Turn off "secure" boot

Posted Jun 28, 2012 9:42 UTC (Thu) by rwmj (subscriber, #5474)
Parent article: Ubuntu details its UEFI secure boot plans

I think the best answer is that we encourage end users to not buy hardware that has this anti-user feature. If they have to buy such hardware, turn "secure" boot off.

Turn off "secure" boot

Posted Jun 28, 2012 16:32 UTC (Thu) by wookey (guest, #5501) [Link] (4 responses)

Quite. It seems like a really good reason not to buy an ARM device with Windows 8 on.

And is there a real practical problem that all this faffing about with keys solves? It seems to me that pre-boot infections are a very rare thing, and this cure it a lot worse than the disease. Perhaps I am wrong about that?

Secure boot could be useful in the same way that encrypting your machines disk, but only if _you_ have control. I remain doubtful that manufacturers are going to provide that control, and that could start to be a serious problem when buying new kit. We all resented the 'microsoft tax' on much PC and laptop x86 hardware to date, but you did at least get control of the hardware once it was in your hands. We seem to be heading for a world where that may no longer be true.

Buy carefully!

Turn off "secure" boot

Posted Jun 28, 2012 19:29 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (3 responses)

> It seems to me that pre-boot infections are a very rare thing, and this cure it a lot worse than the disease. Perhaps I am wrong about that?

Yes.

Turn off "secure" boot

Posted Jun 28, 2012 19:39 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (2 responses)

That is to say, yes, you're wrong about it being very rare - attacks on the boot process are becoming more common. Whether the cure is worse is more of a value judgement.

Turn off "secure" boot

Posted Jun 28, 2012 21:45 UTC (Thu) by wookey (guest, #5501) [Link] (1 responses)

Some evidence would help convince. Is this something that only affects Windows people which is why I've never heard of a case?

Turn off "secure" boot

Posted Jun 28, 2012 21:47 UTC (Thu) by mjg59 (subscriber, #23239) [Link]

Improvements in Windows security have meant that the boot process is an easier target. http://www.slideshare.net/daniel_bilar/matrosov-2012-reco... is a description of this in the real world, but there are several others out there.

Turn off "secure" boot

Posted Jun 28, 2012 19:41 UTC (Thu) by dlang (guest, #313) [Link] (1 responses)

the problem is that Microsoft is requiring this feature on any hardware that is going to be certified as supporting Windows 8

There is going to be very little PC hardware produced that deliberatly opts not to be able to support Windows 8, even the vendors that sell linux pre-installed will be buying motherboards from vendors that want to sell the same motherboards to Windows users.

simply opting not to buy hardware with this feature is not likely to be a realistic option, the best we can hope for is that vendors have the option, but default to having it turned off.

Turn off "secure" boot

Posted Jun 29, 2012 15:53 UTC (Fri) by giraffedata (guest, #1954) [Link]

I think the best answer is that we encourage end users to not buy hardware that has this anti-user feature.

But answer to what? I believe the challenge that Ubuntu and Fedora are answering is the challenge of running Ubuntu or Fedora on hardware that has this feature.