Secure Boot and Restricted Boot | Hacker News Reader

Secure Boot and Restricted Boot

mjg59.dreamwidth.org

32 pointsmartey12 comments

In the comments, someone says: "We were campaigning against Restricted Boot 10 years ago..." and gets the reply:

"Yes, you were campaigning against Microsoft. However, when Apple implemented the Palladium spec to the letter, most people folded because they were more anti-Microsoft than pro-freedom and were taken by the shiny stuff. Now it is acceptable to the public to buy locked down devices."

I saw that comment too. It's incredible what we as the larger tech community have let Apple get away with this decade that we never would have let Microsoft get away with the previous decade.

An amazing number of self-identifying FOSS fanboys still seem to have their tighty whities in a bunch over the evil deeds Microsoft committed in the 1990s, while giving Apple and Google free passes.

Of course, this makes sense. Scape-goating doesn't require anyone to use their brains ;-)

As a developer in Windows org, it pained me to see secure boot be so widely misinterpreted by the public.

I'd be amazed if many members of "the public" knew anything much about it. As far as I can see, it was a Linux fanboy phenomenon.

He's so right. Sadly this has come a bit too late and warnings have fallen mostly on deaf ears.

Linux desktop users risk to go back to being a niche, just when they were starting to rise above it.

Good move, Microsoft.

PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ...

> PS: Oh, and you'd think the fact Secure Boot "CA" is controlled by an American company would raise some eye brows at Bruxelles ...

The CA is only controlled by an American company if you, the user, choose to stick with that CA. You are free to reconfigure your system to use a different CA.

Is it ? MS requirements are to be able to turn off Secure Boot, not allow changing the CA. I wouldn't be surprised if most manufacturers just implement the former.

All of the manufacturers that I am aware of allow you to load your own keys.

MS also requires allowing for user replacement of all keys.

But only on x86_64 and not on ARM, right?

They require that you have the ability to change the keys; remove the Microsoft ones, load your own keys, etc.

The problem is that they don't specify any kind of common interface for doing so, or standard for key formats, or anything of the sort. So how it works can vary greatly between manufacturers, or may be buggy, or the like. So several prominent Linux distros have decided to ship bootloaders signed with Microsoft's keys, so that people can just install the distro without having to go through some hardware specific key loading process that may brick their machine.

Reply on news.ycombinator.com