Linked by Thom Holwerda on Fri 23rd Sep 2011 22:22 UTC, submitted by kragil
The story about how secure boot for Windows 8, part of UEFI, will hinder the use of non-signed binaries and operating systems, like Linux, has registered at Redmond as well. The company posted about it on the Building Windows 8 blog - but didn't take any of the worries away. In fact, Red Hat's Matthew Garrett, who originally broke this story, has some more information - worst of which is that Red Hat has received confirmation from hardware vendors that some of them will not allow you to disable secure boot.
Thread beginning with comment 490718
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Member since:2011-01-28
benayed,
"Grub or LILO bases boot loaders would allow regular non signed kernels to boot. This is after getting the keys through reverse engineering and all more or less in a similar fashion like the DVD scene played out through DeCSS."
This is a misunderstanding of the public key cryptography involved. Reverse engineering may reveal bugs in the bios which might be exploited, however all the keys present in the firmware are public knowledge. Even if the firmware is completely open source, it would not help break the private keys.
DVDs on the other hand are not cryptographically sound because the encryption keys used must be accessible on the end user device (otherwise the DVD would not play).
"2) legally through the anti-trust process."
Maybe someone with a legal background can provide some legal insight?
"On my side, personally, I would refrain from purchasing any PC motherboard or laptop that does not allow disabling this feature."
Same here, but we'd be such a minority that the large OEMs may not take notice. The key is to get the major media to pick it up.
RE[2]: Bootloader anyone ?
by matthewp131 on Sun 25th Sep 2011 18:58
in reply to "RE: Bootloader anyone ?"
Member since:2011-09-21
RE[2]: Bootloader anyone ?
by lemur2 on Sun 25th Sep 2011 23:51
in reply to "RE: Bootloader anyone ?"
Member since:2007-02-17
DVDs on the other hand are not cryptographically sound because the encryption keys used must be accessible on the end user device (otherwise the DVD would not play).
Correct. Linux, for example, does not use DeCSS software to play DVDs, it uses libdvdcss.
DeCSS used a "stolen" player key, it was stolen from the Xing software player I believe. This strategy is arguably illegal.
libdvdcss does not use a stolen player key, but rather it reads information from the DVD it is attempting to play, and from that data it calculates a list of possible keys. All of the possible keys are tried until one which works for that DVD is found.
The situation with UEFI secure boot is that the keys will be stored in secure storage on the motherboard, and they will not be accessible to the boot loader.
In order to boot the boot loader must in effect know one of the signing keys, because no method similar to that used by libdvdcss will be possible. Any work-around will have to be similar to DeCSS, which is to say it must use "stolen" keys. This will probably be in violation of the DMCA, and therefore illegal.
News
Linked by Thom Holwerda on 05/23/13 23:22 UTC
"Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues."
Linked by Thom Holwerda on 05/23/13 22:04 UTC
"Google is facing a new antitrust probe by the U.S. Federal Trade Commission into whether the company is using its leadership in the online display-advertising market to illegally curb competition, people familiar with the matter said." Sucks to be Google today, apparently.
Linked by Thom Holwerda on 05/23/13 22:01 UTC
"In the midst of the major press blitz surrounding its annual I/O Conference, Google dropped some unfortunate news about its instant messaging plans. In several places around the web, the company is replacing the existing 'Talk' platform with a new one called 'Hangouts' that sharply diminishes support for the open messaging protocol known as XMPP (or sometimes informally Jabber), and also removes the option to disable the archiving of all chat communications. These changes represent a switch from open protocols to proprietary ones, and a clear step backward for many users." That's why I always say: only suckers trust companies.
Linked by Thom Holwerda on 05/23/13 17:52 UTC
"The wave of departures is a sign of internal struggle, but amidst all the bad news, there is a glimmer of hope. According to an anonymous HTC executive cited by WSJ, the crucial HTC One is selling 'pretty good so far'. The executive revealed that HTC sold about five million One units since launch, a performance that is deemed encouraging. However, sales have been limited by the persisting supply issues that still plague the production of the HTC One." Finally some good news for HTC. Five million units amidst supply constraints is very impressive.
Linked by Thom Holwerda on 05/22/13 22:23 UTC
"Sony gave the PS4 50% more raw shader performance, plain and simple (768 SPs @ 800MHz vs. 1152 SPs & 800MHz). Unlike last generation, you don't need to be some sort of Jedi to extract the PS4's potential here. The Xbox One and PS4 architectures are quite similar, Sony just has more hardware under the hood. Weâll have to wait and see how this hardware delta gets exposed in games over time, but the gap is definitely there. The funny thing about game consoles is that itâs usually the lowest common denominator that determines the bulk of the experience across all platforms. On the plus side, the Xbox One should enjoy better power/thermal characteristics compared to the PlayStation 4. Even compared to the Xbox 360 we should see improvement in many use cases thanks to modern power management techniques." AnandTech does its usual in-depth thing.
Linked by Thom Holwerda on 05/22/13 13:38 UTC
"The Verge has learned that HTC's Chief Product Officer, Kouji Kodera, left the company last week. Kodera was responsible for HTC's overall product strategy, which makes the departure especially notable on the heels of the global launch of the make-or-break One. It's not just Kodera. In the past three-odd months, HTC has lost a number of employees in rapid succession." I really hope HTC pulls it together.
Linked by Thom Holwerda on 05/22/13 13:30 UTC, submitted by JRepin
"It is with huge pleasure that the Debian GNU/Hurd team announces the release of Debian GNU/Hurd 2013. This is a snapshot of Debian 'sid' at the time of the Debian 'wheezy' release (May 2013), so it is mostly based on the same sources. It is not an official Debian release, but it is an official Debian GNU/Hurd port release." Important note: 75% of Debian packages are supported bu Debian GNU/Hurd. Impressive.
Linked by Thom Holwerda on 05/21/13 22:06 UTC
"The first killer app was VisiCalc. This early spreadsheet turned the Apple II from a hobbyist toy to a business computer. VisiCalc came with room for improvement, though. In addition, a new architecture and operating system, the Intel-based IBM PC and MS-DOS, also needed a spreadsheet to be taken seriously. That spreadsheet, released in early 1983, would be Lotus 1-2-3, and it would change the world. It became the PC's killer app, and the world would never be the same. On May 14, IBM quietly announced the end of the road for 1-2-3, along with Lotus Organizer and the Lotus SmartSuite office suite. Lotus 1-2-3's day is done." Impressive 30 year run.
Linked by Thom Holwerda on 05/21/13 21:45 UTC
"There's a disconnect between how Apple CEO Tim Cook sees his company's tax strategies and how some members of the US Senate view it. That became clearer than ever today after Cook and two other Apple executives testified before Congress, explaining why they're holding most of their international income in Irish subsidiaries like Apple Operations International, which declare no tax residency anywhere in the world. AOI hasn't filed a tax return anywhere in the world for the last five years, yet it earned $30 billion in income from 2009 to 2012, according to a Senate report released yesterday." Just because something is legal, doesn't mean it's just. Apple, Google, Microsoft, and many more - these companies might not be breaking any laws, but it's obvious to anyone that what they are doing is scummy.
Linked by Thom Holwerda on 05/21/13 15:53 UTC
The new WebKit Opera for Android has been released. "Opera 14 for Android is built on top of Chromium 26, with a total overhaul of the UI in native code, making it fit well with the latest Android design guidelines. Go get the build from Google Play or point your browser to m.opera.com, and give it a spin!"More News »
Sponsored Links
Member since:
2010-12-24
I expect that this issue will be tackled on two fronts:
1) Grub or LILO bases boot loaders would allow regular non signed kernels to boot. This is after getting the keys through reverse engineering and all more or less in a similar fashion like the DVD scene played out through DeCSS.
2) legally through the anti-trust process.
On my side, personally, I would refrain from purchasing any PC motherboard or laptop that does not allow disabling this feature.