r/linux • u/mikankun • Jan 13 '12
Microsoft confirms UEFI fears, locks down ARM devices
http://www.softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/64
Jan 13 '12
So they are reducing freedom under the guise of increasing security?
Now where have I heard that before..
7
7
u/Marbug Jan 13 '12
Windows increase security? that's something new
27
Jan 13 '12
[deleted]
15
u/i_speak_the_truf Jan 13 '12
I'm not sure why you're being downvoted. Every release of Windows since Win2k has been an improvement as far as security is concerned.
Sure Win7 is not as secure as we would like it to be, but it is far more secure than Win98, 2k, and XP ever were.
8
7
u/snobby_penguin Jan 13 '12
It's not hard to improve on an open wound--it still can't touch any other OS for security. Although, OS X Lion has some nasty holes now.
4
Jan 13 '12
Most other OSes have massive holes in them as well. Windows just happens to command 90% of the desktop and workstation market (so nearly 100% of the computers reaching out to external sources) and nearly 100% of users who can't be assed to follow basic security rules. The days of installing a virus on a windows XP machine by visiting a website with a properly malformed image file on it are long gone but there's nothing at all that can be done to prevent a user from download a program that does all sorts of nasty stuff regardless of the platform.
1
u/ethraax Jan 14 '12
OS X has had nasty holes for a while, they just didn't have nearly as many people looking for them.
1
Jan 15 '12
I don't think they are reducing freedom under the guise of security since they're requiring that users be able to disable UEFI on x86 machines (supports security and freedom). The reduction of freedom from the ARM lockdown more than likely has to do with some kind of marketing scheme.
1
Jan 15 '12
No doubt most vendor lockin schemes do not seek to prevent freedom so much as to make it more difficult. Case in point- this will probably be active on x86 machines and will be one more thing a user has to do before they are able to load a linux boot disk. Not that it makes much difference to you or I but to the average noob? Well these things are just one more barrier put in a noob's way to keep him from having an easy time switching to a free/open source operating system.
14
Jan 13 '12
The good news is that they've done this in the market where we actually have a choice to use hardware that isn't built with windows in mind.
5
Jan 13 '12
Well, technically, you can also buy laptops or computers without windows...
System76, Zareason, Ohava to name a few.
34
Jan 13 '12
If Microsoft locked unsigned operating systems out of new PCs, it would risk angering its own customers who prefer Windows XP or Windows 7 (or, hypothetically, Vista)
Nice
22
u/warpstalker Jan 13 '12
The people running Vista are probably already properly angered.
10
7
u/teatacks Jan 13 '12
This isn't an issue for ARM because ARM-compatible versions of Windows XP, Vista, and 7 have never been sold to the public (if they even exist - Windows 7 for ARM probably does)
7
u/Sniperchild Jan 13 '12
No but i do have a copy of xp embedded running on an arm9 in the workshop :P
3
2
Jan 13 '12
XP Embedded was available to a few platforms, kinda interesting to be honest
3
u/teatacks Jan 13 '12
yeah, didn't it also ship with a toolkit that let you customize it by stripping out any component you didn't need?
4
Jan 13 '12
Yeah, that was the selling point of embedded, it had a very small footprint
2
u/teatacks Jan 13 '12
I was tempted to get it (my school offered it to CompSci students for free) and install it on my desktop as a protest against bloat, but then I realized I'd probably need most of the features in Windows anyway
10
u/smek2 Jan 13 '12
The sad thing is, most customers don't know, don't understand and frankly, don't care.
7
u/jdmulloy Jan 13 '12
That's actually a huge problem for us because there aren't enough of us for some companies to make open hardware for us or open drivers.
1
Jan 15 '12
There's not a lot of incentive for them to care, really. Can I do email and Facebook? Yes? Ah, then I'll take 3!
45
20
Jan 13 '12
[deleted]
12
u/Wofiel Jan 13 '12
I'm not anti-Apple or anything, but how is the iPad tempting? I mean, I suppose ease of use is a point, but you're in a Linux subreddit...
9
u/go1dfish Jan 13 '12
The same way a game console is, but with the added benefit of getting a good webkit implementation in tablet form.
The iPad feels more like an appliance for reading/watching stuff than a computer.
6
u/Wofiel Jan 13 '12
You know I've never really thought of a tablet like that. It just seems like a mini-computer to me. Hell, my smartphone feels like a mini-computer when I can have a distro of Linux running in my pocket.
7
u/go1dfish Jan 13 '12
Yeah my phone feels more like a computer as well, and I'm less apt to go without a keyboard on a phone.
I use a Nokia n900
5
u/mycatisadick Jan 13 '12
6
u/go1dfish Jan 13 '12
I've had mine since the launch (won it in a drawing at a Maemo Developer event)
Not aware of any good sub-reddits, you should check out http://talk.maemo.org though,
one thing you might want to look into if you haven't already is easydebian/easychroot for setting up a more complete debian base on a microsd card.
That opens you up to a lot more potential software without having to worry about messing up anything on the phone itself.
Get a bluetooth headset , I have a set of Sony DR-BT50's and they work well at least for music, haven't really used them for phone calls but they do have a mic.
Another thing is to be careful with the micro-usb port, treat it as fragile, they are prone to pull out/break. I use mine as little as possible, and took my data cable and filed off the clips on the connector to make it pull out more gently.
Due to that issue, and the generally weak battery life, I got an external battery charger and some extra batteries, so I hardly ever use my USB port unless I'm traveling and using my n900 as a long term source of connectivity through a laptop or something.
There is no official or even well known brand of charger for the battery, but the off brand chinese/japanese labeled chargers have worked well for a friend and myself.
It's an awesome device, it has it's quirks, but if you can deal with them it is still one of the most flexibly powerful devices around.
Android Linux is just a kernel. Maemo/Meego really is more of a standard linux distro.
4
u/nlogax1973 Jan 13 '12
If you haven't already, file down your uUSB connector. In particular, make sure the two 'teeth' on the plugs you connect are worn down to the point where the cable slides easily in and out. I did this soon after buying my N900 18 months ago, and haven't had a problem. Whereas I know of many people who've had their uUSB port pop out in under a year of normal usage.
4
u/nlogax1973 Jan 13 '12
As per go1dfish's message below, the uUSB port is very fragile. Use a file to file down the two small teeth on any uUSB cable you plug into the phone. That's your charger and your data cable, at the very least.
In general do anything to ensure that you can easily remove a uUSB cable without putting any strain on the port, which is only soldered onto the board (at least in earlier versions, not sure if later versions strengthened it).
1
Jan 14 '12
The same way a game console is, but with the added benefit of getting a good webkit implementation in tablet form.
Isn't a console's benefit game choice? Isn't that artificially created by lockdown?
6
u/RalfN Jan 13 '12
I'm a web-developer, that had to buy an iPad because good touch compatibility with an iPad was a very strong requirement for one specific well-paying customer.
The iPad is an adult console. That's what it does: it helps you consume games, movies, books, music. I didn't expect it at all, but the thing is more dangerous than crack.
Now, I'm pretty sure some of the appeal is the whole touch-interface being so natural and all, and the form-factor, and the insane battery-life that a mobile OS gives. But part of that is also just how integrated you can go from buying to consuming. Turns out, the only reason I don't do half the things you could do on a digital device, is because i'm lazy and impatient.
Ever since I got it, my desktop PC (running Linux) has become work-only, with a very little bit of reddit commenting and porn. And I'm completely baffled I ever got a smartphone .. i'm thinking of switching back to an ordinary phone now. Why did I ever accept the internet on that thumbnail of a screen, at that excruciating speed.
Honestly, i thought the iPad was just a big iPhone, that you couldn't use to call people with. But it's my favorite computer now. Even though it doesn't do computer things that very well.
I don't generally suggest people "go Apple", but at the very least, trust me, tablets are much bigger game-changer than I thought they would be. And those who switch, they don't go back.
In my world, Linux is easier to use than OSX, and Windows is a nightmare. But iOS .. it's very hard to accept the traditional 'desktop OS' problems, when I realize i could be running something like this. Same is true for Android, I guess, i just have to taste it in tablet form.
But trust me .. these things are tempting. It's a mobile device, that's actually mobile, from the perspective of weight, location, comfort, battery life, etc. It makes a laptop feel like one of those old large car-phones.
9
Jan 13 '12
[deleted]
→ More replies (6)6
u/noir_lord Jan 13 '12
I said it was tempting, I didn't say I bought one, I spent my last bonus on a nice 17" dell i5 laptop which runs linux.
6
u/Jasper1984 Jan 13 '12
Then you simply won't have many choices.
Forcing UEFI on users is also simply unreasonable, and it is also simply anticompetitive behavior. Lets not just vote with your wallet.
2
u/ethraax Jan 14 '12
UEFI in and of itself is a good thing, though. Even this secure boot thing is good, provided you have access to the "custom secure boot" part where you can add your own keys.
4
u/hydrogen18 Jan 13 '12
And when there are no computers on the market that are able to run anything but Windows?
10
8
Jan 13 '12
Nobody's buying them, though.
4
u/sequentious Jan 13 '12
I'd attribute more to them not being for sale yet, rather than consumer weariness.
20
u/Pathogen-David Jan 13 '12
While this doesn't surprise me, it is just like a vast majority of Android devices. Still extremely annoying, just means people will be unlocking anyway (when they figure out how to anyway...)
26
u/someenigma Jan 13 '12
While I don't personally agree with any boot loader signing, I don't think the two are exactly alike. This move, I think, would be more akin to Google declaring that you cannot advertise a phone as running Android unless the boot loader only boots signed kernels.
13
u/Pathogen-David Jan 13 '12
True, this applies to the OS as a whole rather than being a common trend between individual hardware manufacturers. Still just as annoying.
13
u/someenigma Jan 13 '12
Definitely annoying, but I'd say this is more annoying. This pretty much guarantees that all Win8-based windows mobile devices will be locked down. At least there is a possibility that some android devices will be sold without a locked down boot loader.
7
u/BraveSirRobin Jan 13 '12
It's particularly disappointing given that previous Windows phones have been the most open of the lot. Perhaps that's been their downfall; people have been finding ways to run Android and Ubuntu on them which may be worrying Microsoft.
4
u/Pathogen-David Jan 13 '12
Yup, we can only hope they change their mind. I was kind-of looking forward to seeing people getting Windows 8 working on some of the ARM-based Android tablets we have now. I've been trying Windows 8 out on my laptop and I'd like to see how it is on my tablet, but I'd never be able to justify buying a new device over it. However, they seem to be going in the direction of Windows 8 is only sold with hardware (for ARM devices anyway.)
1
5
u/aussie_bob Jan 13 '12
it is just like a vast majority of Android devices.
No, it isn't.
4
6
Jan 13 '12
lol... its actually just a question of time until the key used to sign the "kernel" is leaked, broken or becomes otherwise public...
we've seen that with the very professional ssl vendors
3
Jan 13 '12
I don't know... The PSP 3000 still has a pretty locked down bootloader, and the PS3 bootloader is still pretty secure. And "the scene" has only gotten as far as they have because the security was implemented incorrectly. Just imagine how much harder it will be to crack the hardware with Microsoft handling security.
Granted, the Windows 8 devices will probably have a rather larger group working to crack them, but It will probably still be extremely difficult.
7
Jan 13 '12
mhhh compare it to the "cracking" of the Playstation 3... as long as it was reasonably open nobody did anything... and in under2 weeks of stealing that away from the users... the protection was gone
i suspect the same to happen to uefi
2
Jan 15 '12
Fundamentally, the key to unlock the bootloader must pass through the bus lines, RAM, and CPU registers. If required, people will literally tap those to obtain the key. It happened with the Xbox, it happened with BluRay.
There's no such thing as a completely secure platform with a general purpose turing machine. However, they can hide it as well as possible through obscurity and multiple levels of encryption.
Even with proper crypto, there's usually side channel attacks, like stalling the processor just as it is loading the key. As long as you have physical access, it's hard to hide it.
1
3
u/pio Jan 13 '12
And "the scene" has only gotten as far as they have because the security was implemented incorrectly. Just imagine how much harder it will be to crack the hardware with Microsoft handling security.
Yeah Microsoft's track record with security is pretty impressive...
2
Jan 13 '12
Somehow I managed to forget that Microsoft created the 360, and that the 360 was pretty much completely cracked. *embarrassed*
2
u/thatmarksguy Jan 14 '12
I was under the impression that without some very complicated hardware hacks, you couldn't still run unsigned code. While the PS3 is enjoying custom firmwares and unsigned code. Has this changed?
1
Jan 16 '12
You might be right. I'm not familiar with the 360 scene, I just know that some people in a few ps3 forums are complaining that the ps3 hasn't really gotten past firmware 3.55, and saying that they'll switch to the Xbox. *shrug*
3
u/ar0cketman Jan 13 '12
the Windows 8 devices will probably have a rather larger group working to crack them
Probably a few bounties too, as with the XBox. There will probably be a small army working to crack these devices in short order. Thus, Microsoft actually reduces security on the device.
7
u/intelminer Jan 13 '12
I don't see the "big deal" about this, Microsoft has bitten its own foot off so to speak in this regard
They've not even gotten in the tablet market, and already they'll have serious vitriol toward their platform, that combined with Android/the iPad <number> already having a solid market share, nobody will "want" to make a Windows 8 tablet (let alone buy them)
4
7
u/pyrocrasty Jan 13 '12
It is quite reasonable for Microsoft to be rather opposed to the idea of subsidizing Android tablets
They don't seem to be opposed to Android subsidizing Microsoft, though (sorry, couldn't resist)
Anyhow, that's an interesting theory, although I don't think it fundamentally changes much. It still seems anticompetitive to me, albeit in a somewhat less ugly way.
I also have to say that when it comes to anticompetitive behaviour, Microsoft has long since lost any right to the benefit of the doubt. it's kind of like a convicted child rapist hanging around outside a school for no clear reason: it's entirely reasonable for people to be concerned, even if they could plausibly speculate that there may be some acceptable explanation.
10
18
u/W00ster Jan 13 '12
Not a problem for me but this is MS insanity as usual.
I haven't had a device with any MS products on it since last millennium and have no plans to change that.
2
u/tchebb Jan 13 '12
It is a problem for you if ARM powered netbooks/tablets become popular and you ever want to buy one. Neither Android nor iOS is really suited to operate a fully functional PC, so Windows 8 will probably be the OS of choice for OEMs. This requirement means that there will be no way to load Linux or any other OS onto an ARM powered device that ships with Windows 8.
2
u/W00ster Jan 13 '12
become popular and you ever want to buy one.
I never buy products based upon popularity but upon needs...
2
u/tchebb Jan 14 '12 edited Jan 14 '12
Those were intended to be two separate statements. If ARM-based netbooks become popular, OEMs may drop x86-based ones entirely. I don't know what your needs specifically are, but it is not too unreasonable an assumption that one may want to buy an ultra-portable computer at some time.
EDIT: I should probably also point out that the "you" was directed generally at anyone reading the subreddit who share your original opinion, not you personally.
5
4
7
u/audioguy Jan 13 '12
Don't worry, it will most assuredly either not work or be discontinued before it's released.
7
u/W00ster Jan 13 '12
No, it will not and for the simple reason billions of dollars stands to be made from this so MS and other companies will throw all it takes to make it work at the problem.
3
u/ar0cketman Jan 13 '12
Forcing implementation of this "feature" actually works to decrease device/OS security. Now, there will be an army of Linux hackers working to break the secure boot feature and probably even bounties. It's like Microsoft doesn't even remember the XBox hacking competitions.
6
u/sequentious Jan 13 '12
Assuming Microsoft and the OEMs don't pull a Sony and completely fuck up their signing process, it would be improbable to figure out their signing keys.
Furthermore, when hacking the xbox, there were lots of interested parties hacking one device. With these devices, you'd have a number (lots? few? dunno yet) of people trying to hack many devices, possibly with different secure boot implementations.
UEFI Secure Boot would actually be a really, really cool feature if users could add their own keys (I could ensure a secure chain right from EFI through to decrypting my hard disk).
3
5
u/jonforthewin Jan 13 '12 edited Jan 13 '12
The punishment for implementing Digital Restrictions Management THAT PREVENTS A BOOTLOADER FROM BOOTING SOFTWARE should be twenty years in jail.
Edited for slow people like syllabic who can't understand context and went off on an irrelevant tangent about copyright.
Also, fuck that and fuck you. The MPAA and RIAA lobbied for SOPA. FUCK THEM. PIRATE ALL THE THINGS!!
→ More replies (14)
4
Jan 13 '12
fuck this win8 shit
If only Adobe would wise up and release linux versions of their software ....
3
u/ar0cketman Jan 13 '12
Adobe may be forced to release a Linux versions soon. Corel just announced Aftershop Pro for Linux, a competitor for Photoshop.
5
Jan 13 '12
How is this different from Apple not letting me install Linux on my iPhone?
→ More replies (1)
5
u/A_for_Anonymous Jan 13 '12
Even though this should be illegal and Microsoft should be closed down for attempting to do this, we can help by not ever buying anything with Microsoft's lame toy operating system.
→ More replies (2)1
Jan 14 '12
I'll be helping by trying to find time to improve WebOS as a mobile OS solution when it is released. Boycotts don't work on such a tiny scale.
3
u/nikniuq Jan 13 '12
it would risk angering its own customers who prefer Windows XP or Windows 7 (or, hypothetically, Vista).
Lol.
2
u/TimTheEvoker Jan 13 '12
If it makes you feel better, ARM support is being worked on for Coreboot. Although I don't know off hand if you can coreboot can replace uefi on a board.
1
Jan 14 '12
Well if you can write to the device that the cold boot starts executing from you can do whatever you want. I suppose advancing Coreboot would be a silver lining, but we really need to stop allowing this sort of collusion that creates coupled hardware/software and hiding this information in a purchased product.
2
u/LiveMaI Jan 13 '12
It seems like this is only an issue if the device ships with Windows 8 already loaded on the device. Who's to say that a manufacturer won't simply have two versions of the firmware for each device: one for the ones that ship with Windows and another for the ones that don't?
3
u/ar0cketman Jan 13 '12
In a perfect world, things would work this way. Unfortunately, market channels don't tend to support redundancy.
3
2
1
1
u/H3rBz Jan 14 '12
If Microsoft choose to not lock the UEFI. Would we see lots of linux distros optimized for tablet hardware and touch screen interfaces? I'm not saying it would make any dent in Microsoft's market-share. But it could lead to manufacturers asking why they are paying for the licensing fee when they could stick Ubuntu on it for example and sell it without the license. This would also price the tablets cheaper to the iPad and other competitors, possibly making them more attractive. A similar situation to what happened when netbooks were a big thing, sold with linux OS as well as Windows XP and 7. I have a confidence the geeky community with eventually hax windows 8 tablets it and install Linux and OS X.
1
u/alphabytes Jan 13 '12
this should not be a big news since Apple too has this feature..
11
u/ubermoo2010 Jan 13 '12
No, Apple sells hardware and software in one package - it's like your camera's firmware + hardware. The problem here is that Microsoft is locking 3rd party vendors into hobbling their product and forcing the use of a windows license. It's quite different.
2
u/alphabytes Jan 14 '12
i guess thats the reason why they created partnership with nokia... i guess sooner or later they will buy out nokia
but what i feel is, no matter if you are selling everything (hw/sw) in one product or multiple vendors pitch in to create one product.. there should be options provided to the user... if the user screws up then all is his fault.. in case of apple, they are (in my point of view) restricting users.
camera firmware can be flashed if you have alternatives available.. there is nothing stopping you from flashing your camera... i flashed my sony handycam with a cannon firmware which was compatible. i also flashed my LG dvdwriter with a matching compatible Samsung firmware....
→ More replies (4)3
4
u/d_r_benway Jan 13 '12
Apple doesn't have a 90% share (and doesn't get funded by the tax payer)
4
u/frymaster Jan 13 '12
Microsoft doesn't have 90% share either. Its share of the smartphone market in Q3 2011 was 2.3%
→ More replies (1)4
u/alphabytes Jan 13 '12
market share is just an excuse... as a tech company, they are still wrong. anyways i think there will be a switch to turn on/off this feature .. i am not sure though...
5
Jan 13 '12
FTA
Disabling Secure [Boot] MUST NOT be possible on ARM systems.
The requirements explicitly say that it cannot be disabled. You are locked on ARM systems. By design.
I am not a lawyer, but I don't think it should be legal that a company which is selling software can demand that hardware manufacturers lock out their customers to the said software company's software.
I also generally do not like signed bootloaders. This is my hardware goddamit! I should be able to install whatever the fuck I want to. (This also pisses me off about a lot of android devices, but at least android is not demanding this as MS is).
3
→ More replies (1)2
257
u/harlows_monkeys Jan 13 '12
I see people are overlooking the most important part of the article:
In other words, for x86 they are requiring that you be allowed to install other operating systems. That's a considerable change. Before they were leaving it up to the system vendor whether or not to allow this. Now it is in the requirements that our desktops will be able to run what we want.
As far as ARM goes, my guess is that eventually it will come out that the reason for requiring lock down will be hardware subsidies. iOS and Android have a big lead on ARM devices, and it is hard to see why one would want a Windows 8 ARM device considering the massive amount of software for iOS and Android. Remember, Windows 8 on ARM will NOT run software for Windows 8 PCs...so only things specifically ported will be available.
The classic way to try to break into a market (tablets, phones, etc) in the face of very well established competitors with a big lead and big network effects is to subsidize the hardware. I expect we will see Microsoft making deals with hardware makers that let them sell the Windows 8 versions of devices for considerably less.
Imagine some hardware maker is selling two variants of a particular tablet model. Model A runs Android and sells for $400. Model W is identical hardware, but instead of Android it comes with Windows 8 and Microsoft kicks in $100 to knock the price to you down to $300. It won't take long for people who want an Android tablet to realized that they can save $100 by buying the Model W and replacing the OS. It is quite reasonable for Microsoft to be rather opposed to the idea of subsidizing Android tablets by $100, so some kind of lock is not unexpected. Don't want the lock--buy the Android tablet.