Before you Dual Boot – MS, OEMs and Linux
eightforums.com
eightforums.com
It was only a few decades ago when IBM released the PC AT, complete with a full set of documentation, even the full source code of the BIOS. Now you're lucky if you can even get a datasheet for the SuperI/O chip or processor VRM controller. I've observed this decrease in openness through the years, but it's only most recently (post-Nehalem?) I've noticed this happening at an accelerated pace.
Throughout this time, all the changes that have been made for "security" appear to me as more and more like attempts to secure systems against their users, taking control away from them and forcing them to trust some authority instead. Code signing, secure boot, TPM, patch protection, etc. It is becoming more difficult to stay in control of the hardware you bought.
It is true that several years ago, it was probably much easier to infect systems with malware, but at the same time, the users had more freedom; including the freedom to explore, use, and modify the OSes of their choosing. Is this freedom something we should really be sacrificing? The well-known quote comes to mind: "Those who give up freedom for security deserve neither."
"The right to Read": http://www.gnu.org/philosophy/right-to-read.html RMS was right all along.
"The Coming War on General Purpose Computing" http://boingboing.net/2012/01/10/lockdown.html, Cory Doctorow, 17 years from now most will realize that Cory was also just as right as RMS was 17 years ago.
There have always been two kinds of computer users: Administrators--those who can be trusted to administer their own systems; and Users--those who cannot, who need someone else to Administer their system for them.
The Power User emerged as a gross hybrid because of the limitations of Personal Computer OSes. In Windows 98, for example, everyone was implicitly considered an Administrator, even if they had no idea how to Administer anything. (They were Users with the full Power of an Administrator.)
What would frequently happen is that one person in an extended family would have such knowledge as to be capable of actually Administering computers, and would frequently have to drop in to perform Administrative maintenance for relatives, who had no idea they had to do such things themselves. Nobody would be looking out for the computer in the interstice.
This era is thankfully over. What do we have now? No greater number of people capable of Administering their own computers, certainly.
Instead, what happens now is that the hardware manufacturer provides hooks (the Secure Boot certificate store et al.) such that the computer's Owner can delegate Administrative power to the OS distributor (Microsoft, Apple, Canonical, etc.), leaving the Owner as a plain User. "That guy in the family who knows computers" no longer has to be involved--effectively, the OS distributor is "that guy."
This is only really a problem for people who want to Administer their own computers (though in any form-factor where you can buy a motherboard separately, all these protections can be disabled.)
Frankly, though, I see less and less of a need for people to Administer personal computers. PCs (I'm including both desktops and mobiles in this set), these days, are basically the equivalent of VT-100 terminals: fancy screens you buy, take out of the box, and plug directly into the internet.
This is what I would call the "modern tinkerer mindset":
• "Real Software" runs on Impersonal Computers: servers, either racked in your office, or existing nebulously in "the cloud." When you are developing this software, you keep a VM that simulates such an Impersonal Computer running on your Personal Computer, and interact with it as if it were a network resource.
• Development of new Operating Systems occurs using a hardware emulator (really a more precise VM), like qemu. It then moves to ordinary VM software. Everyone else who tries your hobbyist OS will only want to run it in a VM themselves. Getting it running on Real Hardware is a 1.0 feature.
• If you want to fiddle with hardware yourself, you get a Raspberry Pi, or any of innumerable other devices aimed squarely at tinkerers. You could develop an OS using these, too, although it's a much greater hassle than just using emulation software. These devices are open in ways Personal Computers never were, having everything from schematics to JTAG pins available.
Given that mindset, what do you gain by having Administration rights to your new-age VT-100 Personal Computer?
You might answer "the surety that Microsoft/Apple/etc. will never ban VM software from its platform", but no OS distributor would dream of doing this: after all, how, then, would its first- and third-party developers do their jobs? They rely on VM software just like the rest of us.
Nobody wants to work on hobby projects that have no chance of ever running on real hardware. What's the point then? Even if you'll never get to run your hobby OS on real hardware, that possibility still serves to motivate the developer. Nobody likes to work on things they know beforehand nobody will ever use for anything.
As an example, coding a toy shell in JavaScript that runs in a web browser and prints some text to a canvas is not the same as coding a toy shell that can touch the actual file system and be used for real work.
Life is too short to write toy software for emulators, I want to write software that people use and get something out of. I'm an engineer, if I buy a computer it's because I want to make cool things with it and for it, not because I want a dumb terminal to connect to some rented server.
I never said hobbyist OS projects won't run on real hardware; I said running on real hardware is a "1.0 feature." Which is to say, around the 0.9, you start taking some real test machines, disabling their boot protections, and putting your OS on them. You get it polished.
And then, only after that, you go and apply for a boot-signing certificate from the hardware makers. Which, because you now have a real, polished OS instead of a hobbyist project, they will give you. It's sensible enough: if they gave a cert to every hobbyist developer, one of them might just be a virus-writer; but there are only so many groups who actually end up with real, working, polished Operating Systems that Users will want to run. And it's easy enough to tell when a group has made one of those, and to sign their bootloader.
This is, if you'll note, pretty much the same logic behind the iOS development workflow. First, you deploy to test devices that are specifically configured with an "I am an Administrator, obey me" flag. Then, once you've proven out your software on those devices, you get it signed with a "this is allowed to run on regular User PCs" cert.
---
Also: if a "toy shell in Javascript" can both connect to the network, and use the browser's Javascript data-storage APIs to store data, then what makes it incapable of getting Real Work done? It's basically a (really slow) VM.
If someone buys a computer, why do there have to be barriers from getting and using software directly from the developer? This has everything to do with milking money from developers and making users' alternative choices as difficult and unpractical as possible. It's discouraging choice and diversity.
--
> Also: if a "toy shell in Javascript" can both connect to the network, and use the browser's Javascript data-storage APIs to store data, then what makes it incapable of getting Real Work done? It's basically a (really slow) VM.
So who wants to play with "basically a (really slow) VM"? Why should hobbyist developers be content with only having access to second rate capabilities? No thank you.
Then the developers get angry and throw out the people in charge. Imagine, for example, what would happen if IANA arbitrarily stopped just a few people from getting domain names. We'd get a new IANA. (We can't do this with the "apps marketplace" vendors, though, and that is a problem. It's probably something that should be solved with an anti-trust suit or two.)
> If someone buys a computer, why do there have to be barriers from getting and using software directly from the developer?
Because--and this is the whole point of the Users/Administrators distinction--Users don't know enough about computers to distrust malicious software.
We put barriers between people and phishing sites, so they can't be tricked into giving their money away. We put barriers between children and in-app purchases, because they don't understand the consequences.
This is the same idea. Most people would go through whatever series of scary dialog boxes it took to run "cat_videos.exe". If you, an Administrator, were standing right there beside them, you'd grab the mouse from their hand and stop them, for their own good. We can't be there all the time. We want the OS to grab the mouse from their hand for their own good.
I'm talking about small everyday people, not rich Silicon Valley rock stars bitching to their Twitter followers to trigger a social wave of justice.
> Users don't know enough about computers to distrust malicious software.
I'm not arguing against secure defaults, I'm arguing against removing the option for power users to use their computing devices as they see fit.
Then the solution is to educate them, not mollycoddle them and keep them locked up. But knowledge is power, and educated users are difficult to control and deceive, so the "developers", the ones who want to remain in control, don't want that happening.
> We put barriers between people and phishing sites, so they can't be tricked into giving their money away.
The same people who would then fall for a different scam, before even more barriers are erected, and would think "security software X doesn't think this is a phishing site, so it must be safe."
> We put barriers between children and in-app purchases, because they don't understand the consequences.
A "think of the children" argument? I agree a lot of young ones haven't developed to that point yet, but if you make it so they never experience any bad consequences, they'll never learn from them too.
> If you, an Administrator, were standing right there beside them, you'd grab the mouse from their hand and stop them, for their own good.
No, I'd just tell them "you're very likely not going to like the outcome, but the ultimate choice is yours."
"We do not truly have freedom if we do not have the freedom to make the wrong choices."
The developers aren't the ones giving these companies money. The users are. The developers aren't their customers. The users are. The developers have little power to "throw out the people in charge" as long as the users keep giving the companies money.
Solutions which protect the user from cat_videos.exe can also "protect" them from subversive_essay.pdf (or competitor.com). It's maybe not that practical a vector, at least where there's democracy and competition, but still something to consider.
The freedom and power to control what's yours. A chance to explore, to learn more about the system you're using and possibly adapt it to fit your needs. IMHO giving users that chance is very important: how many experienced developers started out as power users - who also were originally only users? By taking away these chances, keeping regular users relatively oblivious, fewer of them will want to go through the increasing hassle of "becoming a developer"; it becomes an abrupt decision instead of the continuum of knowledge it once was. This divide between "users" and "developers/administrators" only makes it harder for users to cross that gap, and takes control away from them.
> If you want to fiddle with hardware yourself, you get a Raspberry Pi [...] These devices are open in ways Personal Computers never were, having everything from schematics to JTAG pins available.
Funny you mention the RPi, as it's nowhere close to being as open as the PC/AT was.
Want to be a developer? Download https://love2d.org/, open Notepad and write some Lua, save it in the same directory and run the executable. Or write some text that starts "<script>", save it as HTML, and double-click it. Or download Racket and follow the tutorials. Or, if you really insist on writing low-level code, download {Visual Studio Express, XCode Command Line Tools, Debian build-essential} and open up a shell. Learning to program has only gotten easier and easier over the decades.
But wanting to be an Administrator? What for?
Do you want to Administer your DVD player? It's an appliance. It plays DVDs. It works well because it only plays DVDs.
PCs are appliances. They run, in sandboxed environments, "application software", which are binary packages code-signed-by-proxy by the OS developer. They work well because they only do this. And within the framework of these restrictions, you can still program new software, or an entirely new OS. These are tasks this appliance lets you perform.
You can build your own computer. It won't be an appliance. You can also build your own DVD player. It won't be an appliance either. Is it so bad, then, that DVD players exist for playing DVDs? Is it so bad, then, that PCs exist for running sandboxed code-signed applications?
Just let someone else more qualified than you, or well maybe not more qualified, but more in charge than you, decide what you should eat. Selecting a restaurant or frozen dinner has only gotten easier and easier over the decades. But wanting to be a cook? What for?
And why do you need a camera? People should be able to sell you pictures of whatever you want a picture of. There should be enough pictures of everyone on Facebook already. Or, if you really insist on having a picture of something or someone that a Big Corporation doesn't have, just get out some crayons and sketch them. Buying crayons and coloring books has only gotten easier and easier over the decades. But why take your own pictures, what for?
And what do you need musical instruments for? Want to be a musician? Just download some songs that have already been written and play them in a different order on your DRM-closed player. Or, if you really insist on having your own choice in music, just call a radio station and request something. Calling and requesting songs has only gotten easier and easier over the decades. But wanting to make your own music or start your own band? What for?
And that address bar on your web browser? Just go to yahoo.com, and click all the links there. They already know what's good for you. If you really insist on having your own, post to a social network. Starting a web page on Facebook/google has only gotten easier and easier over the decades.
But wanting to go to whatever websites you want - or make your own websites? What for? </sarcasm>
Most kitchens have microwaves in them. Sometimes a microwave is the best tool for a job. (For defrosting red meat, for example.) But chefs don't insist on forcing their microwave to somehow do all their kitchen-related tasks; they use other tools, each with its own affordances, each with a best-suited task, together, to get done what they want done.
Likewise, a home-entertainment system usually has a DVD player in it. You don't try to use your DVD player as a PVR, or a video-game machine. You use separate devices for each of those tasks.
A capital-c-Computer is an amazing machine that can do many things equally well--it's sort of like an undifferentiated stem-cell. I completely understand wanting to use a capital-c-Computer, just for the sheer neatness-factor of it.
But a PC? The modern PC isn't a capital-c-Computer. The modern PC is a microwave, a DVD player. Like the microwave, like the DVD player, you likely have one in your toolkit--in fact, you likely use it for a lot of things. But it'd be silly to expect it to do everything.
You can have your capital-C-Computer and a PC too. Neither of them is going anywhere.
Meanwhile, proprietary software and closed hardware specifications have nothing to do with security and should be criticized more harshly.
On Chromebooks, which I'm a bit more familiar, you cannot, and disabling verification involves a 30 second delay on boot with beep, to prevent against evil maid attacks. However, apparently it's not too hard [1] to flash the ROM on some devices if you can open the thing.
[1] http://krblogs.com/post/63809988096/bootloader-unlock-on-sam...
When my Sandy Bridge laptop dies, I will buy my next computer from System76 who sell Ubuntu laptops. My next laptop may not even be an Intel laptop - I don't need x86, when most programs I use are open source and can be compiled to run natively on anything. I hope we will have a healthy number of Linux ARM laptops to choose from in the near future.
If you're going to support "Linux-friendly" computing, you should also support free software. If not, you might as well just get a Dell XPS Developer Edition or Asus Zenbook and slap Ubuntu on it.
I settled on using Windows as a host OS[1] and use Linux on VMs because to be fair, Windows power management, suspend/resume and hibernate and driver support is miles better i.e. it actually works more than once. Oh and they really don't fuck up the kernel every 2 minutes like on Ubuntu and don't throw out buggy shit like Apple do.
I used a 2011 MBP for the last 6 months or so however (with virtualbox) and I had to go back to an older and slower T400 as it was more reliable as well.
So virtualbox on windows 7 it is. And it works really well. I'm pretty happy and I'm a picky as they come when it comes to hardware and software.
On my desktop (a Dell T3500 with piles of RAM), it's 8.1 with Hyper-V with Linux in it as that works pretty damn well too.
Is suspect the problem here is users rather than hardware and vendors.
[1] On my Lenovo T400.
Now I have a MacBook with OS X. It combines the things I want from Windows and Linux, so I have no need to change OS. If I really need Linux or Windows for something, hardware virtualisation makes things easy.
I can't open windows on AWS when someone digs up my Internet connection...
I've never had issues setting up dual boot. It works fine and I can read/write NTFS if needed from Linux or just rely on Dropbox for simple stuff. The problem is it is too inconvenient to reboot so I usually just run Win 7 from a VM inside Linux. I also had a number of issues with Windows being glitchy (this persisted on three different Thinkpads with Windows 7 and, back in the day, Windows XP) and a pain to maintain, which is why I use Linux as my primary desktop OS.
I also don't have a problem with power management and suspend on Linux, though I know it probably isn't as good as Windows. I don't use hibernate so I'm not sure if it is awful. For my next PC upgrade I'm not getting a laptop, however, since I hardly ever travel with it...
I like OSX fine enough, too, but I rely on a lot of Linux tools so I have no real reason to have an OSX machine.
I'm using the former and it works pretty well for me. Though I wish either of those would use apt-get like Fink did.
I have different machines running different linux distros, so I'm familiar with all the popular package managers (apt-get, yum, pacman), and I must say, Homebrew is really my favorite.
Homebrew also doesn't manage OS X itself, which is something I really prefer about apt-get.
The benefit of apt-get source is being able to read the correct version of the source code of any part of the operating system to debug a problem, not necessarily building from source.
Binary packages are a wonderful thing and a package manager that doesn't support them out of the box isn't a usable solution for the things I do.
Wrong. Homebrew has so-called "bottled" binaries that get "poured in" unless you tell it to build from source or use a flag mandating a custom build.
If I were forced to use OSX or someone gave me an OSX machine I think I would get along fine and be productive, though. I can actually get along fine in Windows, too, but it is somewhat frustrating and slower for me to get things done.
Not that Linux is perfect, but I'm used to it.
It's exactly the same the other way around for e.g. audio and video editing on OS X vs. other platforms.
It seems my experience with computers has been radically different from yours.
The only kernel I've ever had problems with is the NT kernel, and one of the reasons I stick with Apple portables is that they're generally the least buggy devices I can find.
If you really want to try Linux, you need to buy a computer designed to run it, or at least vet your hardware before a purchase. I haven't bought a computer with a Windows license attached in over a decade because that isn't buying a Linux capable machine - its buying a Windows machine you might be able to run Linux on.
My most recent system was a build I made last year and I vetted every part for LInux support (and boy, did it take a while to verify Asus z87 motherboards had a working EFI that could boot a linux kernel, albeit they have a busted EFI shell and can only have one EFI boot table entry).
If that is indeed the case I think it would be tremendously important to fix that.
Are there better sources to read up on this, or is the controversy a bit over blown?
I have no problems with UEFI whatsoever; in fact, I think it's a nice improvement to the dated BIOS technology. The Microsoft thing called "Secure Boot" might pose a problem, but I never activate that anyway.
People need to stop confounding UEFI with Secure Boot.
You can't blame Linus for that. If a company doesn't want to push what is often only a few hundred lines of C to make their devices work under Linux, thats their right. But you can't blame the ecosystem for the companies choices not to support it. It is like buying Nexus 7 and bitching about how Windows doesn't run on it.
You can't "fix" people to stop them from talking out of their ass.
There is a distinction here - Linux, the kernel, runs on pretty much every CPU in the universe. If it is presented with any CPU and chipset ever made, it can run on that.
Your PCI devices, your USB devices, etc are not guaranteed to have Linux drivers for that hardware. And if the producers of said hardware don't release driver documentation or support a Linux driver directly, you can't blame the Linux community for not being magicians that can force private companies to bend to their will.
Hell, Broadcom - one of the worst FOSS companies, in the same class as Nvidia for the longest time - is finally producing scant upstream NIC drivers. They support a tiny fraction of their product range, and they have another 2 proprietary drivers on top of those for Linux and those don't work either, but the situation is improving.
But that is all you can do. There is no "sit down and code" answer for undocumented motherboards, bad EFI implementations, and a 15 button mouse with a 50MB proprietary driver on Windows. Well, the latter actually you can just wireshark the usb bus and get all the signaling for the buttons, but that is a lot of work to do what the company itself could have done in minutes (publish the opcode manual they obviously have on the thing).
Saved a tidy sum compared to shopping locally. Just pay attention to KB layout.
https://www.dell.com/us/business/p/xps-13-linux/pd
There are a few others. Its not really hunt, you just have to use a Linux laptop brand or find an OEM that sells bare notebooks.
While it is not apple to apple reason, this part is why I actually moved away from Windows -- yes, resume and hibernate (mostly) works on Windows, but with a great pain of waiting forever for that process to complete.
And that is Ubuntu (12.04 LTS) noob friendly edition on standard Intel Centrino hardware.
> Noob friendly Linux distributions like Ubuntu provide excellent support of all the points you mention.
I have a small Asus netbook for traveling with Ubuntu LTS, bought from Amazon with Linux already installed.
My home system, a more beefy laptop, has Windows with VMWare for Linux related stuff.
Since 1995, my first Linux experience, there are things that hardly have changed in terms of hardware support.
My latest issue is trying to make MTP support work properly.
I have a Windows 8 laptop. It had 2 HDDs, so I easily installed Ubuntu 13.04 to second HDD. However, during a Win8 update process, it hanged for hours and I force closed. Then even my recovery partition was corrupted. So, I wiped my first HDD, and since the OEMs don't give DVDs anymore, I could not install it. I live in Turkey, and there is a special version of Win8 Single Language, not found on internet. You cannot confirm checksum of them because it is not widely used, and depends on the region I think (maybe wrong). Therefore, even If I found a iso on Turkish forum I could not verify it, but tried to install Single Language version anyways. But It could not verify my key, that is burried in my motherboard. I tried to install Windows 8 Pro from MSDNAA, and it said it cannot because of the internal license on my pc. I tried dozens of way to disable it. When I got Windows 8.1 Pro from MSDNAA as well, It installed without problems. That is really f*cked up. I did not like flatness of even windows, I disabled Secure Boot, removed my partioning from GPT to MBR, installed my Ubuntu with Windows 7 as it is used to be, before these dark times.
Now I'm a teaching assitant of operating systems course, students need to use Linux for assignments, and almost all of them uses VirtualBox, which is not a very good replacement for native experience. It is fast, but not fast enough.
Secure Boot systems verify your OS against a key stored on your hardware.
It's got nothing to do with Secure Boot. If he had gone into the UEFI and disabled Secure Boot, the problem would still have occurred.
Secure Boot has become this scapegoat for everything that could possibly go wrong.
As its name suggests, Secure Boot prevents the OS from booting. If the installer is complaining about a product key mismatch, then it's got everything to do with the installer and nothing to do with Secure Boot.
Here's what you said:
> Hear my fucked up story of UEFI, Secure Boot and Windows 8:
Why mention Secure Boot at all? It's got absolutely nothing to do with your situation.
Suppose that a user buys a Windows 8 machine, goes to a website, and downloads malware that slows down the machine and makes it unusable. Finally, a local teenager wipes the machine, disables Secure Boot, and installs Windows 7.
One would hardly say that this is a "f-cked up story of" malware, Secure Boot, and Windows 8. Secure Boot is merely incidental, and has nothing to do with the issue of malware on Windows 8.
I use Linux.
Please note that OpenBSD has no problem handling large disks, greater than 2 TB. The problem is with the horrible Restricted Boot (UEFI) system.
The Asus model 1015E is in violation of the requirement that UEFI (Restricted Boot) can be disabled, and that Legacy Boot can be enabled. I am boycotting all future Asus products, because I had to deal with this problem after I had already purchased one. It was difficult and painful to get my money back.
If any manufacturer purposely builds systems without Restricted Boot, I will patronize them (even for non-Arm products). I am hoping that some manufacturer will build a line of Arm-based devices without Restricted Boot. (Yes, I know about BeagleBone, Raspberry Pi, etc. But these are not full-featured laptops. They are embedded machines aimed at embedded uses. I do use them for that purpose. Also note that the Raspberry Pi has the craptastic Broadcom chip, and it is anything but free [as in liberty] and open. http://permalink.gmane.org/gmane.os.openbsd.misc/192942 Also, the recent release of source code from Broadcom is only open source wrappers that call proprietary binary blobs. Fsck Broadcom.)
You need to run into every possible incompatibility or bricking while you're still well within the return and credit card dispute periods. And if you're actually unsure of how to proceed in making sure that shiny new device actually works for you, please please ask a technical friend for help. The future of society very much depends on it.
And http://www.rodsbooks.com/efi-bootloaders/
Kernels 3.3+ can be loaded from EFI partition directly without additional bootloader, no need to wrestle with grub-efi. This blog explains required configuration: http://wolfwings.dreamwidth.org/224805.html
efibootmgr -c -l /vmlinuz-linux -L "Archlinux" -u "initrd=/initramfs-linux.img root=<root partition uuid> ro quiet splash security=tomoyo"
Assuming /boot is my efi system partition.
The real problem is that most motherboard manufacturers have absolute garbage bloated proprietary messes of EFI implementations, and we are stuck with Intel jamming this shit down our throats in the first place rather than opening up their chipset documentation so we could have coreboot support on these boards.
I smell a simple 26 step process that can't legally be done in some parts of the Middle East and N. Korea, a few assembler and brainf*ck scripts, and a little simple arc-welding.
Thus far, with the ability for the VM to bind specific hardware directly and not shared via the host OS I get all the benefits of a Linux host OS without the hassle of broken driver implementations taking me down for long stretches at a time. As an example, I can bind my ALFA WiFi adapter directly to the Linux VM and run aircrack-ng all day long.
Yes, there are drawbacks. You will need a bigger hard-drive (best if you can fit two in your laptop) and more memory, but those are cheap these days. The benefits, however are massive. I keep multiple VM versions and can instantly recover from anything stupid that I might do in the Linux kernel without impacting my ability to actually get my work done.
I use VirtualBox and have found it reliable for years.
The Windows host OS can then be kept very clean and it remains fast and relatively secure.
Then in those rare instances when you need to download something insecure or that you don't want cluttering your Windows install you can put it in a virtual machine that acts as a sandbox.
If you organize your files right you can even wipe your windows partition and reinstall with very little downtime and setup (other than the several gigs of updates that will be needed during the first few boots).
And yeah - you are right about very little downtime when reinstalling stuff. While my peers will be out for a week because of an OS or hardware failure I can be up and running again in no time at all.
For years I dealt with alt-tab between windows as well as using various windows managers so I could have multiple desktops but the problem was that I couldn't have eye's on what was going on in the instrumentation. This setup saves me a massive amount of time.
Here's a picture with two additional monitors mounted to the wall next to my desk which are connected to another system I use:
Judging by the scopes, you're also an EE?
Why is it a problem? Because if you active hyper-v (and you need a reboot to change from active/deactive) all other VM, if started, will crash your os, show a blue page of death, restart your machine and show a "I am trying to recover your system" for like 20 minutes.
And hyperv is like the shittest VMm ever to run linux over it, also with the "officially supported" linux versions.
When you have Hyper-V installed, you have to be exceptionally careful about what drivers you have installed. I've even seen a Bluetooth driver bluescreen the management OS when Hyper-V was enabled.
This is just the nature of hypervisors. Most drivers are only tested on an OS that's running directly against the hardware. Run them through a hypervisor, and their behavior becomes unpredictable.
Ultimately, Hyper-V is a hypervisor, and it competes against ESX -- not VMWare Workstation. That's why it's best run on workstation-class or server-class hardware. Basically, situations where the hardware vendor might actually keep the drivers up-to-date. On consumer-level hardware, it's a crapshoot.
1. Thinkpad T or W series
2. Dell Precision
3. HP Z-series.
Nothing else is worth throwing any money at all unless it's for facebook or pr0n usage (consumer).
On notebook? Trying to combine Hyper-V (for WP dev) and Intel HAXM (for Android dev) is BSOD nightmare. It stopped after I got rid of Hyper-V...
More than one hypervisor per machine is not a good idea. You'll get the same problem with Intel HAXM and VMware as well.
To be fair the problem with this is that the whole Intel virtualization architecture is hacked on the side (as is every other damn feature since the 80186).
I ask because, considering popularity of Windows as malware/spyware target, running it as bare-metal host OS doesn't sound like a completely good idea to me, even if owner's really cautious.
This should been a scandal when Windows 8 launched.
Any problem you have with your computer now, you are required to buy another Windows copy.
It's hard as fucking hell.
Sounds like the Ubuntu installer might just suck for UEFI.
EDIT: license -> license key
I don't use Windows however that would be the point where I'd just pirate it, if I buy a single user license for a piece of hardware I expect to be able to run it on that hardware.
Fortunately my life and work (web dev) is better on Linux than Windows.
I think there are just a lot of people who don't know how to install GRUB to the EFI partition, or don't know how to edit their EFI boot menu with efibootmgr. UEFI is more complex than BIOS booting and if the only mental model you have is of a boot sector, you will have trouble understanding why a misbehaving system is acting as it is.
I don't enjoy needing to fix my boot loader when I install Linux or update Windows, but I'm always able to make it work. I always had boot loader issues when I dual-booted BIOS systems too, so although it's still unpleasant, it's not any worse. It's just different and requires learning some new concepts and command-line tools.
FWIW, my key/activation is stored in firmware on my Lenovo X1 and I had no trouble when I disabled Secure Boot.
I have a Windows 8 Sony Vaio. If I disable Secure Boot and install Linux on a partition, the Bios doesn't work. Period. I've seen that a number of people got it to work for a while by modifying the grub loader and other hackery but then try updating Linux. Why? Buggy UEFI that is not "standards" compliant.
If I try to use UEFI with a Linux distro that supports UEFI, I get a message saying something like "Can't find Windows."
Linux is installing its UEFI bootloader to someplace like /EFI/debian/grubx64.efi. Move that file to /EFI/Boot/bootx64.efi and it will boot GRUB. You can chainload the Windows bootloader from GRUB.
It took about a day to get it up and running, but I've had no issues at all since.
Except that Intel has less of a monopoly than Microsoft, so that's way easier.
With AMD laptops you might end up with a Broadcom wireless card and an AMD GPU.
The flip side of it is that this security software can also be used as a tool for mass censorship, and I certainly don't want something like that being impossible to remove and running in "ring -1".
I had always thought that PC makers paid Microsoft for Windows. The article claims that, instead, Microsoft pays the PC makers to install Windows. I don't see how this could possibly be true if most copies of Windows are sold pre-installed on PCs.
This is all from years ago, I don't know what terms are these days. Obviously Dell, HP, etc. do have a few preinstalled Linux systems in their catalogs now.
It is also plausible that Microsoft has a patent agreement with PC manufacturers so that they have to pay Microsoft a fee to ship systems with Linux installed. I know we've seen similar situations with companies that run Linux servers or sell Android devices.
Now here's where I think this can be improved. Usually, hitting something like F12 at boot time gives you a list of devices to boot from (internal drive, USB devices, DVD, network, etc). What I'd like to see added to this is an item labeled "Boot from unsigned DVD/USB/Network [for OS installation mode]". Once this is selected, whatever you boot would have access to adding additional certificates to the firmware. Or, more appropriately, you should be able to select 3 boot options: 1) boot from signed media; 2) boot from unsigned media; 3) boot from unsigned media with write access to certificate key store [OS installation mode]. That way, the end user can still maintain complete control over their hardware, yet still get the benefits of protection against boot sector malware / low level root kits.
The reality is: Windows boots fine with Secure Boot disabled. Linux boots fine from UEFI; the Debian installer sets everything up perfectly.
UEFI (better called Restricted Boot) takes away the user's freedom.
I want to own my hardware. I don't want the manufacturer to own it. I don't truly own it unless I can run whatever software I want on it. I don't own it if it prevents me from doing anything I want to do -- no matter what that is.
I don't have direct proof or experience, but I understand that many other models (and manufacturers) are similarly broken.
I was worried about driver issues and spending too much time adminstering my system instead of using it for being productive. I cannot emphasize enough how unnecessary those worries were - I f love it! As an IT guy using R, Git, Python and further Linux tools this made actually a lot of tasks way easier!
My recommendation - f* dual boot - get rid of Windows and switch to Linux!
https://www.dell.com/us/business/p/xps-13-linux/pd
And others. Really, if you are buying a new system for Linux, and it isn't a custom desktop, just buy a notebook from a Linux provider so you know modern kernels support the thing out of the box flawlessly.
In the future, I suppose I'll need to look to a Chromebook as a cheap platform for my GNU/Linux.
Unless people actually start making open hardware...
I don't get what you're trying to say here, so pardon me if this response is totally orthogonal to your point.
OS X isn't supposed to be run on PC's (laptop+desktop). Nor is it expected. Desktop Linux, however, is.
[0]: http://en.wikipedia.org/wiki/Apple%E2%80%93Intel_architectur...
Except when OS X doesn't have drivers for your hardware...
For a less snarky remark, please read my response to a similar, sibling comment.
Their office laser printers are great, and their workstations (e.g. the Z820) are pretty awesome.
Their cheap stuff on the other hand... I agree with you on every point.
If you boot Windows for games, you are far better off buying or building a rig designed for gaming. Conversely, if you need a fast Linux software development system, swap out the hard disk of any decent Core i7 machine for an SSD, which will usually be smaller than the rotating media, which makes dual booting less attractive. And if you are shopping for a Linux machine that's less likely to be a hassle in any way, look for one that uses Intel graphics and has no 3rd party GPU.
If you do your homework, you'll always have a perfectly functioning system. My ThinkPad runs Ubuntu (and Suse) like they were meant for each other.
And dual booting is always a PITA... Just delete Windows...
Dual-booting with UEFI is entirely possible, provided that your hardware allows entering EFI vars manually, in a SIGNED OS ENVIRONMENT. Every comment I've seen thus far doesn't seem to grasp that this is MANDATORY before you have the ability to finish installing a new bootloader. This is how UEFI protects itself from unauthorized OS signing!
I have my own custom EFI vars set up with grub2 running on a GPT partition table, all booting beside windows, as purely as the air you breathe, and I'm loading custom Linux kernels daily and haven't ran into an issue since I originally set it up. Grub2 itself is my primary boot partition, which can then jump into the windows boot manager on the other disk.
Grub2 itself has the capacity to act as a custom-signed EFI boot partition (Not sure if I've got the wording on that correct -- but the gist is there!). This means grub can be what your bios looks for the signature from. You don't absolutely need your kernel to be signed, provided you can get a signature produced from grub, OR you have the ability to write one while in a signed O/S.
IF you want the easiest approach, look no further than any Linux distribution that purchased a key to find such a signed environment that permits the further writing of EFI variables.
Or, even easier -- just write then boot grub 2's EFI-signed bootloader to a usb key to get started. After that, writing a new OS entry to UEFI should be the most straightforward thing to do in the world!
*(You can even boot any kernel in the world with such a signed grub2 USB disk!)
First thing I do is wipe any Windows/Recovery partition from the drive and install Linux. Yet, I know that Microsoft got their cut and there is nothing I can do about it.
How this passes any reasonable antitrust test is beyond my comprehension; on the other hand what we call capitalism these days has not much to do with actual capitalism, so maybe I should not be surprised.
For me, day to day, Linux makes an amazing desktop and development machine. It's been 7 years since I ran a Windows computer daily (although my iMac has a Bootcamp partition for DayZ), and I don't miss it, so I'm voting with my wallet. If you'd told me I could do that a decade ago, I would have thought you were nuts, but I'm happy that's the case now. I understand the Secure boot frustration, but without needing to dual boot it's a lot easier.
We've ceded a lot of control, and yet I wonder if we ever had a real say in the matter. Oh well, I can buy Linux laptops, and that's what matters to me. Heck, it might be easier to get them to dual boot than a Windows laptop ;)
But it seems like this is less of a UEFI issue and more of an HP shitty UEFI issue, since plenty of other manufacturers don't cause any problems.
I can't believe how convoluted and snafu-prone the process appears to be. I bought my Aspire V7 laptop in December and have never gotten around to installing Ubuntu on it simply because I dread the almost-guaranteed loss of 1-2 working days trying to undo whatever screwups happen.
I can't imagine even one lay, non-Linux lover even thinking of attempting something like this.
When I built my current PC, I specifically set it up to boot in UEFI mode with secureboot disabled, so that windows won't thrash the mbr. Then I happily installed arch, everything worked fine (even though the double-bootloader, i.e. UEFI->grub->linux still makes me queasy).
The only trouble was when afterwards I tried installing windows. At least at the time, windows 7 DVDs weren't able to boot in UEFI mode, therefore weren't able to use the GPT-partitioned hard-disk. The fix was easy enough at least - just copy the bootloader to the correct location on the DVD and it boots just fine.
I would use it solely with Ubuntu, but I'm not sure whether I can make Ubuntu run in a usable state right away, so I might dual-boot.
What should I know beforehand about running Linux on UEFI computers before my Surface Pro 2 arrives?
I didn't want to use Windows at all, just boot Clonezilla straightaway, clone the HDD and then install Debian. No go on booting from CD - "not allowed" due to the security setup. Ah, OK .. so it then boots Win 8.1 and I had to go through various Windows setups I wanted to avoid before rebooting and trying again.
It was then I had to figure out the BIOS side of things and saw it was all UEFI. I just turned it off and switched to "legacy" mode (BIOS legacy I assume) and disabled secure boot. Cloned the HDD, booted the Debian Testing CDROM and now have a "Jessie" install on it.
The machine has a terrible single-button trackpad arrangement, but is otherwise fabulously good as a Linux development box.
(I do also run Windows, in a VM rather than dual-booting)
My current laptop has an UEFI implementation that only boots from a hardcoded path in the EFI partition. You guessed right, the path of the windows 8 bootloader.
The UEFI in my home server overwrites the UEFI boot manager list every time you save & exit the configuration tool.
If I remember correctly, the UEFI implementation of a MBP that my friend and I tried to make dual boot Ubuntu required a blessed HFS boot partition for every OS.
Yea, they don't open up all their stuff, but if you dig around you can usually find a board on most chipsets that works with coreboot. That gets my purchase. Plus they are doing good work with the radeonSI mesa driver, even if they still pack binary power firmware with it (I've read a few articles decompiling and inspecting it to know it is mostly just init command code to start the hardware).
The issue with PC hardware is, as it ever was, hardware vendors not following the standard. Much like Apple and OS X, they build some implementation and only fix bugs if they break Windows. So if you want to build a Linux implementation, you have to implement workarounds for all the quirks in different vendors' EFI implementations, and in the meantime you can't install on their hardware.