Hacker News Reader

Comment by snorkel | Hacker News Reader

It's reassuring the Canonical is involved with the UEFI Forum and making sensible recommendations, it's doubtful that BIOS manufacturers would bother making a chip that won't support Linux.

It's also amusing the Microsoft is so concerned with malware operating underneath the OS when most nuisance malware on Windows simply uses the features that are readily available within Windows itself.

View on HN

It's also to combat piracy. For example, Windows Loader uses a pre-boot technique to fool WGA:

http://forums.mydigitallife.info/threads/24901-Windows-Loade...

Personally I think this is the real reason behind the push for secure boot.

Without piracy, nobody (approximately) in the Third World will use Windows or, by extension, any Microsoft software. Microsoft knows this. I doubt Microsoft wants to stop piracy that badly.

I suspect that only name brand PCs will use secure boot; people in developing regions mostly buy whitebox PCs and thus can easily avoid it.

If users can easily disable Secure Boot, it won't prevent much piracy at all.

Users can disable SB, but then they wouldn't be able to boot Windows 8.

Isn't it a completely optional feature? Otherwise, Windows 8 would not work on any pre-Secure Boot PCs.

The article states that "According to Microsoft’s presentation at //BUILD/2011, Secure Boot will be “Required for Windows 8 client”"

For machines that adhere to the Windows 8 logo program. Windows 8 itself will still boot on BIOS, let alone UEFI systems without secure boot.

Canonical isn't concerned that windows 8 compatible motherboards won't support linux because secure boot can be disabled. They're worried that a naively implemented secure boot will add one more barrier to installing linux. Requiring a user to 'turn off security' through an unfriendly bios screen would make the first steps into linux more hostile.

Exactly. Canonical has gone out of their way to make sure that you never have to muck around in a terminal or BIOS to install Ubuntu, with their Windows installers and all that.

If you run their installer and the first step is "reboot, press F12 (or F2, or DEL, or who knows what else) to enter the BIOS and turn off this security setting - that you have to find on your own - then reboot and run the installer again" instead of "click the Install button" that's a big step backwards. Not to mention the fear some users will have about turning of security, wondering if they're being had.

The BIOS vendors will surely support linux as a checklist item. But they don't sell to consumers. They sell to PC manufacturers. Sony and Dell and HP's laptop divisions don't give a hoot about linux. If they get a directive from MS to turn on UEFI secure boot with MS's key, that's exactly what they'll do. What they're not going to do is write a user-supplied key UI in the BIOS allowing the user to install their own keys. Even if the BIOS vendor provides one, they won't test it. Or might even disable it to "reduce support costs".

Maybe microsoft is focusing on tomorrow's threat instead of todays? All too often people give MS too little credit. There are some very smart people at Microsoft even though they do not exclusively use hw/sw from apple...

Microsoft's concern is recent rootkit malware that loads before Windows even boots. Thus it can make itself completely indetectable from Windows and any anti-virus software that is loaded later on in the booting process. The malware can even run a hypervisor of sorts if it wanted to and no one will be any wiser that there's malware running.

While that's an understandable concern, I think parent was wondering whether Microsoft should be more concerned with why their system allowed the rootkit to install itself in the first place.

If the software is executed by the boot loader (UEFI), before Microsoft's windows boots, that is not by any fault of windows.

"If the software is executed by the boot loader (UEFI), before Microsoft's windows boots, that is not by any fault of windows."

That's what it does after it gets installed. It got installed by attacking Windows itself.

> It got installed by attacking Windows itself.

The same attack is technically possible in OS X and Linux but not in iOS or WP7. Go figure.

No reason they can't do both, it increases security. Security is all about layers. You fight malware where you can. You should never depend on any one defense, however strong it is.

>I think parent was wondering whether Microsoft should be more concerned with why their system allowed the rootkit to install itself in the first place

Short of iOS style lockdown, how do they do that? Even OS X and Linux can be rootkitted.

Rootkit doesn't "install itself" - user installs it by running something shady and entering their own password or clicking Yes in UAC prompt.

Doesn't this happen also with virtualized hardware?

>Microsoft's concern is recent rootkit malware that loads before Windows even boots.

Nothing recent about it; boot sector viruses have been around way longer than Windows. I remember getting one on my 386DX from a floppy I'd used to grab a shareware version of Commander Keen from our local public library. Pain in the ass to clean up.

I remember writing one on my Atari ST.

Boot viruses were to major form of viruses back then, there was a fun one that reversed your mouse's y-axis after a while. There weren't many destructive ones though.

Reply on news.ycombinator.com