Debian Developers Discuss UEFI SecureBoot Plans

[ImNtReal]

Direct or Gummiboot

You know, if they don't want to boot a signed kernel directly from UEFI which isn't that hard, they can just use this.

[sandain]

It's still not decided what approach Debian will ultimately support whether it's like Fedora using GRUB2 and singing the entire stack, Ubuntu using efilinux and only signing the low-level bits, or some entirely new approach for handling EFI/SecureBoot

s/singing/signing/

[Gusar]

I can only say it again, on x86 hardware Microsoft is actively forcing the hardware manufacturers to not lock out other systems, if they want to get the Windows 8 logo for their hardware. Why is everyone bitching about Microsoft but no one actually reading their documentation?

Because we're not so narrow-minded to only look at x86. Tablets are to a large degree ARM. There may be ARM netbooks and laptops not far into the future. Even in the server space ARM is making inroads.

Because there's no guarantee Microsoft won't change their agreement in the future.

Because there may be companies that will only accept SecureBoot "protected" OSes on their company computers, so a solution is required if Linux wants to be part of that space.

So do Apple and many Android vendors. Why is nobody complaining about them?

Err, where do you get that there's no complaining about them? People are *all the time* speaking against Apple's walled garden practices. And there's *tons* of complaints at Android vendors who lock their bootloaders, with people petitioning them to provide an unlock mechanism and such.

[Rallos Zek]

Debian hasn't stated exactly what approach they will take with the whole secure boot/UEFI mess so it's a bit silly to criticize them at this point. The whole proprietary bootloader nonsense was enforced by those pigs at Microsoft since they never want to play fairly and are scared of the rising momentum that GNU/Linux has. Tampering with the open architecure of the PC to ensure only one OS can be used is blatant anti-competitve behavior by Microsoft and I hope they suffer a nasty retaliation for the shenanigans they constantly pull.

The x86/x64_86 ISA is not even close to being an open architecture, if your looking for that try Sparc, or Opencores, Heck even IBM powerPC/Power is more open than x86.

[Kano]

First of all i still doubt that you can boot with that signed loader. Even if you could that give you no extra security the way ubuntu wants to do it, you just save the 30s you need to enter you setup and disable it. Wow, so much trouble for such a small effect. Better provide uptodate bootloaders instead of heavyly patched old ones...

[uid313]

basically debian does not need to discuss things that could be disabled with a simple setup setting. they should better provide grub 2.00 in experimental soon.

Maybe GRUB 2 ought to be re-licensed under the GPLv2 instead of the GPLv3?

[Kano]

basically debian does not need to discuss things that could be disabled with a simple setup setting. they should better provide grub 2.00 in experimental soon.

[uid313]

Interesting

I am curious to find out what Debian's approach will be.
It is very interesting due to the Debian Free Software Guidelines (DFSG).

[TobiSGD]

NOFI, but don't be so naive ... They already require it on ARM.

So do Apple and many Android vendors. Why is nobody complaining about them?

They don't do it know, because of all the antitrust shit that will rain over them.

So why do you think that no antitrust shit will be raining when Windows 9 is released?
The only way would be if Microsoft suddenly wouldn't be a monopoly anymore. But If Microsoft will not rule the market anymore, why should the manufacturers close their products to the other players on the market.
Microsoft won the browser wars in the beginning, but look at the browsers now, in the long run there was competition. I think that the same will be with the OSes, they won the OS wars in the beginning, but we will see diversion again.

[oliver]

Have I stated that? How should I guarantee that? Do you think I am Steve Ballmer? I have stated clearly that this is for the Windows 8 logo, shouldn't be hard to understand. People are spreading enough FUD about Secure Boot already, do you want to start now with spreading that about later Windows versions? You don't know what will happen then, I don't know what will happen then, so guessing around is of no use.

NOFI, but don't be so naive ... They already require it on ARM. Chances are pretty good, if they have their way, it will be a requirement sooner rather then later. That's just how the beast works. They don't do it know, because of all the antitrust shit that will rain over them. They are hoping/guessing/betting, that in a few years, they can encourage OEM to enable it by default claiming 'see, less piratism, less virusses etc happened because of secure boot' and a few years after that, lock the platform entirely.

But you are right. We don't know for sure what will happen. For all we know Microsoft will play nice and .... right, sure it may be possible, but extremly unlikly. Embrace, Enhance and what was that last one again?