Main Area and Open Discussion > Living Room

Windows 8 Secure Boot may lock out Linux

<< < (3/3)

zridling:
By locking (the Win8) OS to the hardware, they also get to prevent anyone from running an older version of Windows. Like Apple, maybe the only way to get Windows in the future will be to buy a new machine.

40hz:
Well...more information from Microsoft has come in. And the situation now looks to be even worse than was originally feared.

OSNews has just put up an  article: Microsoft Responds to Secure Boot Story, Doesn't Address Issue

Some highlights (emphasis added) from the article follow.

At first, it doesn't sound all that bad...

The story about how secure boot for Windows 8, part of UEFI, will hinder the use of non-signed binaries and operating systems, like Linux, has registered at Redmond as well. The company posted about it on the Building Windows 8 blog - but didn't take any of the worries away. In fact, Red Hat's Matthew Garrett, who originally broke this story, has some more information - worst of which is that Red Hat has received confirmation from hardware vendors that some of them will not allow you to disable secure boot.

A short recap: if OEMs want to partake in the Windows 8 Logo Program (and they all want to), they will have to implement secure boot on all Windows 8 machines. Secure boot requires signing keys from either Microsoft or the OEMs themselves to be installed into the firmware - any binaries, drivers, or operating systems not signed by one of those signing keys will refuse to work on that machine.

Secure boot is part of UEFI, and in some cases, you will be able to go into UEFI and disable it. However, the fear is that OEMs will not include the option to disable it - there's enough historical precedence to assume this will be the case. Just look at any of the gazzilion crippled BIOS implementations out there today.

Microsoft tried to address this lingering, but potentially very problematic issue in a blog post today, but sadly, none of our concerns were addressed. Microsoft does not intend to mandate OEMs include the option to turn secure boot off (surprising!), which means OEMs are free to omit this option from their firmware implementations.

And this is exactly what some of them intend to do, according to Red Hat's Matthew Garrett in a response to Microsoft's blog post. "Windows 8 certification does not require that the user be able to disable UEFI secure boot, and we've already been informed by hardware vendors that some hardware will not have this option," he notes on his own blog.
--- End quote ---

But then, the central problem is identified:

"Why is this a problem? Because there's no central certification authority for UEFI signing keys," Garrett explains, "Microsoft can require that hardware vendors include their keys. Their competition can't. A system that ships with Microsoft's signing keys and no others will be unable to perform secure boot of any operating system other than Microsoft's. No other vendor has the same position of power over the hardware vendors. Red Hat is unable to ensure that every OEM carries their signing key. Nor is Canonical. Nor is Nvidia, or AMD or any other PC component manufacturer. Microsoft's influence here is greater than even Intel's."
--- End quote ---

And then comes the kicker that shows how truly ingenious Microsoft can be when it comes to being devious by not directly requiring vendor participation. Much like the Captain Barbarossa's interpretation of the Pirate Code - "The code is more what you'd call "guidelines" than actual rules."

This could be disastrous for end users. They will lose considerable control over their own hardware if Microsoft gets its way. "The end user is not guaranteed the ability to install extra signing keys in order to securely boot the operating system of their choice. The end user is not guaranteed the ability to disable this functionality," Garrett details, "The end user is not guaranteed that their system will include the signing keys that would be required for them to swap their graphics card for one from another vendor, or replace their network card and still be able to netboot, or install a newer SATA controller and have it recognise their hard drive in the firmware."

This is going from merely potentially maybe kind of problematic into full-on dangerous. From what both Microsoft and Garrett have told so far, this seems like a perfect storm for Microsoft - they will essentially lock people into using Windows without actually doing any of the locking themselves; they're basically relying on the utter incompetence of OEMs. And let's face, three things in life are certain: death, taxes, and incompetent OEMs. This is so damn clever and diabolical I just can't help having some admiration for it.
--- End quote ---

Lovely!

Carol Haynes:
In the general OEM market place the shit won't hit the fan until 3 or 4 years down the line when customers start wanting to upgraded their hardware. The majority of customers I do upgrades for are Windows XP and Windows Vista users. Windows 8 users are going to be thoroughly pissed off in a few years time when they need to add a USB expansion card or replace a graphics card or possibly even upgrade memory or hard disk if MS can lock them out.

I can understand the security advantage of this (and it will get Apple worried because they won't have such a big target to aim at in MS once hardware is locked down). I can also understand there is an economic argument for MS but why are the OEMs clamouring to do this - and not even offer the option of turning this ON (OFF should be the default)?

Next they will be shipping BIOSes with preinstalled admin passwords that only they have so that the BIOS is completely inaccessible.

They need to ensure all BIOSes have this as an OPTION - not mandatory.

Any business contemplating possible future shifts of loyalties are going to be very reluctant to buy into OEM machines!

Actually realistically how many hours do you think it will take before someone writes a utility to disable UEFI from within Windows? Or are MS going to insist that ALL binaries (including those of applications inside the OS) are only going to be allowed to run if they are signed?

Shades:
The shit already hits the fan when Microsoft decides to revoke the certificate your mainboard uses. Instant uselessness!

Talking about a hostage situation!

40hz:
In the meantime Microsoft continues to sign deals with individual vendors where the Linux-based vendor is licensing IP Mocrosoft claims Linux is infringing on.

Apparently Microsoft has adopted a divide and conquer legal strategy where they're planning on getting enough vendors licensing from them that they can claim there's de facto industry recognition Linux is infringing on their IP without having to prove it in court.

In many ways, this is just a smarter version of the game SCO was playing.

Why do so many otherwise savvy people insist on kidding themselves Microsoft has suddenly decided to play nice?

Navigation

[0] Message Index

[*] Previous page