OS and Software > All Things Unix > Windows 8 Secure Boot Would 'Exclude' Linux

The new policy betrays the cynicism of Microsoft's initial response to concerns over Windows 8's secure boot requirement.

It is clear now that opportunism, not philosophy, is guiding Microsoft's secure boot policy.

Before this week, this policy might have concerned only Windows Phone customers. But just yesterday, Qualcomm announced plans to produce Windows 8 tablets and ultrabook-style laptops built around its ARM-based Snapdragon processors. Unless Microsoft changes its policy, these may be the first PCs ever produced that can never run anything but Windows, no matter how Qualcomm feels about limiting its customers' choices. SFLC predicted in our comments to the Copyright Office that misuse of UEFI secure boot would bring such restrictions, already common on smartphones, to PCs. Between Microsoft's new ARM secure boot policy and Qualcomm's announcement, this worst-case scenario is beginning to look inevitable.

F Microsoft confirms UEFI fears, locks down ARM devices

Unless Microsoft changes its policy, these may be the first PCs ever produced that can never run anything but Windows, no matter how Qualcomm feels about limiting its customers' choices.

I think OEMs see that sticker as a big deal. Look at the crap that gets "Wind X Certified" stickers put on them.

I think OEMs see that sticker as a big deal. Look at the crap that gets "Wind X Certified" stickers put on them. Monitors, mice, keyboards, all sorts of nonsense that just conforms to a standard and isn't built for any specific OS.

Why UEFI secure boot is difficult for Linux by Matthew Garrett of RedHat.

quote:

---

In this scenario, the signed Linux kernel is simply used as a malware loader. The only sign that anything is wrong is that boot will be slightly slowed down.

Signing the kernel isn't enough. Signed Linux kernels must refuse to load any unsigned kernel modules. Virtualbox on Linux? Dead. Nvidia binary driver on Linux? Dead. All out of tree kernel modules? Utterly, utterly dead. Building an updated driver locally? Not going to happen. That's going to make some people fairly unhappy.

---

This is a great read and I encourage anyone interested in this topic to read it.

We can write the code required to support secure boot on Linux in a minimal amount of time - in fact, most of it's now done. But significant practical problems remain, and so far we have no workable solutions for any of them.

I wonder what a reasonable solution is to it.

My question was specifically, how can we have secure boot and be able to perform mass remote installs....

I would very much like to put the Ubuntu key in my BIOS and feel safe that my PC is not booting anything I didn't authorize.