Hacker News Reader

Comment by shawnz | Hacker News Reader

Do people still believe this crap? It's not as if OEMs are being forced to make Microsoft the sole CA of machines they sell. The requirement for the logo is that the feature is available. Any OEM who doesn't provide options to enable/disable the feature or adjust trust options is crazy. I mean, come on -- what if your hard drive fails? These are desktop computers we're talking about. It's an open platform.

To be honest, I'm very excited for Secure Boot. It, combined with TPMs and disk encryption, will finally allow desktop computers to be a truly secure platform (barring opening up the ICs on the motherboard, anyway).

View on HN

It's not as if OEMs are being forced to make Microsoft the sole CA of machines they sell.

Here's Fedora's response (Matthew Garret mjg59):

"We explored the possibility of producing a Fedora key and encouraging hardware vendors to incorporate it, but turned it down for a couple of reasons. First, while we had a surprisingly positive response from the vendors, there was no realistic chance that we could get all of them to carry it. That would mean going back to the bad old days of scouring compatibility lists before buying hardware, and that's fundamentally user-hostile. Secondly, it would put Fedora in a privileged position. As one of the larger distributions, we have more opportunity to talk to hardware manufacturers than most distributions do. Systems with a Fedora key would boot Fedora fine, but would they boot Mandriva? Arch? Mint? Mepis? Adopting a distribution-specific key and encouraging hardware companies to adopt it would have been hostile to other distributions. We want to compete on merit, not because we have better links to OEMs."

But couldn't they have just signed the other distros' keys? (Naive question)

Yes, but that would make them responsible for any malicious code that any other distro used. That would mean they would have to do security reviews of every other distro if they wanted secure boot to remain secure, which is not feasible at all.

Surely the answer is to sign distributions (or not) as verified as originating from a domain (eg microsoft.com), then let the user choose which os to boot in the bios (or whatever becomes). Then if you want to run an os from an untrusted domain you can, or you can just stick to whatever is sighed as coming from microsoft

As far as I can see all pc manufacturers would need to do is verify the certificate of each os on an os selection screen and display the result to the user

Why would you need to open up the ICs on the motherboard? Just plug in to that "thunderbolt" that's got people so excited, and DMA whatever you need.

Surely the Thunderbolt interface has an IO-MMU?

From wikipedia:

>A number of Intel processors since the introduction of the Nehalem microarchitecture (that is, a number of CPU branded Core i5, Core i7, or later) support VT-d, an IOMMU implementation. This allows the operating system (OS) to isolate a device in its own virtual memory address space (in a manner analogous to the isolation of processes from one another using the MMU). Devices could thus be prevented from having access to unauthorized parts of the memory space. However, this feature isn't generally used other than for its initial purpose of giving guest virtual machines passthrough access to specific host hardware.[citation needed]

So.. maybe? Resolving that 'citation needed' would be nice.

Reply on news.ycombinator.com