SoylentNews is people
SoylentNews
At its WinHEC hardware conference in Shenzhen, China, Microsoft talked about the hardware requirements for Windows 10. The precise final specs are not available yet, so all this is somewhat subject to change, but right now, Microsoft says that the switch to allow Secure Boot to be turned off is now optional. Hardware can be Designed for Windows 10 and can offer no way to opt out of the Secure Boot lock down.
The presentation is silent on whether OEMs can or should provide support for adding custom certificates.
[Original Submission]
This discussion has been archived.
No new comments can be posted.
Windows 10 May Make the Secure Boot Lock Out a Reality for Alternate OSs
|
Log In/Create an Account
| Top
| 55 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Oh, that sound of male ego. You travel halfway across the galaxy and
it's still the same song.
-- Eve McHuron, "Mudd's Women", stardate 1330.1
(Score: 5, Insightful) by vux984 on Saturday May 30 2015, @02:36AM
I'm fine with secure boot being always on. As long as I can still load my own keys and sign my own start up binaries. As long as -swe have that it can (and arguably -should- ) be on. It is more secure that way.
Its also unclear whether this affects the various linux (red hat, ubuntu...) deals in place to use the Microsoft keys to sign the bootloader. (The former is crucial to true freedom, but the latter does make linux easier to use -- and if those deals are cancelled then we have a legitimate gripe.)
Also the OEMs really have no incentive to force it to be on that I can think of either; so it's unclear why they would.
I realize people are concerned about a gradual 'turning of the screws'; but this 'turn' doesn't worry me and likely will make no practical difference to linux users.
(Score: 5, Insightful) by frojack on Saturday May 30 2015, @03:19AM
I refer you to the prior time we covered this issue. (link above).
The problem is that there currently is only one key signer, although nothing prevents more, nobody else has stepped up.
Microsoft will sign your key, maybe. They've signed shim keys for some of the big distros, but probably not for some of the smaller distros.
You want to compile your own? Not sure they will rush to help you.
No, you are mistaken. I've always had this sig.
(Score: 2) by maxwell demon on Saturday May 30 2015, @07:15AM
He already covered that, explicitly:
If you can load your own keys, there's absolutely no need to have a separate entity sign your stuff. You generate your own key, install it, and sign yourself everything you compile.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by hash14 on Saturday May 30 2015, @01:29PM
As I wrote in the summary last time, which NCommander then proceeded to edit/remove:
This basically kills Gentoo as a distribution because (to the best of my knowledge) there is no stock kernel. Every Gentoo user compiles his/her own, so how is that supposed to work in a thou-shalt-not-choose-thy-OS environment? Also affected is the fact that many of the other major distributions (Arch, notably) also provide solid support for alternative kernels. Plus those who are paranoid and simply want to compile and run their own are also pretty much out the window with this policy. If you want any of these nice things (whether you are a professional developer or just a hobbyist), you will have to invest in specialized hardware to do your work - and this has a chilling effect on the modding community.
This very, very much is an effort to make life difficult for hackers, modders, and anyone who wants the choice to modify or run their own platform. While signed images are a good idea in theory, it completely trades away our ability to control what is rightly OUR hardware and OUR right to do what we wish with it - and it is certain that many short-sighted firmware developers are going to overlook this (case in point: I was installing Linux on a Lenovo laptop only to find out that the firmware is limited to booting BIOS + MBR or UEFI + GPT but not BIOS + GPT because only OSes developed outside Redmond, WA support that).
Perhaps MS really is in kahoots with Redmond Hat on forcing Linux users on to systemd.
(Score: 3, Interesting) by NCommander on Saturday May 30 2015, @04:43PM
I have no idea which post you're talking about. I very rarely edit stories unless we're in an editor drought and the hopper is empty. Even then, its not something I'm great at.
Still always moving
(Score: 3, Informative) by TheRaven on Saturday May 30 2015, @08:57PM
This basically kills Gentoo as a distribution because (to the best of my knowledge) there is no stock kernel. Every Gentoo user compiles his/her own, so how is that supposed to work in a thou-shalt-not-choose-thy-OS environment?
The approach used for other operating systems is to provide a signed bootloader that then chain loads something else. The signed bootloader is tiny and can be distributed as a binary, and then launches GRUB, which then launches the kernel.
sudo mod me up
(Score: 1, Interesting) by Anonymous Coward on Saturday May 30 2015, @09:04AM
Yes, it does make a practical difference. It is a pain in the arse to sign all your boot code. Maybe you could install someone else's key that most distros then use, but if it widely available to be used for signing it won't make good security, and at that point you might as well turn it off.
Yes secure boot does really make it more secure, but the risks are minimal for me anyway, and thus the benefits of having it disabled are outweighed by the risks of having it disabled.
To clarify I'm just referring to my own risk/benefits, I recognise that it can be an overall benefit to many users and am not trying to argue otherwise.
And it increases the barrier to entry reducing the number of new users willing to give it a try.
(Score: 2) by maxwell demon on Saturday May 30 2015, @11:01AM
Then someone should write an utility that makes it easy. I don't see why the utility would need an user interface more complicated than
where the first argument is the name of the unsigned boot loader file, the second names the file containing the private key, and the final argument specifies where to write the signed bootloader.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by hash14 on Saturday May 30 2015, @01:36PM
As long as I can still load my own keys and sign my own start up binaries.
But that's what it's all about, isn't it? If you can load your own keys then great - there really is no story here.
But the fact of the matter is that many vendors are short-sighted enough to think that there's only one key that needs to be loaded into the firmware and that no one will ever have to change it. After all, every additional feature costs money (dammit!) and if the MBAs don't want to invest in it, then you're screwed and stuck with a one-trick-pony pile of silicon.
Make no mistake: if this non-feature is enabled by default and it will take special care of vendors (not you, but the vendors!) to disable it there WILL be a lot more more hardware that's locked into Redmond's vertical stack.
(Score: 2) by vux984 on Saturday May 30 2015, @09:20PM
But the fact of the matter is that many vendors are short-sighted enough to think that there's only one key that needs to be loaded into the firmware and that no one will ever have to change it. After all, every additional feature costs money (dammit!) and if the MBAs don't want to invest in it, then you're screwed and stuck with a one-trick-pony pile of silicon.
Here's the deal as I see it. No... the cost of making secure boot non optional is negligible etc; and the cost of developing it has already been completed. And vendors will have product lines that DO allow for linux, for customers who want it. So they're going to be building and maintaining it anyway. Code-reuse for the win.
Microsoft and the Vendors will need an incentive to lock them down.
Blocking some tiny fraction of users from installing Linux on the hardware simply isn't worth Microsoft providing an incentive to the vendors. How much of a discount are they going to offer on OEM licenses to block 1/4 of a percent from re-imaging with linux on a new unit, 1/2 of a percent re-imaging with linux when the unit is 4 years old. And both of these groups paid for their OEM license?? Anything MS would pay vendors in the form of discounts etc to block linux on these units would be throwing money down a hole.
So what will that incentive be? Where's the big money?
This is the endgame that I see:
Subscription based Windows 10. When that happens then there is a proper incentive to lock out other OSes. Because if I can wipe windows and install linux, I stop subscribing. Vendors will probably get in on it too. Free hardware, paid over time as part of your windows subscription, etc.
AT that point, yes, we will see a fragmentation of the market. Disposable windows 10 only subscription hardware. This is going to happen.
Will that be the death of linux? no. Because at that point there will be a real demand for Linux preinstalled hardware. Right now the linux crowd, by and large, either builds their own whitebox or reimages a linux friendly computer that came with windows because its cheaper than buying it with no-OS. So vendors see almost no real demand for linux.
When windows 10 goes subscription, that all ends. And if you want linux you'll buy hardware for it. And vendors will step up and offer it.
Meahwile, the disposable windows subscription hardware will see a jailbreaking; mod-chip; core-boot reflash community spring up.