Linked by Elv13 on Sun 17th Jun 2012 10:35 UTC
Thread beginning with comment 522566
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
distro makers should not offer to voluntarily go with MS's lockout plan.
Except if they want to compete in the server business (RHEL vs. Windows Server 8). Having a checkbox to tick "protected boot process" might come in useful when trying to secure government contracts, whereas having that checkbox empty might hurt sales.
Even NIST is aware that firmware level attacks might be a problem.
MJG is paid by Redhat, and so he will work on what's best for them. Compiling your own kernel is so far down the requirements lists for enterprise servers that they don't care about it much. They just need a way to _somehow_ get around the lock-down for their own development (and the geeks) - and right now, there is.
I failed to see how the proposed solution is somewhat unfitting. He asked for a simple jump or switch on motherboards, nothing more. I think it is the best and simplest solution I ever heard. It will not lessen what Red Hat can do or claim for their systems and provides a fair level playing field for all others involved on linux/*BSD, or whatever camps.
Going for abominations like this Fedora plan (where you can't use your own compiled kernel, modified drivers, etc.) should be the absolute no-go, and distro makers should not offer to voluntarily go with MS's lockout plan. Instead they should join the effort in full to lobby for including the option to switch off UEFI SB on every and each UEFI hardware.
That would mean death to them then.





Member since:
2005-07-06
On several occasions I've seen and heard the argument that easy disabling (e.g. including a simple switch in the bios/whatever you want to call it) should be a no-go. Then for crying out loud, at least provide a jumper on the mobo in an accessible place (anywhere on desktop/server boards, and near the ram slots on laptops) where those who care enough, can disable it.
Going for abominations like this Fedora plan (where you can't use your own compiled kernel, modified drivers, etc.) should be the absolute no-go, and distro makers should not offer to voluntarily go with MS's lockout plan. Instead they should join the effort in full to lobby for including the option to switch off UEFI SB on every and each UEFI hardware.