Linked by Thom Holwerda on Fri 22nd Jun 2012 23:17 UTC
Ubuntu, Kubuntu, Xubuntu After Fedora, Ubuntu has now also announced how it's going to handle the nonsense called "Secure" Boot. The gist: they'll use the same key as Fedora, but they claim they can't use GRUB2. "In the event that a manufacturer makes a mistake and delivers a locked-down system with a GRUB 2 image signed by the Ubuntu key, we have not been able to find legal guidance that we wouldn't then be required by the terms of the GPLv3 to disclose our private key in order that users can install a modified boot loader. At that point our certificates would of course be revoked and everyone would end up worse off." So, they're going to use the more liberally licensed efilinux loader from Intel. Only the bootloader will be signed; the kernel will not.
Thread beginning with comment 523404
To read all comments associated with this story, please click here.
Comment by Lazarus
by Lazarus on Sat 23rd Jun 2012 00:49 UTC
Lazarus
Member since:
2005-08-10

Of the various proposed solutions I've read about, this one seems to be the least evil. The only thing that would be better IMO is for the option for disabling EFI secure boot be mandatory and not be to terribly different from vendor to vendor. If only everyone making consumer hardware would just use the reference implementation and stop screwing around reinventing things =/

Reply Score: 6

RE: Comment by Lazarus
by Pro-Competition on Sat 23rd Jun 2012 01:21 in reply to "Comment by Lazarus"
Pro-Competition Member since:
2007-08-20

I'm certainly not an expert in this, but from what I've seen, I agree. (In fact, I half wonder why Fedora isn't going the same route.)

This whole "Secure Boot" thing has me upset at Microsoft to a degree I haven't been for several years. The x86/x64 situation is bad enough, but the ARM (WinRT) situation really burns me up.

Reply Parent Score: 4

RE[2]: Comment by Lazarus
by mjg59 on Sat 23rd Jun 2012 02:48 in reply to "RE: Comment by Lazarus"
mjg59 Member since:
2005-10-17

(In fact, I half wonder why Fedora isn't going the same route.)


The only real difference is that Fedora will be requiring a signed kernel and Ubuntu won't. I think we've explained why we believe a signed kernel is necessary.

Reply Parent Score: 3

RE: Comment by Lazarus
by Alfman on Sat 23rd Jun 2012 02:14 in reply to "Comment by Lazarus"
Alfman Member since:
2011-01-28

Lazarus,

"The only thing that would be better IMO is for the option for disabling EFI secure boot be mandatory and not be to terribly different from vendor to vendor."

Please please please don't forget about allowing us to control the keys in our own hardware. I don't think it's acceptable *just* to be able to disable secure boot in UEFI, it should be mandatory that owners can choose to enable secure boot for any operating system that supports it.

Unfortunately the path we are now on seems to be headed in the direction where microsoft, having it's keys embedded in all consumer machines, will become the defacto secure boot gatekeeper and secure boot enabled alternative operating systems have no choice but to become subordinates within microsoft's chain of trust. We already see it beginning.

To top it all off, secure boot is even less secure now because owners don't know who's code is running under microsoft's keys. It's very likely that malware will eventually get a key under MS's $100/year program. Sure, widespread worms will have their keys revoked after the fact. But narrowly targeted attacks are likely to remain undetected because the owners are kept entirely out of the loop, we're never informed by secure boot that something bad is afoot with our boot chain - secure boot my ass!

Being able to disable it is important, but I'm disappointed this crap security standard got adopted in the first place.

Reply Parent Score: 7

RE: Comment by Lazarus
by Soulbender on Sat 23rd Jun 2012 13:45 in reply to "Comment by Lazarus"
Soulbender Member since:
2005-08-18

The only thing that would be better IMO is for the option for disabling EFI secure boot be mandatory and not be to terribly different from vendor to vendor


In all fairness, being able to disable (in)secure boot is a requirement for the Windows 8 certified/logo thingy on x86. Somewhat ironic that if you want to make sure you can run a non-MS OS you should get hardware that is certified for Windows 8.

Reply Parent Score: 3