6 ms·

Microsoft is killing Linux shops with Secure Boot

113 points by gabordemooij 13y ago

Here are some examples (Dutch so I passed the links through Google Translate) http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Fwww.mingos.nl%2F&act=url http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.hettes.nl%2F http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Flinuxcomputers.nl%2F It's now impossible to buy a Linux laptop in the Netherlands. You HAVE to pay for Windows, even though you don't want to use that OS at all. Seems like we're back to square one. And the worst part is, nobody seems to care. No outcry from the developer community. It's really sad. We don't seem to give a shit about freedom and choice.

jeena 13y ago
I don't quite understand from those links how Microsoft does that, what is Secure Boot, what are Linux shops and what does Microsoft do to kill them?
- Toshio 13y ago
  If you haven't been following this story as it developed over the past year and a half, microsoft corporation has leveraged their existing dominant position in the desktop OS market and mandated that OEMs include microsoft's encryption key in their motherboards, to the exclusion of all other encryption keys, as a prerequisite to their logo certification program. What is sad though is that antitrust regulators worldwide have looked at this practice and saw nothing wrong with it.
  - jagermo 13y ago
    You forget to mention that secure boot can be disabled. And that there are Linux distributions that can handle secure boot. To quote the Linux Foundation: "Linux and other open operating systems will be able to take advantage of secure boot if it is implemented properly in the hardware. This document is intended to describe how the UEFI secure boot specification can be implemented to interoperate well with open systems and to avoid adversely affecting the rights of the owners of those systems while providing compliance with proprietary software vendors' requirements." http://www.linuxfoundation.org/publications/making-uefi-secure-boot-work-with-open-platforms http://www.linuxfoundation.org/publications/making-uefi-secu...
    - Toshio 13y ago
      > "You forget to mention that secure boot can be disabled." Correct. But the steps to do so vary wildly from motherboard to motherboard and are not documented anywhere. In fact, one of the things HispaLinux requested is that OEMs provide clear documentation of the technical steps required to disable SecureBoot.
      - jagermo 13y ago
        Yes, I agree (although you cannot really blame Microsoft for this). But, to be honest, someone who is able to install Linux should also be able to roam through the Bios (which he/she should do anyway to check the settings, e.g. confirm the boot sequence). Plus, as far as I understand it, Linux can actually profit from secure boot, right?
  - Kiro 13y ago
    I don't understand. This seems multiple times worse than the previous things Microsoft has been fined for so how can they see nothing wrong with it?
    - pyre 13y ago
      1. It's actually trying to solve a real issue (viruses installing themselves in the boot loader so that they load before the operating system). 2. EFI Secure Boot was designed to allow for multiple keys, not just the 'one true Microsoft key.' 3. It's the OEMs that are creating crappy implementations, and not documenting how to disable Secure Boot. These are not things (at least officially) mandated by Microsoft. [Though one could make an argument that Microsoft should mandate that these things be documented instead of just stating that 'the ability to do X should exist.']
  - pyre 13y ago
    You responded to: | what is secure boot with: | microsoft corporation has leveraged their | existing dominant position in the desktop OS | market and mandated that OEMs include microsoft's | encryption key in their motherboards, to the | exclusion of all other encryption keys, as a | prerequisite to their logo certification program. If I did not know what SecureBoot was, I would still be in the dark.
Toshio 13y ago
I'm with you. HispaLinux did send a memo to their local EC office, but the official position in Brussels seems to be that there's been no breach of law. Speaking for myself, I sent a private e-mail to Neelie Kroes saying that I support the position of HispaLinux and that I regard it as an anticompetitive, exclusionary practice for there to be only microsoft's encryption key by default on all new motherboards, to the exclusion of say the GNU/Linux community's key. But there's only so much one private e-mail can do.
- recoiledsnake 13y ago
  > I sent a private e-mail to Neelie Kroes saying that I support the position of HispaLinux and that I regard it as an anticompetitive, exclusionary practice for there to be only microsoft's encryption key by default on all new motherboards, to the exclusion of say the GNU/Linux community's key. The whole problem is that there is no "GNU/Linux community's key" because no one is stepping up to provide it. The big OEMs had already told Red Hat that they're willing to include the community's keys so I fail to see the "anticompetitive, exclusionary practice". Microsoft does not mandate that only its key should be included by default on all new motherboards. The OEMs are free to include any other keys.
  - betterunix 13y ago
    Who do you trust to maintain a GNU/Linux community key? The Free Software Foundation, which takes an extreme position that even excludes Fedora? The Linux Foundation, which talks about compliance with proprietary vendors' requirements? Linus Torvalds, who takes no issue with TiVO? There is no single vendor I trust with the decision about which distro's bootloaders can be signed. I only trust the distro I am using, and only because I can switch to another distro at will (which I have done three times since I began experimenting with Linux all those years ago). That is the problem with the UEFI design: it does not let me, the user, decide who to trust, unless I am technically adept enough to install custom keys (I personally am, but even a lot of people at the local LUG and 2600 meetups are not). What we really need a system that allows me to install whatever OS I want, and allows that OS to optionally enable bootloader signing with its own key. I should be able to hit a button while booting up to enable a special "OS installation mode," which will boot from a USB device or a DVD to install an OS. During that process, the OS installer can load keys for bootloader signing. The user should always be able to install the OS of their choice, and should not have to rely on Microsoft or anyone else to "approve" a bootloader, OS, or anything else.
muddybulldog 13y ago
There no outcry because what you've shown is a market issue that has nothing to do with secure boot or Microsoft.
- sharms 13y ago
  I am not sure that is fair; the websites above mention that they can no longer purchase laptops without a Microsoft license, which hurts their ability to remain profitable. Ie at one point you could argue that if you didn't like AT&T, then the market would create a viable alternative. It never did, and was broken up as we know the free market does not solve everything. In this situation, you could argue the market would create a viable alternative, but Microsoft has a consistent track record of influencing the market monopolistically.
  - hollerith 13y ago
    >the websites above mention that they can no longer purchase laptops without a Microsoft license. OK, but what does that have to do with secure boot?
  - scholia 13y ago
    Unfortunately, none of the websites says why suppliers X, Y and Z, who used to sell them laptops without Windows, will no longer supply them with laptops without Windows, if that is the case. (There's no evidence that it is.) Also, none of the websites says why they can't just buy their laptops directly from Chinese white box PC suppliers. Am I supposed to believe it's cheaper to buy them via another European company that actually buys them from a Chinese white box supplier? Really? Microsoft's record of trying to influence the market dates from around 1992-95, and it spent the 2000's under close judicial control, so your fact-free monopoly assertion doesn't carry a lot of weight now. Either way, Apple has conclusively demonstrated that the market certainly will support a viable alternative -- and one that commands huge profit margins. This doesn't mean suppliers of crappy low-spec/high-priced Linux laptops are entitled top a free lunch, or that politicians should interfere with the market to prop up their failing businesses.
  - lovehashbrowns 13y ago
Ergomane 13y ago
You can still buy a Dell XPS 13 with Ubuntu via dell.nl or an OS-less laptop via BTO. > http://linuxcomputers.nl/ http://linuxcomputers.nl/ They don't appear to even mention secure boot as the reason, but pricing, margin and lack of interest, both from consumers as from vendors.
- Toshio 13y ago
  The thing is, high-end laptops used to be one expensive option among many before the whole SecureBoot thing. You had a choice. That choice has been killed. High-end laptops are now the only option if you want freedom, and that's not an accidental thing, it's by microsoft's design.
  - mdmarra 13y ago
    I'm failing to see why disabling Secure Boot on a lower-end laptop before installing Linux isn't a viable option here? Of course, being able to have it ship disabled by default is ideal, but for the HN crowd and for Linux shops, disabling Secure Boot in BIOS/EFI is trivial.
    - phaylon 13y ago
      What about people who want to dual-boot?
      - illuminate 13y ago
        What about them? It remains trivial to dual-boot.
pyalot2 13y ago
There are two separate but correlated issues. 1) SecureBoot on WART (windows on ARM) 2) SecureBoot on x86/64 The first issue (WART) is easily explained. Microsoft stipulates that ARM vendors may not accept any other operating system than Windows to run. This is a case where one company (Microsoft) colludes with other companies (Asus etc.) to create a product that is closed to the competition. The second issue (x86/64) is more nuanced. Microsoft stipulates that other OSes need to be able to run on these devices. However to do so one has to obtain a boot key from microsoft. The bios mechanism to restrict boot also has to work. There are a couple issues with this: 1) microsoft so far has issued barely any secure boot keys 2) Obtaining a secure boot key costs money 3) Microsoft can revoke those keys at any time 4) The implementation of secure boot on some devices is hardcoded to windows and won't work otherwise Both topics are not a "market issue" because there are multiple companies involved, many of which are monopoly holders in an area or other. Dell/HP/Asus etc. are monopoly holders to personal computing hardware. And Microsoft is a monopoly holder to personal computing operating systems. When you get multiple monopoly holders banding together forming one company, you are talking of a syndicate. Syndicates are explicitely forbidden to be formed under monopoly laws. Thus Microsoft and its OEMs are in deep shit, at least in theory.
- pyre 13y ago
  | Dell/HP/Asus etc. are monopoly holders to | personal computing hardware Doesn't the mono- part of monopoly make this statement a little shakey?
- UnoriginalGuy 13y ago
  > Microsoft stipulates that other OSes need to be able to run on these devices. However to do so one has to obtain a boot key from microsoft. No. Microsoft stipulates that other OSes must be supported AND that Secure Boot must have an off-switch in the BIOS/uEFI. Secure Boot has three "modes:" - Use my built in keys (aka Microsoft signing only). - Use user supplier keys (aka Custom Mode). - Off Only Microsoft-mode and off-mode are relevant to this discussion, because outside of government entities it isn't viable to produce and distribute custom keys.
- recoiledsnake 13y ago
smogzer 13y ago
Politicy makers are dumb. They took ages to resolve an issue such as availability to choose the default browser on an operating system, yet, in their closed world of waiting for their retirement checks, they, and their fault of ideals in their confortable sofas do no address the : simple issue of hardware and operating system separation.
- sultezdukes 13y ago
  Because responsible citizens should be making those decisions, not "policy makers".
  - dhimes 13y ago
    Unfortunately, in market-driven cases like this the decisions are being made by the middle of the bell curve. And we know what that means: http://usatoday30.usatoday.com/news/washington/2003-09-06-poll-iraq_x.htm http://usatoday30.usatoday.com/news/washington/2003-09-06-po...
UnoriginalGuy 13y ago
Wait wait wait... So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user... So these Linux-computer companies either buy laptops from manufacturers directly or produce their own, but somehow the laptops they're buying are unable to have Secure Boot turned off even though that is the industry standard and literally what every single laptop retailer's laptops do? This whole thing makes no logical sense at all. I totally doubt that anyone is producing x86 laptops where you cannot disable Secure Boot, if for no other reason that it would make these laptops ineligible for Windows/Microsoft certification which consumers care about. These companies might be going out of business, but trying to tie it to Secure Boot is nonsensical. Plus on top of everything I just said several Linux distributions now support Secure Boot out of the box. So these companies don't even have to go into the BIOS/uEFI and change the settings, just install Ubuntu like they always have. So OP: PROVE that Secure Boot is the cause of these companies going under? Or at least explain the logic to it.
- Toshio 13y ago
  > "So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user..." You say "easily disable-able" but that's not the case. The process of disabling SecureBoot is anything but easy, and it's undocumented.
  - mdmarra 13y ago
    My experience has been: Enter uEFI > Navigate to Security > Select SecureBoot > Disable What has your terrible experience been and on what model of computer?
  - UnoriginalGuy 13y ago
    On my motherboard I go: Security (tab) -> Secure Boot -> Disabled -> Save And it is documented. It is right there in the manual. This is an ASRock motherboard produced in the last few years. It literally is as complicated as turning on and off the internal sound or networking, or switching on USB legacy mode. PS - This web-site shows a different ASRock motherboard with the same-ish setup: http://www.eightforums.com/tutorials/17058-secure-boot-enable-disable-uefi.html http://www.eightforums.com/tutorials/17058-secure-boot-enabl...
X4 13y ago
In future Organizations want us to "Root" our PC's, huh? We didn't complain enough, we accepted that our vendor-locked Smartphones had to be rooted, to become free. Our freedom is getting hand-cuffed slow enough, that the spoilt Slave of the industry doesn't revolt, but fast enough to raise profits for the supporters of this party. My words in your ears, dear friends. We have to stop the engine of slavery, the software that limits our hardware, it will limit our horizon when we allow it mature and manifest itself within our technology. Viva Freedom!
- jagermo 13y ago
  No, you just head into the UEFI Bios and turn secure boot of. No rooting required here (besides its not being the right phrase).
  - betterunix 13y ago
    Unless you are on ARM, and only for now.
    - jagermo 13y ago
      Agree, sorry, should have mentioned that I mean the X86 plattform.
      - betterunix 13y ago
        Sure, but ARM is going to be more and more common on low-end computers. Even if the ability to disable these restrictions on x86 is still available in five or ten years -- and I am not so confident that it will be -- it will not matter for people who cannot spend more than $500 on a computer.
        recoiledsnake 13y ago
        Are you saying that WindowsRT will totally take over the ARM market and kill Android?
mcpat 13y ago
Not exactly a solution to the troubling issue, but System 76 assembles wonderful linux machines and they ship to the Netherlands. https://www.system76.com/home/shippinginformation https://www.system76.com/home/shippinginformation
- rquirk 13y ago
  Ouch. $112.68 shipping to Europe.
- claudius 13y ago
  For appropriate values of ‘wonderful’. But I guess if one pays 1500+ € for a computer, an extra 100 € for Windows is not all that important.
  - gabordemooij 13y ago
    Yes it's important. I don't want to pay for something I don't want.
    - scholia 13y ago
      The question is (a) how much extra are you willing to pay for not having Windows pre-installed. Does $100 - $200 sound reasonable? And (b) how many other people share your view? You are welcome to make your own personal demands on the market only if you are willing to pay for them, or in this case, if you can find many thousands of other people also willing to pay the price. It's pointless just claiming a "right". You have no rights. You can't force anybody to supply what you want except by enabling the supplier to make a profit. As it is, you're expecting them to make a significant loss. It's not just a question of removing Windows (or whatever OS you have installed for burn in and testing). There's the huge cost of qualifying parts for a different operating system, the extra tracking and stock-keeping costs, extra advertising and marketing costs (that will reflect the small number of units shipped), and the high cost of supporting Linux. Since any 157 Linux buyers typically want at least 57 different versions of Linux, and a fair few want to dual boot because they actually do use Windows (for games, iTunes, whatever), the whole idea is a non-starter....
skriticos2 13y ago
I bought my high end Ubuntu laptop from System76 (1) but the international shipping is horribly expensive (north of $100). I'd hope there would be regionally more distributed dedicated Linux hardware shops. Well, maybe this will happen when things get worse? [1] https://www.system76.com/ https://www.system76.com/
rth 13y ago
In Turkey's laws you can not sell a product with combining another product in same label. Computer is a product and software is another product. Hence you can not sell them under same label according to laws. But they selling computers by combining with M$ licenses. Some of my friends had to seek to justice but as you expect they can not take their money back. The winner is always who has the big money. They don't need to put an encryption key in motherboards. They do this f.cking shit already without key.
- jagermo 13y ago
  In all fairness, I don't think secure boot has the IT pros in mind. It targets the vast majority of IT users who have no clue at all and install every crap they can find on their systems. I recommend you take a look at this document by the linux foundation. http://www.linuxfoundation.org/publications/making-uefi-secure-boot-work-with-open-platforms http://www.linuxfoundation.org/publications/making-uefi-secu...
- bluefinity 13y ago
  > In Turkey's laws you can not sell a product with combining another product in same label. Do you have a source for this? I can't find any.
recoiledsnake 13y ago
Here we go again, just like last time with lots of FUD. I read through the links in the post and they're completely devoid of any details. First, I completely fail to see what this has to do with Secure Boot. If you're a System Builder and you're able to install Linux but are unable to turn off a checkbox in the settings, then you're a shitty system builder and deserve to have your business shut down. Second, I completely fail to see what this has to do with Windows 8. The main complaint seems to be that the big OEMs are not shipping laptops without Windows being already installed. Wasn't this true with Windows 7 too? It looks like the magic words "Windows 8 Secure Boot" were included in the headline and post only to gain HN karma points. If you're a business and want laptops without an OS, you need to go to the ODMs like Clevo, Compal, Asus, MSI, Quanta, Wistron, Mitac, Arima and Invente. http://en.wikipedia.org/wiki/Original_design_manufacturer http://en.wikipedia.org/wiki/Original_design_manufacturer They will happily sell you laptops in bulk without an OS installed. For example http://www.system76.com http://www.system76.com does exactly that. Looks like the computer shops linked seem to just want Lenovo to sell them bare laptops so they can skim a profit by just loading Linux on them and then selling them for a higher price. Guess what, Lenovo doesn't want to increase their costs by creating a separate assembly line process which won't make them any money. Asus sells barebones laptop kits if I am not mistaken. It's interesting how yelling "OMG WINDOWS 8 SECURE BOOT!!!" gets you a lot of karma here even though it has nothing to do with the issue at hand. The user is in control of the PC. They can load any key they trust or roll their own personal key and even remove Microsoft's key to prevent Windows from booting on their computer. I don't see why tens of millions of PCs used by non-technical people should be susceptible to undetectable rootkits out of the box just to appease some stupid system builders who can't find the setting to turn it off in the BIOS menu.
- Toshio 13y ago
  > "If you're a business and want laptops without an OS" No, I'm a consumer who wants the same variety of laptops/specs/price points that are sold with windows eight preinstalled, to be available without microsoft's contraptions, be they operating systems or encryption keys. microsoft doesn't want me to have that choice, and this is the topic at hand, and by the way, you should consider sticking to the topic at hand.
outside1234 13y ago
Run Linux on your iPad or iPhone then. Oh wait.
- Toshio 13y ago
  It's different. Apple and microsoft can do what they want with hardware/software bundles that they build themselves. That's why noone complains that those surface products are locked down, it's because microsoft manufactures them. Consumer harm comes into play when microsoft leverages their existing desktop OS monopoly to twist OEMs' arms into including an encryption key that OEMs gain no direct benefit from.
  - recoiledsnake 13y ago
    >That's why noone complains that those surface products are locked down, it's because microsoft manufactures them The Surface Pro is not locked down. You can even remove Microsoft's key and stop Windows from booting and install Ubuntu's key or your own. >Consumer harm comes into play when microsoft leverages their existing desktop OS monopoly to twist OEMs' arms into including an encryption key that OEMs gain no direct benefit from. The OEMs benefit is that their customer's PCs are not vulnerable to undetectable rootkits as soon as they get on the internet and get hit by a Java, Flash exploit or download a fake codec or toolbar. Interesting how no one seems to talk about benefits of secure boot to real users in this discussion.
    - Toshio 13y ago
      > "Interesting how no one seems to talk about benefits of secure boot to real users in this discussion." Look, microsoft should be working to fix their software instead of leaving it as it is and instead making life miserable for those who want digital freedom.
      - recoiledsnake 13y ago
        I don't see how any computer can be flexible enough to be a general purpose PC with full freedom of customization and at same time be invulnerable to viruses and bootkits The only way to make an OS more secure is iOS style DRM walled garden sandbox lockdown. If what you say is true, why are Android, OS X and even Linux susceptible to viruses and rootkits? For example, Java, Flash and Adobe Reader PDF exploits are all the rage now, and OS X and Linux are as vulnerable to them as Windows is.
scholia 13y ago
Microsoft doesn't sell laptops to OEMs, and none of these companies is buying anything from Microsoft, so I don't see what Microsoft has to do with it. If they have lost their original supplier, for whatever unstated reason, there are dozens of Asian white box PC makers who will ship whatever you like, at low prices.... Perhaps the market is just too small to make financial sense, or these Dutch shops have no money. I used the Wayback machine to have a look at the products and the results are not too exciting. For example, a year ago, the 1.9kg Mingos LT-13-2 laptop had a 1.3GHz Pentium, 2GB of RAM and a 160GB hard drive for €540.00 ($708) with Ubuntu. http://web.archive.org/web/20120603005911/http://www.mingos.nl/ubuntu-laptops/mingos-lt-13-2.html http://web.archive.org/web/20120603005911/http://www.mingos.... I can't see how any rational person would buy that, even if they were totally clueless, rabid anti-Microsoft fanboys. It's not like installing Ubuntu is hard ... This whole thing makes no sense.
alanctgardner2 13y ago
Having worked at (and briefly managed) a local computer store, then a big box store, it's a brutal business. In the small store we made all our money on service: selling recycled commodity boxes was a way to get traffic through the door, so you could fix them later. A few high-end builds were the highlight of my year, but they were few and far between. We considered offering Linux, but: - It used to be that most technical people ( and some non-technical) would buy desktops. You can sidestep the Windows tax and attendant issues by building a desktop (from parts you know work well with Linux), and maybe hit a competitive price in the high end. Now that desktops are a tiny sliver of the market, these stores are enslaved by OEMs, reboxing existing laptop designs. - Starting from the same wholesale price, Linux resellers 'add value' by installing Linux. But this value-add isn't really apparent to a large enough audience - there isn't enough public awareness, and people aren't willing to pay a premium. Especially if they're competent enough to install Linux themselves. In my experience people expect ANY OS to be free; when we used to try and sell Win XP as an upgrade (over 2K), people were aghast that the software cost money. - People want free support if you sell them on Linux. If they nuke the system, you either scare them off with your hourly service rate, or you eat the cost of the labour and go broke. - So the vendor either charges a higher sticker price and doesn't sell many, or eats the labour cost for developing Linux support, fixing and reboxing laptops and tries to make up the tiny (or even negative) gross margin on volume. When I moved to a bigger chain store, they subsidized the low-margin laptop market by aggressively pushing house-brand accessories: cables, cases, blank media, printer ink. These small stores are typically much less aggressive about selling high-margin commodities along with a system (it's harder to do with less capital, space and by mail). So it isn't a problem of freedom and choice. It isn't a problem of Microsoft crushing little independents (not consciously). The computer business is very hard to do well at small scale, and you should expect that on a medium time-scale most will die. This is only exacerbated by the rush to laptops, then tablets and smartphones, where it's impossible to differentiate.
pootch 13y ago
Secure boot sounds like a bunch of bullshit. Look if your OS lets a program infect the bootloader, it was your fault. If your buying systems that have been hijacked by your oppressive govt, well that sucks for you. This is an obvious antitrust violation, MS (nor Intel) dictate the security practices of system BIOS loading. Is it a bug or a feature? Its neither, once your MS Windows key has loaded and the BIOS boots it, your PC will still be just as infected as it was before. This whole thing is bullshit. I call bullshit on secure boot. Its a BIOS lockout that probably disables other OSes from running, disables dual boot systems, I mean cmon. This is why I use VMs and dont mess with the boot process, the BIOS mafia is a fucking joke.
eliben 13y ago
Of all the vile things Microsoft has been doing to suppress superior competition to their inferior products, this must be one of the vilest. It's absolutely disgusting.
guilloche 13y ago
I myself will boycott the evilest MS and will not buy anything associated with MS from now on. Secure boot is evil until we can provide our own key. Even if GNU keys are permitted, it is still bad enough.
- Tomdarkness 13y ago
  You can provide your own keys, at least on some motherboards. Here is the screenshot from my motherboard's bios: http://i.imgur.com/XkJ11If.png http://i.imgur.com/XkJ11If.png
crutch 13y ago
Dutch here. These vendors have all run into the same problem; their Dutch distributor is no longer able/willing to sell them laptops without Windows 8 preloaded and they haven't found an alternative distributor. Previously they could buy branded laptops (HP, Lenovo, and such) without Windows. Consumers can already buy such laptops with Windows, and then install Linux on them. These shops made it possible to buy laptops free of Windows, so without having to pay "Windows-tax". Hettes.nl have received an outpouring of support and have started a petition with the intent to get this practice of product tying discussable in the Dutch House of Representatives and in a well known Dutch consumers' rights television show, and raise awareness of this to the European Union. They write (my translation): "At this moment we are receiving many comments about the stopping of Hettes.nl, also on the Internet we are mentioned multiple times and many visitors of Hettes.nl are disappointed that we are stopping. Because of these comments we want to start a petition to make the Dutch government and the European union see that this product tying should stop and that it should be possible to buy computers (any brand) without Windows. So that we can offer computers without Windows to consumers that prefer other operating systems!" The petition is the link in the last paragraph on this page: http://www.hettes.nl/hettes-stopt http://www.hettes.nl/hettes-stopt Edit: added translation of Hettes.nl paragraph about their petition.

113 points by gabordemooij 13y ago

jeena 13y ago

I don't quite understand from those links how Microsoft does that, what is Secure Boot, what are Linux shops and what does Microsoft do to kill them?

Toshio 13y ago
If you haven't been following this story as it developed over the past year and a half, microsoft corporation has leveraged their existing dominant position in the desktop OS market and mandated that OEMs include microsoft's encryption key in their motherboards, to the exclusion of all other encryption keys, as a prerequisite to their logo certification program. What is sad though is that antitrust regulators worldwide have looked at this practice and saw nothing wrong with it.
- jagermo 13y ago
  You forget to mention that secure boot can be disabled. And that there are Linux distributions that can handle secure boot. To quote the Linux Foundation: "Linux and other open operating systems will be able to take advantage of secure boot if it is implemented properly in the hardware. This document is intended to describe how the UEFI secure boot specification can be implemented to interoperate well with open systems and to avoid adversely affecting the rights of the owners of those systems while providing compliance with proprietary software vendors' requirements." http://www.linuxfoundation.org/publications/making-uefi-secure-boot-work-with-open-platforms http://www.linuxfoundation.org/publications/making-uefi-secu...
  - Toshio 13y ago
    > "You forget to mention that secure boot can be disabled." Correct. But the steps to do so vary wildly from motherboard to motherboard and are not documented anywhere. In fact, one of the things HispaLinux requested is that OEMs provide clear documentation of the technical steps required to disable SecureBoot.
    - jagermo 13y ago
      Yes, I agree (although you cannot really blame Microsoft for this). But, to be honest, someone who is able to install Linux should also be able to roam through the Bios (which he/she should do anyway to check the settings, e.g. confirm the boot sequence). Plus, as far as I understand it, Linux can actually profit from secure boot, right?
- Kiro 13y ago
  I don't understand. This seems multiple times worse than the previous things Microsoft has been fined for so how can they see nothing wrong with it?
  - pyre 13y ago
    1. It's actually trying to solve a real issue (viruses installing themselves in the boot loader so that they load before the operating system). 2. EFI Secure Boot was designed to allow for multiple keys, not just the 'one true Microsoft key.' 3. It's the OEMs that are creating crappy implementations, and not documenting how to disable Secure Boot. These are not things (at least officially) mandated by Microsoft. [Though one could make an argument that Microsoft should mandate that these things be documented instead of just stating that 'the ability to do X should exist.']
- pyre 13y ago
  You responded to: | what is secure boot with: | microsoft corporation has leveraged their | existing dominant position in the desktop OS | market and mandated that OEMs include microsoft's | encryption key in their motherboards, to the | exclusion of all other encryption keys, as a | prerequisite to their logo certification program. If I did not know what SecureBoot was, I would still be in the dark.

Toshio 13y ago

I'm with you. HispaLinux did send a memo to their local EC office, but the official position in Brussels seems to be that there's been no breach of law. Speaking for myself, I sent a private e-mail to Neelie Kroes saying that I support the position of HispaLinux and that I regard it as an anticompetitive, exclusionary practice for there to be only microsoft's encryption key by default on all new motherboards, to the exclusion of say the GNU/Linux community's key. But there's only so much one private e-mail can do.

recoiledsnake 13y ago
> I sent a private e-mail to Neelie Kroes saying that I support the position of HispaLinux and that I regard it as an anticompetitive, exclusionary practice for there to be only microsoft's encryption key by default on all new motherboards, to the exclusion of say the GNU/Linux community's key. The whole problem is that there is no "GNU/Linux community's key" because no one is stepping up to provide it. The big OEMs had already told Red Hat that they're willing to include the community's keys so I fail to see the "anticompetitive, exclusionary practice". Microsoft does not mandate that only its key should be included by default on all new motherboards. The OEMs are free to include any other keys.
- betterunix 13y ago
  Who do you trust to maintain a GNU/Linux community key? The Free Software Foundation, which takes an extreme position that even excludes Fedora? The Linux Foundation, which talks about compliance with proprietary vendors' requirements? Linus Torvalds, who takes no issue with TiVO? There is no single vendor I trust with the decision about which distro's bootloaders can be signed. I only trust the distro I am using, and only because I can switch to another distro at will (which I have done three times since I began experimenting with Linux all those years ago). That is the problem with the UEFI design: it does not let me, the user, decide who to trust, unless I am technically adept enough to install custom keys (I personally am, but even a lot of people at the local LUG and 2600 meetups are not). What we really need a system that allows me to install whatever OS I want, and allows that OS to optionally enable bootloader signing with its own key. I should be able to hit a button while booting up to enable a special "OS installation mode," which will boot from a USB device or a DVD to install an OS. During that process, the OS installer can load keys for bootloader signing. The user should always be able to install the OS of their choice, and should not have to rely on Microsoft or anyone else to "approve" a bootloader, OS, or anything else.

muddybulldog 13y ago

There no outcry because what you've shown is a market issue that has nothing to do with secure boot or Microsoft.

sharms 13y ago
I am not sure that is fair; the websites above mention that they can no longer purchase laptops without a Microsoft license, which hurts their ability to remain profitable. Ie at one point you could argue that if you didn't like AT&T, then the market would create a viable alternative. It never did, and was broken up as we know the free market does not solve everything. In this situation, you could argue the market would create a viable alternative, but Microsoft has a consistent track record of influencing the market monopolistically.
- hollerith 13y ago
  >the websites above mention that they can no longer purchase laptops without a Microsoft license. OK, but what does that have to do with secure boot?
- scholia 13y ago
  Unfortunately, none of the websites says why suppliers X, Y and Z, who used to sell them laptops without Windows, will no longer supply them with laptops without Windows, if that is the case. (There's no evidence that it is.) Also, none of the websites says why they can't just buy their laptops directly from Chinese white box PC suppliers. Am I supposed to believe it's cheaper to buy them via another European company that actually buys them from a Chinese white box supplier? Really? Microsoft's record of trying to influence the market dates from around 1992-95, and it spent the 2000's under close judicial control, so your fact-free monopoly assertion doesn't carry a lot of weight now. Either way, Apple has conclusively demonstrated that the market certainly will support a viable alternative -- and one that commands huge profit margins. This doesn't mean suppliers of crappy low-spec/high-priced Linux laptops are entitled top a free lunch, or that politicians should interfere with the market to prop up their failing businesses.
- lovehashbrowns 13y ago

Ergomane 13y ago

You can still buy a Dell XPS 13 with Ubuntu via dell.nl or an OS-less laptop via BTO. > http://linuxcomputers.nl/ http://linuxcomputers.nl/ They don't appear to even mention secure boot as the reason, but pricing, margin and lack of interest, both from consumers as from vendors.

Toshio 13y ago
The thing is, high-end laptops used to be one expensive option among many before the whole SecureBoot thing. You had a choice. That choice has been killed. High-end laptops are now the only option if you want freedom, and that's not an accidental thing, it's by microsoft's design.
- mdmarra 13y ago
  I'm failing to see why disabling Secure Boot on a lower-end laptop before installing Linux isn't a viable option here? Of course, being able to have it ship disabled by default is ideal, but for the HN crowd and for Linux shops, disabling Secure Boot in BIOS/EFI is trivial.
  - phaylon 13y ago
    What about people who want to dual-boot?
    - illuminate 13y ago
      What about them? It remains trivial to dual-boot.

pyalot2 13y ago

There are two separate but correlated issues. 1) SecureBoot on WART (windows on ARM) 2) SecureBoot on x86/64 The first issue (WART) is easily explained. Microsoft stipulates that ARM vendors may not accept any other operating system than Windows to run. This is a case where one company (Microsoft) colludes with other companies (Asus etc.) to create a product that is closed to the competition. The second issue (x86/64) is more nuanced. Microsoft stipulates that other OSes need to be able to run on these devices. However to do so one has to obtain a boot key from microsoft. The bios mechanism to restrict boot also has to work. There are a couple issues with this: 1) microsoft so far has issued barely any secure boot keys 2) Obtaining a secure boot key costs money 3) Microsoft can revoke those keys at any time 4) The implementation of secure boot on some devices is hardcoded to windows and won't work otherwise Both topics are not a "market issue" because there are multiple companies involved, many of which are monopoly holders in an area or other. Dell/HP/Asus etc. are monopoly holders to personal computing hardware. And Microsoft is a monopoly holder to personal computing operating systems. When you get multiple monopoly holders banding together forming one company, you are talking of a syndicate. Syndicates are explicitely forbidden to be formed under monopoly laws. Thus Microsoft and its OEMs are in deep shit, at least in theory.

pyre 13y ago
| Dell/HP/Asus etc. are monopoly holders to | personal computing hardware Doesn't the mono- part of monopoly make this statement a little shakey?
UnoriginalGuy 13y ago
> Microsoft stipulates that other OSes need to be able to run on these devices. However to do so one has to obtain a boot key from microsoft. No. Microsoft stipulates that other OSes must be supported AND that Secure Boot must have an off-switch in the BIOS/uEFI. Secure Boot has three "modes:" - Use my built in keys (aka Microsoft signing only). - Use user supplier keys (aka Custom Mode). - Off Only Microsoft-mode and off-mode are relevant to this discussion, because outside of government entities it isn't viable to produce and distribute custom keys.
recoiledsnake 13y ago

smogzer 13y ago

Politicy makers are dumb. They took ages to resolve an issue such as availability to choose the default browser on an operating system, yet, in their closed world of waiting for their retirement checks, they, and their fault of ideals in their confortable sofas do no address the : simple issue of hardware and operating system separation.

sultezdukes 13y ago
Because responsible citizens should be making those decisions, not "policy makers".
- dhimes 13y ago
  Unfortunately, in market-driven cases like this the decisions are being made by the middle of the bell curve. And we know what that means: http://usatoday30.usatoday.com/news/washington/2003-09-06-poll-iraq_x.htm http://usatoday30.usatoday.com/news/washington/2003-09-06-po...

UnoriginalGuy 13y ago

Wait wait wait... So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user... So these Linux-computer companies either buy laptops from manufacturers directly or produce their own, but somehow the laptops they're buying are unable to have Secure Boot turned off even though that is the industry standard and literally what every single laptop retailer's laptops do? This whole thing makes no logical sense at all. I totally doubt that anyone is producing x86 laptops where you cannot disable Secure Boot, if for no other reason that it would make these laptops ineligible for Windows/Microsoft certification which consumers care about. These companies might be going out of business, but trying to tie it to Secure Boot is nonsensical. Plus on top of everything I just said several Linux distributions now support Secure Boot out of the box. So these companies don't even have to go into the BIOS/uEFI and change the settings, just install Ubuntu like they always have. So OP: PROVE that Secure Boot is the cause of these companies going under? Or at least explain the logic to it.

Toshio 13y ago
> "So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user..." You say "easily disable-able" but that's not the case. The process of disabling SecureBoot is anything but easy, and it's undocumented.
- mdmarra 13y ago
  My experience has been: Enter uEFI > Navigate to Security > Select SecureBoot > Disable What has your terrible experience been and on what model of computer?
- UnoriginalGuy 13y ago
  On my motherboard I go: Security (tab) -> Secure Boot -> Disabled -> Save And it is documented. It is right there in the manual. This is an ASRock motherboard produced in the last few years. It literally is as complicated as turning on and off the internal sound or networking, or switching on USB legacy mode. PS - This web-site shows a different ASRock motherboard with the same-ish setup: http://www.eightforums.com/tutorials/17058-secure-boot-enable-disable-uefi.html http://www.eightforums.com/tutorials/17058-secure-boot-enabl...

X4 13y ago

In future Organizations want us to "Root" our PC's, huh? We didn't complain enough, we accepted that our vendor-locked Smartphones had to be rooted, to become free. Our freedom is getting hand-cuffed slow enough, that the spoilt Slave of the industry doesn't revolt, but fast enough to raise profits for the supporters of this party. My words in your ears, dear friends. We have to stop the engine of slavery, the software that limits our hardware, it will limit our horizon when we allow it mature and manifest itself within our technology. Viva Freedom!

jagermo 13y ago
No, you just head into the UEFI Bios and turn secure boot of. No rooting required here (besides its not being the right phrase).
- betterunix 13y ago
  Unless you are on ARM, and only for now.
  - jagermo 13y ago
    Agree, sorry, should have mentioned that I mean the X86 plattform.
    - betterunix 13y ago
      Sure, but ARM is going to be more and more common on low-end computers. Even if the ability to disable these restrictions on x86 is still available in five or ten years -- and I am not so confident that it will be -- it will not matter for people who cannot spend more than $500 on a computer.
      - recoiledsnake 13y ago
        Are you saying that WindowsRT will totally take over the ARM market and kill Android?

mcpat 13y ago

Not exactly a solution to the troubling issue, but System 76 assembles wonderful linux machines and they ship to the Netherlands. https://www.system76.com/home/shippinginformation https://www.system76.com/home/shippinginformation

rquirk 13y ago
Ouch. $112.68 shipping to Europe.
claudius 13y ago
For appropriate values of ‘wonderful’. But I guess if one pays 1500+ € for a computer, an extra 100 € for Windows is not all that important.
- gabordemooij 13y ago
  Yes it's important. I don't want to pay for something I don't want.
  - scholia 13y ago
    The question is (a) how much extra are you willing to pay for not having Windows pre-installed. Does $100 - $200 sound reasonable? And (b) how many other people share your view? You are welcome to make your own personal demands on the market only if you are willing to pay for them, or in this case, if you can find many thousands of other people also willing to pay the price. It's pointless just claiming a "right". You have no rights. You can't force anybody to supply what you want except by enabling the supplier to make a profit. As it is, you're expecting them to make a significant loss. It's not just a question of removing Windows (or whatever OS you have installed for burn in and testing). There's the huge cost of qualifying parts for a different operating system, the extra tracking and stock-keeping costs, extra advertising and marketing costs (that will reflect the small number of units shipped), and the high cost of supporting Linux. Since any 157 Linux buyers typically want at least 57 different versions of Linux, and a fair few want to dual boot because they actually do use Windows (for games, iTunes, whatever), the whole idea is a non-starter....

skriticos2 13y ago

I bought my high end Ubuntu laptop from System76 (1) but the international shipping is horribly expensive (north of $100). I'd hope there would be regionally more distributed dedicated Linux hardware shops. Well, maybe this will happen when things get worse? [1] https://www.system76.com/ https://www.system76.com/

rth 13y ago

In Turkey's laws you can not sell a product with combining another product in same label. Computer is a product and software is another product. Hence you can not sell them under same label according to laws. But they selling computers by combining with M$ licenses. Some of my friends had to seek to justice but as you expect they can not take their money back. The winner is always who has the big money. They don't need to put an encryption key in motherboards. They do this f.cking shit already without key.

jagermo 13y ago
In all fairness, I don't think secure boot has the IT pros in mind. It targets the vast majority of IT users who have no clue at all and install every crap they can find on their systems. I recommend you take a look at this document by the linux foundation. http://www.linuxfoundation.org/publications/making-uefi-secure-boot-work-with-open-platforms http://www.linuxfoundation.org/publications/making-uefi-secu...
bluefinity 13y ago
> In Turkey's laws you can not sell a product with combining another product in same label. Do you have a source for this? I can't find any.

recoiledsnake 13y ago

Here we go again, just like last time with lots of FUD. I read through the links in the post and they're completely devoid of any details. First, I completely fail to see what this has to do with Secure Boot. If you're a System Builder and you're able to install Linux but are unable to turn off a checkbox in the settings, then you're a shitty system builder and deserve to have your business shut down. Second, I completely fail to see what this has to do with Windows 8. The main complaint seems to be that the big OEMs are not shipping laptops without Windows being already installed. Wasn't this true with Windows 7 too? It looks like the magic words "Windows 8 Secure Boot" were included in the headline and post only to gain HN karma points. If you're a business and want laptops without an OS, you need to go to the ODMs like Clevo, Compal, Asus, MSI, Quanta, Wistron, Mitac, Arima and Invente. http://en.wikipedia.org/wiki/Original_design_manufacturer http://en.wikipedia.org/wiki/Original_design_manufacturer They will happily sell you laptops in bulk without an OS installed. For example http://www.system76.com http://www.system76.com does exactly that. Looks like the computer shops linked seem to just want Lenovo to sell them bare laptops so they can skim a profit by just loading Linux on them and then selling them for a higher price. Guess what, Lenovo doesn't want to increase their costs by creating a separate assembly line process which won't make them any money. Asus sells barebones laptop kits if I am not mistaken. It's interesting how yelling "OMG WINDOWS 8 SECURE BOOT!!!" gets you a lot of karma here even though it has nothing to do with the issue at hand. The user is in control of the PC. They can load any key they trust or roll their own personal key and even remove Microsoft's key to prevent Windows from booting on their computer. I don't see why tens of millions of PCs used by non-technical people should be susceptible to undetectable rootkits out of the box just to appease some stupid system builders who can't find the setting to turn it off in the BIOS menu.

Toshio 13y ago
> "If you're a business and want laptops without an OS" No, I'm a consumer who wants the same variety of laptops/specs/price points that are sold with windows eight preinstalled, to be available without microsoft's contraptions, be they operating systems or encryption keys. microsoft doesn't want me to have that choice, and this is the topic at hand, and by the way, you should consider sticking to the topic at hand.

outside1234 13y ago

Run Linux on your iPad or iPhone then. Oh wait.

Toshio 13y ago
It's different. Apple and microsoft can do what they want with hardware/software bundles that they build themselves. That's why noone complains that those surface products are locked down, it's because microsoft manufactures them. Consumer harm comes into play when microsoft leverages their existing desktop OS monopoly to twist OEMs' arms into including an encryption key that OEMs gain no direct benefit from.
- recoiledsnake 13y ago
  >That's why noone complains that those surface products are locked down, it's because microsoft manufactures them The Surface Pro is not locked down. You can even remove Microsoft's key and stop Windows from booting and install Ubuntu's key or your own. >Consumer harm comes into play when microsoft leverages their existing desktop OS monopoly to twist OEMs' arms into including an encryption key that OEMs gain no direct benefit from. The OEMs benefit is that their customer's PCs are not vulnerable to undetectable rootkits as soon as they get on the internet and get hit by a Java, Flash exploit or download a fake codec or toolbar. Interesting how no one seems to talk about benefits of secure boot to real users in this discussion.
  - Toshio 13y ago
    > "Interesting how no one seems to talk about benefits of secure boot to real users in this discussion." Look, microsoft should be working to fix their software instead of leaving it as it is and instead making life miserable for those who want digital freedom.
    - recoiledsnake 13y ago
      I don't see how any computer can be flexible enough to be a general purpose PC with full freedom of customization and at same time be invulnerable to viruses and bootkits The only way to make an OS more secure is iOS style DRM walled garden sandbox lockdown. If what you say is true, why are Android, OS X and even Linux susceptible to viruses and rootkits? For example, Java, Flash and Adobe Reader PDF exploits are all the rage now, and OS X and Linux are as vulnerable to them as Windows is.

scholia 13y ago

Microsoft doesn't sell laptops to OEMs, and none of these companies is buying anything from Microsoft, so I don't see what Microsoft has to do with it. If they have lost their original supplier, for whatever unstated reason, there are dozens of Asian white box PC makers who will ship whatever you like, at low prices.... Perhaps the market is just too small to make financial sense, or these Dutch shops have no money. I used the Wayback machine to have a look at the products and the results are not too exciting. For example, a year ago, the 1.9kg Mingos LT-13-2 laptop had a 1.3GHz Pentium, 2GB of RAM and a 160GB hard drive for €540.00 ($708) with Ubuntu. http://web.archive.org/web/20120603005911/http://www.mingos.nl/ubuntu-laptops/mingos-lt-13-2.html http://web.archive.org/web/20120603005911/http://www.mingos.... I can't see how any rational person would buy that, even if they were totally clueless, rabid anti-Microsoft fanboys. It's not like installing Ubuntu is hard ... This whole thing makes no sense.

alanctgardner2 13y ago

Having worked at (and briefly managed) a local computer store, then a big box store, it's a brutal business. In the small store we made all our money on service: selling recycled commodity boxes was a way to get traffic through the door, so you could fix them later. A few high-end builds were the highlight of my year, but they were few and far between. We considered offering Linux, but: - It used to be that most technical people ( and some non-technical) would buy desktops. You can sidestep the Windows tax and attendant issues by building a desktop (from parts you know work well with Linux), and maybe hit a competitive price in the high end. Now that desktops are a tiny sliver of the market, these stores are enslaved by OEMs, reboxing existing laptop designs. - Starting from the same wholesale price, Linux resellers 'add value' by installing Linux. But this value-add isn't really apparent to a large enough audience - there isn't enough public awareness, and people aren't willing to pay a premium. Especially if they're competent enough to install Linux themselves. In my experience people expect ANY OS to be free; when we used to try and sell Win XP as an upgrade (over 2K), people were aghast that the software cost money. - People want free support if you sell them on Linux. If they nuke the system, you either scare them off with your hourly service rate, or you eat the cost of the labour and go broke. - So the vendor either charges a higher sticker price and doesn't sell many, or eats the labour cost for developing Linux support, fixing and reboxing laptops and tries to make up the tiny (or even negative) gross margin on volume. When I moved to a bigger chain store, they subsidized the low-margin laptop market by aggressively pushing house-brand accessories: cables, cases, blank media, printer ink. These small stores are typically much less aggressive about selling high-margin commodities along with a system (it's harder to do with less capital, space and by mail). So it isn't a problem of freedom and choice. It isn't a problem of Microsoft crushing little independents (not consciously). The computer business is very hard to do well at small scale, and you should expect that on a medium time-scale most will die. This is only exacerbated by the rush to laptops, then tablets and smartphones, where it's impossible to differentiate.

pootch 13y ago

Secure boot sounds like a bunch of bullshit. Look if your OS lets a program infect the bootloader, it was your fault. If your buying systems that have been hijacked by your oppressive govt, well that sucks for you. This is an obvious antitrust violation, MS (nor Intel) dictate the security practices of system BIOS loading. Is it a bug or a feature? Its neither, once your MS Windows key has loaded and the BIOS boots it, your PC will still be just as infected as it was before. This whole thing is bullshit. I call bullshit on secure boot. Its a BIOS lockout that probably disables other OSes from running, disables dual boot systems, I mean cmon. This is why I use VMs and dont mess with the boot process, the BIOS mafia is a fucking joke.

eliben 13y ago

Of all the vile things Microsoft has been doing to suppress superior competition to their inferior products, this must be one of the vilest. It's absolutely disgusting.

guilloche 13y ago

I myself will boycott the evilest MS and will not buy anything associated with MS from now on. Secure boot is evil until we can provide our own key. Even if GNU keys are permitted, it is still bad enough.

Tomdarkness 13y ago
You can provide your own keys, at least on some motherboards. Here is the screenshot from my motherboard's bios: http://i.imgur.com/XkJ11If.png http://i.imgur.com/XkJ11If.png

crutch 13y ago

Dutch here. These vendors have all run into the same problem; their Dutch distributor is no longer able/willing to sell them laptops without Windows 8 preloaded and they haven't found an alternative distributor. Previously they could buy branded laptops (HP, Lenovo, and such) without Windows. Consumers can already buy such laptops with Windows, and then install Linux on them. These shops made it possible to buy laptops free of Windows, so without having to pay "Windows-tax". Hettes.nl have received an outpouring of support and have started a petition with the intent to get this practice of product tying discussable in the Dutch House of Representatives and in a well known Dutch consumers' rights television show, and raise awareness of this to the European Union. They write (my translation): "At this moment we are receiving many comments about the stopping of Hettes.nl, also on the Internet we are mentioned multiple times and many visitors of Hettes.nl are disappointed that we are stopping. Because of these comments we want to start a petition to make the Dutch government and the European union see that this product tying should stop and that it should be possible to buy computers (any brand) without Windows. So that we can offer computers without Windows to consumers that prefer other operating systems!" The petition is the link in the last paragraph on this page: http://www.hettes.nl/hettes-stopt http://www.hettes.nl/hettes-stopt Edit: added translation of Hettes.nl paragraph about their petition.