Shimming your way to Linux on Windows 8 PCs
zdnet.com
zdnet.com
That would be similar to Apple's message that you can install Windows on their hardware, but you can't install Mac OS X on other hardware, so then why not buy a Mac and get the best of both worlds?
The OEMs approached RedHat offering to add their keys but they and the Linux foundation did not form a mechanism responsible for signing open source kernels. If someone steps up to the plate, the OEMs are willing to add keys.
We thought about this. In detail. My conclusion was that in the absence of a standards body with absolutely no commercial involvement whatsoever stepping up, Microsoft is probably actually the least bullshit option because at least if (or when) someone screws up they'll be blamed.
(You don't have to go into the firmware settings to choose to boot from removable media any more. You can just do it from the Windows 8 bootloader options, so it's the same on every machine. This is actually a genuine improvement that Microsoft made to the ease of installing alternative operating systems)
There's no explicit list of required implementation policies. People are free to implement whatever policy they want, based on their perceptions of the risk of revocation.
I wonder if any kind of antitrust case could be made against Microsoft for this, as it's clearly putting an impediment in the way of installing other operating systems.. and this is a form of anti-competitive behavior.
Personally, I think having to specifically enable boot-from-USB in the BIOS is a very valuable security measure. However, I do support the ability of everyone to control their own PC.
0: https://launchpad.net/usb-creator
1: https://help.ubuntu.com/community/Installation/FromUSBStick
I'm just saying I find it much more involved than changing a simple BIOS setting.
http://fedoraproject.org/wiki/How_to_create_and_use_Live_USB...
Very simple.
It was a fairly straightforward process except for determining the BIOS hotkey as this system hides the hotkey when secure boot is on, but shows it during boot when it's off. I had to call the OEM to figure it out -- it wasn't in the manual, the support site, or elsewhere on the internet.
Would doing this void your laptop's warranty?
This is also good security policy ...
http://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_...
Does anyone know why the source is not available?
Is there a chance that an open-source alternative will become available in the future?
The issue is getting binaries you build signed, I guess (i.e.: Debian can't build Shim and get a signed binary at the end, so having source isn't important to them; however if you want to contribute fixes, etc, then presumably you can develop on a machine with your own certificate installed and then RedHat can pay to get a new Shim build signed by Microsoft).
How is the shim binary signed?
"Debian can't build Shim and get a signed binary at the end"
Why can the shim's author sign his own binary, but Debian can't sign theirs?
I paid Symantec $99, sent them a notarised copy of my ID, created a Microsoft sysdev account, uploaded the binary to Microsoft, waited a couple of days and got a signed one back.
"Why can the shim's author sign his own binary, but Debian can't sign theirs?"
Debian could do the same, but could all their users? Will Microsoft sign binaries for someone in Syria? That kind of thing is important to Debian, and it's one of the things that distinguishes them from the vast majority of other Linux distributions.
Can't there be some sort of independent signing authority? In fact, why couldn't the user just sign and install his own code without involving any third party at all?
This whole "secure boot" system seems really poorly conceived, unless its purpose is to take power away from the user who owns the computer and give it to a central authority.
They might refuse to do it on an ideological basis, though.
The way that they have set this up seems to be obviously designed for the main purpose of literally locking Linux out of the hardware.
So I expect to hear about an anti-trust law suit against Microsoft (and possibly a number of hardware manufacturers).
Purchasing a non-logo system is another alternative alternative for use cases where virtualization offers inadequate performance. There are plenty of compatible machines in the logistical pipeline.
The issue which this article asserts effects a small number of use cases currently - persons purchasing new consumer oriented PC who want to run Linux.
With potentially large ripple effects. Old Windows boxes getting lightweight Linux distros provide a lot of machines for students, schools, people without cash, giveaway machines for friends, elderly relatives in need, etc.
Making that process harder (e.g., shim required) probably means more machines will just go to the trash (unless the shim is widely incorporated in lightweight distros maybe). What a waste (at the very least, of time).
It's a maintenance headache - now you have to administer two systems instead of one (network troubleshooting / dhcp, security updates, login/password, ports). And if you have limited disk space (e.g. a 128GB SSD) - you also lose on that front. (Linux can install comfortably in 4GB; I didn't try to optimize my last Win7 install, I boot it once a month or so to sync my iphone with iTunes, and it's balooned to 15GB somehow without the iPhone data).