Ramblings of an old Doc

Claiming security as the reason, MS’s new OS W8 won’t allow “Dual Boot”. OK, no tragedy, right?

OEM systems shipping with Windows 8 will have secure boot enabled by default to only load verified operating system loaders during boot time. This prevents malware from switching the boot loader, but also other operating systems that are not signed from being loaded. According to the gHacks article I read (among others), this is only a issue for UEFI systems, if you plan to upgrade an existing system with BIOS you won’t be affected by it.

This is the foot in the door. How long will older Bios systems be around, especially when unknowing consumers get the spiel about how much more secure the UEFI systems are?

UEFI is touted as a more secure replacement for the older BIOS firmware interface, present in all IBM PC-compatible personal computers, which is vulnerable to bootkit malware.

While Windows 8 certification requires that hardware ship with UEFI boot enabled, it does not require users to be able to disable the feature (which can be done) and that it does not require that the PCs ship with any keys other than that of Windows. The main problem that the Free Software Foundation (FSF) sees is that Microsoft defines consumers as the hardware manufacturers and not the little guy at the store who actually buys the computer. MS sells OS’s, not computers.  MS is giving the manufacturers the power to decide how to implement the feature. That’s where the problems will come in:

  • Windows 8 certification requires that hardware ship with UEFI secure boot enabled.
  • Windows 8 certification does not require that the user be able to disable UEFI secure boot, and we've already been informed by hardware vendors that some hardware will not have this option.
  • Windows 8 certification does not require that the system ship with any keys other than Microsoft's.
  • A system that ships with UEFI secure boot enabled and only includes Microsoft's signing keys will only securely boot Microsoft operating systems. – M. Garrett, Red Hat

 

This will mean that you are no longer in control of your PC and might well not be able to switch graphics cards, nor hard drives, printers, sound or network cards:  All hardware that would otherwise be compatible with the PC won’t function because of missing signing keys in the OS.

That will be the purveyance of the computer manufacturer and any deal it may have made with MS (and anyone else). Proprietary hardware might see a heyday never before imagined. The opposite for software like OS’s, and perhaps browsers. No one should have the power to determine that for you:

“The UEFI secure boot protocol is part of recent UEFI specification releases. It permits one or more signing keys to be installed into a system firmware. Once enabled, secure boot prevents executables or drivers from being loaded unless they're signed by one of these keys. Another set of keys (Pkek) permits communication between an OS and the firmware. An OS with a Pkek matching that installed in the firmware may add additional keys to the whitelist. Alternatively, it may add keys to a blacklist. Binaries signed with a blacklisted key will not load.

There is no centralised signing authority for these UEFI keys. If a vendor key is installed on a machine, the only way to get code signed with that key is to get the vendor to perform the signing. A machine may have several keys installed, but if you are unable to get any of them to sign your binary then it won't be installable.” – M. Garrett, Red Hat

The biggest problem that will create (besides from a lack of competition) is that the consumer would have to do hours of research as to what hardware and software he or she could use with his or her system, which keys his/her machine has enabled for what. That’s ridiculous. How many people understand Pkek keys and couldn’t change them even if they did. It’s also way too limiting. Arguably, this is in restraint of free trade.

The Free Software Foundation wants people to urge computer manufacturers to enable the keys to allow software such as those for other OS’s and other software to be enabled. I agree, and anticipate you do as well.

What about Stardock’s software? Will you be able to install it? Will it be allowed to work on boot?

“Those who would sacrifice freedom for security soon have neither”, said Ben Franklin so long ago. How right he was. In so many ways.

By the way: Does anyone seriously think the hackers won’t find holes in the UEFI? I promise you they will. Then what will we have?

No security and no freedom.

I recommend you follow Martin Brinkmann's gHack.net website. It is a source of excellent reviews and commentaries.

Source:

http://www.ghacks.net/2011/09/23/windows-8-boot-security-and-third-party-operating-systems/

http://mjg59.dreamwidth.org/5552.html

http://mjg59.dreamwidth.org/5850.html


Comments (Page 6)
9 PagesFirst 4 5 6 7 8  Last
on Oct 27, 2011

Hmmm, the more I see of this Metro animal the more I dislike it.  The guy in the above video just gave me more reasons to avoid it like the plague... like the ugly icons for your installed apps... the fact that grouping is up the shit and scrolling in Metro is not that convenient when you have numbers of apps/items.  Nope, definitely not for me.

on Oct 29, 2011

This anti MS idiocy makes me laugh.  All MS is doing is securing the computer.  They're not demanding OEMs lock out other OSes, and never have.

All they are demanding is that an existing UEFI option (that they did not create) be enabled and usable by their OS, to lock out rootkits getting between the OS and its loading process.  They're not forcing anyone to lock out Linux or any other OS.

Rootkits are the only major security problem left in computers, because they're hard to find, hard to remove, and generally a gigantic pain in the ass.

So if there's anything to complain about, it's the OEMs.  And I'm sure they'll get a lot of complaints.

on Oct 29, 2011

Has anyone thought about this?

Major OEMs have always wanted to lock the buyer into buying hardware from them at inflated prices. This is the way to do it. Any hardware upgrade is Buy New Computer. After all, they have to keep their cash flow going. Systems that have a programmed End Of Life.

Most of us here are enthusiasts and build our own from high quality parts. We want our systems to be robust and last a longer time. This sort of thing won't affect us.

on Oct 29, 2011

Sarissi
Any hardware upgrade is Buy New Computer.
If that was the case, my next purchase would be from a different manufacturer. In the long run, such limitations on upgrading would hurt cash flow, not help it, imo.

on Oct 29, 2011

This anti MS idiocy makes me laugh.

It is not 'anti-MS' idiocy.  The company has made some not so good decisions in recent times [default Metro, dropping the gadgets gallery, for example] and people are not happy with the results.  Besides, MS didn't get to the top by playing fair, and if we trust it implicitly that's when it will most likely take advantage of us.  And no, this is not just another conspiracy theory.  No, not at all!  It's what the large and successful corporations do to ensure survival... they use any means possible to stay on top.

As for this being purely a security thing on MS' part, I doubt it.  Besides, it still hasn't got the implementation of UAC right.  If enabled you're still clocking okay for apps that should be remembered as being safe long ago, and this new measure in Win 8, given MS' less than admirable security record, is likely to be fraught with issues for users and [as the OP suggests] be open to abuses by the OEMs. 

The fact that all hardware and software will require Windows 8 Certification in OEM machines, in itself, can and will be a nightmare for users.  For example, when a part breaks down, which is quite likely given how cheaply and nastily OEM rigs are thrown together, the user will be required to replace it with an OEM part rather than a better, more reliable one of his or her own choosing.  And what about non- MS partner software a user may want/need to run?  If it's not certified by Win 8 then it can't be run, can it, and that, my friend, takes away from the user's freedom of choice.

So no, it's not just some anti-MS thinking, and it's not without merit and some cause for concern.  Simply put, the users of pre-built proprietary machines will have greater mediocrity foisted upon them [by the OEMs AND Microsoft] unless there's a customer backlash... like a boycotting of all OEM machines with Win 8 installed.

Wizard1956
If that was the case, my next purchase would be from a different manufacturer.

If that were the case, the next manufacturer I'd be looking at would be...... ME!!!  If one OEM has gone down the wrong path, from a consumer's perspective, it's likely others will follow or already have... as decreed by Microsoft.

on Oct 29, 2011

starkers
The fact that all hardware and software will require Windows 8 Certification in OEM machines, in itself, can and will be a nightmare for users. For example, when a part breaks down, which is quite likely given how cheaply and nastily OEM rigs are thrown together, the user will be required to replace it with an OEM part rather than a better, more reliable one of his or her own choosing. And what about non- MS partner software a user may want/need to run? If it's not certified by Win 8 then it can't be run, can it, and that, my friend, takes away from the user's freedom of choice.

Got sources for that? There's quite a difference between requiring the bootloader to be signed and requiring *everything* to be signed. MS is only requiring the former for Win8 certification. The latter would require the vendor to take responsibility for providing anything and everything, and that's not something PC vendors are going to do, as it's not not worth the costs.

on Oct 30, 2011

I wish I had your faith, Kryo, but I do not believe that MS or the OEMs are really doing what's best for the consumer.  They dominate and control the market through saturation, their sheer enormity, and consumers of proprietary machines are more or less told to "be grateful for what you get".

The latter would require the vendor to take responsibility for providing anything and everything, and that's not something PC vendors are going to do, as it's not not worth the costs.

Those would be the costs that inevitably are passed on to the consumer... right, and with all these extended warranties they try to sell you these days, it would be of little or no cost to the vendors to lock users into designated hardware/software. 

The thing is, because the majority of PC consumers buy straight off the shelf, expect it just to work and rarely ever think outside the square, the PC market is a captive one, and the vendors know it.  Hence there is no reason for OEMs to lift their game... and if they want to do shit that's not so great for the consumer, they know they can pretty much get away with it, because uneducated sheeple who [thus blindly] buy their machines are not going to complain. 

A case in point, to highlight the nerve, disregard and sheer audacity of the OEMs... all the non-essential and annoying crapware/bloatware they bundle with their systems.  Apart from a few. slightly more educated magazine writers, I have yet to see complaints, enmasse or otherwise, coming from average/off the shelf buyers regarding the practice of installing unwanted and sometimes harmful crap on new PCs.  Yes, harmful crap!!! 

On more than one occasion I've had to get rid of MyWaySearch toolbars [among other things] from brand new, never been used OEM machines.  This particular toolbar has been flagged by the security community as being harmful, yet OEMs still installed it. Then there's the 100's of megabytes of trialware users have to purchase to get any real use from.  It effectively is [free] advertising for other vendors... and in one way or another, users are paying for that crap when they purchase OEM machines,

So no, when it comes to the OEMs doing the right thing by consumers, I am neither trusting or optimistic.

on Oct 30, 2011

starkers
The thing is, because the majority of PC consumers buy straight off the shelf, expect it just to work and rarely ever think outside the square, the PC market is a captive one, and the vendors know it.

 

That's true.

Actually they (OEM's) work on a relatively small markup. That is the truth and it's a rather important part of this pending mess.

They need all the edge they can get (and MS knows this, believe me) so the "Microsoft Windows 9 Certified" becomes a major selling point and the OEM's won't give up any possible advantage. You'll see it happen, so there's no long range thing - probably stating around August 2012 (the latest guess as to W8 release date). Also, the possibility of becoming 'slightly' or 'imperceptably' more propietary is something which shouldn't be ignored (and won't be by the OEM's).

If the product is excellent, it'll have relatively little, if any effect on the consumer. If it's a 'less than ideal' product, then the OEM has a 'locked in' market. No one can afford to switch brands every day, or very few, anyway.

The assertion as to preventing boot sector malware, is a 'partially true'... and not in a bad sense at all. The boot sector and root kits are real baddies and not to be trifled with. The problem with MS's solution to them (and I can accept MS wants it's OS to offer real security) is that by doing so, it will kill the competing OS's.

That needs further looking at since MS has a *certain* rep (as do many businesses). The "secure boot" promises to be a massive legal minefield for MS both here and abroad.

It's also not sound thinking to believe hackers won't be able to hack their way into it. History has shown us the value of such Maginot lines.

The major W8 inspired field to go into isn't IT. Unfortunately it'll be becoming a litigator-negotiator. And that's a shame.

on Oct 30, 2011

DrJBHL
Actually they (OEM's) work on a relatively small markup.

That's when you add in the CEO and upper echelon salaries.  Take them out and the profit margins are reasonably good.... given the cheapest of parts and labour are employed to build these things OEMs call a computer.  For mine, take out the top 5% of any... all of these companies and they will not only profit more handsomely but actually come up with some great ideas that actually empower the consumer rather than hold them back with mediocre products merely operate/just work, not serve the user.

I tell ya what, Doc, I'm so glad you posted this thread... because I've been wanting to vent about this issue for quite some time and just needed a venue to do so.  It just isn't the advent of Win 8 and the proposed 'security measures' that bother me.  Both Microsoft and the OEMs have taken it upon themselves to tell consumers what they want and what's best for them, and I abhor the fact that we as consumers are rarely, if ever. listened to.

Take, for example, UAC in Win 7. Microsoft has has since the advent of Vista to get it right, yet UAC continually prompts for permissions on safe applications that should be on a whitelist by now but are not.  Now I have seen users [and uneducated ones as well as the educated] bitch about this feature... not just since Win 7, but since Vista hit the shelves. 

The other main bitch with MS, is its insistence to force users to facilitate then install things to a 'Public' folder they would otherwise never require or use, I am the ONLY user on my PC, yet I am forced by MS to have, by default, a public set of folders that take up valuable space on my limited SSD.  I can't install skins and other things to an off-site HDD because MS says so.  Where the fuck does MS get off telling me where to store MY shit... on MY effing PC?  For security, bullshit!!!!

As for the OEMs, don't get me started on those fucks.  What they do to a reasonably working PC [can't say perfectly a perfectly working one cos that'd be an outright oxymoron, given the cheap shit they generally put in 'em] is near friggin' criminal, to say the least.  My niece's partner's daughter brought her brand spanking new Dell to me because she couldn't surf the internet as she was normally accustomed.  The reason?  Dell installed a so-called 'browser helper'.... something that searched its way rather than hers.  Let's just say it took me the best part of an afternoon to get rid of it... a MyWaySearch toolbar that, once connected to the internet, more or less took control of search references and where the browser went.

More to the pont, though, is the inferior and cheap parts the OEMs use for their 'off-the-shelf' machines. I can't remember just how many I've had to replace the PSU's in... or just after the warranty expiures, just how many mobos, CPU's and RAM sticks I've had to replace.  I've never seen that rate of attrition in custom or home-builds, So I therefore place the responsibility for these equipment failures squarely at the feet of the OEMs, who clearly have a responsibility to consumers but invariably neglect it to post greater profits.

I'd like to have the positivity and perhaps trusting views Kryo has of MS and the OEM's, but I am a realist who sees these corporations for what they really are... greed driven entities who produce the cheapest and nastiest PC possible and tell people "it's a friggin' bargain at twice the price". 

Sorry Kryo, but I cannot share your optimism or trust in people who clearly have agendas of their own.

on Oct 30, 2011

starkers
So I therefore place the responsibility for these equipment failures squarely at the feet of the OEMs, who clearly have a responsibility to consumers but invariably neglect it to post greater profits.

The only way things will change is through ethical people creating a company that sells a good product at a cost commensurate with the quality of the product... not an Einsteinian conclusion to reach but a utopian one, I'm afraid. Our species just isn't up to it, because if one starts a company, he becomes the judge of what he receives from it. Idealists will say that if he's too greedy the company will go out of business. That doesn't seem to happen, does it? Not judging from what we see in the world.

It's all rather depressing because with the advent of W8 (and MS's OS market share), the precedent of "If you don't create an OS as well as a company to make the OEM's, you're SOL." will be set. Face it, the OEM's have no incentive. The other OS's market share is so small they have no leverage whatsoever, unless they become OEM's as well... and that's no solution. Who's going to buy an additional computer just to run another OS? I wouldn't be expecting the OEM's to be doing much business there.

The BIOS board producers are the only hope, but with the size of the DIY community? The main hope will be the gamers and the emerging markets. For the latter, I don't hold much hope, as they'll fall prey to the same marketing strategy that the West did.

Let's also not forget that the hackers/cybercriminals have had a good deal in creating and contributing to this situation, may they rot in hell.

I figure the game's pretty much over for the small OS's in the desktop/laptop markets except Apple... and even they're being pressured strongly by Asus and Acer.

The MacBook Pro has just recieved serious upgrading of hardware because of this (without a rise in price, incidentally):

[ http://www.infopackets.com/news/business/apple/2011/20111029_apple_upgrades_macbook_pro.htm ]

The only real competition left for OS's is in the mobile market.

on Oct 30, 2011

I wonder how many people will buy Windows 8?

Best regards,
Steven.

on Oct 30, 2011

DrJBHL
The MacBook Pro has just recieved serious upgrading of hardware because of this (without a rise in price, incidentally):

The sad thing is, by the article you linked, the upgraded specs are the same as the HP laptop I recently purchased. The price on the MacBook Pro is $2499.00 and the HP is availible for below $1000.00 which includes sales tax and a 5 year extended warranty.

on Oct 30, 2011

starkers
I'd like to have the positivity and perhaps trusting views Kryo has of MS and the OEM's

The only thing I trust in is their profit motive. Turning every PC OEM into its own walled garden would be extremely cost prohibitive (restriction at the level you describe can't be done by a single signing authority), and thus it is extremely unlikely to occur because prices are already at the point the market will bear. People aren't going to pay more for the same in a poor economy--they'll just buy it at the old price elsewhere.

Now, this sort of thing is already occurring with tablets--I seem to recall hearing Amazon will block Kindle Fire users out of the android market and only allow Amazon market apps for instance. It's only really practical if done from the ground up; for a general purpose machine, the existing software ecosystem is just far too vast for this to work.

on Oct 30, 2011

Isn't HP parting from making PCs? I think I read that on article a while back and I did see it on a Revision3 tech web episode.

on Oct 30, 2011

The BIOS board producers are the only hope, but with the size of the DIY community?

I'll say it again: You DO NOT need a BIOS-based board to run older OSes or to dual boot. An EFI board with signing turned off in the settings will work just fine.

 

It's all rather depressing because with the advent of W8 (and MS's OS market share)... The other OS's market share is so small they have no leverage whatsoever

It's worth pointing out that the market is a bit more complicated than that. MS has to, in effect, compete against themselves, simply because the size of the install base with older versions of Windows with no compelling reason to upgrade. For instance, I believe XP (a ten year old OS) only recently fell below 50%. The market still has to support all of those existing systems, and will most likely continue to do so for at least a decade, regardless what MS does on new machines. Those who do move off XP are moving onto Win7, where they're likely to stay for years to come (business users especially).

 

9 PagesFirst 4 5 6 7 8  Last