Win2012 wants Secure Boot - damn?

273 · 03-21-2015, 02:29 PM

Quote:

Originally Posted by smeezekitty

The problem is that it removes the possibility for non highly computer-savvy people to try alt OSes. Not even a live cd.

Indeed. For those of us more in the know I'm sure there will be lists of hardware vendors or products where secure boot can be switched off or more keys added. As you note the problem here is there will be people who cannot choose to try Linux due to the restrictions.
There is hope though as both Canonical and Red Hat are able to sign their boot loaders, though a google tells me that Canonical's may be signed by the wrong key currently.

273 · 03-21-2015, 02:30 PM

Quote:

Originally Posted by Head_on_a_Stick

Apart from Ubuntu, Fedora & OpenSUSE live CDs all of which will boot and install a working system with Secure Boot enabled...

Since I pushed this thread over a page after your post I'll quote it so others can see and thank you for the heads-up of what to try in my "secure boot" experiments when I get my secondary laptop fixed.

smeezekitty · 03-21-2015, 06:06 PM

And what if the next step is to disallow third party signers? or charge an exorbitant fee to have it signed?

TobiSGD · 03-22-2015, 07:02 AM

Quote:

Originally Posted by smeezekitty

And what if the next step is to disallow third party signers? or charge an exorbitant fee to have it signed?

Won't happen. Microsofts biggest fear is another anti-trust lawsuit. That is why they made it mandatory to have an option to disable it for Windows 8. Now that there are competitors that also have the possibility to use Secure Boot they don't have to care for that anymore. But third party signing is wanted by the industry and making signing expensive may open the possibility of another lawsuit.

Pearlseattle · 03-22-2015, 08:13 AM

Quote:

It will be mandatory to ship with Secure Boot enabled. It will be optional to allow the user to turn it off.

@Dugan
Thx, now I understood

@TobiSGD

Quote:

If it makes changes to the bootloader or kernel then it shouldn't work with Secure Boot enabled.

So, how does it work? E.g. "Secure Boot" fires up only bootloaders (e.g. Grub, Windows bootloader, etc...) that have been appropriately signed and that one in turn loads only a kernel that has been signed as well appropriately?

Thx

TobiSGD · 03-22-2015, 01:28 PM

Quote:

Originally Posted by Pearlseattle

So, how does it work? E.g. "Secure Boot" fires up only bootloaders (e.g. Grub, Windows bootloader, etc...) that have been appropriately signed and that one in turn loads only a kernel that has been signed as well appropriately?

Thx

Yes, that is how it works. From that point on the OS is responsible for security.

smeezekitty · 03-22-2015, 02:13 PM

Quote:

Originally Posted by TobiSGD

Won't happen. Microsofts biggest fear is another anti-trust lawsuit. That is why they made it mandatory to have an option to disable it for Windows 8. Now that there are competitors that also have the possibility to use Secure Boot they don't have to care for that anymore. But third party signing is wanted by the industry and making signing expensive may open the possibility of another lawsuit.

They have been taking away user freedom one step at a time. Don't underestimate what greedy corporations will do.

Pearlseattle · 03-22-2015, 03:26 PM

Quote:

Originally Posted by TobiSGD

Yes, that is how it works. From that point on the OS is responsible for security.

So, on:

Linux
Do I have to sign the kernel every time I recompile it?
Windows
If my father downloads "something" and keeps on clicking on "yes" even when it asks if the kernel or some drivers should be updated he still will end up with a virus/whatever, he will still end up having the system compromised, right?

Thank you

TobiSGD · 03-23-2015, 06:44 AM

Quote:

Originally Posted by Pearlseattle

So, on:

Linux
Do I have to sign the kernel every time I recompile it?

As I understand it, yes. Keep in mind that Secure Boot is not aimed at kernel developers, but at enterprise and the "common user". In that environments kernels don't change often.

Quote:

Windows
If my father downloads "something" and keeps on clicking on "yes" even when it asks if the kernel or some drivers should be updated he still will end up with a virus/whatever, he will still end up having the system compromised, right?

Yes, the whole purpose of Secure Boot is to be able to have a trusted boot chain.

smeezekitty · 03-23-2015, 12:32 PM

Quote:

Yes, the whole purpose of Secure Boot is to be able to have a trusted boot chain.

But it doesn't help at all once the system is booted. What it DOES do is make it harder to install a more secure OS in the first place.

linux4everybody · 03-23-2015, 01:27 PM

I feel this way and I don't care what others say, if I pay for the computer, I should install whatever I want. I always removed a pee-installed windows OS with linux. These vendors and OEMs think that windows is the only player in town. Not everybody likes to use windows as there are other operating systems out there. It would piss me off if secure boot is grey-out and I can't disable it.

Secure boot sucks, Microsoft sucks and OEMs that prevent us to disable secure secure boot suck even more!!!!!!!!!!!!!!!

smeezekitty · 03-23-2015, 01:41 PM

Quote:

Secure boot sucks, Microsoft sucks and OEMs that prevent us to disable secure secure boot suck even more

Yep. As a tinkerer, being able to boot whatever I want is very important.

TobiSGD · 03-23-2015, 01:49 PM

Quote:

Originally Posted by smeezekitty

But it doesn't help at all once the system is booted. What it DOES do is make it harder to install a more secure OS in the first place.

Of course it doesn't help after the system is booted. That is not what it was designed for. The point is, your OS can be as secure as you want, it still can't be trusted without having a trusted boot chain. Secure Boot fixes this issue. And of course it does make it harder to install an OS that is not signed, this is also by design. What worth would a trusted boot chain have if you just could pop in a Knoppix or Puppy CD/USB to circumvent all that stuff?

TobiSGD · 03-23-2015, 01:50 PM

Quote:

Originally Posted by linux4everybody

I feel this way and I don't care what others say, if I pay for the computer, I should install whatever I want. I always removed a pee-installed windows OS with linux. These vendors and OEMs think that windows is the only player in town. Not everybody likes to use windows as there are other operating systems out there. It would piss me off if secure boot is grey-out and I can't disable it.

Secure boot sucks, Microsoft sucks and OEMs that prevent us to disable secure secure boot suck even more!!!!!!!!!!!!!!!

From a security point of view, Secure Boot does not suck. But anyways, it is as it always is in the corporate world: Vote with your money, if an OEM does not allow you to disable Secure Boot then just don't buy their products.

veerain · 03-23-2015, 02:08 PM

Quote:

Originally Posted by 273

Not when Windows 10 machines are released. Well, to be more precise, it is not guaranteed that it will be possible to create one's own keys on a Windows 10 machine as M$ are removing that requirement for vendors to be able to mark their equipment Windows compatible.
I am sure some vendors will continue to play fair but some may be paid by M$ to lock down secure boot and some may find it cheaper to do so.
So, this isn't "the sky is falling" but it is a slightly worrying move.

Yes, currently Ubuntu have got their own keys from MS to support Secure Boot and for Fedora it uses shim bootloader from Mathew Garett who got key from MS.

What if Microsoft denies giving it or revokes already given one. An anti-trust case may be waiting in future.