5 ms·

The best thing that company can do about OSS is (drumroll) ... ... STOP the SecureBoot madness!

by Toshio 14y ago

kunai 14y ago
To be honest, the FUD over Secure Boot is really reaching a fever pitch, and for no reason, as well. Just turn it off in the UEFI settings and install as much Linux, BSD, or GNU that you want. It really is not a big deal.
- pfraze 14y ago
  A quick google shows you're right! That's some pretty bad FUD if there's nothing else to this. Is there something about Secure Boot that turning it off doesn't solve?
  - Toshio 14y ago
    Yes. Easy to use dual-boot is key to slowly transitioning your friends and family to Linux.
  - icebraining 14y ago
    There's no turning it off on some platforms (ARM).
- jaredmcateer 14y ago
  I just bought a laptop that came with Windows 8, after 15 minutes of frustration just trying to play around with it, I replaced it with Linux, I didn't even notice the secureboot stuff.
  - Toshio 14y ago
    This isn't about you or me or any other tech-savvy person. It's about the non-technical person, and about evangelizing the use of free-as-in-freedom operating systems to them. It used to be easy to dual-boot, but now that it's a seven-step operation to switch operating systems, that's effectively a monkey-wrench thrown into the widespread adoption of Linux.
    - deleted 14y ago
      [deleted]
    - jaredmcateer 14y ago
      It's a bit of a strawman, there are virtually no non-tech-savvy individuals that would ever embark on installing an alternative operating system without being influenced by, let alone without assistance from, a tech-savvy person.
      - rbanffy 14y ago
        > there are virtually no non-tech-savvy individuals that would ever embark on installing an alternative operating system And that's exactly what secure boot is designed to accomplish.
        jaredmcateer 14y ago
        Secure boot has nothing to do with it, you have to drag non-technical people kicking and screaming to do something as simple as switching their browser from IE. It's a minor inconvenience for the people that will actually be doing the work.
- Toshio 14y ago
  > "Just turn it off in the UEFI settings" Yes, because when you're trying to get your non-technical friends and family to get used to Linux, they will be REALLY keen on going into UEFI to disable-reenable-disable-again etc. to switch between operating systems, whereas it was a simple keystroke up until recently.
  - kunai 14y ago
    IIRC, couldn't you run Windows 8 without boot authentication? I believe there was a control panel option for this, and after you turn it off, GRUB should be the only thing you need.
  - recoiledsnake 14y ago
    First, Windows 8 runs fine with secure boot disabled, so there no need to "disable-reenable-disable-again etc. to switch between operating systems". Second, how many folks that are able to install and configure Linux are unable to turn a setting off in the UEFI menu? Third, you need to balance this difficulty against the problem of bootkit malware across the PC ecosystem. Why should the hundreds of millions of technically not savvy not be protected from bootkits by default? Is there a way to make it less complicated for Linux users while still maintaining the security that Secure Boot provides?
    - kunai 14y ago
      > "Is there a way to make it less complicated for Linux users while still maintaining the security that Secure Boot provides?" Yes. It's called a PC with Linux preinstalled. Or just a Mac. The only PC I can think of that isn't just a rebrand or a really poorly designed one is the XPS 13, and that doesn't fit my needs currently (awful 16:9 aspect ratio). So, I bought a MacBook Air instead, and I'm running Linux Mint alongside OS X without any problems.
- icebraining 14y ago
  That's because you bought a x86 machine. On ARM, you have no such option: http://arstechnica.com/information-technology/2012/01/windows-8s-locked-bootloaders-much-ado-about-nothing-or-the-end-of-the-world-as-we-know-it/ http://arstechnica.com/information-technology/2012/01/window...
  - kunai 14y ago
    I doubt anyone purchasing a mobile Windows RT RISC machine would be inclined to install Linux on it. In fact, the only devices I can currently think of are Windows RT tablets, which nobody is buying anyhow.
    - rbanffy 14y ago
      I'd do it. It's decent hardware and well designed.
  - cooldeal 14y ago
    I love the phrasing "ARM device" as opposed to Windows RT. Somehow the largest selling "ARM Devices" i.e iPads are not blamed for having locked bootloaders. But on a barely selling platform, suddenly it's a huge deal.
    - icebraining 14y ago
      Who are you criticizing exactly? The article is specifically about Window's Secure Boot, so it doesn't make much sense to bring iPads and other devices into it. If you're talking in general, there are those who blame them: http://www.defectivebydesign.org/ipad http://www.defectivebydesign.org/ipad
icebraining 14y ago
As the FSF says, SecureBoot is not the problem; only implementations that don't let the user override it.
- Toshio 14y ago
  It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. It's this exclusionary practice that's the problem, not the implementation per se.
  - deleted 14y ago
    [deleted]
  - recoiledsnake 14y ago
    >It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. Please, stop the FUD, it just makes people look totally ignorant. Microsoft does not insist that in any shape or form. If you have a reference, please share it. But don't go around spreading falsehood.
  - cooldeal 14y ago
    >It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. Bullshit, they do no such thing. The OEMs are perfectly able and willing to preload other keys. It's the community that is unable to step up to having a signing infrastructure. Why don't you contribute to the effort of a signing mechanism for Linux instead of just spreading anti-Microsoft lies? Edit: I see that my post is getting downvoted while the factually incorrect parent post is not. This feels like /r/Linux, where facts are not welcome and where FUD gets voted up.
    - sethrin 14y ago
      > Edit: I see that my post is getting downvoted while the factually incorrect parent post is not. This feels like /r/Linux, where facts are not welcome and where FUD gets voted up. I have a variety of negative responses to this, ranging from the apathetic, to the contradictory, to the ad hominem. I would probably not have had the same reaction had you omitted the "Edit:", although your description of the situation is perhaps oversimplified. Holding factual accuracy as the highest virtue is the blessing and curse of the tech world, and as such it may be forgivable. How you are choosing to express yourself, on the other hand, would seem to have a great deal to do with how well those comments are received.

The best thing that company can do about OSS is (drumroll) ... ... STOP the SecureBoot madness!

by Toshio 14y ago

The best thing that company can do about OSS is (drumroll) ... ... STOP the SecureBoot madness!

kunai 14y ago

To be honest, the FUD over Secure Boot is really reaching a fever pitch, and for no reason, as well. Just turn it off in the UEFI settings and install as much Linux, BSD, or GNU that you want. It really is not a big deal.

pfraze 14y ago
A quick google shows you're right! That's some pretty bad FUD if there's nothing else to this. Is there something about Secure Boot that turning it off doesn't solve?
- Toshio 14y ago
  Yes. Easy to use dual-boot is key to slowly transitioning your friends and family to Linux.
- icebraining 14y ago
  There's no turning it off on some platforms (ARM).
jaredmcateer 14y ago
I just bought a laptop that came with Windows 8, after 15 minutes of frustration just trying to play around with it, I replaced it with Linux, I didn't even notice the secureboot stuff.
- Toshio 14y ago
  This isn't about you or me or any other tech-savvy person. It's about the non-technical person, and about evangelizing the use of free-as-in-freedom operating systems to them. It used to be easy to dual-boot, but now that it's a seven-step operation to switch operating systems, that's effectively a monkey-wrench thrown into the widespread adoption of Linux.
  - deleted 14y ago
    [deleted]
  - jaredmcateer 14y ago
    It's a bit of a strawman, there are virtually no non-tech-savvy individuals that would ever embark on installing an alternative operating system without being influenced by, let alone without assistance from, a tech-savvy person.
    - rbanffy 14y ago
      > there are virtually no non-tech-savvy individuals that would ever embark on installing an alternative operating system And that's exactly what secure boot is designed to accomplish.
      - jaredmcateer 14y ago
        Secure boot has nothing to do with it, you have to drag non-technical people kicking and screaming to do something as simple as switching their browser from IE. It's a minor inconvenience for the people that will actually be doing the work.
Toshio 14y ago
> "Just turn it off in the UEFI settings" Yes, because when you're trying to get your non-technical friends and family to get used to Linux, they will be REALLY keen on going into UEFI to disable-reenable-disable-again etc. to switch between operating systems, whereas it was a simple keystroke up until recently.
- kunai 14y ago
  IIRC, couldn't you run Windows 8 without boot authentication? I believe there was a control panel option for this, and after you turn it off, GRUB should be the only thing you need.
- recoiledsnake 14y ago
  First, Windows 8 runs fine with secure boot disabled, so there no need to "disable-reenable-disable-again etc. to switch between operating systems". Second, how many folks that are able to install and configure Linux are unable to turn a setting off in the UEFI menu? Third, you need to balance this difficulty against the problem of bootkit malware across the PC ecosystem. Why should the hundreds of millions of technically not savvy not be protected from bootkits by default? Is there a way to make it less complicated for Linux users while still maintaining the security that Secure Boot provides?
  - kunai 14y ago
    > "Is there a way to make it less complicated for Linux users while still maintaining the security that Secure Boot provides?" Yes. It's called a PC with Linux preinstalled. Or just a Mac. The only PC I can think of that isn't just a rebrand or a really poorly designed one is the XPS 13, and that doesn't fit my needs currently (awful 16:9 aspect ratio). So, I bought a MacBook Air instead, and I'm running Linux Mint alongside OS X without any problems.
icebraining 14y ago
That's because you bought a x86 machine. On ARM, you have no such option: http://arstechnica.com/information-technology/2012/01/windows-8s-locked-bootloaders-much-ado-about-nothing-or-the-end-of-the-world-as-we-know-it/ http://arstechnica.com/information-technology/2012/01/window...
- kunai 14y ago
  I doubt anyone purchasing a mobile Windows RT RISC machine would be inclined to install Linux on it. In fact, the only devices I can currently think of are Windows RT tablets, which nobody is buying anyhow.
  - rbanffy 14y ago
    I'd do it. It's decent hardware and well designed.
- cooldeal 14y ago
  I love the phrasing "ARM device" as opposed to Windows RT. Somehow the largest selling "ARM Devices" i.e iPads are not blamed for having locked bootloaders. But on a barely selling platform, suddenly it's a huge deal.
  - icebraining 14y ago
    Who are you criticizing exactly? The article is specifically about Window's Secure Boot, so it doesn't make much sense to bring iPads and other devices into it. If you're talking in general, there are those who blame them: http://www.defectivebydesign.org/ipad http://www.defectivebydesign.org/ipad

icebraining 14y ago

As the FSF says, SecureBoot is not the problem; only implementations that don't let the user override it.

Toshio 14y ago
It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. It's this exclusionary practice that's the problem, not the implementation per se.
- deleted 14y ago
  [deleted]
- recoiledsnake 14y ago
  >It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. Please, stop the FUD, it just makes people look totally ignorant. Microsoft does not insist that in any shape or form. If you have a reference, please share it. But don't go around spreading falsehood.
- cooldeal 14y ago
  >It's about microsoft insisting that the only pre-loaded encryption key is theirs, to the exclusion of all other encryption keys. Bullshit, they do no such thing. The OEMs are perfectly able and willing to preload other keys. It's the community that is unable to step up to having a signing infrastructure. Why don't you contribute to the effort of a signing mechanism for Linux instead of just spreading anti-Microsoft lies? Edit: I see that my post is getting downvoted while the factually incorrect parent post is not. This feels like /r/Linux, where facts are not welcome and where FUD gets voted up.
  - sethrin 14y ago
    > Edit: I see that my post is getting downvoted while the factually incorrect parent post is not. This feels like /r/Linux, where facts are not welcome and where FUD gets voted up. I have a variety of negative responses to this, ranging from the apathetic, to the contradictory, to the ad hominem. I would probably not have had the same reaction had you omitted the "Edit:", although your description of the situation is perhaps oversimplified. Holding factual accuracy as the highest virtue is the blessing and curse of the tech world, and as such it may be forgivable. How you are choosing to express yourself, on the other hand, would seem to have a great deal to do with how well those comments are received.