5 ms·

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to wi

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to win about this so easily as it was never seriously challenged.

AStonesThrow 1y ago
[dead]
whatagreatboy 1y ago
Only legal requirements can change it. Nowadays, the mokutil is good enough that linux users can build a good tool around it to automate registration at boot that should ease some pain. But otherwise, it is a big mess and still needs legal requirement.
- riedel 1y ago
  The EU should step in and make sure that any critical OS attestation is taken out of the hands of the big players. Look at GrapheneOS is being denied Google Play Integrity [1] on pretty much no grounds with large consequences. Such security infrastructure is to easily abused to put bias into the market. On the other hand funding is needed to professionally run this stuff. [1] https://discuss.privacyguides.net/t/grapheneos-is-taking-action-against-anti-competitive-play-integrity-api/18695 https://discuss.privacyguides.net/t/grapheneos-is-taking-act...
  - nullc 1y ago
    "The EU should step in" EU mandates any hardware sold will only boot software signed by EU private key, with signatures only provided to software including government spyware and passing a billion euro certification process. "No not like that!"
nine_k 1y ago
Basically every x64 computer is intended to be able to run Windows. Hence MS had to be involved, and I suppose nobody else with serious money wanted the burden. AFAICT you can still disable Secure Boot in most UEFI firmware, and boot anything you like (or not like, if an attacker tampers with your system).
- oakwhiz 1y ago
  We don't even reap the benefits of autocratic decisions from Microsoft in this area. Boards always come out with things like messed up ACPI, etc.
  - p_l 1y ago
    Boards' ACPI etc. is still better than what it would be without "certified for Windows" (whatever name of the hour is) programs
- blkhawk 1y ago
  Secure boot belongs to a class of security that while clearly giving a theoretical benefit in practice it falls far short of providing any benefit whatsoever at least to the user of a system. Its introduction was mostly part of a wider (probably partially defunct and failed regarding mobile x86) strategy to lock down the PC so the Microsoft store and purchased apps through it would be more secure from the end-user. Secondary was in my opinion better security for handheld phones and tablets running x86 but there the "App store" aspect is even more clear. "attacker tampers with your system" does not happen at least in the way you think it does or it does not protect you against meaningful attack at all.
  - pdimitar 1y ago
    What kinds of attacks was Secure Boot designed to mitigate? Is it the evil maid attack? Or an accidentally ran with `sudo` program can indeed screw your entire boot process and inject rootkits etc.? Or is it something else?
    - 1y ago
sugarpimpdorsey 1y ago
It makes more sense if you view it for what it is: Honest Satya's Certificate Authority. Microsoft showed they can semi-competently run a PKI. The end. Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.
- flomo 1y ago
  Maybe this isn't a great take, but RedHat/LKF/etc could obviously run a 'semi-competent' PKI, and probably should be. But doing so would allow PC vendors to cleanly segment machines between Windows and Linux (+$$), so perhaps it made the best sense to lay-low and use MS infrastructure for this.
  - danudey 1y ago
    Can easily imagine companies like Dell selling you a system with Ubuntu preinstalled but without Windows signing keys so you can't run Windows on an Ubuntu laptop (or vice-versa) with Secure Boot on an unmodified system. Not out of malice, necessarily, but at least incompetence. Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system that supports Windows, whereas if RedHat had their own 100% comptent, rock-star PKI then a huge proportion of systems sold today would not be able to run Linux unmodified because the manufacturers wouldn't bother.
    - hulitu 1y ago
      > Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system No. See certificate expiration.
  - sugarpimpdorsey 1y ago
    This isn't really true. MS uses three separate CA's to sign Windows boot loaders, third party bootloaders (including Linux bootloaders) and UEFI Option ROMs. In theory, no manufacturer has to install all three as trusted. But it makes no business sense to do so - why have two separate hardware SKUs for the sole purpose of lock-in? Once word got out no one would buy from that manufacturer.
ChocolateGod 1y ago
But you can turn it off or en-roll your own keys.
EnPissant 1y ago
It's just a default. You can override it with your own platform key.
craftkiller 1y ago
You don't. I remove microsoft's keys from all of my systems and enroll my own key.

AStonesThrow 1y ago

[dead]

whatagreatboy 1y ago

Only legal requirements can change it. Nowadays, the mokutil is good enough that linux users can build a good tool around it to automate registration at boot that should ease some pain. But otherwise, it is a big mess and still needs legal requirement.

riedel 1y ago
The EU should step in and make sure that any critical OS attestation is taken out of the hands of the big players. Look at GrapheneOS is being denied Google Play Integrity [1] on pretty much no grounds with large consequences. Such security infrastructure is to easily abused to put bias into the market. On the other hand funding is needed to professionally run this stuff. [1] https://discuss.privacyguides.net/t/grapheneos-is-taking-action-against-anti-competitive-play-integrity-api/18695 https://discuss.privacyguides.net/t/grapheneos-is-taking-act...
- nullc 1y ago
  "The EU should step in" EU mandates any hardware sold will only boot software signed by EU private key, with signatures only provided to software including government spyware and passing a billion euro certification process. "No not like that!"

nine_k 1y ago

Basically every x64 computer is intended to be able to run Windows. Hence MS had to be involved, and I suppose nobody else with serious money wanted the burden. AFAICT you can still disable Secure Boot in most UEFI firmware, and boot anything you like (or not like, if an attacker tampers with your system).

oakwhiz 1y ago
We don't even reap the benefits of autocratic decisions from Microsoft in this area. Boards always come out with things like messed up ACPI, etc.
- p_l 1y ago
  Boards' ACPI etc. is still better than what it would be without "certified for Windows" (whatever name of the hour is) programs
blkhawk 1y ago
Secure boot belongs to a class of security that while clearly giving a theoretical benefit in practice it falls far short of providing any benefit whatsoever at least to the user of a system. Its introduction was mostly part of a wider (probably partially defunct and failed regarding mobile x86) strategy to lock down the PC so the Microsoft store and purchased apps through it would be more secure from the end-user. Secondary was in my opinion better security for handheld phones and tablets running x86 but there the "App store" aspect is even more clear. "attacker tampers with your system" does not happen at least in the way you think it does or it does not protect you against meaningful attack at all.
- pdimitar 1y ago
  What kinds of attacks was Secure Boot designed to mitigate? Is it the evil maid attack? Or an accidentally ran with `sudo` program can indeed screw your entire boot process and inject rootkits etc.? Or is it something else?
  - 1y ago

sugarpimpdorsey 1y ago

It makes more sense if you view it for what it is: Honest Satya's Certificate Authority. Microsoft showed they can semi-competently run a PKI. The end. Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.

flomo 1y ago
Maybe this isn't a great take, but RedHat/LKF/etc could obviously run a 'semi-competent' PKI, and probably should be. But doing so would allow PC vendors to cleanly segment machines between Windows and Linux (+$$), so perhaps it made the best sense to lay-low and use MS infrastructure for this.
- danudey 1y ago
  Can easily imagine companies like Dell selling you a system with Ubuntu preinstalled but without Windows signing keys so you can't run Windows on an Ubuntu laptop (or vice-versa) with Secure Boot on an unmodified system. Not out of malice, necessarily, but at least incompetence. Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system that supports Windows, whereas if RedHat had their own 100% comptent, rock-star PKI then a huge proportion of systems sold today would not be able to run Linux unmodified because the manufacturers wouldn't bother.
  - hulitu 1y ago
    > Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system No. See certificate expiration.
- sugarpimpdorsey 1y ago
  This isn't really true. MS uses three separate CA's to sign Windows boot loaders, third party bootloaders (including Linux bootloaders) and UEFI Option ROMs. In theory, no manufacturer has to install all three as trusted. But it makes no business sense to do so - why have two separate hardware SKUs for the sole purpose of lock-in? Once word got out no one would buy from that manufacturer.

ChocolateGod 1y ago

But you can turn it off or en-roll your own keys.

EnPissant 1y ago

It's just a default. You can override it with your own platform key.

craftkiller 1y ago

You don't. I remove microsoft's keys from all of my systems and enroll my own key.