FSF takes Win 8 Secure Boot fight to OEMs

Re: Pah...

And just when did common sense, lawsuits and customer opinions become a guiding force at Micro$oft?

Naive

@AC (1st post) you are being naive.

a) Why on earth would MS be interested in older versions of Windows being installed? They want to sell new ones.

b) MS have never been afraid of anti-trust cases because they usually get away with it. They are so blatent I wonder how, but they do. That is what is so "clever" about this - MS can seem to shift the blame onto the PC maker or retailer, certainly enough to convince a non-technical judge or anyone else who wants to believe them.

c) The vast majority of corporate machines just use Word, Outlook, IE and maybe Excel. Many also use apps such as Photoshop, SAP and Sage, which are recognised as mainstream even by MS. No problem there. If you are talking about corporate servers meant to run Apache on Linux or BSD, then this is a niche professional market in which the secure boot password *will* be passed to the buyer.

But it is the "casual" Linux user who will find the barrier raised. Try running a live Linux DVD on a home PC from the high street, just to try it out, and it will probably be blocked. MS hate that sort of thing - it might result in another Linux convert.

@AC ["Err...] Direct contracts between MS and large corporate users will always accommodate particular requirements. As you say they are too valuable to MS. However that is not what this move is aimed at, it is aimed to stop home and small business users using Linux and any other software that MS frowns on, whether malware or simply minority.

Syren Baran "At the end of the day, the customer is in control of their PC" → #

we will probably have a web site for PC's at http://www.jailbreakme.com

yes, but...

I think the concern is that some (a lot?) of PC makers won't bother to include a "disable" option, thus tying the machine to the OS (indeed, one version of one particular OS).

I'm a bit ambivalent about this - MS are correct in saying that they are not mandating that such a "disable" option is not allowed, and that it is up to the hardware manufacturer to provide such an option, should they so wish. I can see their point - all MS are asking for is a facility to be included into the BIOS for their OS (a facility that is and always has been in the UEFI spec by the way - this is nothing new). They are coming under fire because they have NOT mandated the disable option. I think it is a bit unfair to blast MS for this; do we have a go at Ford because they mandate the use of round wheels, but not square ones? There's nothing stopping you from fitting square wheels to their cars, but Ford don't make such a requirement part of the spec and they don't support it, but if that's what you want to do then go ahead; Ford don't care one way or the other (just don't try and claim on the warranty for any damage to the suspension!). It's the same with MS - all they want is for this facility to be made available for their OS (which is not unreasonable). What happens after that they don't care about, and why should they?

Disclaimer - I loath MS as much as the next geek, and I think their software is a joke, but in this case, I think MS are being lambasted for something that they genuinely have no interest in, nor should they have to. Oh yes, I am well aware that MS would be more than happy if no manufacturer included the "disable" option, but that's not the point; the point is, they are not stopping anyone from adding it as far as we know :o)

Only if you have that option-- which you may or may not be given. From what I've seen, you won't have that option. FSF opposes this form of secure boot because it's not GPL-compatible... I doubt they'd care if it was, since then they could incorporate it into their software.

Dual boot?

And if your requirement is to have a boot menu so that the user can choose between Windows and Linux?

As I'm reading it, secure boot enabled - LInux cannot boot. Secure boot disabled - Windows 8 cannot boot. Utility of such a system in my environment: zero.

And of course, the last thing one wants to do is to leave the BIOS itself unprotected, for the user to poke at all the other setttings, boot unapproved media, etc. etc.

If it's going to be straightforward for a Linux sysadmin to generate the appropriate certificates from his Linux system (including a custom-patched, modified kernel) and install these certificates into the system BIOS so that Linux can secure-boot, then that's (just about) OK.

I'm also thinking there's a danger that even if this is do-able, it'll take ten minutes per PC, which it won't be possible to automate like the rest of the deployment process because the only way to interact with a BIOS is by prodding its keyboard. Ten minutes times 200 PCs equals most of a man-week.

Yuk.

Yuk.

Yuk.

Bleugh.

options

The way that this type of attack can be thwarted is to put a physical switch on the motherboard or hard drive that will not allow the boot record to be modified unless that switch was set.

Agreed. I used to work at a local retail/repair shop where we also built new PCs. In theory, we could put whatever OS we wanted on the system, but if we put anything other that Windows on our new-build machines, we would lose our "discount" and any hope of being able to sell the machines at a competitive price (already difficult since we used quality hardware with solid manufacturer's warranties as opposed to the flimsy crap in the big boys' systems).

So... of course you can disobey MS, but you'll go out of business if you do. Unfortunately, they can say they weren't "forcing" us since, in theory, we could do whatever we wanted. In practice, you obey Redmond or go bankrupt....

You should remove your tin-foil hat - I think you're overheating

"It is high time that Microsoft were actively prevented from using anticompetitive measures, technical or economic, to corrupt the market. Regulators should get off their behinds and unbundle Windows now!"

Microsoft operated from 2002 -> March 2011 under DOJ oversight and in compliance with the 2002 DOJ consent decree. The DOJ has kept a close eye on all of Microsoft's business dealings to make sure that it completely changed the way it did business.

OEM's are entirely free to ship machines running Linux if they want and some do. Dell offers Linux as an option on all its servers for example. They used to offer a range of PC's running Linux too but quit that business because NOBODY BOUGHT THEM.

With the razor-thin margins that the OEM's operate under it costs them too much to sell and support PC's preinstalled with free OS'.

let me fix that

Customer starts pc the next day and it ignores the unsigned code.

Don't care which computer I use!

Just as long as it has a spell checker! (Is that one or two words?)

Were you raised by the internet?

Or by a Daily Star journalist? You seem to write a different kind of English from the rest of us.