@f0dder -thx for the link. I knew about that one. But AFAIK Microsoft nothing to do with it. And it is a very inelegant hack at best.-40hz
It's
signed by Microsoft. The $99 mentioned in that reply doesn't go to Microsoft (it's for the code signing certificate, and it's my understanding that cash goes to Verisign, not MS).
I also don't see how the shim is an inelegant hack. I haven't tested it, so I might have misunderstood how it works, but it's my understand that the
first time you boot with it, you have to do the somewhat kludgy key enrollment process (which, AFAIU, only enrolls the key with the shim, not the UEFI keystore) - after that, you can autoboot Grub (or whatever you've chosen). That's the standard pre-compiled shim - a linux distribution that's willing to shell out the $99 for a signing cert can build a version that has their own key embedded, and thus avoid the first-time kludge.
What most of us were hoping was that any computer owner could elect to permanently disable UEFI/SecureBoot and still have Windows 8 function the same way it does on a non-UEFI machine. That would allow users who wish to dual-boot (or simply not use WIndows at all) to sidestep this entire issue and continue working as they did before.-40hz
Dunno if there's anything in Win8 that (currently!) doesn't work if Secure Boot is disabled - one could expect potential DRM nastyness. But as long as UEFI implementations allow you to do your own key management, and there's alternate solutions like the Shim loader, there's no need to
panic.
I really do believe that Secure Boot isn't necessarily a bad idea in and by itself - it does offer an additional level of protection against resilient malware. It might be broken, we'll see about that (given how complex a beast UEFI is, there'll probably be a way), but it's going to be one additional barrier that an attacker has to penetrate.
Heck, I even think it's possible that the engineers that came up with the idea actually did have security in mind.
On the other hand, I
am cynical enough to know that there's bound to be a lot of slimey creeps in MS that are waiting for the right opportunity to use it for ultimate vendor lock-in... so I
am weary & wary about the whole thing. But I'll still rather keep my eyes open and discuss things rationally and wait a bit before I cry wolf.