Insecure Boot

Jeff Hoogland tries to make the point that M$’s “secure boot” protocol is only a problem if OEMs do not give Linux the key…

He’s drunk the Koolaid. How are OEMs to give Linux the key without giving it to every Tom, Dick and Harry malware writer??? Linux is open source software. Kernel.org does not distribute signed binaries but source code. If the key is in the source code somehow, the world can see it and so can the malware artists.

The bottom line is that the OEMs will not give GNU/Linux the key. They might give some distros the key but that would violate the GPL if the distros use it. You cannot give someone a licence to run the code and then deny them to run the code.

Further, M$ can well twist OEMs’ arms to change the key for M$’s next release, or they can have keys revoked.

Twit.

About Robert Pogson

I am a retired teacher in Canada. I taught in the subject areas where I have worked for almost forty years: maths, physics, chemistry and computers. I love hunting, fishing, picking berries and mushrooms, too.
This entry was posted in technology. Bookmark the permalink.

44 Responses to Insecure Boot

  1. oiaohm says:

    oldman over MS network protocol mess Open source had to go the court path.

    Redhat moves are not just about what market wants it also about what may be legally required to win if that path has to be used.

    We all of course hope MS sees common sense and expands the test suite. Even if the hardware vendor don’t follow MS path means to keep the anti-trust case open in the EU will be worth it to the Linux world. So MS has the regulator looking over their shoulder.

    Basically oldman is not about the limiting area of just market.

    The market is never the only consideration here. Linux and Open Source is also playing a long term game. If they are still in the game they can still fight for market. Half the picture is what you are talking about.

    The other half is if a new vendor compete against Microsoft due to what Microsoft is wanting. If MS actions are excluding they are breach of anti-trust plan and simple does not matter how much market share you have.

  2. oldman says:

    “There is the what is legally acceptable as well. What MS is upto might turn out not to be legally acceptable.”

    I dont speculate on legalities, and what you are doing in the end is speculating. What I do believe that long before the courts weigh in, the market will speak loud and clear.

    No hardware vendor is going to leave money on the table.

  3. oiaohm says:

    oldman close.

    “The reality is that the market will dictate what is acceptable.”

    There is the what is legally acceptable as well. What MS is upto might turn out not to be legally acceptable.

    Yes its what the market and laws with accept. If it was just market share then MS will have won for sure.

    Market share is only half the problem. I expect Redhat and others to apply to anti-trust regulators and the like over the Microsoft Move. This could turn into a major legal mess before the end.

    Remember Microsoft is still on the to be watched in the EU. Yes there are reasons why Redhat is making noise now. Microsoft fail to ensure other OS’s can work could leave Microsoft in big trouble. They were public-ally informed of the problem.

    Redhat is like any other company this way if they can get there competition wrapped up in red tape its helpful.

    Remember courts back the underdog in most cases. So the exact reverse applies in court as to the market place. Voting with you feet is only half the problem. Law enforced the right to vote with you feet making sure the option to vote with your feet is still there.

  4. oldman says:

    “The question is about who has the final say on what runs on your computer. I personally believe the final say should be the owners of the hardware.”

    As do I , but whining about what is in the end to most people techno-crap is meaningless.

    The reality is that the market will dictate what is acceptable. For server class x86 systems where one would could have any OS running, no major OEM will be stupid enough to not allow all viable commercial OS’s to run. For the desktop, there is enough money on the table that you can bet that at least some OEM’s will build systems that allow for any system to load.

  5. oiaohm says:

    This has driffed serousally off the starting topic.

    The starting topic was secure boot.

    I had another few things pointed out about it. The first implementations of secure boot to UEFI standards are intels. That Linux Freebsd and Solaris can cope with. Windows 8 on the other hand is incompatible.

    Issue is the subset of UEFI secure boot MS is demanding to operate.

    Basically no matter what you say MS implementation of secure boot is truly not to the agreed UEFI spec and this should be enough ground to call them trouble.

    Apple also should be held to account for there suspect EFI as well.

    ibm and intel secure boot is locked down by the owner/administrator of the machine. Not by the OEM system builder.

    The question is about who has the final say on what runs on your computer. I personally believe the final say should be the owners of the hardware.

  6. oldman says:

    “I and my students had absolutely no problems using Caldera GNU/Linux.”

    We were experimenting with caldera and red hat in 2000. Caldera did have the distinction of being that first and only company to make a distro that could be used by the non technical.

    The problem was that caldera could not
    single-handedly make up for the fact that the linux desktop applications at the time were at best half baked. Furthermore, it didnt take very long for those doing the experiment to have to step outside caldera’s carefully constructed facade into the world that we the true state of the linux desktop – they were all busy professionals and veteran windows 9x users and they were not amused.

    And that was that.

  7. I and my students had absolutely no problems using Caldera GNU/Linux. Lose ’95 would not work for any of us. Every class, one of them would crash. I used the machines all day long because I was teaching four grades at once and the cluster of machines was one of the activity stations. That’s about 5 crashes per day and it wasn’t a shortage of RAM. The machines had 72MB and M$ said 16MB was sufficient. The software was a donation by M$ to keep GNU/Linux out of schools and it did not work.

  8. oldman says:

    “Useful features, like security…”

    A secure system without my required applications is useless, pog. That was the reality in 1998 for what passed for a desktop on linux.

    “I saw many people using Lose ’95 and they didn’t need a lot. A few games, a browser and a word-processor worked for most.”

    And I saw many people using windows 95 using much more than than what you say on a regular basis, and they were even doing it connected to the internet to boot.

    Regardless of what you saw. the fact remains that even commercial desktop distros like Caldera, Red Hat and Mandrake were light years more difficult to use than windows 9x. I knew several adventurous sould who actually tried linux in this time frame, only to give it up quite rapidly as ” a pile of trash” and go back to windows 9x as “superior”

  9. I saw many people using Lose ’95 and they didn’t need a lot. A few games, a browser and a word-processor worked for most.

  10. A GNU/Linux system may well require more RAM for installation as the package management system uses large trees in RAM. Lose ’95 was the reason I moved to GNU/Linux. In 72MB it was crashing daily. GNU/Linux was far more featurful than Lose ’95 then. Useful features, like security…

  11. ch says:

    “It’s slick, It’s attractive!”

    Yeah sure. And what applications did you get ?
    What could you actually do with it ? Have you even bothered to read the text on that scan ?

    BTW: Minimum of 8 MB, 16 MB recommended ? In 1995, that was BLOAT ! (Win95 ran well with 4MB – without IE – or later 8MB with IE.)

  12. oldman says:

    “Caldera’s desktop OS ca 1995…”

    Here is a reality check Pog., People needed working code and working applications, and no matter how you spin it, neither Caldera or Red Hat of the time could deliver anything near the functional equivalents applications people had access to on windows 9x.

    I have no doubt that with your minimal computing needs that you could have made due with these environments, but that really proves nothing about their utility for others.

  13. Contrarian says:

    “The only viable alternative to VS is Eclipse for Java.”

    Oh pshaw, #phenom, #pogson has already told you (in another thread) that

    “The GNU system is a wonderful asset to the world. It saves a ton of development time for anyone wanting to bring something different to market.”

    Vi and GCC, are enough for anyone, surely! Well, use EMACS if you are a girly man.

  14. Hmmm. See 1995 for a reality check. That’s a scan of the back of Caldera’s desktop OS ca 1995. I used it in 2000 and it was slick. Here’s a review from 1995:
    “It’s slick, It’s attractive! It installs on your i486 computer with a minimum of fuss. It does everything it says it will do, and—it’s only in pre-release!”

    So, ch is wrong.

    One of my personal regrets in life is not hooking up with GNU/Linux about five years sooner.

  15. see Linux Uptake Is Getting SERIOUS Windows Struggles To Keep Up!

    I don’t know why GNU/Linux is overtaking that other OS as a development platform but it could be that software made by developers for developers is better for the task.

    Quoting M$’s internal document on the subject, “We’re NOT just here to help developers.”. see GROKLAW for the text of the document produced as an exhibit in court.

  16. Phenom says:

    I have been using OS/2 for a few releases – from 2.0 till 3.0, when I had to abandon it and go back to Windows.

    Development tools for OS/2 were close to non-existant. There was a C++ compiler from Watcom, and Borland at some point released their C++ compiler, too. However, IBM charged money for their SDK, and the learning curve was kind of steep. At the same time, on WIndows there were also Delphi, VB, MSVC + MFC… Better tools, better documentation, easier transition from 16 to 32 bit.

    Developers are always important. And speaking of them, development tools for Windows currently surpass anything there is for Linux. The only viable alternative to VS is Eclipse for Java. And that runs under Windows, too.

  17. ch says:

    “Many of the comments here look and sound like ducks.”

    Right, I remember a comment where someone quoted figures that disprooved his very point – and then said those figures don’t have any bearing, anyway.

    Or this gem: “Perhaps M$ did not write/release the malware” ? Even for a paranoid person, that’s quite much.

    Seriously: “How about requiring OEMs to ship their OS exclusively and driving competition from the market?”

    MS was only in a position to do that when (in the 1990s) the only “competition” that mattered were pirated copies of Windows. OS/2 never got anywhere – thanks to IBM in no small part – and nothing else mattered: DR-DOS was dead with Win95, Linux made a nice X-Terminal and SCO Unix was decidedly not for the masses.

  18. oldman wrote, apologizing for M$, “How am I damaged?”

    Well, count your re-re-boots. Value them at $1 or some arbitrary value for your time and lack of access to your systems. What’s the bottom line? That’s one measure of one kind of damage. Do the same for downtime for malware… Do the same for 2minute logins or however long it takes to get a usable desktop. Add extra for every time the “hourglass” has mocked you as you try to get something done. Add extra for having a busy hard drive on a lightly loaded system. Then count the times your system has “phoned home”… Then multiply by all the times M$ has dictated it’s time to replace your whole damned system just because M$ wants more money…

    If you can remember that far back count the delay on the network before M$ got the BSD stack. I actually measured it. On the same hardware GNU/Linux was three times faster on the LAN.

    Oh, I almost forgot. Add $5 or $10 for each time you got a BSOD or freeze from that other OS. That’s what pushed me to GNU/Linux. Even with out adding it all up, I knew software should not have those problems. Meanwhile, M$ kept telling you how wonderful the next version was going to be.

  19. I guess if you repeat that often enough, you could believe it. There were lots of competitive OS available. M$ was given a monopoly by IBM through DOS which allowed M$ to blackmail most of the OEMs. It wasn’t anything to do with how nicely M$ treated ISVs. Indeed Plamondon’s piece mentions exploiting ISVs.

  20. That anecdote is a good reason no one should become a “partner” of M$. They can eliminate competition any time a product is seen to be valuable and that competition could be a partner.

  21. Contrarian says:

    “I thought Netscape went bye-bye because they had no clue what the hell they were doing”

    Netscape is a good example of what can happen if you are too arrogant to do what is smart. Microsoft offered Netscape the cat bird seat in the integrated browser world wherein they could provide the base functionality that shipped with Windows and upsell just about anything that they wanted as aftermarket add-ons. They didn’t think that they needed to share and that their ability to code was some sort of golden goose that no one else in the world had the ability to match.

    Turns out they were wrong and that there was no good way to monetize their product outside of selling it to people using Windows who suddenly had a zero cost alternative in the form of IE. IE was a poor product in the first versions, but it turned out that the golden goose was not a singular entity and Netscape was quickly left in the dust. Now the code is resurrected in Firefox and they give IE a tussle, but everyone still uses both products on Windows and all the money still goes to the MS bank.

  22. oldman says:

    “Really, oldman, you have put up with M$’s damage for so long you don’t notice it, like the frog being cooked slowly by gradually raising the temperature.”

    I have put up with NOTHING Pog. all of my windows boxes have served me well and the windows ISV ecosystem has also served me well. I have the applications that I need at a cost that I can afford.

    How am I damaged?

    I didn’t care about IE because I continued to use netscape even after IE went on the market. As far as Netscapes demise is concerned, the URL that D-G provided more than covers the topic.

    “How about requiring OEMs to ship their OS exclusively and driving competition from the market? ”

    What competition Pog? OS/2? IBM’s support of its ISV’s was so bad that they basically killed any chance for being a real replacement. Name that competition Pog?

    BTW My last non microsoft os was OS/2 which I used up until it became very clear that the ISV’s who produced native code were abandoning it and because the win16 apps began to be rewritten for the win32 interface that IBM didn’t have a license for.

    The fact is that OEM’s willingly went to microsoft because microsoft and their ISV’s provided them with the applications that allowed the OEM’s to sell their systems.

    Remember Pog, people run applications not operating systems, and the fact was that microsofts’ OS platforms of the time were good enough for most people.

  23. D-G says:

    “You mean that driving Netscape from the market by buying up stocks of CDs, bribing ISPs not to promote Netscape, and bundling IE with Lose ’95 did no harm?”

    Funny. I thought Netscape went bye-bye because they had no clue what the hell they were doing:

    http://www.joelonsoftware.com/articles/fog0000000069.html

  24. oldman wrote, “Microsoft has NOT done ANY damage”.

    You mean that driving Netscape from the market by buying up stocks of CDs, bribing ISPs not to promote Netscape, and bundling IE with Lose ’95 did no harm? How about including no security features whatsoever in that other OS until recently? That caused $billions of dollars damage due to malware attacks. Perhaps M$ did not write/release the malware but they let it in and propagated it with their bugs/features. How about requiring OEMs to ship their OS exclusively and driving competition from the market? That allowed them to charge higher prices which harmed consumers.

    Really, oldman, you have put up with M$’s damage for so long you don’t notice it, like the frog being cooked slowly by gradually raising the temperature.

  25. oldman says:

    “I have no other rational explanation why sentient beings would support a company that has done so much harm in the world. ”

    Its simple Pog, Microsoft has NOT done ANY damage, other than helping to take computers out of the hands of the geeks computing priesthood and put them in the hands of people like my wife who wants to know only enough technology in order to use the web and email.

    IMHO classical Linux as desktop is many ways, is a step backward into the world of the priesthood/Geek.

    IMHO Any “damage” done by microsoft and its ISV’s are in your mind only!!!

  26. M$ does pay its partners. Lots of people work keeping that other OS going, including the IT guys/gals and anti-malware industry. Then there is the sales-channel. I have read that for every $1 M$ takes in there is a crowd with their hands out taking $8. So, people can be paid to be fans of M$ without being on M$’s payroll. We know that M$ arranges that competing technology is frowned upon by a campaign of propaganda that costs M$ hundreds of $millions annually. Many of the comments here look and sound like ducks. Maybe they are ducks. I have no other rational explanation why sentient beings would support a company that has done so much harm in the world. US DOJ v M$ is just the tip of an iceberg. M$ acts globally. Where were the country X DOJ v M$ cases? Why does Canada allow M$ to do business here? etc.

  27. Alex says:

    I think you are just clowns. And Robert keeps you for his own amusement.

  28. Kolter says:

    fast forward a short period of time until someone announces that they’ve cracked the key on their 500node PS3 cluster.
    Once that happens, any bad guy can just sign his malicious code – and you’ll all continue on happily installing anything.exe.
    This is a great way to get more money out of non-technical users without offering anything in return – and all you shills get hard thinking about it.

    Gee, I hope the next move is to prosecute the consumers for fair-use and hacking their kit to bypass this BS.

  29. Contrarian says:

    “Strange how that works. Almost as if they’re……”

    You are rather arrogant, #ipbear, to think that your pathetic attacks require any sort of dedicated and paid personnel effort to blunt them. Try contributing some rational thoughts and skip the schoolboy jeering.

  30. oldman says:

    Strange how that works. Almost as if they’re……

    being paid to do it.

    Skanks”

    Are you paid to be a zealot Mr. IPBear?

    If Pog thought we were anything other than dissenting voices, he would have banned us all. He knows that we are nothing of the sort.

    Deal with it.

  31. oiaohm says:

    Linux world has a item called trowsers

    http://trousers.sourceforge.net/faq.html

    Yes this the something I have not mentioned.

    Who develops the secure boot system for Linux. IBM.

    Now lets look at the UEFI members. http://www.uefi.org/about/

    Yep IBM is there. Linux world different companies are assigned different jobs. IBM is documentation and boot secuirty design as there prime projects.

    Basically IBM are the Linux guys that had to be asleep at the wheel D-G they were not. Basically Microsoft was and is passenger fighting with the wheel of the driver.

    Don’t mind that Redhat whips are out messing with the media. That is part of Redhat job. IBM does not have a clean Linux image. Redhat does.

    Yes its warped that the Linux tpm system is called trossers. Most of the Linux secure boot things have warped and funny names.

  32. Ivan says:

    “If one could use that boot loader to load anything, it would not be any more secure than BIOS.”

    So you don’t want to be able to boot into Linux? Got it.

    “Strange how that works. Almost as if they’re……

    being paid to do it.”

    Where do you apply for that job? Sounds like a sweet gig.

  33. lpbbear says:

    Say something negative about Microsoft! (yes, I know, it is hard NOT to say something negative about such a shitty company)

    OH LOOK! Here come all the roaches!

    Look theres another one and hes holding an “I Love Bill” sign.

    Accck, theres one waving 100 dollar bills!

    Theres another kissing Stevie B’s sweaty fat rearend….yeeccch.

    Whoa, theres one dressed in a skin tight mini skirt and high heels. No that one…the one waving at everyone.

    Odd how the roaches come out in droves any time someone dares say something….anything negative about Mickeysoft?

    Strange how that works. Almost as if they’re……

    being paid to do it.

    Skanks

  34. oiaohm says:

    Ray Microsoft makes test suite for particular standards like acpi.

    Microsoft has already made a test suite for bios certification for Windows 8 still in draft.

    Linux would have been broadsided if MS had got around to full formal release of the test suite.

    I am sorry many Linux hardware companies are now starting to look at injections against Microsoft.

    The battle is not over D-G. The Linux world does have a uefi test suite with all the stuff of secure boot but with the extras so users can add there own keys. This was done for coreboot the open source bios.

    Sorry this is a battle for the ages.

    Ray Microsoft requires a non standard conforming implementation. The non replaceable platform key is not in Uefi standard. To replace platform key was a trip to hell in back to say the least in conforming implementations.

    Once you can replace the platform key you can then self sign the kex sections. The effect MS does not like this idea. Since now the machine is now 100 percent control of the person who replaced the platform key. So no stealth updating.

    PS everyone secureboot bios images to uefi standard have only existed for the past 3 years and Linux grub does work with them.

    This is not that Linux was caught fully on the hop. Everything bar MS taking away means to change platform key change was allowed for.

    Yes the Linux world design give the owner of the hardware the right to be 100 percent in control of what OS’s will run on it. No third party control.

  35. Ray says:

    Let me just one thing straight, Microsoft is merely requires the OEMs to implement UEFI. It’s up to the OEMs to make it standard.

  36. D-G says:

    “Simple fact is the Linux guys were not asleep at wheel MS has attempted a broad side attack and we are fighting back.”

    Wrong again. That bus has already hit ’em. I also doubt you can fight back. I mean, yes, Pog is an experienced deer hunter, but he’s far from Redmond. On the other hand the usual Linux geeks/nerds possess just enough muscles to press the keys on their keyboards. Perhaps you could use Stallman’s beard. It’s supposed to be a terrible weapon. The smell, that is.

  37. oiaohm says:

    Funny some of the claims here. uefi.org Linux people are part of.

    The issue is Microsoft Windows 8 certified implementation of uefi.

    Microsoft uefi implementation is not a joint approved implementation from uefi.org.

    Its another case of MS taking a common standard and extending it for there own good including part implementation.

    Simple fact is the Linux guys were not asleep at wheel MS has attempted a broad side attack and we are fighting back.

    Note Grub2 licensing is not breached if you can use your own keys. GPLv3 don’t require you to hand over the keys you signed the file with. As long as the user has an option of doing it themselves. Could be a complex annoying option.

    Basically RealIT your a twit. You should have checked what the real standards are. MS version is not what the standard says.

    MS by passing standard processes again. Why am I not surprised.

  38. If one could use that boot loader to load anything, it would not be any more secure than BIOS. This is not about security but messing with competition.

  39. Ivan says:

    Guess you’ve never read either the two or the three clause BSD licenses, which is pretty damned funny as you are using quite a bit of software that uses those licenses…

    See, there is no valid reason the boot loader has to be GPL. Considering how craptastic Grub 2 is, you’d think more people would welcome the move away from that bloated piece of trash.

    Of course there’s also no reason why you couldn’t use the windows boot loader to boot into linux if you were crazy enough to use linux as a desktop.

  40. D-G says:

    “The maker of the motherboard and M$ are certainly in collusion to make life impossible for FLOSS if this scheme is implemented as advertised.”

    Yes, I’ve bribed them, too. And you need a therapist.

  41. The GPL is a licence. It gives permission to run the code. If you are not allowed to run the code by Wintel etc. the licence is an illusion. A distro cannot legally give permission and take it away under the guise of securely booting a PC. Further the licence says you can modify and distribute the code but what about the signature? If I can modify the code and sign it with a working key then every malware artist can do the same. So, giving out the keys will not happen and a distro would be violating the GPL to give a licence under these circumstances. The maker of the motherboard and M$ are certainly in collusion to make life impossible for FLOSS if this scheme is implemented as advertised.

  42. RealIT says:

    @Pog Typical Linux freetard paranoia. Unfortunately your own ethos and open source philosophy is what is shutting you out. The world is moving to UEFI and if Stallman says that private keys are unethical well then tough for you. DVD has them, Bluray has them now your BIOS has them. Cry all you want about MS being evil, your own GPL is infact your enemy. Cry me a river.

    My offer for Tech-Ed still stands. I get you Windows 8 key. Maybe even Office 2010. Cuz I’m nice like that and want to spread the love.

    @Contratian. No one cares about Linux. They were asleep at the wheel while UEFI was being developed. Too busy holding logo contests than to rather see where technology was going. Now they are caught with their pants down and look to Microsoft to take the blame. Rather should have been looking at ways to ensure that they meet UEFI standards. But alas, Linux failed as they do in the market. No one would really care if UEFI locked Linux out. At sub 1% market share Linux is more like the brown noise in an office. You never really cared that its there, but when you do take notice it annoys and irritates you.

  43. D-G says:

    Mommy, they’ve stolen my toys!

    Unfortunately they’ve just stolen your mind, Pog. OEMs control their hardware, not Microsoft. It’s their choice to enable the disabling of secure boot. Microsoft forcing them to not do this is just your wild fantasy at work.

    http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx

    I know it’s of no use posting this link again and again. You will continue to claim that Microsoft wants to shut out other operating systems despite the facts being different.

  44. Contrarian says:

    “but that would violate the GPL if the distros use it.”

    Why would that be the case, #pogson? Surely it would be easy enough to encapsulate a Linux distribution within a bootable container that supplied the key to the firmware to allow it to load. Nothing in the GPL prevents that.

Leave a Reply