Red Hat engineer renews attack on Windows 8-certified secure boot
Linux lock-out row rumbles on
Posted in Developer, 26th September 2011 11:06 GMT
Free whitepaper – King's College LondonUses IBM BNTRackSwitch for HPC
A senior Red Hat engineer has lashed back at Microsoft's attempt to downplay concerns that upcoming secure boot features will make it impossible to install Linux on Windows 8 certified systems.
Unified Extensible Firmware Interface (UEFI) specifications are designed to offer faster boot times and improved security over current BIOS ROM systems. The secure boot feature of the specification is designed so that only digitally signed OS loaders will load, a security feature that would prevent the installation of generic copies of Linux or FreeBSD as well as preventing rootkits and other boot-time malware from running.
A digitally signed build of Linux would work, but that would mean persuading OEMs to include the keys. Disabling the feature would allow unsigned code to run. However, it is unclear how many OEMs and firmware vendors will follow this route, which isn't required for Windows 8 certification.
The forthcoming secure boot feature has created a huge row with computer scientists, such as Ross Anderson of Cambridge University (here), and open-source developers who accuse Microsoft of pushing lock-in and decreasing consumer choice. Microsoft responded by saying consumers would continue to control their PC and cited the example of one OEM, Samsung, which is including a "disable secure boot" feature on prototype versions of its tablet PC.
Power play
This response has failed to satisfy critics of the technology. Matthew Garrett, power management and mobile Linux developer at Red Hat, who was among the first to flag up concerns over the technology, said that Microsoft's response fails to address his central point that "Windows 8 certified systems will make it either more difficult or impossible to install alternative operating systems".
Red Hat, he explains, has been working with Linux suppliers, hardware manufacturers and BIOS developers since becoming aware of the issue in early August.
Garrett said that Windows 8 certification requires that hardware ship with UEFI secure boot enabled. A feature allowing secure boot to be disabled – necessary to run Linux and FreeBSD on certified systems – is not required for certification. "We've already been informed by hardware vendors that some hardware will not have this option," Garrett writes in a flow-up blog post to his original critique of the technology.
In addition, Windows 8 certification does not require that the system ship with any keys other than Microsoft's. Such systems will only securely boot Microsoft operating systems.
A system that ships with Microsoft's signing keys and no others will be unable to perform secure boot of any operating system other than Microsoft's," Garrett writes. "No other vendor has the same position of power over the hardware vendors. Red Hat is unable to ensure that every OEM carries their signing key. Nor is Canonical. Nor is Nvidia, or AMD or any other PC component manufacturer."
Neither of the two options – the first being to get OEMs to include keys for a digitally signed copy of a particular build of Linux and the second being allowing users to disable secure boot – look likely in most circumstances. The upshot of this, as things stand, is that Linux fans will only be able to run the alternative operating system on a small minority of Windows 8-certified hardware.
Control
But the issue goes beyond operating system choices and also affects other modification a user might choose to make to their PC, Garrett argues. He reckons Microsoft is pushing control of what can or can't be done on a PC away from consumers towards hardware manufacturers.
Read More...http://www.theregister.co.uk/2011/09/26/uefi_linux_lock_out_row_latest/
Looks like it's time for another Antitrust Law Suite against Microsoft. Like the United States vs. Microsoft was a set of civil actions filed against Microsoft Corporation pursuant to the Sherman Act 1890 Section 1 and 2 on May 8, 1998 by the United States Department of Justice (DOJ) and 20 U.S. states. But, since BG has Defected to Germany... Would that be in Germany's Jurisdiction now???;)
Don
No comments:
Post a Comment