Wednesday, September 21st 2011
Windows 8 Secure Boot: Designed to Lock Out Linux?
Proposed changes to the Unified Extensible Firmware Interface (UEFI) firmware specifications would mean PCs would only boot from a digitally signed image derived from a keychain rooted in keys built into the PC. Microsoft is pushing hard to make this mandatory, so that users cannot override it. This feature would have the handy benefit of excluding alternative operating systems such as Linux and FreeBSD. This is according to Professor Ross Anderson of Cambridge University and other industry insiders. Also, it's not at all clear that it actually secures against viruses and other malware and appears to be solely designed to appease corporate self interests for unbreakable Digital Restrictions Management (DRM).
UEFI supercedes the 30 year old veteran BIOS found in most PCs today, which is very inefficient and slow for modern PCs, carrying a lot of old, legacy compatibility baggage that's just not needed in today's PC. UEFI, a key component of Windows 8, is designed to work on several CPU architectures, such as ARM and is streamlined and efficient. It also includes a much improved graphical interface that replaces the keyboard-driven menu system of the BIOS.
If the changes are adopted, then any system that ships with only OEM and Microsoft keys will not boot a generic copy of Linux. Tech blogger Matthew Garrett explains that while a signed version of Linux would work, this poses problems:
The effect of all these changes is to return to the dark days of 2003, when the Trusted Computing platform was being pushed as a way to completely DRM your entire PC to satisfy the content industries. However, this version will be far worse:
Source:
The Register
UEFI supercedes the 30 year old veteran BIOS found in most PCs today, which is very inefficient and slow for modern PCs, carrying a lot of old, legacy compatibility baggage that's just not needed in today's PC. UEFI, a key component of Windows 8, is designed to work on several CPU architectures, such as ARM and is streamlined and efficient. It also includes a much improved graphical interface that replaces the keyboard-driven menu system of the BIOS.
If the changes are adopted, then any system that ships with only OEM and Microsoft keys will not boot a generic copy of Linux. Tech blogger Matthew Garrett explains that while a signed version of Linux would work, this poses problems:
Firstly, we'd need a non-GPL bootloader. Grub 2 is released under the GPLv3, which explicitly requires that we provide the signing keys. Grub is under GPLv2 which lacks the explicit requirement for keys, but it could be argued that the requirement for the scripts used to control compilation includes that. It's a grey area, and exploiting it would be a pretty good show of bad faith.However, there's no need to panic just yet, concluded Garrett.
Secondly, in the near future the design of the kernel will mean that the kernel itself is part of the bootloader. This means that kernels will also have to be signed. Making it impossible for users or developers to build their own kernels is not practical. Finally, if we self-sign, it's still necessary to get our keys included by ever OEM.
There's no indication that Microsoft will prevent vendors from providing firmware support for disabling this feature and running unsigned code. However, experience indicates that many firmware vendors and OEMs are interested in providing only the minimum of firmware functionality required for their market.
The effect of all these changes is to return to the dark days of 2003, when the Trusted Computing platform was being pushed as a way to completely DRM your entire PC to satisfy the content industries. However, this version will be far worse:
These issues last arose in 2003, when we fought back with the Trusted Computing FAQ and economic analysis. That initiative petered out after widespread opposition. This time round the effects could be even worse, as 'unauthorised' operating systems like Linux and FreeBSD just won't run at all. On an old-fashioned Trusted Computing platform you could at least run Linux - it just couldn't get at the keys for Windows Media Player.Anderson concludes that this restrictive technology might violate EU competition law, on Cambridge University's Light Blue Touchpaper blog.
The extension of Microsoft's OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate.
84 Comments on Windows 8 Secure Boot: Designed to Lock Out Linux?
I, personally, would not purchase a motherboard if it had no way to override or disable this type of restriction. When enough people feel the same, and the enthusiast market segment manufacturers begin to lose money, you can bet it will become an 'option'.
That wasn't such a silly question. :toast:
So this price that is charged has to go somewhere....and what better way NOT to incur the cost than to tack on the extra expense onto us customers? OS prices will go up....as if they aren't high enough? Pretty soon it will be an "option" at a price, then it will be standard in all PCs with an "on/off switch" with a price, and finally we will have no more say in it....oh and the price is one with the total cost and can no longer be negotiated. Plain and simple, this all comes down to control. More control, more certainty.
If it were to be implimented it would definitely have to be regulated with an option in the BIOS/UEFI. There's no way Microsoft should be allowed to have a defacto monopoly like that.
For now, I fell the same way about Win8.
Also, how are all the school boys going to access their porn now?
If they really include an option to turn it off, and give the buyer the choice whether to use it or not when buying a new Laptop/ Prebuilt Desktop, I don't see it being much of a problem. If anything, if there claims that it stops viruses from completely ruining the system, it might prove to be a very useful utility....and the two types of users mentioned above won't have a problem running Linux on a Win8 machine, even if there is no off button
Edit: wait a sec, does that mean Win 8 will only run on a UEFI equipped system ?
Microsoft is trying to kill two birds with one stone here. First, they want to stop malware infecting the boot record, and Secure Boot will certainly do that. Second, they want to discourage people from using other operating systems, and Secure Boot will put a damper on that, too. Naturally, Microsoft doesn't say anything about item #2, because that would draw the unwanted attention of Federal regulators for anti-trust behavior.
Deny it all you want, OneMoar, but that won't make it go away.
It is the device manufacturer's responsibility to allow you to unlock the device, not Microsoft.
This sort of stuff makes my skin crawl. Regardless of who's behind it - Microsoft or otherwise - It's only acceptable in my mind if the "off" button is a REQUIRED part of the specification. Furthermore, having it turned off should have no effect on any part of the OS. If this is about hardening the boot path against damage like they seem to be saying it is, there's no reason why it should effect anything to be off. I know corporate politics far to0 well (unfortunately) to think that anything of this sort offered up by the guys in the money making spots is anything but a thinly veiled attempt at making more money.
yup, you're right... M$ has NOTHING to do with it, and are perfectly fine with users turning it off.....
Stay on topic and behave.