9 ms·

UEFI and Secure Boot: The Hell I Went Through

69 points by Tsiolkovsky 14y ago

shawnz 14y ago
> Yes, I’m aware that OEMs are supposed to give an option to turn it off, but when has this ever happened? Not "supposed to". They must. Why would OEMs waste their time implementing Secure Boot for the logo program, and then disqualify themselves by hiding the option to disable it?
- freehunter 14y ago
  The ramp-up to Windows 8 has shown more FUD from the community than Microsoft would ever be capable of even with an unlimited marketing budget. This argument gets thrown around in every W8 conversation, "you won't be able to turn off secure boot!" The more it gets repeated, the more it might as well be true because people are going to believe it. I just ranted about this happening in the Apple community; don't think it doesn't happen everywhere [1]. It's toxic, and I really wish there was more critical thinking going on. [1] https://news.ycombinator.com/item?id=4377064 https://news.ycombinator.com/item?id=4377064
  - kbolino 14y ago
    Microsoft requires that Secure Boot can be disabled by the user, but only on x86. On ARM, the exact opposite is true: Microsoft requires that Secure Boot cannot be disabled by the user. For now, this doesn't really matter, but the situation may change if/when Windows on ARM becomes a serious platform.
    - freehunter 14y ago
      Microsoft requires that Secure Boot can be disabled by the user, but only on x86. On ARM, the exact opposite is true: Microsoft requires that Secure Boot cannot be disabled by the user. Yet it's completely accepted on the market leader's products. Funny how that works.
      - kbolino 14y ago
        Plenty of people have voiced objection to the lockdown of mobile devices by other vendors. The reason for this particular fooferaw, I think, is the misconception that this will apply to x86. It was my goal to clear that up, not to specifically endorse Microsoft-bashing.
  - viraptor 14y ago
    Given the possibility to enforce it being always on... why would MS ever want to make it optional? I'm trying to apply critical thinking here, but can't figure out any reason to explain it. At the level that kind of decision/deal is made, what could prevent it? What's stopping them from pushing for that once secure boot is widespread enough?
    - freehunter 14y ago
      why would MS ever want to make it optional? ... what could prevent it? You do remember their lawsuit that spanned almost the entirety of the 90's, right? The lawsuit that cost them hundreds of millions and almost saw Microsoft split into two companies? That's what would prevent it. If they tried it again, the company would be shut down faster than you can say "But Apple does it too!" The fact that is in front of us right now is that Microsoft is requiring that it can be turned off. Requiring. So telling people that Microsoft won't let you turn it off goes so far beyond a flat-out, bald-faced lie: it becomes flagrant and malicious disinformation designed to scare people into staying away from a product, to scare them into continuing to spread this disinformation. Even you saying "but it could happen in the future!" is complete garbage. It's not relevant. There's no way to know what Microsoft will do in the future, so spreading rumors now based on pure speculation and fantasy... no, this goes beyond spreading rumors about the future, you're applying future speculation to what they're doing now, pretending that what you're fantasizing about is actually happening as we speak. It's not. You're not thinking critically, you're making wild accusations and presenting them as reality. In short, you're perpetuating fear, uncertainty, and doubt. This argument completely blows my mind.
      - viraptor 14y ago
        I just think that if they're really worried about such lawsuit, they would make secure boot also optional on ARM platforms. The way it's currently done just looks like a setup for making a claim on windows 9 release "see, there's nothing wrong with enforcing it on ARM, we're going to enforce it on x86 too".
        freehunter 14y ago
oinknotramen 14y ago
Secure Boot is probably one of the lamest systems in place. It's clearly a move by Microsoft to try to further their monopoly, and stifle migration to other systems. That's why you should only buy laptops from https://www.system76.com/ https://www.system76.com/, or http://zareason.com/ http://zareason.com/, or http://www.emperorlinux.com/ http://www.emperorlinux.com/. You wouldn't have to deal with Microsoft's BS, and you would get a pretty kickass computer in the process.
- freehunter 14y ago
  It's clearly a move by Microsoft to try to further their monopoly, and stifle migration to other systems. Bullshit. I'll provide my reason supporting my statement: they require that it can be turned off. Now you provide your reasons.
- tzs 14y ago
  So to further their monopoly, they are REQUIRING PC OEMs to let you turn Secure Boot and add your own signing keys, and they are subsidizing the cost of signing for other operating system vendors who would like to use Microsoft's key instead of provide their own?
- perssontm 14y ago
  How are system76 hardware compared to lenovos T-series? Especially the keyboard is interesting.. :)
uslic001 14y ago
I am glad I build all my own desktops. Too bad I can't do the same for my laptop.
blinkingled 14y ago
I wonder how Apple is going to deal with this Windows 8/UEFI situation w.r.t Boot Camp. If they totally ditched Windows 8 support it would spell at least a little bit of (well deserved, IMHO) trouble for Microsoft. This really is getting out of hand Microsoft - this stupidity that Secure Boot is - it isn't solving any real problem for the user. It is only creating nuisance.
- cooldeal 14y ago
  Windows 8 will boot without UEFI or secure boot. So this will not make any difference to Apple.
  - blinkingled 14y ago
    Ah ok - I wasn't aware - I thought it was technically mandatory. Looks like to get Windows certified logo manufacturers will have to do secure boot. Apple couldn't care less about that which is good for Boot Campers. Still though this whole thing is nonsensical - wonder if they were waiting for the antitrust era oversight to end (May 2011) before trying this schtick.
- alter8 14y ago
  > it isn't solving any real problem for the user. It is only creating nuisance. That's the whole purpose of it - creating enough nuisance so that average Joe can't get out of Windows ecosystem. Each OEM will implement the disabling option in their own obscure way, and some of them will even fail to work properly. I remember when I needed one boot pendrive for each of my computers.
- npsimons 14y ago
  it isn't solving any real problem for the user. It is only creating nuisance. And what makes you think they give two shits about what users want? Anyone who has been paying any attention at all to the computer industry for the last three decades would have learned by now that Microsoft doesn't serve "users"; they have always been the "safe" choice for "business" ("no one ever got fired for choosing Microsoft!"), and recently they have become dogs in the laps of the crony capitalist cartels of the entertainment industry. Microsoft has always been about anti-competition and locking the user to their platform; this recent offensive of "secure boot" just gives a bonus of the DRM that the entertainment racketeers so badly want.
bcl 14y ago
In general, if the OS pre-installed on your computer doesn't boot nothing else will either. No Linux distribution can fix your broken computer and blaming your problems on BIOS, UEFI or Secure Boot just to get attention won't fix things either. Secure Boot, when enabled, will not let you boot anything that isn't signed, including removable media. Fedora 17 isn't signed so SB wasn't enabled. Expecting GRUB2 to work when your Windows bootloader didn't work isn't logical. Like it or not PC's are designed for Windows. If Windows doesn't work on it, take it back. Very likely the harddrive had problems, this would explain it not booting and the install running slow as it retried when getting errors from the drive.
deleted 14y ago
[deleted]
zokier 14y ago
> I didn’t need anything for gaming, just a workstation, so I picked out a cheap HP pavilion slimline (mistake 2) and a $100 Acer monitor If you need a workstation, more specifically a linux workstation, maybe you should have bought a workstation. Like HP z-series which support (and some models even ship with) Linux. > I did a first boot, and had an error come up that it couldn’t boot to Windows. “Well… Recovery media time!” What error? If even first boot fails, I'd suspect hardware fault, which would make the whole post moot. Instead of trying to force Fedora on a machine that doesn't boot in the first place, more sensible solution would be to return the machine to the store. > “Feature Byte” The system was using Secure Boot False conclusion. Idk what "Feature Byte" stuff is, but it seems completely unrelated to UEFI and SecureBoot. Quick googling even reveals that some HP BIOS have Feature Bytes too. > Yes, I’m aware that OEMs are supposed to give an option to turn it off, but when has this ever happened? Is there actually any SecureBoot enabled systems out there which do not allow disabling SB? > All this said, I refuse to support UEFI until some real standards are put into place and enforced. I’ll take something like OpenBIOS, but NOT UEFI The UEFI standard is clearly at fault here, right? And the Windows Logo program is exactly about laying out standards and enforcing them. I'd also note that UEFI and the MS stuff are independent entities. UEFI is an industry standard, and predates all this secure boot fuss by years. This blog post is full of plain old FUD, and it's sad that open source advocates spread such stuff. Especially in matters of such importance imho posts like this only cloud the real issues and erodes the credibility of FOSS camp.
deleted 14y ago
[deleted]
armored_mammal 14y ago
I built my latest PC on a mobo with UEFI and had 0 trouble at all with Mint. FWIW.
wmf 14y ago
I see 20 comments saying this is wrong; instead of endlessly rehashing let's flag this and get it off the front page.
zepolud 14y ago
By far the worst thing about RMS is that his far-fetched, nightmarish scenarios have the tendency to become reality in a few years.
- tedunangst 14y ago
  bah, I've had nightmares about broken hard drives for years too.
- rickmb 14y ago
  This is the one reason why I will always continue to take RMS very seriously, no matter how annoying he gets. Also, since he is not just a prophet of doom but has spend a major part of his life trying to turn the tide, creating and inspiring stuff most of us have profited from, he deserves a hell of a lot more respect than he usually gets.
- keithpeter 14y ago
  Yes, true You might find that Ivan Illich might be worth reading for a wider view (Illich wrote before PCs let alone the Internet). http://www.infed.org/thinkers/et-illic.htm http://www.infed.org/thinkers/et-illic.htm
ashleyblackmore 14y ago
I have been through similar hell with UEFI. Problem with building your own stuff is that you can't easily build tablets or laptops. Only OEMs do that. Since mobile is on the increase, so too is the prevalence of OEM stuff (macs, tablets, phones etc). On top of this, people are being forced into the cloud on what basically amounts to disposable computers (Android tablets/Kindle) by companies like google and amazon. Thus, it seems likely to me that DIY systems are on the way out, as is the support and development for that kind of stuff. Even gamers, who have long been a bastion of the DIY system market have cloud options now (onlive/gametap). It doesn't bode well for the future. Maybe there will be some kind of online cataclysm that will end this madness. Who knows? In the meantime, check that your motherboard has legacy boot options. Or just don't upgrade to Windows 8 and vote with your wallet
noonespecial 14y ago
I feel the trucks heading for the landfills with a tsunami of e-waste thanks to "secure boot" like a tremor in the force.
rwmj 14y ago
He buys a machine, takes it home, and it won't boot => Take it back and get an immediate refund.
- the_mitsuhiko 14y ago
  But you could not complain on your blog then!
  - deleted 14y ago
    [deleted]
keithpeter 14y ago
"I didn’t need anything for gaming, just a workstation, so I picked out a cheap HP pavilion slimline (mistake 2) and a $100 Acer monitor." Market opportunity for people who assemble Linux capable PCs? Market opportunity for people selling reliable slightly older technology laptops? Plenty of sellers on UK ebay (their laptops are ex-corporate so a bit too old for here I suppose) http://www.h-online.com/open/news/item/Fedora-18-to-support-UEFI-Secure-Boot-1651014.html http://www.h-online.com/open/news/item/Fedora-18-to-support-... Opportunity for followup post trying a beta/testing install of Fedora 18?
guilloche 14y ago
My solution: not bother to buying any machine with secure boot.
mjg59 14y ago
Secure boot would have prevented the system booting from the unsigned CD. Whatever the problem is here, it's nothing to do with secure boot.

69 points by Tsiolkovsky 14y ago

> Yes, I’m aware that OEMs are supposed to give an option to turn it off, but when has this ever happened? Not "supposed to". They must. Why would OEMs waste their time implementing Secure Boot for the logo program, and then disqualify themselves by hiding the option to disable it?

freehunter 14y ago
The ramp-up to Windows 8 has shown more FUD from the community than Microsoft would ever be capable of even with an unlimited marketing budget. This argument gets thrown around in every W8 conversation, "you won't be able to turn off secure boot!" The more it gets repeated, the more it might as well be true because people are going to believe it. I just ranted about this happening in the Apple community; don't think it doesn't happen everywhere [1]. It's toxic, and I really wish there was more critical thinking going on. [1] https://news.ycombinator.com/item?id=4377064 https://news.ycombinator.com/item?id=4377064
- kbolino 14y ago
  Microsoft requires that Secure Boot can be disabled by the user, but only on x86. On ARM, the exact opposite is true: Microsoft requires that Secure Boot cannot be disabled by the user. For now, this doesn't really matter, but the situation may change if/when Windows on ARM becomes a serious platform.
  - freehunter 14y ago
    Microsoft requires that Secure Boot can be disabled by the user, but only on x86. On ARM, the exact opposite is true: Microsoft requires that Secure Boot cannot be disabled by the user. Yet it's completely accepted on the market leader's products. Funny how that works.
    - kbolino 14y ago
      Plenty of people have voiced objection to the lockdown of mobile devices by other vendors. The reason for this particular fooferaw, I think, is the misconception that this will apply to x86. It was my goal to clear that up, not to specifically endorse Microsoft-bashing.
- viraptor 14y ago
  Given the possibility to enforce it being always on... why would MS ever want to make it optional? I'm trying to apply critical thinking here, but can't figure out any reason to explain it. At the level that kind of decision/deal is made, what could prevent it? What's stopping them from pushing for that once secure boot is widespread enough?
  - freehunter 14y ago
    why would MS ever want to make it optional? ... what could prevent it? You do remember their lawsuit that spanned almost the entirety of the 90's, right? The lawsuit that cost them hundreds of millions and almost saw Microsoft split into two companies? That's what would prevent it. If they tried it again, the company would be shut down faster than you can say "But Apple does it too!" The fact that is in front of us right now is that Microsoft is requiring that it can be turned off. Requiring. So telling people that Microsoft won't let you turn it off goes so far beyond a flat-out, bald-faced lie: it becomes flagrant and malicious disinformation designed to scare people into staying away from a product, to scare them into continuing to spread this disinformation. Even you saying "but it could happen in the future!" is complete garbage. It's not relevant. There's no way to know what Microsoft will do in the future, so spreading rumors now based on pure speculation and fantasy... no, this goes beyond spreading rumors about the future, you're applying future speculation to what they're doing now, pretending that what you're fantasizing about is actually happening as we speak. It's not. You're not thinking critically, you're making wild accusations and presenting them as reality. In short, you're perpetuating fear, uncertainty, and doubt. This argument completely blows my mind.
    - viraptor 14y ago
      I just think that if they're really worried about such lawsuit, they would make secure boot also optional on ARM platforms. The way it's currently done just looks like a setup for making a claim on windows 9 release "see, there's nothing wrong with enforcing it on ARM, we're going to enforce it on x86 too".
      - freehunter 14y ago

oinknotramen 14y ago

Secure Boot is probably one of the lamest systems in place. It's clearly a move by Microsoft to try to further their monopoly, and stifle migration to other systems. That's why you should only buy laptops from https://www.system76.com/ https://www.system76.com/, or http://zareason.com/ http://zareason.com/, or http://www.emperorlinux.com/ http://www.emperorlinux.com/. You wouldn't have to deal with Microsoft's BS, and you would get a pretty kickass computer in the process.

freehunter 14y ago
It's clearly a move by Microsoft to try to further their monopoly, and stifle migration to other systems. Bullshit. I'll provide my reason supporting my statement: they require that it can be turned off. Now you provide your reasons.
tzs 14y ago
So to further their monopoly, they are REQUIRING PC OEMs to let you turn Secure Boot and add your own signing keys, and they are subsidizing the cost of signing for other operating system vendors who would like to use Microsoft's key instead of provide their own?
perssontm 14y ago
How are system76 hardware compared to lenovos T-series? Especially the keyboard is interesting.. :)

uslic001 14y ago

I am glad I build all my own desktops. Too bad I can't do the same for my laptop.

blinkingled 14y ago

I wonder how Apple is going to deal with this Windows 8/UEFI situation w.r.t Boot Camp. If they totally ditched Windows 8 support it would spell at least a little bit of (well deserved, IMHO) trouble for Microsoft. This really is getting out of hand Microsoft - this stupidity that Secure Boot is - it isn't solving any real problem for the user. It is only creating nuisance.

cooldeal 14y ago
Windows 8 will boot without UEFI or secure boot. So this will not make any difference to Apple.
- blinkingled 14y ago
  Ah ok - I wasn't aware - I thought it was technically mandatory. Looks like to get Windows certified logo manufacturers will have to do secure boot. Apple couldn't care less about that which is good for Boot Campers. Still though this whole thing is nonsensical - wonder if they were waiting for the antitrust era oversight to end (May 2011) before trying this schtick.
alter8 14y ago
> it isn't solving any real problem for the user. It is only creating nuisance. That's the whole purpose of it - creating enough nuisance so that average Joe can't get out of Windows ecosystem. Each OEM will implement the disabling option in their own obscure way, and some of them will even fail to work properly. I remember when I needed one boot pendrive for each of my computers.
npsimons 14y ago
it isn't solving any real problem for the user. It is only creating nuisance. And what makes you think they give two shits about what users want? Anyone who has been paying any attention at all to the computer industry for the last three decades would have learned by now that Microsoft doesn't serve "users"; they have always been the "safe" choice for "business" ("no one ever got fired for choosing Microsoft!"), and recently they have become dogs in the laps of the crony capitalist cartels of the entertainment industry. Microsoft has always been about anti-competition and locking the user to their platform; this recent offensive of "secure boot" just gives a bonus of the DRM that the entertainment racketeers so badly want.

bcl 14y ago

In general, if the OS pre-installed on your computer doesn't boot nothing else will either. No Linux distribution can fix your broken computer and blaming your problems on BIOS, UEFI or Secure Boot just to get attention won't fix things either. Secure Boot, when enabled, will not let you boot anything that isn't signed, including removable media. Fedora 17 isn't signed so SB wasn't enabled. Expecting GRUB2 to work when your Windows bootloader didn't work isn't logical. Like it or not PC's are designed for Windows. If Windows doesn't work on it, take it back. Very likely the harddrive had problems, this would explain it not booting and the install running slow as it retried when getting errors from the drive.

deleted 14y ago

[deleted]

zokier 14y ago

> I didn’t need anything for gaming, just a workstation, so I picked out a cheap HP pavilion slimline (mistake 2) and a $100 Acer monitor If you need a workstation, more specifically a linux workstation, maybe you should have bought a workstation. Like HP z-series which support (and some models even ship with) Linux. > I did a first boot, and had an error come up that it couldn’t boot to Windows. “Well… Recovery media time!” What error? If even first boot fails, I'd suspect hardware fault, which would make the whole post moot. Instead of trying to force Fedora on a machine that doesn't boot in the first place, more sensible solution would be to return the machine to the store. > “Feature Byte” The system was using Secure Boot False conclusion. Idk what "Feature Byte" stuff is, but it seems completely unrelated to UEFI and SecureBoot. Quick googling even reveals that some HP BIOS have Feature Bytes too. > Yes, I’m aware that OEMs are supposed to give an option to turn it off, but when has this ever happened? Is there actually any SecureBoot enabled systems out there which do not allow disabling SB? > All this said, I refuse to support UEFI until some real standards are put into place and enforced. I’ll take something like OpenBIOS, but NOT UEFI The UEFI standard is clearly at fault here, right? And the Windows Logo program is exactly about laying out standards and enforcing them. I'd also note that UEFI and the MS stuff are independent entities. UEFI is an industry standard, and predates all this secure boot fuss by years. This blog post is full of plain old FUD, and it's sad that open source advocates spread such stuff. Especially in matters of such importance imho posts like this only cloud the real issues and erodes the credibility of FOSS camp.

deleted 14y ago

[deleted]

armored_mammal 14y ago

I built my latest PC on a mobo with UEFI and had 0 trouble at all with Mint. FWIW.

wmf 14y ago

I see 20 comments saying this is wrong; instead of endlessly rehashing let's flag this and get it off the front page.

zepolud 14y ago

By far the worst thing about RMS is that his far-fetched, nightmarish scenarios have the tendency to become reality in a few years.

tedunangst 14y ago
bah, I've had nightmares about broken hard drives for years too.
rickmb 14y ago
This is the one reason why I will always continue to take RMS very seriously, no matter how annoying he gets. Also, since he is not just a prophet of doom but has spend a major part of his life trying to turn the tide, creating and inspiring stuff most of us have profited from, he deserves a hell of a lot more respect than he usually gets.
keithpeter 14y ago
Yes, true You might find that Ivan Illich might be worth reading for a wider view (Illich wrote before PCs let alone the Internet). http://www.infed.org/thinkers/et-illic.htm http://www.infed.org/thinkers/et-illic.htm

ashleyblackmore 14y ago

I have been through similar hell with UEFI. Problem with building your own stuff is that you can't easily build tablets or laptops. Only OEMs do that. Since mobile is on the increase, so too is the prevalence of OEM stuff (macs, tablets, phones etc). On top of this, people are being forced into the cloud on what basically amounts to disposable computers (Android tablets/Kindle) by companies like google and amazon. Thus, it seems likely to me that DIY systems are on the way out, as is the support and development for that kind of stuff. Even gamers, who have long been a bastion of the DIY system market have cloud options now (onlive/gametap). It doesn't bode well for the future. Maybe there will be some kind of online cataclysm that will end this madness. Who knows? In the meantime, check that your motherboard has legacy boot options. Or just don't upgrade to Windows 8 and vote with your wallet

noonespecial 14y ago

I feel the trucks heading for the landfills with a tsunami of e-waste thanks to "secure boot" like a tremor in the force.

rwmj 14y ago

He buys a machine, takes it home, and it won't boot => Take it back and get an immediate refund.

the_mitsuhiko 14y ago
But you could not complain on your blog then!
- deleted 14y ago
  [deleted]

keithpeter 14y ago

"I didn’t need anything for gaming, just a workstation, so I picked out a cheap HP pavilion slimline (mistake 2) and a $100 Acer monitor." Market opportunity for people who assemble Linux capable PCs? Market opportunity for people selling reliable slightly older technology laptops? Plenty of sellers on UK ebay (their laptops are ex-corporate so a bit too old for here I suppose) http://www.h-online.com/open/news/item/Fedora-18-to-support-UEFI-Secure-Boot-1651014.html http://www.h-online.com/open/news/item/Fedora-18-to-support-... Opportunity for followup post trying a beta/testing install of Fedora 18?

guilloche 14y ago

My solution: not bother to buying any machine with secure boot.

mjg59 14y ago

Secure boot would have prevented the system booting from the unsigned CD. Whatever the problem is here, it's nothing to do with secure boot.