'Stop-gap' way to get Linux on Windows 8 machines to be issued
You'll still be able to pick up a Penguin
Free whitepaper – Enabling efficient data center monitoring
The Linux Foundation is temporarily supporting a Microsoft security policy to ensure Linux isn’t blocked from running on PCs installed with Windows 8.
The Foundation plans to obtain a Microsoft key to sign a pre-bootloader from core Linux kernel maintainer James Bottomley. Together, the key and pre-bootloader will allow users to start up and run Linux as an authorised piece of software on Windows 8 PCs – it would otherwise have been barred by the machine as potential malware.
The pre-bootloader will allow you to install Linux from CD, DVD or via download and will be made available from the Linux Foundation’s website once it has a Microsoft signature.
A Microsoft-authorised key is a stop-gap measure until Linux distros devise their own ways to work with the Windows 8 Unified Extensible Firmware Interface (UEFI) secure boot.
Bottomley announced the key and pre-bootloader here and here, saying: "The pre-bootloader it [The Linux Foundation] is releasing as a stop-gap measure that will give all distributions time to come up with plans that take advantage of UEFI secure boot.”
He said the Foundation also welcomes the work of Fedora, SuSE and Ubuntu towards allowing Linux to boot on Windows 8 PCs via Microsoft’s UEFI secure boot.
Tech blogger Matthew Garrett first discovered UEFI secure boot would block Linux on Windows 8 PCs back in 2011. Professor Ross Anderson of the Cambridge University Computer Laboratory and a security and privacy commenter blogged that UEFI secure boot was worse than previous attempts to push Digital Rights Management on Windows users and warned it could extend Microsoft's operating system monopoly.
Demonstrating how seriously Windows and Windows Live president Steven Sinofsky took the growing concern, he issued a rare blog response denying UEFI secure boot would prevent Linux from installing by "locking out" operating system loaders. He tried said consumers would retain complete control over their machines.
The fact is, though, that Microsoft will only give PC makers access to the Windows 8 OS if their PCs' UEFI firmware uses Secure Boot. This mechanism will only recognise code that has been signed with a digital key recognised by the motherboard's firmware.
Software which tries to modify the start-up process, is not recognised or which tries to bypass the key, won’t be allowed to install – in theory, at least.
The idea is to stop the installation of malware – but inevitably means that Penguins will need to install a distro which ALSO has a key that is recognised through the UEFI boot.
Microsoft is permitting user-generated keys on x86 PCs but on ARM systems, customised keys are forbidden and only a limited set of keys will be recognised.
According to Bottomley, here, the Foundation’s pre-bootloader works on x86 but should work on ARM, too.
Canonical will generate its own private key for signing code that loads Ubuntu while Fedora is using the GRand Unified Bootloader 2 (GRUB2) from the GPL – its boot-loader key will be signed by Microsoft under a service from Verisign. ®
COMMENTS
Re: @HMB - let me get this straight
"Not quite straight! Microsoft will allow (but not require!) computer OEM to allow users to disable secure boot on non-ARM platforms and we all know how independent manufacturers are from Microsoft"
If you're going to correct someone, you should be correct. HMB has it right. It is a requirement that PC providers allow users to disable Secure Boot. The Reg. article or Linux Foundation are spreading FUD. Here is the relevant document:
MS Hardware Certification Requirements. Because it's a long document, the part to skip to is the section on UEFI Secure Boot (begins page 118). The relevant paragraphs I have quoted below:
"17. Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:
a. It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx), which puts the system into setup mode.
b. If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system is operating in Setup Mode with SecureBoot turned off.
c. The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults.On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled.
18. Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems."
!--End Quote.
Now, let's see who downvotes a post for putting factual information with a source.
Linux as an authorised piece of software on Windows 8 PCs
One word: What The F***!
Do we have any intelligent politicians?
When you buy a Mac it is made by them and you expect their OS. That's fair.
Microsoft don't make any PCs so it should be illegal for their OS to be paid for in the purchase price.
Why not have it like shareware? At initial boot-up get the option* to pay $60 to use Windows or $1 to use Linux.
*maybe a one week free trial before paying.
Sorry if I have said this before but it needs repeating until someone in power does something about it.
This is a bad case of a monopoly gone wrong.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Enabling efficient data center monitoring
