4 ms·

Secure Boot and Restricted Boot

32 points by martey 14y ago

Nux 14y ago
He's so right. Sadly this has come a bit too late and warnings have fallen mostly on deaf ears. Linux desktop users risk to go back to being a niche, just when they were starting to rise above it. Good move, Microsoft. PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ...
- tzs 14y ago
  > PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ... The CA is only controlled by an American company if you, the user, choose to stick with that CA. You are free to reconfigure your system to use a different CA.
  - zimbatm 14y ago
    Is it ? MS requirements are to be able to turn off Secure Boot, not allow changing the CA. I wouldn't be surprised if most manufacturers just implement the former.
    - bcl 14y ago
      All of the manufacturers that I am aware of allow you to load your own keys.
    - deleted 14y ago
      [deleted]
    - tzs 14y ago
      MS also requires allowing for user replacement of all keys.
      - drdaeman 14y ago
        But only on x86_64 and not on ARM, right?
    - lambda 14y ago
      They require that you have the ability to change the keys; remove the Microsoft ones, load your own keys, etc. The problem is that they don't specify any kind of common interface for doing so, or standard for key formats, or anything of the sort. So how it works can vary greatly between manufacturers, or may be buggy, or the like. So several prominent Linux distros have decided to ship bootloaders signed with Microsoft's keys, so that people can just install the distro without having to go through some hardware specific key loading process that may brick their machine.
scholia 14y ago
In the comments, someone says: "We were campaigning against Restricted Boot 10 years ago..." and gets the reply: "Yes, you were campaigning against Microsoft. However, when Apple implemented the Palladium spec to the letter, most people folded because they were more anti-Microsoft than pro-freedom and were taken by the shiny stuff. Now it is acceptable to the public to buy locked down devices."
- thechut 14y ago
  I saw that comment too. It's incredible what we as the larger tech community have let Apple get away with this decade that we never would have let Microsoft get away with the previous decade.
  - scholia 14y ago
    An amazing number of self-identifying FOSS fanboys still seem to have their tighty whities in a bunch over the evil deeds Microsoft committed in the 1990s, while giving Apple and Google free passes. Of course, this makes sense. Scape-goating doesn't require anyone to use their brains ;-)
Metrop0218 14y ago
As a developer in Windows org, it pained me to see secure boot be so widely misinterpreted by the public.
- scholia 14y ago
  I'd be amazed if many members of "the public" knew anything much about it. As far as I can see, it was a Linux fanboy phenomenon.

32 points by martey 14y ago

Nux 14y ago

He's so right. Sadly this has come a bit too late and warnings have fallen mostly on deaf ears. Linux desktop users risk to go back to being a niche, just when they were starting to rise above it. Good move, Microsoft. PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ...

tzs 14y ago
> PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ... The CA is only controlled by an American company if you, the user, choose to stick with that CA. You are free to reconfigure your system to use a different CA.
- zimbatm 14y ago
  Is it ? MS requirements are to be able to turn off Secure Boot, not allow changing the CA. I wouldn't be surprised if most manufacturers just implement the former.
  - bcl 14y ago
    All of the manufacturers that I am aware of allow you to load your own keys.
  - deleted 14y ago
    [deleted]
  - tzs 14y ago
    MS also requires allowing for user replacement of all keys.
    - drdaeman 14y ago
      But only on x86_64 and not on ARM, right?
  - lambda 14y ago
    They require that you have the ability to change the keys; remove the Microsoft ones, load your own keys, etc. The problem is that they don't specify any kind of common interface for doing so, or standard for key formats, or anything of the sort. So how it works can vary greatly between manufacturers, or may be buggy, or the like. So several prominent Linux distros have decided to ship bootloaders signed with Microsoft's keys, so that people can just install the distro without having to go through some hardware specific key loading process that may brick their machine.

scholia 14y ago

In the comments, someone says: "We were campaigning against Restricted Boot 10 years ago..." and gets the reply: "Yes, you were campaigning against Microsoft. However, when Apple implemented the Palladium spec to the letter, most people folded because they were more anti-Microsoft than pro-freedom and were taken by the shiny stuff. Now it is acceptable to the public to buy locked down devices."

thechut 14y ago
I saw that comment too. It's incredible what we as the larger tech community have let Apple get away with this decade that we never would have let Microsoft get away with the previous decade.
- scholia 14y ago
  An amazing number of self-identifying FOSS fanboys still seem to have their tighty whities in a bunch over the evil deeds Microsoft committed in the 1990s, while giving Apple and Google free passes. Of course, this makes sense. Scape-goating doesn't require anyone to use their brains ;-)

Metrop0218 14y ago

As a developer in Windows org, it pained me to see secure boot be so widely misinterpreted by the public.

scholia 14y ago
I'd be amazed if many members of "the public" knew anything much about it. As far as I can see, it was a Linux fanboy phenomenon.