5 ms·

It costs $99 to sign the software. I'm sure most of the distros can afford that (unless they take a die-hard stand, in which case, just don't buy a Windows pre-

It costs $99 to sign the software. I'm sure most of the distros can afford that (unless they take a die-hard stand, in which case, just don't buy a Windows pre-loaded PC from the OEM that disables the option to run Linux with).

stonogo 12y ago
And who gets that $99? Microsoft. Some of us are not okay with one company charging a gatekeeper fee for access to hardware we already bought from a different company.
- caryhartline 12y ago
  If you buy from an OEM that pre-installs Windows then you are already paying a fee for the Windows license. If you don't want to pay a fee for software then just buy a from a company that pre-installs Linux.
  - stonogo 12y ago
    My organization provides the disk images to the manufacturer for the computers we buy. This isn't about "paying a fee for software." It's about the fact that Microsoft has used its industry influence (and cozy relationship with Intel) to attach itself like a parasite to the process of bootloading in UEFI. We currently pay our manufacturers to install our signing keys into UEFI; this is fantastically expensive. It's a damn shame that it is literally impossible to buy a consumer UEFI device without Microsoft's keys in the image unless you pay to have yours put in. In short: it sucks that they are the default, and it sucks that Red Hat and Ubuntu rolled over on the issue and pay the (latest) Microsoft tax. I would have preferred a more flexible solution.
    - pbz 12y ago
      How much are we talking about?
      - pgeorgi 12y ago
        $99 (not sure for which time period) and the risk of losing your cert whenever Microsoft thinks you compromised their platform. Canonical uses kernels without signature checking, where you can just load new kernel modules. In principle this allows to hack into a "Secure Boot" Windows in a day or so (rough draft: have a kernel module, eg. kexec, that runs Tianocore, which can load and run Windows, and pretend the system is "secure" while there's random crap running in the background). I think Microsoft is silent about Canonical's use of Secure Boot for now, but they might change their tune (and once there's a PoC, they certainly will).
- CurtHagenlocher 12y ago
  I don't think you read the article. It says that Fedora paid VeriSign the $99 to sign the loader.
nightcracker 12y ago
While the price is disgusting, the price is not what matters most. The reason this is absolutely outrageous is that Microsoft gets to say what OS's you're allowed to install, because they control what they sign.
- powertower 12y ago
  Unless I'm mistaken, I think it's the OEM that decides whether to allow the option of turning off secure boot... Not Microsoft. It's whoever implements and controls the BIOS.
byuu 12y ago
Doesn't it also have requirements (which may or may not be strongly enforced) that users are not allowed to run their own kernel code? (because you could then undermine most of the point of this whole system.) With possible key revocation (blacklisting) being the enforcement? The cost alone is one thing, that'd only ruin the ability of hobbyists to create new OSes. Something exceedingly rare anymore, sadly. But the restrictions stating what your kernel is allowed to let you do is quite another. I want the ability to write my own kernel space drivers on my own hardware, if I so choose (and I have done so in the past.)

stonogo 12y ago

And who gets that $99? Microsoft. Some of us are not okay with one company charging a gatekeeper fee for access to hardware we already bought from a different company.

caryhartline 12y ago
If you buy from an OEM that pre-installs Windows then you are already paying a fee for the Windows license. If you don't want to pay a fee for software then just buy a from a company that pre-installs Linux.
- stonogo 12y ago
  My organization provides the disk images to the manufacturer for the computers we buy. This isn't about "paying a fee for software." It's about the fact that Microsoft has used its industry influence (and cozy relationship with Intel) to attach itself like a parasite to the process of bootloading in UEFI. We currently pay our manufacturers to install our signing keys into UEFI; this is fantastically expensive. It's a damn shame that it is literally impossible to buy a consumer UEFI device without Microsoft's keys in the image unless you pay to have yours put in. In short: it sucks that they are the default, and it sucks that Red Hat and Ubuntu rolled over on the issue and pay the (latest) Microsoft tax. I would have preferred a more flexible solution.
  - pbz 12y ago
    How much are we talking about?
    - pgeorgi 12y ago
      $99 (not sure for which time period) and the risk of losing your cert whenever Microsoft thinks you compromised their platform. Canonical uses kernels without signature checking, where you can just load new kernel modules. In principle this allows to hack into a "Secure Boot" Windows in a day or so (rough draft: have a kernel module, eg. kexec, that runs Tianocore, which can load and run Windows, and pretend the system is "secure" while there's random crap running in the background). I think Microsoft is silent about Canonical's use of Secure Boot for now, but they might change their tune (and once there's a PoC, they certainly will).
CurtHagenlocher 12y ago
I don't think you read the article. It says that Fedora paid VeriSign the $99 to sign the loader.

nightcracker 12y ago

While the price is disgusting, the price is not what matters most. The reason this is absolutely outrageous is that Microsoft gets to say what OS's you're allowed to install, because they control what they sign.

powertower 12y ago
Unless I'm mistaken, I think it's the OEM that decides whether to allow the option of turning off secure boot... Not Microsoft. It's whoever implements and controls the BIOS.

byuu 12y ago

Doesn't it also have requirements (which may or may not be strongly enforced) that users are not allowed to run their own kernel code? (because you could then undermine most of the point of this whole system.) With possible key revocation (blacklisting) being the enforcement? The cost alone is one thing, that'd only ruin the ability of hobbyists to create new OSes. Something exceedingly rare anymore, sadly. But the restrictions stating what your kernel is allowed to let you do is quite another. I want the ability to write my own kernel space drivers on my own hardware, if I so choose (and I have done so in the past.)