoft is really the last one to the party. Most users (myself included) are happy with sandboxing. Apple has implemented this with great effect across its ecosystem. All the actors are private organizations. No one is forcing anyone to buy a computer that enforces any of these restrictions. The FSF should try to understand why if this is such an important issue there does not seem to be a large market for Linux desktops. If there is a private actor can step in and provide the machines. If not, then you can always build your own. One thing that will be interesting to see is if GPLv3 software slowly withers given that many embedded device makers will be unable to use it. I guess another cause may be Apple's continued rise as a platform of choice for both tablets and desktops/laptops.
- wmf 14y agomaybe those people that want to install linux on their desktop would be willing to pay more for the opportunity to do so. But they're not. Desktop Linux can't win in the market, so they're trying to change the rules by whining.
- recoiledsnake 14y ago>We will fight Microsoft's attempt at enforcing Restricted Boot on ARM devices like smartphones and tablets. Like any other computer, users must be able to install free software operating systems on these devices. Again, a multi-thousand word essay on the topic of secure boot and lambasting Microsoft about the locked bootloader in the ARM tablets(which many of the same people think are going to crash and burn anyway). Meanwhile, like in the RedHat and Mozilla blog posts about secure boot, not a peep about Apple or the iPad's locked bootloader which runs about 80% of ARM tablets. Is this because Apple makes their own hardware so the FSF does not care? Or is it just their PR strategy that attacking MS is preferable due to media and people's favorable perception of Apple?
- giZm0 14y agoIt is Microsoft that is pushing this.
- recoiledsnake 14y agoI am referring to the criticism about ARM devices that Windows RT runs on, not about the x86 version.
- rbanffy 14y agoAnd users of ARM devices shouldn't have the freedom to choose which software they run unless it's one approved by the manufacturer and the companies it serves, right?
- recoiledsnake 14y agoDid you even read my OP? I never said anything like that. They're calling out the platform which has no marketshare and making zero mention of the iPad which has around 60 million tablets sold. FYI that's an ARM device. So you mean they think iPad users shouldn't have the freedom of choosing which software they run but Windows RT users need to? Right?
- giZm0 14y agoIs secure boot really gone stop any malware? It will surly make it harder for anyone else to use a different OS. I mean malware is really a huge problem but isn't the majority of it, not related to bootloader.
- cooldeal 14y ago>It will surly make it harder for anyone else to use a different OS. Is it really that hard to go into the bios settings to change a setting? Already most people who want to boot a different OS have to do that to change the boot order to boot from DVD first. http://www.windowsfordevices.com/images/stories/samsung_secureboot.jpg http://www.windowsfordevices.com/images/stories/samsung_secu...
- lunarscape 14y agoExcept MS specified that's not allowed on certified ARM devices.
- stcredzero 14y agoFor security purposes, wouldn't it be enough for the mechanism to simply display a change in the signing status, and not restrict boot? This would allow for the detection of malware without restricting how people use their hardware. Displaying or dismissing such a notification needs to be built into the hardware in such a way that the OS wouldn't be able to interfere. There should also be a read-only channel for applications running on the OS to access the signing status to enable security programs.
- MichaelGG 14y agoIt's pretty well agreed that notifying the user and allowing them to dismiss the notification is a useless security model.
- stcredzero 14y agoWhich is why you also have the ability for security programs to access the same information.