Bottomley: Adventures in Microsoft UEFI Signing [LWN.net]

Bottomley: Adventures in Microsoft UEFI Signing

Posted Nov 21, 2012 16:59 UTC (Wed) by jejb (subscriber, #6654)
In reply to: Bottomley: Adventures in Microsoft UEFI Signing by krake
Parent article: Bottomley: Adventures in Microsoft UEFI Signing

In the interests of full disclosure, the Linux Foundation investigated what it would take to be a Linux CA for UEFI. The figures that came back are pretty staggering.

Firstly the current CA operators want payments in the order of millions of US Dollars to set up a CA and not charge the end user (otherwise they want to charge fairly ridiculous fees). It should also be noted that the UEFI forum tried to go this route as well (they originally planned to sponsor a neutral CA) but gave up when they found out about the kind of money required.

Secondly, the OEMs and ODMs who make the motherboard wanted anyone supplying a UEFI KEK or db entry to post a bond, also in the six to seven figure range, to indemnify them against anything going wrong with the LF Key.

Given there are quite a few OEM and ODMs, that's more cash than the current Linux Foundation core operating budget and therefore not something that could be realistically undertaken.

to post comments

Bottomley: Adventures in Microsoft UEFI Signing

Posted Nov 21, 2012 17:50 UTC (Wed) by krake (guest, #55996) [Link] (1 responses)

Oh boy!

Seems like the UEFI people didn't a lot of thinking as in considering consequence of their decisions.

Not that it is very surprising given that they are a industry group, but still.

It is quite telling that the Linux Foundation didn't do more publicity on this outrage.

It inevitably leads to the conclusion that all the big corporate members have legal contracts with Microsoft that protects their Linux related business in some way that make relying on Microsoft for access to phyical machines unproblematic.

Anyone else, including smaller corporate members like Red Hat, are left to the wolves.

Good to keep in mind next time some LF,IBM, Intel, etc press release claims that any of those companies is "heavly supporting" Linux.

Bottomley: Adventures in Microsoft UEFI Signing

Posted Nov 22, 2012 0:28 UTC (Thu) by vonbrand (guest, #4458) [Link]

Never, ever forget Hanlon's razor.