Linux Group Files Complaint With EU Over SecureBoot

[sofar]

The vendor support will say - we support windows only.
Windows only support means - microsoft certification is required.
Microsoft certification means - need secure boot.
Secure boot means - we control what you can boot.

To prove me wrong, try to boot what you own on "secure boot" enabled system without contacting or contracting microsoft.

True secure boot would mean - user is able to dictate firmware the CRC for any piece of software he uses, as well that chain loading process is good documented and transparent.
Currently UEFI is a mess and microsoft controls what user can boot.

You haven't read any of my previous posts, as I already explained that a system with (x86) UEFI Secure Boot can trivially be made to boot with any other OS. Without even booting win8 once.

And, the entire Secure Boot process is extremely transparent, but I'm not going to repeat all the public information that is already out there.

For reference, please read mjg59's blog, or James Bottomley's blog posts. It points out all the holes in your post above, and provides you with real information on how to do what you think you can't. I've posted links in another post in this thread.

[duby229]

This is completely incorrect. you don't even have to boot windows 8 once to install SuSE on a win8 certified PC. You can go straight into the BIOS setup and disable Secure Boot, delete the platform keys and what not (and replace them with your own keys if you wish). This takes 30 seconds, at most.

I just did so on two random production laptops last week. Took me literally that - 30 seconds - before I could install a Linux OS.

The amount of FUD by folks in this thread is just incredible. Please stop spreading nonsense, and educate yourself.

For a good read, go and read Matthew Garrett's blog - http://mjg59.dreamwidth.org/

And please, stop repeating nonsense, you're only adding to the misinformation.

Don't believe me? Try James Bottomley's HOWTO describing how to own your own system: http://blog.hansenpartnership.com/ow...uefi-platform/

There -are- boards on sale today that don't have configuration options to disable Secureboot. Telling people that they can simply disable Secureboot only covers the fringe cases.. You know the rare edge cases. Like I said we arent specifically dealing with enthusiast class users here. Secureboot -is- a major issue for average users. You try explaining to someone why they can't boot up to the liveDVD they just downloaded and then tell them they need to disable Secureboot by configuring the firmware options and they will laugh at you and ask how much is it going to cost them.

I'll admit that the majority of the people you'll find posting on this forum probably won't have much difficulty. But thats the whole problem. It doesnt stop people who know what they are doing. It only hurts legitimate users who don't know what they are doing. And lets just admit thats the vast majority of people.

Its the typical restriction management crap.

[sofar]

There -are- boards on sale today that don't have configuration options to disable Secureboot.

Can you list boards (x86, I'm not talking about ARM) that have this?

[mjg59]

There -are- boards on sale today that don't have configuration options to disable Secureboot.

Such as?

You try explaining to someone why they can't boot up to the liveDVD they just downloaded and then tell them they need to disable Secureboot by configuring the firmware options and they will laugh at you and ask how much is it going to cost them.

Why would they need to disable Secure Boot? There's no excuse for distributions not to support it now.

[alexcortes]

Don't believe me? Try James Bottomley's HOWTO describing how to own your own system: http://blog.hansenpartnership.com/ow...uefi-platform/

"You could also (assuming you never plan to boot windows) delete all the microsoft keys from the system. Beware if you decide to do this that some of your UEFI drivers may be signed by microsoft keys, and removing them all may limit the functionality of your UEFI platform. Additionally, any UEFI update to your system is also likely to come signed with the microsoft keys, however, in this case you can put the Microsoft keys back before doing the update."

[mjg59]

"You could also (assuming you never plan to boot windows) delete all the microsoft keys from the system. Beware if you decide to do this that some of your UEFI drivers may be signed by microsoft keys, and removing them all may limit the functionality of your UEFI platform. Additionally, any UEFI update to your system is also likely to come signed with the microsoft keys, however, in this case you can put the Microsoft keys back before doing the update."

You simply include the hashes of the UEFI drivers in your whitelist. I don't know why James thinks firmware updates are likely to be signed with the Microsoft key - I've seen no evidence to support that so far.

[RoboJ1M]

Their systems sure, but not my pc.

openSUSE supports both, uefi and secureboot.

But to install suse, you need to go into windows 8, and tell windows to boot from dvd at next start up.

Pc stand for personal computer, not for m$ controlled system.

Is that really all you need to do? Inform the existing OS that you're about to replace it?

Actually brass tacks, if you buy a Windows 8 Secure booted up the wahoozie laptop what are the actual steps to install, say, Ubuntu.
That's got to be a common use case.

Forget the ethics for a moment.
Assume no contact with Microsoft or between Microsoft and Canonical.

What are the steps?

[moilami]

I've called "UEFI Secure Boot" by a more descriptive name before: "UEFI Validated Boot". In effect, your system isn't secure at all, but at least parts of the boot sequence were *validated* during the boot process. Consequences are:

- something modifies kernel code during boot? you're pwned
- something runs in unprivileged mode? you're pwned
- something modifies your kernel file? you won't be able to boot
- something attempts to upload a trojan driver? you won't be able to boot or possibly load that driver

Second, NOTHING, absolutely NOTHING prevents a hardware vendor from shipping a system with UEFI Secure Boot enabled with e.g. Linux and NO Microsoft keys, and instead their own keys or someone elses keys. (hell, YOU can even do this).

(again, I'm not talking about ARM here)

One very big part of secure data/system is that you can use your system and get access to your data.

[WorBlux]

Given the condition you are _not_ on ARM.
Read up the facts and don't be a sheep of the system!

SecureBoot is stealing the users' freedom and should be abandoned asap; the excuse it has been introduced for is a shame to all computer users and the loose conditions for x86_64 are only there to abandon initial criticism.

And windows is far from being a monopoly of ARM systems, and just about everyone in the ARM space locks their bootloader in some manner or another.

[moilami]

If you're buying a Windows 8-certified PC, that's what you're getting. Don't want it locked down? Don't buy it.

The idea that a manufacturer doesn't have a right to control their product or try things to make it more secure is kinda absurd.

The idea of a car which would only accept gasoline made by SHELL is absurd. And if you did not know it, there are tons of laws saying what corporations can do and what they can't do. No company is free to do whatever they want - and ?$ should never be an exception to this.

There are tons of used computers in the world. People should be able to install whatever OS on those computer they can legally install. That is what people should be able to do. If they can only install ?$ on those computers, then the result is very insecure system in many ways.

If GNU/Linux would have 98% share of all computers having preinstalled OS, then, I might have hard time to resist the dark side but rather yell and demand "GIVE US 'SECURE' BOOT authorized by the Big Penguin and give it now!"

Could be so much fun to say "no, sorry, it is impossible to install ?$ in that. There should be a switch in BIOS making it possible, but for some very strange reason there is none, and even if the switch would be there it would be very hard and time consuming thing to do so much so that an expert would be needed for it."