Hacker News Reader

Comment by arel | Hacker News Reader

As a developer my first question would be: Can I dual boot linux on it? If so it would be an extremely attractive developer machine and switch to Windows when you need it. The hardware is the show stealer here.

View on HN

It seems like running in a VM is a much more attractive option than dual booting these days. The performance hit is negligible (especially with 16GB RAM), you can use both OSes at the same time, and you can use all the native Windows touch/pen drivers and have them carry over to the VM.

Good point, but not ideal for everyone. Especially with IOMMU and an SSD, performance isn't so bad when it works. I haven't liked the overhead with this in the past though, plus no full disk encryption, (although I guess you could do it in the guest), and Windows security in general, and bad 3D drivers for the guest (compositing please), and anything that wants low level hardware access is out. So if you don't actually want to _use_ Windows it makes a pretty crummy hardware abstraction layer.

Windows security in general is better than Linux security in general.Unless you are running Grsec/PaX but hey i do not believe you do that on desktop.

Also you can still run EMET on Windows.

> Windows security in general is better than Linux security in general.

Can you elaborate on this or provide some sources?

Theo de Raadt of OpenBSD made a comment in this line recently. https://www.youtube.com/watch?v=OXS8ljif9b8&t=54

> Windows security in general is better than Linux security in general.

Maybe. Have they fixed UAC not being security boundary [1] if you are on a default administrator account? It's hard to take them seriously when most software for most users still runs effectively under 'root'.

[1] http://www.pretentiousname.com/misc/win7_uac_whitelist2.html

Sorry, I didn't really mean to say that Windows securtiy is inherantly worse, so I should probably rephrase. What I mean is I am more comfortable dealing with client security issues on Linux systems than with Windows. Of course you're right that I'm not running grsec patches.

I feel like I know how to reduce the attack surface a bit more easily on linux client systems. Most OEM Windows installations are pretty bad, so I would want to install Windows myself, sans crapware, and with unneeded built in services, apps and hooks and so on removed. If the bootloader was locked, I'm not sure whether I could reinstall the Windows OS of my choosing. Maybe these products have less crap on them though, since the OS image comes directly from Microsoft.

I didn't mean to refer to situations other than personal clients used by me, and I don't really have an opinion about this in general, except maybe: It depends... :)

Pro and Enterprise versions of Windows 10 come with Bitlocker Drive Encryption, FYI.

Which is as trustworthy as mailing a copy of your HDD to the NSA directly.

We, as users, have no way of verifying what BitLocker does, if it has backdoors, etc.

We really need to differentiate between the two types of "security" when we're talking about them. Are you worried about your personal information being stolen? That's security. Are you worrying about being spied on? That's privacy. People generally aren't worried that the NSA will steal their personal information, run up their credit card bill, etc. They're worried that the NSA will see something that could be used against them in court, or used to target government actions against them in any way. Not to say that an NSA backdoor couldn't compromise both security and privacy, but this is a simplified view.

BitLocker is secure in that it keeps out the attackers. If it keeps out the NSA is a different story (one that is much harder to determine).

As someone from EU, if it was only NSA I would be mostly okay, but I can't trust NSA/USG to be competent enough to safeguard the private key controlling possible BitLocker backdoor from the Chinese and other governments running massive industrial espionage campaigns.

This. Is the bootloader locked?

So far I have mixed feelings about tablets. I like the "tablet" part but not the "it is cryptographically sercured from doing anything that might upset a government, corporation, or business model" part.

The Surface Pro 3 you could. Just had to disable Secure Boot for setup, boot from a USB stick, and after installation you could re-enable it (assuming you had a Linux distribution that supports Secure Boot signing).

Obviously nobody outside of Microsoft will know if that remains true with the Surface Pro 4.

Secure Boot is always disable-able on x86. This has been true since Surface Pro 1.

The Windows 10 hardware certification permits the OEM to make Secure Boot not disablable. But the way the major distros work, they get a pre-bootloader signed with the Microsoft key through Microsoft's signing service, and that pre-bootloader contains a key permitting the chaining of the real bootloader, the kernel, signed with the distro key. So it's not a big problem.

Up till W8.1, the spec (https://msdn.microsoft.com/en-us/library/windows/hardware/jj...) explicitly requires the ability to disable Secure Boot:

    On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following:
    ...
    B.If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system is operating in Setup Mode with SecureBoot turned off.
    ...
    Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv.

I can't find the doc for W10. Has the language changed? Can you link it?

The closest thing I found is https://msdn.microsoft.com/en-us/library/windows/hardware/dn... which isn't really a spec, but does say:

    For most PCs, you can disable Secure Boot through the PC’s firmware (BIOS) menus. For logo-certified Windows RT 8.1 and Windows RT PCs, Secure Boot is required to be configured so that it cannot be disabled.

which seems to imply that it is no longer a hard requirement for x86 unlike before.

I'm not finding an actual Windows 10 hardware certification requirement document. Yet Windows 10 is out and shipping pre-installed on hardware, so how can there not be a document somewhere?

"The precise final specs are not available yet, so all this is somewhat subject to change, but right now, Microsoft says that the switch to allow Secure Boot to be turned off is now optional. Hardware can be Designed for Windows 10 and can offer no way to opt out of the Secure Boot lock down." http://arstechnica.com/information-technology/2015/03/window...

yes. I run ubuntu on my surface pro. Everything works well, with reasonably good battery life (not as good as win10, obviously).

it is a painful install process, but that should change completely with ubuntu 15.10

Why painful? Can you desable secureboot, but UEFI on Ubuntu is still sucky?

Ubuntu 14 doesn't support a lot of the latest hardware at the moment. I had an Intel i7 NUC and installing ubuntu 14 on it was a nightmare... You fix one thing to move the installer, another thing breaks. It's trial and error. Ubuntu 15 was just straight forward, one click install.

I have a Surface Pro 1, and installed Ubuntu and Linux Mint pretty easy... but I wouldn't use any Linux in a Surface honestly, the Desktop Environments are far from having decent HDPI support, and the touch experience is still far from feeling usable.

Reply on news.ycombinator.com