Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Linux Foundation's Secure Boot Pre-Bootloader Released

timothy posted about a year and a half ago | from the what-about-the-pre-pre-pre-bootloader? dept.

Linux 178

hypnosec writes "The Linux Foundation's UEFI Secure Boot pre-bootloader for independent Linux distros and software developers has finally been released. Announcing the release of the secure boot system James Bottomley noted that the signed pre-bootloader was delivered by Microsoft on February 6th. Bottomley has released two validated files: PreLoader.efi and HashTool.efi. Bottomley has also created a bootable mini-USB image that provides 'an EFI shell where the kernel should be and uses Gummiboot to boot.' Just last week the pre-bootloader had to be rewritten to accommodate booting of all versions of Linux."

Sorry! There are no comments related to the filter you selected.

only (-1)

Anonymous Coward | about a year and a half ago | (#42844177)

only windows can hibernate on a secure boot uefi pc

Re:only (2)

K. S. Kyosuke (729550) | about a year and a half ago | (#42844641)

That sort of doesn't make sense, the kernel is in full control of the whole physical memory, and once you boot the kernel, it's perfectly free to recreate its state and that of all running processes.

Re:only (1)

Rockoon (1252108) | about a year and a half ago | (#42844645)

You sort of dont know how hibernate works.

Re:only (1)

K. S. Kyosuke (729550) | about a year and a half ago | (#42845061)

Then enlighten me, oh exalted one!

Re:only (4, Interesting)

SuricouRaven (1897204) | about a year and a half ago | (#42845183)

True. Except that it can be used to bypass secure boot:
1. Boot secure OS.
2. Hack it, get root.
3. Write hibernate image to the drive containing your hacked kernel, which includes disabling of the code to delete the image after use.
4. Trigger reboot.
5. Pwnage.

It'd take some very impressive skill to do that - it isn't something you could just make a script-kiddie toolbox for. The only way to prevent this is for the kernel to use TPM hardware to sign the boot image. As this isn't yet an option, it's debated if Secure Boot linux should also disable hibernation, in order to be strictly compliant, even though it introduces much user annoyance to provide protection against an attack that would be near-impossible for even the best hacker to pull off.

Re:only (2)

osu-neko (2604) | about a year and a half ago | (#42845963)

True. Except that it can be used to bypass secure boot:
1. Boot secure OS.

Easy, assuming Microsoft operating systems are defined as a "secure OS", which they are for purposes of secure boot, despite all evidence to the contrary.

2. Hack it, get root.

Easy, assuming a Microsoft OS again...

3. Write hibernate image to the drive containing your hacked kernel, which includes disabling of the code to delete the image after use.

No need to disable such. Once you're at the stage of "waking" into a hacked kernel to boot, you can just write a new image each reboot, becoming how you always boot from then on. In any case, the only real trick here, regardless of which way you decide to handle reboots, is writing a hibernate image and hacking the on-disk kernel in the image. Is this really any more difficult than hacking a kernel in memory? Indeed, isn't it easier?

4. Trigger reboot.

Yup... trivial... once you get past step 3, the machine is pwnt...

It'd take some very impressive skill to do that - it isn't something you could just make a script-kiddie toolbox for.

Anything that you can do, you can make a script-kiddie toolbox for. The person who makes the toolbox obviously has more impressive skills than a script-kiddie, but that's pretty much always the case. This is not the easiest hack in the world, but I would say calling this "near-impossible" is extreme hyperbole.

Re:only (-1, Troll)

rutafalu (2837245) | about a year and a half ago | (#42846305)

http://www.cloud65.com/ [cloud65.com] my roomate's half-sister makes $74 an hour on the internet. She has been fired from work for five months but last month her payment was $15537 just working on the internet for a few hours. Read more here

gay (-1)

Anonymous Coward | about a year and a half ago | (#42844195)

now all the malware can bypass my windows secure boot. yet another reason to avoid ubuntu £inux.

Don't worry, somebody will break it. (0)

Anonymous Coward | about a year and a half ago | (#42844201)

It'll take a week or two, and then they'll report that it blew up their computer, crashed the Internet, and impregnated their teenage daughter.

Re:Don't worry, somebody will break it. (0)

Anonymous Coward | about a year and a half ago | (#42844629)

It'll take a week or two, and then they'll report that it blew up their computer, crashed the Internet, and impregnated their teenage daughter.

Uh, no sorry that was me :-)

Re:Don't worry, somebody will break it. (-1)

Anonymous Coward | about a year and a half ago | (#42844677)

werent you the one who knocked up that 8 year old in mexico ?

go back 2 4chan !

Re:Don't worry, somebody will break it. (1)

jsrlepage (696948) | about a year and a half ago | (#42844669)

...all at the same time.

Re:Don't worry, somebody will break it. (1)

Luckyo (1726890) | about a year and a half ago | (#42845019)

That's how you learn not to have sex on top of your PC tower, with router next to it, and with no additional furniture for support in the end game.

What about *BSD? (5, Insightful)

ad454 (325846) | about a year and a half ago | (#42844205)

This is great news for Linux distributions, and a small victory in the losing battle for openness.

But in the spirit of openness, hopefully bootloaders for NetBSD, OpenBSD, and FreeBSD will also be eventually signed.

Everyone should be able to install and run whatever they want on their own computers.

Re:What about *BSD? (0)

Anonymous Coward | about a year and a half ago | (#42844249)

So far they can. Just insert the OS's key in the motherboard's Secureboot keystore. This story simply means that Linux Foundation systems don't even need to do that anymore, as Microsoft's key (which will be present on basically all motherboards as stock) will accept them.

Re:What about *BSD? (5, Interesting)

Anonymous Coward | about a year and a half ago | (#42844511)

Incidentally.. Microsoft will have two keys. One for Windows, and another for "third party" stuff.

So they can revoke everyone's software and leave theirs working.

BTW: Anyone interested in the abuses that UEFI allows should read both the UEFI guidelines and the Microsoft Mandate (the rules they apply to OEMs for Win8 certs, and anyone wanting to have their software signed).

Microsoft's rules violate several of the guidelines - unsurprisingly those to do with who actually controls the PC.

Re:What about *BSD? (2)

osu-neko (2604) | about a year and a half ago | (#42845985)

Well, yes. UEFI can only make guidelines. Microsoft can impose rules...

Re:What about *BSD? (1)

Anonymous Coward | about a year and a half ago | (#42845999)

And yet strangely... whenever this is discussed.. the shills for UEFI quote the guidelines, not the Microsoft imposed reality.

Re:What about *BSD? (-1, Offtopic)

poetmatt (793785) | about a year and a half ago | (#42844567)

nothing of what you said has anything to do with BSD. BSD isn't about being able to run whatever you want. That's GPL.

Re:What about *BSD? (0)

Anonymous Coward | about a year and a half ago | (#42845123)

GPL "gives" freedom by taking freedom away from developers, who ironically give freedom to the user, which means the end user is indirectly getting their freedoms taken away.

Re:What about *BSD? (1)

unixisc (2429386) | about a year and a half ago | (#42845439)

He's talking about the OS, not licenses.

Re:What about *BSD? (3, Informative)

cupantae (1304123) | about a year and a half ago | (#42845539)

the losing battle for openness

What losing battle? Open source software hasn't been as prevalent as it is now since proprietary software first arose. Linux, in particular, is in the strongest position it's ever been in, and it looks like 2013 will be a very big year for Linux. Sure, there are always setbacks like this, but look: it's been just over 3 months since Windows 8 began to be sold, and the problem is already almost completely solved.

But in the spirit of openness, hopefully bootloaders for NetBSD, OpenBSD, and FreeBSD will also be eventually signed.

So you have time to whinge, but none to RTFA:

A signed pre-bootloader will allow for chain-loading of boot-loader of any other operating system thereby enabling users to install non-signed Linux distros on Windows 8 UEFI hardware.

Everyone should be able to install and run whatever they want on their own computers.

Yes, but not everyone should be able to install or run whatever they want on your computer. In fairness, UEFI goes some way towards securing your PC. Microsoft did well for the consumer in that respect. They're also a fairly ruthless company, and they're not going to go out of their way to make sure you can install rival operating systems from day 1. But today, at about day 100, the problem is a long way towards being solved. Get over it.

Re:What about *BSD? (0)

Anonymous Coward | about a year and a half ago | (#42845643)

"Yes, but not everyone should be able to install or run whatever they want on your computer."

Then Microsoft should fix their goddamn insecure OS, not implement stupid bootloader quasi-security that does nothing but inconvenience everyone that doesn't run a Microsoft OS.

Re:What about *BSD? (0)

Anonymous Coward | about a year and a half ago | (#42845747)

In the USA, we have laws which restrict the ability for monopolistic companies to abuse their monopoly. This fix is inadequate and an adequate fix should have been available before windows 8 was even released, or Microsoft should pay severely for these abuses of monopoly power. A fine in the billions, restrictions against their ability to make deals with OEM's, both PC makers and Tablet/Phone makers, and breaking the companies OS business away from all of it's other software offerings would be a first small step.

Re:What about *BSD? (0)

Anonymous Coward | about a year and a half ago | (#42846167)

2013 will be a very big year for Linux.

Yes, I hear it will definitely be the year of Linux on the desktop.

Re:What about *BSD? (2)

dissy (172727) | about a year and a half ago | (#42846429)

But today, at about day 100, the problem is a long way towards being solved. Get over it.

I interpreted it a little differently. Today at about day 100, Microsoft has won it's war against Linux.

Microsoft started by saying you don't want to use Linux because it's inferior, but they were easily shown to be wrong.

Then Microsoft turned to saying it was illegal to use Linux because it's a mess of copyrights and patents, as well as infected with a viral license that destroys businesses. It took a lawsuit a decade long with one of this countries top companies (at the time) to finally prove otherwise.

Now, today, Microsoft has finished by saying Linux can and will only exist at Microsoft's whim. They hold the keys to the kingdom, and can lock and unlock any OS as they see fit.
Please note I am not speaking of a technical measure, but a legal one.

Instead of having the UEFI key signing authority forced from Microsoft's hands and taken away by power of law, now we are humbly begging for permission to be allowed to use non-windows on our own computers, while also praying the check clears to buy that capability which should be a natural right.

Now I'm not trying to claim that would have been an easy battle, and I myself certainly have not put my own money life and future on the line to fight for it either.
But I still believe that battle not being won is what will make all those "Yeay tablets and phones, we are in the post PC era now!" predictions come true.

The FCC already went back on their fair use ruling about jailbreaking and being allowed to run the software you choose to run. If you didn't notice, only jailbreaking the iPhone is still an exception to the law. Do the same thing on another device that's just a bit bigger (an iPad) or made by any other manufacturer, and you are committing a federal crime.

If Microsoft officially claims they have revoked the certificate and thus permission for the Linux preboot loader, then instantly every desktop and server in this country running Linux is in violation of the law. Booting it is a felony.

While no I do not trust Microsoft, I have to say I can't see myself trusting ANYONE with this power.
Signed booting absolutely MUST be controlled at the highest level by the owner of the computer. No one else!

This means there should be ZERO keys or certs installed by default, and it should be a very serious crime to try and sneak one in, similar to any other mass scale computer intrusion laws.

One should be required to learn how it works, why it works, what the advantages of signing your own boot loader would be, and then using that knowledge to enable it and upload your keys.
If someone can't do that, then clearly they don't need this feature.

Re:What about *BSD? (2)

TCM (130219) | about a year and a half ago | (#42845551)

No. In the spirit of openness, hopefully this bullshit will get eaten by the anti-monopoly regulation.

Giving in to this bullshit was the most stupid thing the Linux guys could do.

Re:What about *BSD? (1)

osu-neko (2604) | about a year and a half ago | (#42845995)

No. In the spirit of openness, hopefully this bullshit will get eaten by the anti-monopoly regulation.

Yes, sooner or later, Microsoft's behavior will become to egregious again that they will once again be forced to pay a small fine and give people coupons before being allowed to continue what they were doing...

yay! (1)

Anonymous Coward | about a year and a half ago | (#42844231)

Yay! Now I can finally ask Microsoft for permission to boot my Linux machine! I've been eagerly awaiting this for years and years.

Oh, I can just disable in the EUFI, you say? Yes, I'm fully confident that situation will persist going into the future. Because that's how these things go.

Re:yay! (0)

Anonymous Coward | about a year and a half ago | (#42844325)

Or you could just load your own key.

Re:yay! (1)

Anonymous Coward | about a year and a half ago | (#42844559)

The UEFI guidelines say nothing about key management - an OEM can get certified just by having a option to wipe all the keys.

Re:yay! (1)

flimflammer (956759) | about a year and a half ago | (#42844769)

You didn't need Microsoft's permission in the first place, and not because you could just disable secure boot.

Re:yay! (0)

Anonymous Coward | about a year and a half ago | (#42845311)

don't count on doing that on a oem uefi with functions not implemented or disabled

This is bollocks (4, Interesting)

Skiron (735617) | about a year and a half ago | (#42844299)

All the time Microsoft have control, they will always have control.

Why don't people LEARN from history from how they operate?

This will all go horribly wrong, mark my words.

And I still do not understand how Microsoft get to control this.

Re:This is bollocks (5, Informative)

EdZ (755139) | about a year and a half ago | (#42844373)

And I still do not understand how Microsoft get to control this.

For anything x86 based; they don't. They expressly require OEMs (and onyone else producing motherboards with a little Windows 8 sticker on the box) to allow the end user to add their own Secure Boot keys, as well as insert Microsoft's key. No end-user modification, no certification.

So what are various Linux distros getting bootloaders signed by Microsoft? Because they assume users are not competent enough to enter keys manually. Thus, they ask Microsoft (or take advantage of the service Microsoft offers) to sign their bootloader with Microsoft's preloaded key.

Re:This is bollocks (5, Informative)

Sarten-X (1102295) | about a year and a half ago | (#42844595)

It's not an issue of "competent". It's an issue of "willing".

A major source of Linux's desktop growth is the use of live CDs. Just drop in a disk at boot, and you've got yourself a working Linux desktop to play with and perhaps even like. You can see the filesystem's different layout, you can see each application's settings saved to plain old files, and you can see the package manager's simple installation of useful software. Perhaps you can even like it and decide to install. If not, there's no changes to your computer.

That's all changed now. Now, either you your computer must be prepared for Linux first, through some means of adding a new key. While not really beyond the average user's level of competence, it is beyond their level of ambition just to try "that Linux thing". The longstanding promise of "try it without changing anything" that has fueled trials isn't wholly true any more. Supposedly Windows' bootloader will let you boot unsigned CDs, but I've tried that three times with three failures on known-good disks, so I expect there's something screwey hidden in that route, and that doesn't really solve the problem of booting once the installation's complete.

To make matters worse, there's no standard mechanism for adding the boot key. One option is an BIOS-based tool, which with come with the typical polish [rodsbooks.com] of a motherboard manufacturer we've had on BIOS setups for years. Expect a keyboard-based menu with unique brand-specific names. Another option that might be viable in the future is a Windows tool to add a key, which will inspire Windows to raise scary warnings about compromising security and never starting again, which will do wonders for the user's confidence.

Microsoft surely knows that Secure Boot won't affect savvy nerds from converting to Linux. They also surely know that Linux is still growing organically, relying on word-of-mouth and firsthand try-before-you-buy experience. By requiring Secure Boot to be user-modifiable, they've thrown a roadblock in the path for Linux's growth, without looking like they're being blatantly nasty. They can keep exaggerating the threat of bootloader rootkits to justify locking everybody out, then point to the key-adding ability to dispel accusations of abusing their monopoly.

Enough is enough (4, Insightful)

benjymouse (756774) | about a year and a half ago | (#42844897)

Microsoft surely knows that Secure Boot won't affect savvy nerds from converting to Linux. They also surely know that Linux is still growing organically, relying on word-of-mouth and firsthand try-before-you-buy experience.

You are seriously delusional. "Converting" to Linux is not, has never been and will never become a threat to Microsoft. Right now Microsoft is pressured on other fronts, such as desktop PC losing relevance, not being on the boat on mobile and not competing effectively in the tablet game.

You are trying to wage last decades battle. Microsoft does not feel threatened by Linux on the desktop *at* *all*. Get real. The threats to Microsoft do not come from conversions in the x86 space, the come from vertical players and mobile, like Chromebooks, tablets, smartphones.

Note how *all* of these emerging platforms have more restricted app models, and especially *boot* models. Microsoft is simply evolving their primary platform to match the features and security (from closed and semi-closed gardens) of the threatening platforms.

The threat to Microsofts desktop business is *not* Linux. Even though Linux has evolved in that space and on the surface appears to be able to go head-to-head, Microsoft Windows is still *much* more mature than any desktop Linux. Consider for instance group policies, restart manager, volume shadow service, various troubleshooting guides, shims for both application and device compatibility etc. The real threat is that the desktop become irrelevant.

If the desktop is perceived as less secure than an online counterpart, Microsoft will be losing. They *need* to ensure secure boot. It is not a anti-Linux move at all. You are flattering yourself. And being stupid.

Re:Enough is enough (3, Insightful)

corvax (941506) | about a year and a half ago | (#42845357)

Even if it wasnt intentional (i doubt it) what this does do is make it just a little bit harder to install linux. And makes microsoft the gatekeeper of YOUR hardware. What happens to ALOT of old windows pc's? They get linux installed on them to give them a few more years of usefulness = a loss of revenue for microsoft. Even if it is a small percentage its not enough microsoft would be much happier if the percentage was ZERO......

Re:Enough is enough (1)

rescendent (870007) | about a year and a half ago | (#42845811)

What happens to ALOT of old windows pc's? They get linux installed on them to give them a few more years of usefulness = a loss of revenue for microsoft.

The old windows pcs are already paid up with the windows software, where is the revenue that MS would be getting from them if they didn't have linux on?

Re:Enough is enough (1)

ais523 (1172701) | about a year and a half ago | (#42846195)

Presumably in the Microsoft Tax on the new computers that would otherwise be bought to replace them.

Re:Enough is enough (0)

Anonymous Coward | about a year and a half ago | (#42845403)

Microsoft isn't threatened by smartphones, tablets, netbooks, or chromebooks

There is no room for expansion in the the market they own (PC OS and Office sales). The 1st world doesn't have any more people left who want/or can afford the products they make money off.

They have to look elsewhere for it now and they aren't in that race. That might scare them. However not being in that race doesn't necessarily mean they are losing anything of value. If they make $0 from licensing for these new devices it doesn't make them money. If they have tapped other spaces (like how Google has tapped advertising) it won't make them money either.

Re:Enough is enough (4, Informative)

Anonymous Coward | about a year and a half ago | (#42845425)

I agree with most of your points, however I feel Microsoft is its own biggest threat. Them fucking around with all sorts of shit in Windows is going to drive people away. I number of changes since WinXP have irritated me, but I have stuck with Windows until now.

I recently bought a new laptop (Lenovo x230). I upgraded the storage myself - to use an mSATA SSD for the operating systems. After spending hours trying to get Win8 installed (no OS DVD provided) I gave up, it was the last straw. The UEFI stuff was a pain in the ass, but managed to get Arch Linux up and running comapartively easily.

I have been tinkering with Linux for a number of years, but it finally took Windows 8 to drive me to Linux full time & I couldn't be happier. This is the first computer I have owned without Windows installed on any partition - it was nerve-wracking at first, but now wish I had made the move sooner.

Re:Enough is enough (0)

Anonymous Coward | about a year and a half ago | (#42845667)

Your the one who is delusional notice the hardware vendors dont offer motherboards without it at my choosing because who would buy this.
 

Re:Enough is enough (0)

Anonymous Coward | about a year and a half ago | (#42845691)

This might just backfire on them when all the nerds like me buy from China and make our own machines like we mostly do anyway and not ever purchase a secure boot machine at best or worst buy. and other see you can only do the three for os muli boot on cool machines like mine you just might be ass out.

Re:Enough is enough (4, Informative)

nzac (1822298) | about a year and a half ago | (#42846045)

Consider for instance group policies, restart manager, volume shadow service, various troubleshooting guides, shims for both application and device compatibility

I don't think Linux has a nice "clicky" interface to any of these things but to suggest that it does not have solid equivalents to the first 3 (the rest appear to assume Linux has the same problems as Windows).
Group polices are probably difficult to fully replicate on Linux but its due to flaws in windows that it even needs a restart manager. Maybe SSV is more permission friendly than LVM also.
You are just another windows user who assumes that a proper OS should function the same Windows. There are better lists than this for things Linux is missing on the desktop but the one is the lack of third party applications.

Re:This is bollocks (2)

robsku (1381635) | about a year and a half ago | (#42845845)

Too bad I don't have mod points to +1 you - or -1 the bollocks you got as a result. Anyone claiming total UEFI lockdown on ARM is for security and has nada to do with blocking OtherOS is deluded - and anyone thinking MS wouldn't love to do just that with x86 but took slightly more moderate route because they are a monopoly at x86 desktop, and it would just be nasty for them if they had gone that way, is deluded.

What you describe is what's happening with the plan they had to settle with.

Re:This is bollocks (1)

SuricouRaven (1897204) | about a year and a half ago | (#42845205)

Would you check the details on that? As I understood it, and I might be wrong, the Microsoft standard doesn't require OEMs provide the ability for the end user to add their own keys - that's up to the OEM. What it does do is require the OEMs provide the user with the option to disable secure boot entirely, and that this can only by done by someone physically present at the machine (The 'press F1 to enter setup' program).

Re:This is bollocks (4, Informative)

EdZ (755139) | about a year and a half ago | (#42845355)

From the horse's mouth itself [microsoft.com] (the Windows 8 certification guidelines, specifically System.Fundamentals.Firmware.UEFISecureBoot para.17):

Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following: It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx), which puts the system into setup mode.

Separately (Para.18):

Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv.

Re:This is bollocks (0)

0123456 (636235) | about a year and a half ago | (#42845411)

For anything x86 based; they don't. They expressly require OEMs (and onyone else producing motherboards with a little Windows 8 sticker on the box) to allow the end user to add their own Secure Boot keys, as well as insert Microsoft's key. No end-user modification, no certification.

Well, duh.

They have to do that in order to get Windows Boot in the door, then with Window 9 or 10 they require that it can't be turned off.

Oh, sorry, I forgot, the slippery slope is a logical fallacy so Microsoft would never, ever do such a thing. Can't happen.

Re:This is bollocks (3, Informative)

darkHanzz (2579493) | about a year and a half ago | (#42844449)

And I still do not understand how Microsoft get to control this.

They talk directly to manufacturers, since windows is still installed by default. So the swing they have on the whole laptop market just became a bit more visible, it's always been there, however.

Re:This is bollocks (1)

Skiron (735617) | about a year and a half ago | (#42844501)

But turn the bloody thing on anyway?

Microsoft must demand that, and also the options to disallow users to turn it off - and the OEM's somehow follow like sheep.

Surely if you put a pre-installed MS OS on the thing, turn it ON. But at least let the tech-savvy be allowed to turn it off to allow installation of anything else they wish to do.

I mean, the USER actually owns the machine, not Microsoft.

Re:This is bollocks (3, Informative)

EdZ (755139) | about a year and a half ago | (#42844977)

Not only can you turn Secure Boot off (and add your own keys to the bootloader) for x86 devices, the end user MUST be able to do so in order to gain Windows 8 certification. No end-user configuration, no shiny windows sticker on the box (or windows pre-installation in the case of OEM systems).

Re:This is bollocks (1)

jones_supa (887896) | about a year and a half ago | (#42845599)

Wait, what? If that's the case, how are we having these problems with Linux then?

Re:This is bollocks (2)

ais523 (1172701) | about a year and a half ago | (#42846223)

Because being able to turn it off doesn't necessarily mean you know how to do so. (It's likely to be buried in a settings menu during the boot process.) Just putting a CD in the drive and choosing "install", like you used to be able to do, won't work unless you reconfigure the UEFI first. So it's adding a bunch of extra steps to try out a new OS.

Re:This is bollocks (1)

robsku (1381635) | about a year and a half ago | (#42845859)

for x86 devices

*yawn*

Re:This is bollocks (1)

RobbieThe1st (1977364) | about a year and a half ago | (#42845111)

No, MS owns it. You should be paying them your monthly fee.

Re:This is bollocks (3, Informative)

SuricouRaven (1897204) | about a year and a half ago | (#42845219)

The margin on most PCs is razor-thin. If they were required to buy a full Windows license, the cost of the machine to manufacture would shoot up by a hundred dollars. Microsoft provides heavily-discounted OEM edition licenses to OEMs, which they simply cannot do without: No OEM licenses, no business. So when Microsoft sets standards for that 'designed for Windows 8' sticker and the license discount that comes with it, OEMs have no option but to meet those standards. This gives MS the power to dictate a sweeping change. Sometimes something major, others something trivial like mandating an extra button on the keyboard.

Its NOT Microsoft (3, Interesting)

ArchieBunker (132337) | about a year and a half ago | (#42845477)

Nobody ever brings this up but me. Guess who else is in the UEFI group?

AMD, American Megatrends, Apple, Dell, HP, IBM, Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies

this is /. (0)

Anonymous Coward | about a year and a half ago | (#42845587)

This is /. so nobody cares who else may be part of UEFI.
All that matters is blaming Microsoft and praising Apple.

Re:Its NOT Microsoft (0)

Anonymous Coward | about a year and a half ago | (#42846119)

UEFI is not "secure boot". And "secure boot" is Micro$oft.

So now you know why nobody ever brings this up but you...

Re:Its NOT Microsoft (1)

Anonymous Coward | about a year and a half ago | (#42846279)

UEFI 2.2 spec includes secure boot, ergo, secure boot is a part of UEFI.

Secure boot is not Microsoft specific.

If Red Hat so desired they could implement their own PK and certify hardware from vendors in the same way that Microsoft does.

As usual ./ is allergic to facts and will continue the group-think despite the facts.

Will dell systems be able to use this or will MS t (1)

Joe_Dragon (2206452) | about a year and a half ago | (#42844391)

Will dell systems be able to use this or will MS try to block this on dell that they now own a part of?

Re:Will dell systems be able to use this or will M (1)

Skiron (735617) | about a year and a half ago | (#42844417)

MS don't own Dell yet. But that is irrelevant - they can change the rules any time they want too {embrace period}

Re:Will dell systems be able to use this or will M (2)

gtall (79522) | about a year and a half ago | (#42845597)

In a sense, they do not own a piece of Dell. From what I understand, they contributed some dough as a loan and I have not heard they will have anyone on the board. Dell cannot live on the desktop market, in the server market they cannot ignore Linux.

This doesn't stop MS from using its usual bag of dirty tricks, but if Dell has any sense and balls, he'll keep MS away from actually running the business.

Does SecureBoot force you to also use EFI? (1)

tstrunk (2562139) | about a year and a half ago | (#42844455)

If your mainboard requires you to use SecureBoot, does this mean you are also forced to boot using EFI instead of some legacy BIOS fallback?

I did not have the best experiences with using EFI in actual EFI mode and not some BIOS fallback mode. My laptop (a eeePC 1215B) refused to boot the windows install in EFI mode and had some wifi problems on Linux; everything works perfectly in BIOS land); I had similar experiences with a Lenovo S205 of a colleague.

Hopefully this one is/can be promptless (1)

sethstorm (512897) | about a year and a half ago | (#42844479)

Requiring a prompt does cripple the bootloader when compared to others that are somehow exempt from it.

Re:Hopefully this one is/can be promptless (1)

Microlith (54737) | about a year and a half ago | (#42844873)

It can't be promptless. The only ones that can be promptless are ones that assert a check on the kernel being loaded.

So where does Win8 / Ubuntu dual boot stand now ? (0)

Anonymous Coward | about a year and a half ago | (#42844487)

Now that this has been achieved, whats the status of Win8 / Ubuntu dual boot via Wubi installer ?
What is the current procedure to get this set up ?

Re:So where does Win8 / Ubuntu dual boot stand now (1)

corychristison (951993) | about a year and a half ago | (#42844935)

Install Ubuntu and run Windows under VirtualBox, or vice versa if you're a gamer.

I honestly don't understand why anyone dual boots anymore. I just seems inconvenient, in my opinion.

Re:So where does Win8 / Ubuntu dual boot stand now (1)

cpghost (719344) | about a year and a half ago | (#42844979)

I honestly don't understand why anyone dual boots anymore. I just seems inconvenient, in my opinion.

You've never used a Hypervisor, have you?

Re:So where does Win8 / Ubuntu dual boot stand now (0)

Anonymous Coward | about a year and a half ago | (#42845229)

Virtualbox is a hypervisor. Unless you ment a bare-metal hypervisor, but if you did I"m sure you would have indicated that as apparently you know a lot about what is and isn't a hypervisor.

Re:So where does Win8 / Ubuntu dual boot stand now (1)

corychristison (951993) | about a year and a half ago | (#42845879)

2-3 days a week, actually. Gentoo/Funtoo host and various guests.

Having to reboot my system to use another OS is inconvenient.

Re:So where does Win8 / Ubuntu dual boot stand now (1)

SuricouRaven (1897204) | about a year and a half ago | (#42845241)

Some things need low-level hardware access to work that a VM can't do. Try running a triple-headed accelerated monitor setup from a VM. No easy thing. There's also a substantial memory overhead in virtualisation - if you've only got a laptop with a gig or two of ram, then you can't afford to throw 500MB of that away holding Windows in memory to host your Linux VM or vice versa.

Re:So where does Win8 / Ubuntu dual boot stand now (1)

corychristison (951993) | about a year and a half ago | (#42845957)

In what situation would you need hardware accelerated access to two operating systems? Choose a host OS you use most and boot up your Guest OS on ome of those displays. Honestly I've never seen the value in multiple monitors. On linux we have Virtual Desktops for a reason.

Also I don't know anyone who would ever need to dual boot on a system with only 1GB of RAM. And if they did it was for gaming, and they wouldn't be limited by RAM as thry would have adequate hardware. And again, if they are gamers on a laptop, why the hell are they dual booting? Just spin up an OS under VirtualBox or similar ona Windows host.

I still fail to see any legitimate reason to dual boot in 2013.

Samsung laptops? (1)

Anonymous Coward | about a year and a half ago | (#42844491)

I've heard somewhere that trying to override UEFI bricks some Samsung laptops. Anything about this?

I think that it could depend on manufacturers correctly implementing UEFA. You can always depend on bugs. Remember "THERE ALWAYS IS ANOTHER BUG" that you have not discovered yet.

Re:Samsung laptops? (1)

Truekaiser (724672) | about a year and a half ago | (#42844583)

Personally I don't think that was a bug. But a feature that was released a 'bit' too early.
If you have the money, i say stockpile some non uefi motherboards, either to sell later at many times the price you bought them when their value goes up to those who use non window's os's. or for you to use when stuff dies.

Re:Samsung laptops? (-1)

Anonymous Coward | about a year and a half ago | (#42844625)

You read it on /.
You also read that it was fixed soon after.
Google will help you find em-i'll wait here till you do...

Re:Samsung laptops? (0)

Anonymous Coward | about a year and a half ago | (#42845665)

trying to override UEFI bricks some Samsung laptops

Not quite, turns out using UEFI in some Samsung laptops can brick them either at boot or from user space application. Note if you're using a Samsung Chromebook that uses a combination of Coreboot & U-Boot, so UEFI bugs don't happen.

Instead of giving Microsoft's ass the boot (0)

Mister Liberty (769145) | about a year and a half ago | (#42844545)

they now offer theirs...

--
    Linux user since 1991

Great! Now let's boycott it. (4, Insightful)

UltraZelda64 (2309504) | about a year and a half ago | (#42844553)

Seriously, when Microsoft is paid for the key and they own the key into our computers, we've lost. Simple solution: Avoid ARM-based machines as long as Microsoft requires that no way exists to disable Secure Boot. By buying into this shit, we're just setting ourselves up to be fucked in the ass by Microsoft. I can't say anything good about the Linux Foundation for playing ball with these assholes either. Pre-bootloader, my ass--more like pre-pre-boot-extra-complexity-nightmare, thanks to Microsoft. Having to use this would be a disgrace; that alone should be enough to get people to buy more compatible hardware (but won't be).

Re:Great! Now let's boycott it. (2)

Microlith (54737) | about a year and a half ago | (#42844883)

This does nothing for ARM machines. Microsoft won't sign anything other than their own software to boot on certified Windows RT devices.

Re:Great! Now let's boycott it. (0)

Anonymous Coward | about a year and a half ago | (#42845107)

I agree. Also, doesn't this mean that Microsoft has the power to disable alll the linux machines that have this pre-boot loader (that use keys provided by MS)?

Re:Great! Now let's boycott it. (1)

corvax (941506) | about a year and a half ago | (#42845297)

yes if the key becomes "comprimised" they could lock you out.

Re:Great! Now let's boycott it. (3, Insightful)

Kjella (173770) | about a year and a half ago | (#42845491)

Seriously, when Microsoft is paid for the key and they own the key into our computers, we've lost. Simple solution: Avoid ARM-based machines as long as Microsoft requires that no way exists to disable Secure Boot.

Uhh this isn't about ARM, Microsoft doesn't allow any third party OS on their ARM machines period. This is if you want any x86 machine shipping with Windows 8 and the "Designed for Windows 8" label to boot any other OS without finding the obscure and non-standard way to disable Secure Boot in UEFI (the new BIOS). At least in this incarnation you can always disable it yourself (again, only on x86), but I smell a Darth Vader quote coming as in "I'm altering the deal. Pray that I do not alter it further." But there's really no way to boycott Secure Boot without boycotting all machines with Win8 preinstalled, which has a snowball's chance in hell of working. What you'd really want is Linux preinstalled laptops, but they're still very few and far between. Desktops are less of an issue because you can always build from parts, or have one built for you.

Re:Great! Now let's boycott it. (1)

UltraZelda64 (2309504) | about a year and a half ago | (#42846141)

Clarification: Windows plus ARM. I could have sworn that after all the times I typed Microsoft the point would be clear, but apparently not. I did not intend to point all the blame on ARM, which again leads back to why my wording was focused so much on Microsoft. People still seem to fail to get the point.

As it is, the most we can do is not buy computers that meet both of these specifications: Windows RT running on an ARM processor. By doing so we are effectively surrendering and increasing their (again, Microsoft's) power to further destroy our freedom in the future. That does still leave x86 machines, which even if they do come with Windows 8, at least you are not anchored and forced with a knife to your throat to use it. Not yet, anyway--just wait for Windows 9 or 10 for that. But at least you *can* still order some machines with Linux or no OS installed; as you said, there's just not many choices and no one's ever heard of any of them.

I agree that in the end avoiding Windows completely is the way to go, but let's face reality here: that's just not gonna happen. As you even stated yourself, it pretty much has "a snowball's chance in hell" of ever happening. But a potentially-emerging market like more general purpose ARM-based machines becoming locked down by Microsoft, there is a chance that something can be done before it gets too bad and then seeps over to the x86 side. Hell, they've already shot themselves in the foot by disallowing all third-party developers from releasing ARM applications for the traditional desktop. Just tack this on as yet another reason to avoid Windows RT.

Microsoft is attempting one of the absolute worst things that it can possibly do: lock everything else out in a brand-new market of computers before it even has the chance to mature. Pretty fucking arrogant, considering they don't even own the rights to the processor.

HATE (0)

Anonymous Coward | about a year and a half ago | (#42844861)

I'll never by this crapware, I can live with UEFI, what is neat is booting from file-system instead of MBR ... but did we really need UEFI for this ?!?
They could have well used http://www.coreboot.org/Welcome_to_coreboot ... less bugs ... less code ... less money wasted.

But I'l never buy a device that has a mandatory boot-lock in it (or sell) (if such devices exist)
But we are a minority ... of cours as "experts" we could badmouth them ...

Anti-Trust (1)

Anonymous Coward | about a year and a half ago | (#42844875)

http://blog.hansenpartnership.com/linux-foundation-secure-boot-system-released/#comment-4096
"Why Microsoft is allowed to use its relationships to OEMs in this way seems to fly in the face of anti-trust law and the latter circumstance is what is objectionable and should be pursued."

I'm still wondering... (2, Interesting)

QuietLagoon (813062) | about a year and a half ago | (#42844901)

... why Microsoft is the gatekeeper for what OS's are allowed to boot on the computers I buy.

Re:I'm still wondering... (1, Flamebait)

BradleyUffner (103496) | about a year and a half ago | (#42845093)

... why Microsoft is the gatekeeper for what OS's are allowed to boot on the computers I buy.

They are A gatekeeper, not THE gatekeeper. In order to get a motherboard certified it is required that the user be able to enter their own keys.

Re:I'm still wondering... (1)

bmo (77928) | about a year and a half ago | (#42845789)

In order to get a motherboard certified it is required that the user be able to enter their own keys.

Except on ARM devices certified for Win8. At which time they are the single gatekeeper.

Fuck Microsoft.

--
BMO

Re:I'm still wondering... (0)

Anonymous Coward | about a year and a half ago | (#42846349)

Fuck Microsoft.

Up the ass. With a red hot poker.

*sigh* (2)

ArchieBunker (132337) | about a year and a half ago | (#42845525)

To quote Wikipedia "The board of directors includes representatives from eleven "Promoter" companies: AMD, American Megatrends, Apple, Dell, HP, IBM, Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies."

No its not just Microsoft.

Re:*sigh* (0)

Anonymous Coward | about a year and a half ago | (#42845589)

Is this not equivalent to price fixing? Monopoly by committee?

Re:I'm still wondering... (1)

blauregen (2837239) | about a year and a half ago | (#42845949)

Mr. Garrett had the following to say on this topic here: http://mjg59.dreamwidth.org/12368.html [dreamwidth.org]

An alternative was producing some sort of overall Linux key. It turns out that this is also difficult, since it would mean finding an entity who was willing to take responsibility for managing signing or key distribution. That means having the ability to keep the root key absolutely secure and perform adequate validation of people asking for signing. That's expensive. Like millions of dollars expensive. It would also take a lot of time to set up, and that's not really time we had. And, finally, nobody was jumping at the opportunity to volunteer. So no generic Linux key.

Re:I'm still wondering... (0)

Anonymous Coward | about a year and a half ago | (#42846091)

Because you fools are buying Windows machines.

why rely on microsoft (1)

corvax (941506) | about a year and a half ago | (#42845273)

Why not our own key signing cert? Myself and many others would gladly pay to help run such a service for the community. Why hand the litereal keys to the kingdom to the very person whos been trying to destroy you for years?

Re:why rely on microsoft (1)

0123456 (636235) | about a year and a half ago | (#42845429)

Because then you have to convince every motherboard manufacturer to install your key too.

Re:why rely on microsoft (1)

corvax (941506) | about a year and a half ago | (#42845555)

Yes and thats what the linux foundation should be doing! Thats their job!

So, other than anticompetition... (1)

epp_b (944299) | about a year and a half ago | (#42845911)

Whatever was the problem with the standard BIOS that we've had for decades? Having the PC's most "hardware-near" firmware locked down only to run code permitted by a third party seems like an extremely bad idea. The whole point of a computer is that it obeys MY instructions blindly and perfectly.

I know, I've heard the argument for security, but has anyone ever even seen real, actual BIOS malware? As far as I'm concerned, that only exists in theory.

Re:So, other than anticompetition... (2)

blauregen (2837239) | about a year and a half ago | (#42846043)

As I understood it, the reason for uefi was being able to boot from big harddisks, having prettier hardware-setting-screens, having a builtin network stack for remote maintenance, and so on. It is questionable whether it was necessary to specify pretty much a complete operating system including cli, just to run another OS, and the recent samsung brick fun, is a good hint that manufacturers will need a few years to iron even the bigger kinks out of their implementation, but uefi itself is in theory not without merits.

The reason for secure boot isn't bios-malware, but boot malware. There are a few of those around, as far as I know. The problem with boot-rootkits would be that they can play hypervisor to your OS, which hides them perfectly from software running under it. The idea with trusted boot, again as far as I understood, would be to have a trusted bootloader, which loads a trusted kernel, which in turn loads trusted drivers and trusted applications, the trust being conveyed by signatures.

Only... you have to start at the bottom, which is the bootloader, if you aim for such a chain of trust.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?