Feeds

MS denies secure boot will exclude Linux

Lock-out security tech can be disabled, if OEMs want

Choosing a cloud hosting partner with confidence

Microsoft has hit back at concerns that secure boot technology in UEFI firmware could lock out Linux from Windows 8 PCs, saying that consumers will be free to run whatever they want on their PCs.

Unified Extensible Firmware Interface (UEFI) specifications, designed to reduce start-up times and improve security, allow computers to verify digitally signed OS loaders before booting. The feature in UEFI, the successor to BIOS ROM, is designed as a countermeasure against rootkits and other bootloader nasties.

However computer scientists, including Professor Ross Anderson of Cambridge University, warned earlier this week that the approach would make it impossible to run "unauthorised" OSes such as Linux and FreeBSD on PCs. A signed build of Linux would work, but that would mean persuading OEMs to include the keys.

In addition since the kernel itself is part of the boot process, kernels will also have to be signed, a huge bureaucratic hurdle for developers that runs wholly against the grain of open source software development, as explained in more depth by tech blogger Matthew Garrett here.

If the draft for UEFI is adopted without modification, then systems with secure boot enabled simply will not run a generic copy of Linux. Disabling the feature would allow unsigned code to run. However Garrett argues that since "firmware vendors and OEMs are interested in providing only the minimum of firmware functionality required for their market" this may not be possible, a concern shared by Anderson.

"The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate," he said. Anderson concludes that the approach is even worse than previous attempts to force feed Windows users with DRM technology.

In a blog post on Thursday, Microsoft attempted to address these concerns arguing that "complete control over the PC continues to be available" to consumers.

Secure boot is a UEFI protocol, rather than a specific Windows 8 feature, and "Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows," Microsoft's Tony Mangefeste explains.

"Secure boot doesn’t 'lock out' operating system loaders, but it is a policy that allows firmware to validate authenticity of components. OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform," he adds.

Mangefeste cites the example of a prototype Samsung tablet with firmware designed to allow customers to disable secure boot, an option that is open to OEMs.

Just how many OEMs will take this approach remains unclear. Microsoft has effectively batted the question over to its hardware partners and firmware suppliers. What both Microsoft and critics of UEFI seemingly agree on is that unless secure boot can be disabled then Linux can't be run on Windows 8 PCs.

We asked the UEFI Forum to comment on the issue earlier this week but are yet to hear back from the industry group, which promotes and manages the UEFI standard. Members of the UEFI forum include Apple, IBM and BIOS giant Phoenix Technologies as well as Microsoft. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
Was ist das? Eine neue Suse Linux Enterprise? Ausgezeichnet!
Version 12 first major-number Suse release since 2009
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.