6 ms·

Making UEFI Secure Boot Work With Open Platforms

53 points by jagermo 13y ago

jagermo 13y ago
Link is mentioned in this debate: https://news.ycombinator.com/item?id=5658184 https://news.ycombinator.com/item?id=5658184
betterunix 13y ago
Compliance with proprietary vendors' requirements? No thanks, I do not want Microsoft, Apple, Sony, or anyone else deciding how I use my computer. Shame that the Linux foundation cannot understand the most basic tenet of free software.
urza 13y ago
The coming civil war over general purpose computing https://news.ycombinator.com/item?id=4436139 https://news.ycombinator.com/item?id=4436139
- bitcracker 13y ago
  For this simple reason the Linux Foundation should stop wasting further energy for UEFI. As a Linux user from the very beginning (since 1992) I won't buy any UEFI device for Linux in general even if Linux would be 100% supported. I won't buy an expensive WinRT tablet just to put Linux on it. When the Linux Foundation was founded I was happy to have a strong organization behind Linux. But today they make me really angry for supporting a system of someone who considered Linux, and the Open Source movement in general, as enemy. UEFI proves that they don't have changed their mind. LF, please stop your unrealistic UEFI dreams, and please focus on the interests of the Linux community. I believe that most Linux users want functional hardware alternatives which will likely remain free from DRM restrictions. I would appreciate that even at the cost of incompatibility with the internet. In that case we would have to build our own new Internet, free from spam etc. There are so many good devices like Raspberry and Beagleboard Black. They are powerful enough to be used as a desktop workstation when using a small and efficient Linux distro. Why not even enhance them with an e-ink display to make them a cheap alternative tablet pc that everyone can afford? By the way, for the price of a single UEFI WinRT tablet we could build a whole server cluster of RPis or BBB.
  - deleted 13y ago
    [deleted]
throwaway2048 13y ago
Here is the major problem with UEFI Secure Boot. Microsoft only changed the reqirement that secure boot must be possible to disable after there was a public outcry, and are free to change it again any time. They can either change a requirement to have the ability to disable it be optional, or make the inability to disable it mandatory, like on surface systems. Thats the real issue. In very real way, Microsoft now hold the keys to the future of the x86 PC archecture, and I question why people are so ready to trust them considering their history. The problem with supporting secure boot is it legitimizes microsoft's role as the gatekeeper to computing. Now with a straight face they can say to regulatory bodies "look at how many free and open source operating systems support secure boot, there is no monopolization here". They are then free to turn the screws, and make disabling secure boot impossible. Not to mention distributions like fedora are making massive changes to restrict access to users of their os when it is booted via secure boot, to prevent windows from being "compromised". This is part of the agreement they signed to get keys signed by Microsoft. These signed keys can also be revoked by mictosoft at any time.[1] I seriously do not understand why everybody has rolled over so hard on this issue. [1] http://mjg59.dreamwidth.org/12368.html http://mjg59.dreamwidth.org/12368.html
- betterunix 13y ago
  "I seriously do not understand why everybody has rolled over so hard on this issue." It is the same reason that Linus Torvalds and plenty of other people have no problem with TiVO, or even see it as a success. A lot of people in the open source community do not subscribe to the free software philosophy. For a lot of people, as long as they can boot Linux by some means and continue to hack, there is no problem, even if Microsoft's signing key is required in that process. Plenty of people also live in a state of denial about the bootloader restrictions. They do not believe that Microsoft would ever deny anyone the ability to turn the restrictions off, or that Microsoft would otherwise prevent us from running GNU/Linux. How anyone can trust Microsoft to not abuse its power is a mystery to me, but there are lots of people here on HN who seem to have such trust. At this point, I do not think there is any debate about the FSF's stance on the open source movement: https://www.gnu.org/philosophy/open-source-misses-the-point.html https://www.gnu.org/philosophy/open-source-misses-the-point....
NelsonMinar 13y ago
This PDF carries a date of October 2011.
- drivebyacct2 13y ago
  And as most people hopefully know, despite the random FUD here and on reddit, SecureBoot is simply not an issue for x86 computers. The only issues so far with Linux + SecureBoot were actually due to OEM bugs in the UEFI implementation. Ubuntu and Fedora both handle SecureBoot seamlessly. Other distros will follow, especially with the Linux Foundation finally releasing their shim loader late last year.
hexonexxon 13y ago
Theo de raadt already blasted Redhat and Ubuntu for instantly compromising and submitting to microsoft. Linux foundation non resistance makes no sense to me either since a lot of people who sit on the board are direct competitors to M$ you'd think they would want to save their companies from being at their mercy. I'm waiting for when cloud o/s takes over that scans for pirate software/dissident behaviour or thought crime, and it becomes illegal to run your own operating system. There will be a Silk Road for computer hardware and guy's peddling BSD installs in dark alleys.
- takluyver 13y ago
  What should they have done? As I see it, they had three options with secure boot: find ways to work with it (as they have), try to get OEMs to disable secure boot or ship with a 'Linux key' as well, or ignore it and let users who want to install Linux deal with it. Making users disable secure boot makes it that much harder and scarier to try Linux, so there would be even fewer users in the future. And I see no evidence that OEMs care enough about Linux to go out of their way to make life easier, even if someone did produce a 'Linux key' to sign all the major distributions. There are a precious few small OEMs that sell computers with Linux, but mostly to existing Linux users. If desktop Linux isn't going to fade into complete irrelevance, we're still crucially dependent on people experimenting with it on Dell/Lenovo/Acer Windows laptops.
guilloche 13y ago
No, this is not what I want, the secure boot is MS's evil plan and I want to get rid of the whole shit.
bitwize 13y ago
You're fighting an uphill fucking battle, Linux Foundation and here's why: UEFI, the standard, is so loosey-goosey, with so many bits unspecified, that the only real test of whether the system is compliant that actually matters is "does it boot Windows". It's rather like the Web back in the day, when we had HTML and CSS and all of that but the only standard that people applied was "does it look nice and work in IE5". We've already seen one UEFI implementation from Samsung that can brick the machine when a non-Microsoft (or even sometimes a Microsoft) OS is installed on it; and one from Lenovo that actually searches the strings of the boot image looking for either "Windows" or "Red Hat Linux" and refuses to boot otherwise. Expect more cock-ups of this sort, whether due to malice or incompetence, to follow. This isn't about a hardware-verifiable boot process, it's about multiple vendor-specific boot processes, the only thing they can be guaranteed to have in common is their capability to boot into a Microsoft OS. Those of us disinclined to trust Microsoft will see this as a largely successful attempt to decommoditize the boot protocol, as per the Halloween Documents.

53 points by jagermo 13y ago

Link is mentioned in this debate: https://news.ycombinator.com/item?id=5658184 https://news.ycombinator.com/item?id=5658184

betterunix 13y ago

Compliance with proprietary vendors' requirements? No thanks, I do not want Microsoft, Apple, Sony, or anyone else deciding how I use my computer. Shame that the Linux foundation cannot understand the most basic tenet of free software.

urza 13y ago

The coming civil war over general purpose computing https://news.ycombinator.com/item?id=4436139 https://news.ycombinator.com/item?id=4436139

bitcracker 13y ago
For this simple reason the Linux Foundation should stop wasting further energy for UEFI. As a Linux user from the very beginning (since 1992) I won't buy any UEFI device for Linux in general even if Linux would be 100% supported. I won't buy an expensive WinRT tablet just to put Linux on it. When the Linux Foundation was founded I was happy to have a strong organization behind Linux. But today they make me really angry for supporting a system of someone who considered Linux, and the Open Source movement in general, as enemy. UEFI proves that they don't have changed their mind. LF, please stop your unrealistic UEFI dreams, and please focus on the interests of the Linux community. I believe that most Linux users want functional hardware alternatives which will likely remain free from DRM restrictions. I would appreciate that even at the cost of incompatibility with the internet. In that case we would have to build our own new Internet, free from spam etc. There are so many good devices like Raspberry and Beagleboard Black. They are powerful enough to be used as a desktop workstation when using a small and efficient Linux distro. Why not even enhance them with an e-ink display to make them a cheap alternative tablet pc that everyone can afford? By the way, for the price of a single UEFI WinRT tablet we could build a whole server cluster of RPis or BBB.
- deleted 13y ago
  [deleted]

throwaway2048 13y ago

Here is the major problem with UEFI Secure Boot. Microsoft only changed the reqirement that secure boot must be possible to disable after there was a public outcry, and are free to change it again any time. They can either change a requirement to have the ability to disable it be optional, or make the inability to disable it mandatory, like on surface systems. Thats the real issue. In very real way, Microsoft now hold the keys to the future of the x86 PC archecture, and I question why people are so ready to trust them considering their history. The problem with supporting secure boot is it legitimizes microsoft's role as the gatekeeper to computing. Now with a straight face they can say to regulatory bodies "look at how many free and open source operating systems support secure boot, there is no monopolization here". They are then free to turn the screws, and make disabling secure boot impossible. Not to mention distributions like fedora are making massive changes to restrict access to users of their os when it is booted via secure boot, to prevent windows from being "compromised". This is part of the agreement they signed to get keys signed by Microsoft. These signed keys can also be revoked by mictosoft at any time.[1] I seriously do not understand why everybody has rolled over so hard on this issue. [1] http://mjg59.dreamwidth.org/12368.html http://mjg59.dreamwidth.org/12368.html

betterunix 13y ago
"I seriously do not understand why everybody has rolled over so hard on this issue." It is the same reason that Linus Torvalds and plenty of other people have no problem with TiVO, or even see it as a success. A lot of people in the open source community do not subscribe to the free software philosophy. For a lot of people, as long as they can boot Linux by some means and continue to hack, there is no problem, even if Microsoft's signing key is required in that process. Plenty of people also live in a state of denial about the bootloader restrictions. They do not believe that Microsoft would ever deny anyone the ability to turn the restrictions off, or that Microsoft would otherwise prevent us from running GNU/Linux. How anyone can trust Microsoft to not abuse its power is a mystery to me, but there are lots of people here on HN who seem to have such trust. At this point, I do not think there is any debate about the FSF's stance on the open source movement: https://www.gnu.org/philosophy/open-source-misses-the-point.html https://www.gnu.org/philosophy/open-source-misses-the-point....

NelsonMinar 13y ago

This PDF carries a date of October 2011.

drivebyacct2 13y ago
And as most people hopefully know, despite the random FUD here and on reddit, SecureBoot is simply not an issue for x86 computers. The only issues so far with Linux + SecureBoot were actually due to OEM bugs in the UEFI implementation. Ubuntu and Fedora both handle SecureBoot seamlessly. Other distros will follow, especially with the Linux Foundation finally releasing their shim loader late last year.

hexonexxon 13y ago

Theo de raadt already blasted Redhat and Ubuntu for instantly compromising and submitting to microsoft. Linux foundation non resistance makes no sense to me either since a lot of people who sit on the board are direct competitors to M$ you'd think they would want to save their companies from being at their mercy. I'm waiting for when cloud o/s takes over that scans for pirate software/dissident behaviour or thought crime, and it becomes illegal to run your own operating system. There will be a Silk Road for computer hardware and guy's peddling BSD installs in dark alleys.

takluyver 13y ago
What should they have done? As I see it, they had three options with secure boot: find ways to work with it (as they have), try to get OEMs to disable secure boot or ship with a 'Linux key' as well, or ignore it and let users who want to install Linux deal with it. Making users disable secure boot makes it that much harder and scarier to try Linux, so there would be even fewer users in the future. And I see no evidence that OEMs care enough about Linux to go out of their way to make life easier, even if someone did produce a 'Linux key' to sign all the major distributions. There are a precious few small OEMs that sell computers with Linux, but mostly to existing Linux users. If desktop Linux isn't going to fade into complete irrelevance, we're still crucially dependent on people experimenting with it on Dell/Lenovo/Acer Windows laptops.

guilloche 13y ago

No, this is not what I want, the secure boot is MS's evil plan and I want to get rid of the whole shit.

bitwize 13y ago

You're fighting an uphill fucking battle, Linux Foundation and here's why: UEFI, the standard, is so loosey-goosey, with so many bits unspecified, that the only real test of whether the system is compliant that actually matters is "does it boot Windows". It's rather like the Web back in the day, when we had HTML and CSS and all of that but the only standard that people applied was "does it look nice and work in IE5". We've already seen one UEFI implementation from Samsung that can brick the machine when a non-Microsoft (or even sometimes a Microsoft) OS is installed on it; and one from Lenovo that actually searches the strings of the boot image looking for either "Windows" or "Red Hat Linux" and refuses to boot otherwise. Expect more cock-ups of this sort, whether due to malice or incompetence, to follow. This isn't about a hardware-verifiable boot process, it's about multiple vendor-specific boot processes, the only thing they can be guaranteed to have in common is their capability to boot into a Microsoft OS. Those of us disinclined to trust Microsoft will see this as a largely successful attempt to decommoditize the boot protocol, as per the Halloween Documents.