LWN.net Logo

Fedora, secure boot, and an insecure future

Fedora, secure boot, and an insecure future

Posted Jun 18, 2012 15:09 UTC (Mon) by josephkliener (guest, #85179)
Parent article: Fedora, secure boot, and an insecure future

Time and time again, it was even said by Linus himself. Linux should be focusing on pre-installed systems.

The user who knows how to download Linux, put it onto a USB stick or USB, restart their computer (potentially have to press the boot menu key for their computer) and run or install Linux. They know or will know how to disable secure boot and it would not deter them from using Linux if they could do. The user that Fedora and Gnome 3 are tailoring their user friendliness to does not exist. 99% of people if it does not come pre-installed they will not change. How do you think people find about Linux? Is there any T.V. Advertising? This kind of attitude is ridiculous. Paying $99 is just supporting and putting Microsoft in a better position than they are now... which currently is failing in every market. Some of these guys are so old and stuck in the 90's thinking that Microsoft on desktop is still the relevant target. The Tablet and Mobile market and some lesser extent Mac is where it is all concentration is at the moment, and you guys are ignoring ARM (which may be a waste of time or it may overtake x86). Secure boot and Windows 8 are aimed for high-end systems currently (e.g. ultrabooks), and these are going to be direct competition with MacBookPros and iPads.... if you were an un-informed consumer, who could not disable secure boot which one would you buy?

Also I have no idea why you cannot see that Secure Boot is supportive of a DRM system. Sure if you are talking proper access control, with a crypto module and tamper resistance, and remote attestation. Yes it does not support that. But what sort of DRM do we have at the moment? Well it is software based, and can be circumvented by say, using software to dump the memory or effectively installing your own root kit. Well what happens if Windows supports software DRM at the kernel level and prevents memory dumping of a certain application? You have to edit the kernel to circumvent the DRM for your system. What happens if at the kernel level it requires the user space code to be signed by Microsoft and downloaded from the Microsoft store. Well we just edit the kernel... but hang on that windows update last week meant I can no longer disable secure boot.... I cannot boot if I try to circumvent the DRM... Okay so I will have to flash the hardware manually... wait a minute the manufacturer has hard coded their certificate into the chip... crap DMCA territory.

This is exactly how the iPhone works and jailbreaking iPhones has a specific exception granted to it that might or might not be granted if secure boot was one day disallowed from being disabled.
Sure their are ways around certain aspects, the system does not have any real unique identifier that cannot be faked, but as it stands currently windows advantage or whatever uses a bunch of ridiculous random hashes of bios, cpu, driver information. The uniqueness required for DRM is included in the software key, which will disable windows update, etc. if it detects it is circumvented already.
Companies want DRM at any level, they would even accept obfuscation as a form of DRM if they thought it would stop even 1 person from pirating their stuff. All it takes it one person to go.... hey wait a minute if we stop people from disabling secure boot we could be in a better place than we are now.... this would trump whatever anti-trust people would through our way.

Sure you could install pirated software on a pirated copy of windows on a computer without secure boot. But in 5 years time you will be stuck with old hardware, as everything you want to buy will come with secure boot.

I mean another example could be on a system with windows 8 starter, black list the signatures for windows 8 home, and premium, ultimate etc. then if they purchase the upgrade you use windows update and the manufacturer's key to un-blacklist the version of windows they purchased. How can you say this is not DRM...

Coreboot support and linux on pre-installs is the way forward. That $99 could be spent elsewhere. Save the pennies and the dollars will look after themselves


(Log in to post comments)

Fedora, secure boot, and an insecure future

Posted Jun 20, 2012 18:45 UTC (Wed) by BenHutchings (subscriber, #37955) [Link]

They know or will know how to disable secure boot and it would not deter them from using Linux if they could do.

What if they're installing it for someone else? Having to find and disable that option is an additional barrier; you'll probably spend the time to do it for your own PC but are more likely to give up on someone else's. Also, what if the other person is a bit naive about downloading programs and would benefit from that protection against malware?

Paying $99 is just supporting and putting Microsoft in a better position than they are now...

The money goes to Verisign, supposedly subsidised by MS.

Well we just edit the kernel... but hang on that windows update last week meant I can no longer disable secure boot....

But you can run it in a VM in which you have a modified UEFI that always says 'Secure Boot is enabled'. The OS cannot verify what the firmware tells it, so this information is not useful for DRM.

Fedora, secure boot, and an insecure future

Posted Jun 20, 2012 19:53 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link]

>The OS cannot verify what the firmware tells it, so this information is not useful for DRM.
That's temporary. The next step is integration with TPM to measure the UEFI integrity.

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds