- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Correction on Secure Boot Article
In Linux Has Not Won, Microsoft is as Dangerous as Ever, Fie on Secure Boot I incorrectly described how the Secure Boot Platform Key works. A reader gave me the correct description: Quoting: The platform key is the firmware vendor's key. Each motherboard will have a platform key controlled by the firmware provider. That key is used to sign the actual SB keys packaged with the system at ship time. Microsoft has no involvement in that at all, except to ask the vendors to sign their key. If the mobo vendor wants to include Microsoft's key, they put it in the list and sign it with the platform key. If they want to include anyone else's key - as well as or instead of Microsoft's key - they put it in the list and sign it with the platform key. The firmware vendor controls the platform key, not Microsoft. The presence of a platform key is an inevitability of any design based around signatures, not a Microsoft plot. The concept that the single platform key controlled by the firmware vendor is used to sign *multiple* OS vendor keys is expressly designed to allow multiple keys to be trusted 'from the factory', precisely the opposite of what you suggest in the article. So it is not correct to call it a Windows Platform Key, because there is no such thing. It is important to get this right because it is fundamental to how Secure Boot works. |
|
|
Comments (6)
In that scenario,
what prevents the Linux Foundation from issuing their keys and request signature and inclusion from firmware providers ? There are not thousands of firmware providers and the LF is well known and respected. I guess they already thought at it, now what stopped them ???
The Linux Foundation does not release distributions, each individual project releases its own. That is hundreds of keys, not one set.
The firmware providers are not going to sign a key from the Linux Foundation that the Linux Foundation would give to anyone who wants it ... there is no "chain of trust" there, and the firmware providers might as well not even have the feature in the first place if "everyone" can gain access to the key. Bad guys also know how to download things off the internet and use them too. :)
The firmware providers are not going to sign a key from the Linux Foundation that the Linux Foundation would give to anyone who wants it ... there is no "chain of trust" there, and the firmware providers might as well not even have the feature in the first place if "everyone" can gain access to the key. Bad guys also know how to download things off the internet and use them too. :)
hughesjr wrote:The firmware providers are not going to sign a key from the Linux Foundation that the Linux Foundation would give to anyone who wants it ... there is no "chain of trust" there,
Now we are finally getting to the key point here. Carla, your retraction should not be so apologetic. It is really all about who controls the platform. A firmware vendor can establish a platform key and with it "trust" Microsoft. Then Microsoft "trusts" Red Hat, Canonical, and maybe if it feels like it, the Linux Foundation.
"trust" = control
The control of the platform flows through Microsoft.
By the way, if the firmware vendors are "trusting" only Microsoft on their Windows 8 platforms then it is a moot point whether the firmware vendor or Microsoft is providing the key. Microsoft has put itself squarely in a position of platform control.
So there's only one non-optional way out : don't buy PCs with Win8 logo, they are designed for Win8 and they don't care about the rest. It's easy for desktop PCs, less for laptops, the more so if we want a laptop with AMD CPU and Radeon graphics. Now if we don't do CPU intensive work, a tablet with keyboard like the Pengpod would do. Perhaps the tablet is the future for 'desktop' linux, as per MS will ! Don't know.
I am fortunate enough to have enough quad core boards and chips stockpiled to last my lifetime. Myself, I can never see any need for a computer that has more than a quad core running at 2.8 per, and 8 gigs of RAM. Of course, the alleged quote by Bill Gates that "640K ought to be enough for anybody" proves out just how fast technology moves and I could be wrong.
But in the event I do ever have to buy a computer, it will be from a trusted Linux machine distributor.
Ultimately, it's not us who are going to pay the price, but the uninformed or the "Meh, I need Windows" crowd. As far as I am concerned, once people like that are educated and they still purchase a locked-down computer, then good enough for 'em. We can educate those in our circles and that might help, but I don't like the trend I am seeing now. People are not reacting well to Windows 8...unfortunately, there are no marketing efforts per se to let them know they have a choice, outside of Mac...and I don't see a lot of TV marketing for them these days anyway.
But in the event I do ever have to buy a computer, it will be from a trusted Linux machine distributor.
Ultimately, it's not us who are going to pay the price, but the uninformed or the "Meh, I need Windows" crowd. As far as I am concerned, once people like that are educated and they still purchase a locked-down computer, then good enough for 'em. We can educate those in our circles and that might help, but I don't like the trend I am seeing now. People are not reacting well to Windows 8...unfortunately, there are no marketing efforts per se to let them know they have a choice, outside of Mac...and I don't see a lot of TV marketing for them these days anyway.
Linux in general
I think it is disgraceful the way computing end users are being treated. It is obvious Microsoft are leveraging their power on motherboard manufacturers/vendors. It should be simple to install whatever OS you prefer on any system without having to jump through hoops. An OS should be written in such a way as to make it virtually impossible for virus programs to attack. If as a company you are unwilling to do so, you should be fined heavily for producing a substandard OS. Instead, the battle against viruses is placed unfairly on computing device users, many of whom do not have the expertise needed to understand the vulnerabilities of using one OS versus another. In my opinion this is an IT industry goal. These corporations want it this way. All the average end user want's is access to their email, and perhaps some browsing on the web. This should not require the installation of expensive software suites to protect them while connected to the http://WWW. Vast SW corporations have a lot to answer for. I have experience in the I.T. industry, and have worked for companies deploying various OS's. To date the safest most hassle free environment for me is GNU/Linux. My sole decision in this respect was anti virus protection from the get go, ease of use, and most importantly, the ability to simply set up the system to behave the way I want it to, not the other way around.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post