3 ms·

Secure Boot is ostensibly a security feature, making it impossible to load kernel-level code that hasn't been signed by an authority recognized by the device's

Secure Boot is ostensibly a security feature, making it impossible to load kernel-level code that hasn't been signed by an authority recognized by the device's hardware. The idea is that this makes it harder for nefarious actors to do nefarious things to your system, because they'll be blocked from the most basic access to the system hardware and be forced through normal OS security channels. In practice, of course, it's just about solidifying lock-in with a cover story that's obviously weak to those with technical experience but is justifiable to politicians and regulators who would otherwise be all over MS for facilitating this kind of funny business.

Zr40 13y ago
Secure Boot isn't about lock-in, at least not on PCs. To qualify for the Windows Logo program, it must be possible to disable Secure Boot.
- rbanffy 13y ago
  As TFA notes, this may involve repeated resets during boot, added hardware and a whole lot of steps my mother wouldn't take. She'd just be coerced to use Windows.
  - Ayabashi 13y ago
    I find it hard to believe that there are a lot of people who are tech savvy enough to be able to install, partition disks and configure Linux and bootloader on a Windows 7 machine, but are suddenly unable to turn off one setting in the BIOS setup on a Windows 8 machine. And to enable them, we need to make every Windows PC insecure by default and leave hundreds of millions of people vulnerable to undetectable bootkit viruses?
    - hackmiester 13y ago
      There are lots of Linux distributions (for instance, Ubuntu) that makes all of that very simple. Some of them will even install inside of a Windows partition, or resize it for you.
Ayabashi 13y ago
Even in practice, it stops undetectable bootkits, for example, like this one. http://www.securelist.com/en/analysis/204792235/XPAJ_Reversing_a_Windows_x64_Bootkit http://www.securelist.com/en/analysis/204792235/XPAJ_Reversi...

Zr40 13y ago

Secure Boot isn't about lock-in, at least not on PCs. To qualify for the Windows Logo program, it must be possible to disable Secure Boot.

rbanffy 13y ago
As TFA notes, this may involve repeated resets during boot, added hardware and a whole lot of steps my mother wouldn't take. She'd just be coerced to use Windows.
- Ayabashi 13y ago
  I find it hard to believe that there are a lot of people who are tech savvy enough to be able to install, partition disks and configure Linux and bootloader on a Windows 7 machine, but are suddenly unable to turn off one setting in the BIOS setup on a Windows 8 machine. And to enable them, we need to make every Windows PC insecure by default and leave hundreds of millions of people vulnerable to undetectable bootkit viruses?
  - hackmiester 13y ago
    There are lots of Linux distributions (for instance, Ubuntu) that makes all of that very simple. Some of them will even install inside of a Windows partition, or resize it for you.

Ayabashi 13y ago

Even in practice, it stops undetectable bootkits, for example, like this one. http://www.securelist.com/en/analysis/204792235/XPAJ_Reversing_a_Windows_x64_Bootkit http://www.securelist.com/en/analysis/204792235/XPAJ_Reversi...