Hacker News Reader

Comment by speeder | Hacker News Reader

Article forgot to mention secure boot shenanigans. I actually own a laptop that literally refuses to run anything except win8 that come with it and doesn't let me disable secure boot. People say that it is a bios bug... but there are no plans to fix the bios.

View on HN

Misplaced blame. You can blame hardware vendors for this. They're supposed to provide a way to load arbitrary signatures, but some didn't (I think they all do now though). Microsoft also has a service where they will sign your executable. And before you claim that's a problem, remember that SSL works the exact same way.

It's perfectly well-placed blame. Windows RT devices are required to disallow anything but MS operating systems, with no user override: https://en.wikipedia.org/wiki/Windows_RT#Restrictions_and_co...

They've also dropped the requirement that vendors must provide a way for users to override secure boot: https://arstechnica.com/information-technology/2015/03/windo...

They know how to boil a frog.

Slippery slope fallacy. That article is from 7 years ago. They're not boiling the frog, you've just fallen for XKCD 605.

They may have dropped the requirement, but hardware vendors are still allowing loading your own keys. Because, there are more factors acting on this than just Microsoft.

> Slippery slope fallacy.

They literally had a requirement that ARM Windows RT devices be not user unlockable. If someone lunges at you with a knife, but fails to stab you, it is not a "slippery slope fallacy" to believe they tried to kill you. What would it take to convince you? Zero remaining unlocked computers on the market?

I could of swore Ubuntu figured out a way around this.

What distro are you using

Yea AFAIK Ubuntu and others use a shim signed by Microsoft that boots grub.

> On Ubuntu, all pre-built binaries intended to be loaded as part of the boot process, with the exception of the initrd image, are signed by Canonical's UEFI certificate, which itself is implicitly trusted by being embedded in the shim loader, itself signed by Microsoft.

https://wiki.ubuntu.com/UEFI/SecureBoot#How_UEFI_Secure_Boot...

Note that the keys uses by Microsoft for signing Windows are different from the ones they use to sign anything else, and some motherboards and laptops only come with the former. Early x86 Surface Pros, for example (even though you could disable secure boot entirely, and be forced to go through Scary Boot Prompts).

Ubuntu and Fedora (among others I'm sure) have signed binaries.

How’s that Microsoft’s fault?

Reply on news.ycombinator.com