6 ms·

Which Distros Work on New Windows 8 Machines

45 points by Garbage 14y ago

bcl 14y ago
Why not just link to Matthew's post? http://mjg59.dreamwidth.org/20522.html http://mjg59.dreamwidth.org/20522.html
hdra 14y ago
I am still using my almost-4-years-old Asus laptop, so I don't know much about this secure boot thingy, but I thought they require vendor to allow consumers to turn the secure boot off?
- bluehavana 14y ago
  Turning off secure boot is only required for x86 and the actual article (at mjg59.dreamwidth.org) says "in case you don't want to fiddle with firmware settings." So for Arm you would still need a signed boot loader.
jlgreco 14y ago
I've been using Fedora since well before they dropped the "Core", but F18 might just be when I jump to Arch. The MSFT signed shim is just too repellent a concept to me; I will sooner use a distro that makes me mess with UEFI/BIOS options crap.
- yuhong 14y ago
  I once suggested transferring the keys to a neutral standard body in another thread on HN.
  - jlgreco 14y ago
    It would be nice to see hardware OEMs completely neutering this nonsense by installing default public keys of their own alongside the MSFT keys, then publicly release the private material so that anyone could sign images that would be trusted by default. Who the hell even needs this "feature"? Are we really so afraid of an "evil maid" attack? People who legitimately need it are a minority (some larger corporations and... paranoid people?) and can remove/add their own keys. I assume some part of their contract with MSFT would prevent them from doing this.
    - gurkendoktor 14y ago
      > Who the hell even needs this "feature"? Are we really so afraid of an "evil maid" attack? People who legitimately need it are a minority (some larger corporations and... paranoid people?) and can remove/add their own keys. Calling people paranoid that want security feature X is not productive. European governments are using Trojans to track pretty small crimes already, and some people regularly change planes in charming environments like China. What you say applies to almost every security measure.
      - jlgreco 14y ago
        Listen, I am into security. I've been using FDE for the better part of the past decade, use two-factor authentication along with a passphrase with ssh (and always tunnel my traffic on public wifi), encrypt all of my personal files before I back them up to S3/dropbox/whatever, and have lined my wallet with foil (after microwaving most of my cards). At one point I considered and partially followed through with epoxying the ram into one of my motherboards. For some people, these may be sensible security measures. For most people, including myself, it's just plain old paranoia. So long as it is harmless, there is no problem with it. Protecting the general public from a hypothetical evil maid that wants to swap out their kernel is not harmless if it means inconveniencing consumers^, and is frankly off the deep end. Some people need to worry about that, and the tools needed to protect themselves should be made available to them, but the general public really doesn't have to worry about it. Making people opt-out of it is nuts. ^ Yeah, it's not MSFT's consumers that are being inconvenienced, and I can't imagine OEMs are going to all of a sudden start caring about minority OS users out of nowhere after all of these years... Neither of those facts will make me refrain from futilely complaining on the internet. (as a side note, I don't see how productivity is involved. What does "being productive" mean here?)
        koide 14y ago
        As Harry Dresden said: "... just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face."
        14y ago
  - recoiledsnake 14y ago
    The problem is that no neutral standard body is willing to step up.
- rwmj 14y ago
  There are lots of valid reasons to dislike Fedora, but "working out of the box on new machines" seems like an unlikely one.
  - jlgreco 14y ago
    No, but to me "paying microsoft for mythical grandmother users" is reason enough for me.
    - TazeTSchnitzel 14y ago
      Especially since all x86 machines with Secure Boot allow you to disable it. And to get a LiveCD or Install CD to boot you need to go via the BIOS/UEFI/other firmware anyway.
    - rwmj 14y ago
      A total of $100 was paid to Microsoft. I'm pretty sure that MSFT's not going to break out this massive new revenue stream in the end of year accounts
      - jlgreco 14y ago
        I am well aware. Actually, I thought it was only $90, not $100. It is the principle of the matter. Paying that $90, when really there is little reason to on x86 (it would be more excusable on ARM), is the equivalent of saying "uncle".
donniezazen 14y ago
My relatively new machine boots both UEFI and Legacy. I have tried Ubuntu, Fedora, and Arch in UEFI only boot and they all work out-of-box in their own ways.
- rshlo 14y ago
  same here. ordered two Lenovo laptops and they were both allowed to switch between legacy and UEFI.
- kuhn 14y ago
  Currently running Ubuntu 12.10 on a brand new HP Envy 4 Ultrabook. Everything works just fine, but I had to use Boot Repair and turn off secure boot in the BIOS before Grub would show at boot.
  - donniezazen 14y ago
    There is a special Ubuntu ISO for secure boot that contains pre-installed Boot Repair but it didn't work for me. I just used regular ISO and it worked like charm.
amalag 14y ago
The latest Windows 8 Dell Inspirons let you turn off UEFI.
- TazeTSchnitzel 14y ago
  Of course they do. All x86 Windows 8 PCs are required by Microsoft to allow disabling Secure Boot.
DanBC 14y ago
Weirdly being filtered by the public wifi spot i was using. (http://imgur.com/fPeXY http://imgur.com/fPeXY)
lsiebert 14y ago
UEFI, at least as I understand things, was really about enterprise desktops, which are nice big chunks in terms of sales compared to individual consumers. The consumer facing change is a side effect. From the perspective of the corporation buying big amounts of computers from an oem, your users are employees, and it makes sense that you don't want them screwing with secure boot. Individual Consumers still have options. The ARM thing is, however, a bigger deal.
- Already__Taken 14y ago
  UEFI is not secure boot just like boot from USB is not BIOS. Secure boot is great we just have to demand that we control the keys.
  - rsyncinside 14y ago
    What? Booting from USB uses the BIOS. The solution to UEFI is to refrain from using it. Just use a classic BIOS. If some Linux distribution cannot boot via a legacy BIOS (how difficult is that, really? we've been doing it for over 30 years), then it's not an OS worth using. Relative to everything else BIOS software has not changed much in 30 years (ask yourself why; it does not need to), and only a couple of companies have a monopoly on nearly all BIOS software. A BIOS does not need features. It does not need a shell and applications. It just needs to initialise hardware and launch a bootloader, and to be able to do this from a variety of media. That is, relatively, a very simple task. You want it to work everytime, with no fiddling. UEFI is not giving you anything that is worth the hassle it can cause and the complications it can add to simply booting a device. It is not giving you more freedom. Whatever the reasoning behind UEFI (maybe there is no compelling reason; that wouldn't be a first), UEFI is a recipe for disaster. Because MS is headed downhill, they will get desperate and will try anything to retain market share; and they have a history of using complexity and obscurity as a way of disincentiving many users from using Windows alternatives (e.g. Gates used the original BIOS strategically this way in the 80's). UEFI is certainly not the path to "hardware and software freedom". It will not make things easier for any user who wants to use different OS's on a variety of HW. But it may be abused by MS who has immense influence on hardware manufacturers. Stick with the old BIOS. Keep it simple.

45 points by Garbage 14y ago

bcl 14y ago

Why not just link to Matthew's post? http://mjg59.dreamwidth.org/20522.html http://mjg59.dreamwidth.org/20522.html

hdra 14y ago

I am still using my almost-4-years-old Asus laptop, so I don't know much about this secure boot thingy, but I thought they require vendor to allow consumers to turn the secure boot off?

bluehavana 14y ago
Turning off secure boot is only required for x86 and the actual article (at mjg59.dreamwidth.org) says "in case you don't want to fiddle with firmware settings." So for Arm you would still need a signed boot loader.

jlgreco 14y ago

I've been using Fedora since well before they dropped the "Core", but F18 might just be when I jump to Arch. The MSFT signed shim is just too repellent a concept to me; I will sooner use a distro that makes me mess with UEFI/BIOS options crap.

yuhong 14y ago
I once suggested transferring the keys to a neutral standard body in another thread on HN.
- jlgreco 14y ago
  It would be nice to see hardware OEMs completely neutering this nonsense by installing default public keys of their own alongside the MSFT keys, then publicly release the private material so that anyone could sign images that would be trusted by default. Who the hell even needs this "feature"? Are we really so afraid of an "evil maid" attack? People who legitimately need it are a minority (some larger corporations and... paranoid people?) and can remove/add their own keys. I assume some part of their contract with MSFT would prevent them from doing this.
  - gurkendoktor 14y ago
    > Who the hell even needs this "feature"? Are we really so afraid of an "evil maid" attack? People who legitimately need it are a minority (some larger corporations and... paranoid people?) and can remove/add their own keys. Calling people paranoid that want security feature X is not productive. European governments are using Trojans to track pretty small crimes already, and some people regularly change planes in charming environments like China. What you say applies to almost every security measure.
    - jlgreco 14y ago
      Listen, I am into security. I've been using FDE for the better part of the past decade, use two-factor authentication along with a passphrase with ssh (and always tunnel my traffic on public wifi), encrypt all of my personal files before I back them up to S3/dropbox/whatever, and have lined my wallet with foil (after microwaving most of my cards). At one point I considered and partially followed through with epoxying the ram into one of my motherboards. For some people, these may be sensible security measures. For most people, including myself, it's just plain old paranoia. So long as it is harmless, there is no problem with it. Protecting the general public from a hypothetical evil maid that wants to swap out their kernel is not harmless if it means inconveniencing consumers^, and is frankly off the deep end. Some people need to worry about that, and the tools needed to protect themselves should be made available to them, but the general public really doesn't have to worry about it. Making people opt-out of it is nuts. ^ Yeah, it's not MSFT's consumers that are being inconvenienced, and I can't imagine OEMs are going to all of a sudden start caring about minority OS users out of nowhere after all of these years... Neither of those facts will make me refrain from futilely complaining on the internet. (as a side note, I don't see how productivity is involved. What does "being productive" mean here?)
      - koide 14y ago
        As Harry Dresden said: "... just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face."
      - 14y ago
- recoiledsnake 14y ago
  The problem is that no neutral standard body is willing to step up.
rwmj 14y ago
There are lots of valid reasons to dislike Fedora, but "working out of the box on new machines" seems like an unlikely one.
- jlgreco 14y ago
  No, but to me "paying microsoft for mythical grandmother users" is reason enough for me.
  - TazeTSchnitzel 14y ago
    Especially since all x86 machines with Secure Boot allow you to disable it. And to get a LiveCD or Install CD to boot you need to go via the BIOS/UEFI/other firmware anyway.
  - rwmj 14y ago
    A total of $100 was paid to Microsoft. I'm pretty sure that MSFT's not going to break out this massive new revenue stream in the end of year accounts
    - jlgreco 14y ago
      I am well aware. Actually, I thought it was only $90, not $100. It is the principle of the matter. Paying that $90, when really there is little reason to on x86 (it would be more excusable on ARM), is the equivalent of saying "uncle".

donniezazen 14y ago

My relatively new machine boots both UEFI and Legacy. I have tried Ubuntu, Fedora, and Arch in UEFI only boot and they all work out-of-box in their own ways.

rshlo 14y ago
same here. ordered two Lenovo laptops and they were both allowed to switch between legacy and UEFI.
kuhn 14y ago
Currently running Ubuntu 12.10 on a brand new HP Envy 4 Ultrabook. Everything works just fine, but I had to use Boot Repair and turn off secure boot in the BIOS before Grub would show at boot.
- donniezazen 14y ago
  There is a special Ubuntu ISO for secure boot that contains pre-installed Boot Repair but it didn't work for me. I just used regular ISO and it worked like charm.

amalag 14y ago

The latest Windows 8 Dell Inspirons let you turn off UEFI.

TazeTSchnitzel 14y ago
Of course they do. All x86 Windows 8 PCs are required by Microsoft to allow disabling Secure Boot.

DanBC 14y ago

Weirdly being filtered by the public wifi spot i was using. (http://imgur.com/fPeXY http://imgur.com/fPeXY)

lsiebert 14y ago

UEFI, at least as I understand things, was really about enterprise desktops, which are nice big chunks in terms of sales compared to individual consumers. The consumer facing change is a side effect. From the perspective of the corporation buying big amounts of computers from an oem, your users are employees, and it makes sense that you don't want them screwing with secure boot. Individual Consumers still have options. The ARM thing is, however, a bigger deal.

Already__Taken 14y ago
UEFI is not secure boot just like boot from USB is not BIOS. Secure boot is great we just have to demand that we control the keys.
- rsyncinside 14y ago
  What? Booting from USB uses the BIOS. The solution to UEFI is to refrain from using it. Just use a classic BIOS. If some Linux distribution cannot boot via a legacy BIOS (how difficult is that, really? we've been doing it for over 30 years), then it's not an OS worth using. Relative to everything else BIOS software has not changed much in 30 years (ask yourself why; it does not need to), and only a couple of companies have a monopoly on nearly all BIOS software. A BIOS does not need features. It does not need a shell and applications. It just needs to initialise hardware and launch a bootloader, and to be able to do this from a variety of media. That is, relatively, a very simple task. You want it to work everytime, with no fiddling. UEFI is not giving you anything that is worth the hassle it can cause and the complications it can add to simply booting a device. It is not giving you more freedom. Whatever the reasoning behind UEFI (maybe there is no compelling reason; that wouldn't be a first), UEFI is a recipe for disaster. Because MS is headed downhill, they will get desperate and will try anything to retain market share; and they have a history of using complexity and obscurity as a way of disincentiving many users from using Windows alternatives (e.g. Gates used the original BIOS strategically this way in the 80's). UEFI is certainly not the path to "hardware and software freedom". It will not make things easier for any user who wants to use different OS's on a variety of HW. But it may be abused by MS who has immense influence on hardware manufacturers. Stick with the old BIOS. Keep it simple.