Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230

 

 

 

"Nail in the coffin" for Linux

Off-Topic discussions about science, technology, and non Debian specific topics.
Post Reply
Message
Author
n_hologram
Posts: 459
Joined: 2013-06-16 00:10

"Nail in the coffin" for Linux

#1 Post by n_hologram »

OEMs Allowed To Lock Secure Boot In Windows 10 Computers
You can currently cryptographically sign a Linux kernel to secure boot, You can install them alongside, or overwrite the windows signature (keep in mind, these keys are your new keys to the windows os. It's not truly keyless, so I would suggest add them alongside.) but most I.T. guys aren't even smart enough to know how it's done. It's no easy task even for Linux people. I currently make 6 figures in a support job and it was difficult for me. I've attempted it only once and was successful, but it is so not user friendly even to smart tech people. I would go as far as to say that even less than 1% of people will ever do it. The other hassle is, if you ever update your kernel in Linux which happens way more than in Windows, you have to re-sign against the new one and re-add the keys all over again alongside or overwrite.

However, I still have the ability to do it, and that's what's important. Make no mistake. This is a literal and direct attack on Linux. OEM's will not care about the few people who use Linux and will omit this ability essentially killing Linux off. This is Microsoft's attempt at the final nail in the coffin of Linux.
It's no secret that the Linux ecosystem is undergoing unorthodox changes. Despite the pro-/anti-systemd mania commandeering the conversaion, I was wondering how you guys feel about the possibility of not being able to even use the next generation of laptops. (Once again, I'm reminded of a member who cautioned, over and over, that hardware, not software, dictates the majority of security issues.) Incidentally, this also comes not long after news that the EFF has removed the AMT feature from a Lenovo Thinkpad, albeit the selling price -- the price of freedom -- is, well...pricey.

Do you think that locking-down the BIOS would kill-off Linux (and, by extension, render all sides of the systemd arguments irrelevant)?
bester69 wrote:There is nothing to install in linux, from time to time i go to google searching for something fresh to install in linux, but, there is nothing
the crunkbong project: scripts, operating system, the list goes on...

User avatar
edbarx
Posts: 5401
Joined: 2007-07-18 06:19
Location: 35° 50 N, 14 º 35 E
Been thanked: 2 times

Re: "Nail in the coffin" for Linux

#2 Post by edbarx »

When I buy a new computer I insist that it has to support Linux, otherwise I don't buy it.
Debian == { > 30, 000 packages }; Debian != systemd
The worst infection of all, is a false sense of security!
It is hard to get away from CLI tools.

User avatar
dasein
Posts: 7680
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: "Nail in the coffin" for Linux

#3 Post by dasein »

n_hologram wrote:(Once again, I'm reminded of a member who cautioned, over and over, that hardware, not software, dictates the majority of security issues.)
What a jerk s/he must be :mrgreen:
Do you think that locking-down the BIOS would kill-off Linux (and, by extension, render all sides of the systemd arguments irrelevant)?
Of course locking out alternate OSes would kill off, well, alternate OSes. But the more important question is whether the mobo OEMs are going to actually implement a lock-out.

Remember that the news piece is merely reporting that MSFT is no longer requiring that SecureBoot be something that end users can bypass. Nothing is preventing an OEM from shipping a bypass-able SecureBoot. Now, will some OEMs shoot themselves in the foot out of laziness/sloppiness? Probably. Especially on laptops? Wouldn't be at all surprising. But you have to ask yourself if you truly imagine that all mobo vendors are really going to forgo the always-growing Linux server market to chase after a dwindling Windows desktop market.

Annoyance, inconvenience, hassle. But probably not the end of things as we know it.

(But do remind yourself that if my forecasting skills were worth beans, I'd be retired on a private island somewhere.)

User avatar
Head_on_a_Stick
Posts: 14114
Joined: 2014-06-01 17:46
Location: London, England
Has thanked: 81 times
Been thanked: 133 times

Re: "Nail in the coffin" for Linux

#4 Post by Head_on_a_Stick »

It's not "locking down", Microsoft are just attempting to make disabling Secure Boot optional rather than part of the UEFI specification (as it is now).

This is a moot point anyway as most motherboard manufacturers use non-compliant UEFI implementations (particularly ASUS).

This just reads like click-bait to me -- Ubuntu, Fedora & OpenSUSE will all install & run with Secure Boot enabled anyway and as the Linux Foundation is a member of the UEFI.org group I can't see Microsoft successfully pushing this through.
deadbang

Magnusmaster
Posts: 168
Joined: 2010-06-12 22:50

Re: "Nail in the coffin" for Linux

#5 Post by Magnusmaster »

It will sure make it much harder to spread Linux around. What about Debian? Will jessie be able to run on machines with Secure Boot on?

User avatar
Head_on_a_Stick
Posts: 14114
Joined: 2014-06-01 17:46
Location: London, England
Has thanked: 81 times
Been thanked: 133 times

Re: "Nail in the coffin" for Linux

#6 Post by Head_on_a_Stick »

Magnusmaster wrote:It will sure make it much harder to spread Linux around. What about Debian? Will jessie be able to run on machines with Secure Boot on?
Not unless you generate your own keys, enrol them into the firmware (BIOS) and sign the kernel image & boot loader/manager.
http://kroah.com/log/blog/2013/09/02/bo ... nux-kernel

AFAICT Debian will never use the official keys or license as it is in violation of the Debian Free Software Guidelines.
deadbang

User avatar
JLloyd13
Posts: 394
Joined: 2012-06-29 04:08
Location: Halifax NS Canada

Re: "Nail in the coffin" for Linux

#7 Post by JLloyd13 »

I'm not very worried to be honest. It would be a a bad business decision, even with the small size of the Linux community there's really no reason not to allow us to disable secure boot just for that purpose. It costs them nothing and gains them users. Worst case scenario and they actually lock us out- then you just have to use the keys. Non ideal, but not the end of the world. Several distros are signed already. And even if somehow that wasn't possible, server hardware certainly wont lock out Linux, and Google is still churning out Chromebooks/boxs that are usually pretty easy to run (regular) Linux on. Dell, HP, etc have good Linux compatibility and I can't see them thrown it out the window.
Laptop: Debian GNU/Linux 9 'Stretch' 64bit
Read: https://wiki.debian.org/DontBreakDebian/
We are the Universal OS. Be patient, give help, teach the Debian way.

n_hologram
Posts: 459
Joined: 2013-06-16 00:10

Re: "Nail in the coffin" for Linux

#8 Post by n_hologram »

dasein wrote: But you have to ask yourself if you truly imagine that all mobo vendors are really going to forgo the always-growing Linux server market to chase after a dwindling Windows desktop market.
Fair point. I keep forgetting Windows' downward-spiral in the market. Since Windows desktops dominate my workplace, and the average competency level of my coworkers is painful at times, I often forget how Windows may fade into obsolescence, albeit plenty of people in charge of finances still swear by them.
Remember that the news piece is merely reporting that MSFT is no longer requiring that SecureBoot be something that end users can bypass. Nothing is preventing an OEM from shipping a bypass-able SecureBoot. Now, will some OEMs shoot themselves in the foot out of laziness/sloppiness? Probably. Especially on laptops? Wouldn't be at all surprising.
True, but this could also be said of many Android phones on the market. Maybe I'm trying to articulate the long-term implications of this move. I'll flesh-out in detail (because I have the day off) what really should have been my original point: that it's not so much this one instance of Windows or manufacturers locking-out alternative solutions, but a larger trend of tying consumers' hands behind their backs, and buyers willingly approaching technology with their wrists pressed together. tl;dr, I argue that consumer choice will dictate our own ability to choose in the future.

Before I begin my tirade, I must remind or inform the reader that 99.9% of my interactions with people offline are people who do not understand, or do not care to understand, their technology; so my perspective natrually reflects this overwhelming majority. People were swept off their feet when they saw me printing from a USB drive on the school printer, despite this same printer having been in the same spot for almost six years. People who forget, despite weekly instruction, how to change their desktop wallpaper. On a Windows 7 computer. I feel like Lacan when I say that I can get to the heart of my point only after a long detour.

Does anyone remember the excited optimism of open-source many developers and open-source advocates when Google announced that their mobile operating system would be based on Linux? (I do, and maybe not in this community, but there definitely was promise). In the past, loading a custom firmware image was trivial, and in some cases part of the appeal for buying an Android phone over an Apple one.

Yet as time has passed (and as one could easily expect), it seems that more and more manufacturers deliberately clamp-down on this: for instance, by locking bootloaders. Anything not christened by a large corporation is branded unsafe for use. Samsung is one of many that locked-out the S3 not long ago for this reason. Another example, Motorola allows user to unlock their phones; but they must first register their phones -- to the Google-owned Motorola -- to receive a "bootloader unlock" key. Although the rationale of "voided warranty" is fair, one could easily see that the bootloader is unlocked because it changes the entire initiral loading screen to red text on a white background warning the user that the bootloader is unlocked; so Google's method is more like a "dancing monkey" treatment of the open-source community. Then there's the VPN message on stock firmware which displays "OMG YOUR INTERNET IS BEING EAVESDROPPED THIS IS IN NO WAY SAFE", although a similar message is nowhere to be found when you link all of your social networking, email, bank account information, etc. to the same device.

In the smartphone realm, advocates of open-source technology and unique security approaches are routinely pissed on, and the official rationale always seems to mirror the same approach that Apple began not long ago; because the end user is stupid*, it is profitable to lock-up the full potential of devices and justify it as a security method. That's the type of approach I anticipate laptop manufacturers, given the liberty to lock-out anything but the default OS, will bandwagon. I can envision maybe a minority of laptop lines which cater to alternative OSes (after all, the profitability of being "the" Linux laptop could be significant; the relationship between the Google Nexus and Cyanogenmod blossomed nicely because of this), but I really don't believe that the current luxury of interfacing with your parents' computer using a live USB disk [to weed-out the malware which entered their computing environment due to the Windows] will carry into the future (or, if it does, then only by proficient hackers).

So, buy a dumb-phone, right? Problem solved, stop getting off-topic.

Sure, that's an ideal solution, but the current smartphone trend shows how indifferent most consumers choose to remain when the inner-workings of their intrastructures are obfuscated by a flashy GUI, great advertisement, and the promise of heightened security. By the way, how are tablets doing? How are tablet-laptop hybrids are starting to look on the market? For anyone who hasn't tried, tablets are often about as easy to hack around as smartphones. How's ChromeOS looking (and is it any safer to install Linux**)? People seem to love it; in fact, we just received eight cartloads of them from a grant. And how are Gnome3 and Unity looking, despite the systemd-related lock-outs of the former, and shameless data-mining-tactics of the latter? People love convenience and sexualized technology; and just like the auto industry banked off sleek cars, so too are manufacturers of mobile technolgoy reaping the financial rewards of their target demographics.

As these social patterns dominate consumer choices, I hold a vision of the current Linux ecosystem's survival which is blurred with doubt. The "mothership" distros are more-or-less systemd, which is driving users towards other distros or BSD etc.; as the gaps between tablet and laptop bridge, so too will the caveats which define each; and, like I said at the beginning, the tablet-smarphone OEMs aren't exactly FOSS-friendly. All the while, I don't believe it far from the truth to safely assume that people en masse just won't give a crap about whether some group of tech nerds gets to use something besides Windows. I also don't feel it far from the truth to safely assume that "buyer's choice" for anyone who deviates from a manufactuerer's target audience will streamline available mobile device choices, and that those, too, could easily die out for trivial reasons.

To be fair, I'm not so pessimistic that I believe all laptops are damned behind unbreakable walls of proprietary technology. But I also see, over and over again, that so many manufacturers will take, not the opportunity, but the initiative to block consumers, who don't care one way or another, from actively breaking their impositions. That, in my opinion, will prove to be a significant turning point for this ecosystem: whether the buying habits of the overwhelming many will dictate the innovative privileges of us few.

*Also, I must end with a note of clarification. Because of many discussions with everyday people, I don't believe that most people want to remain ignorant when it comes to issues like these. It's usually that most people default to wilful ignorance because of other priorities in life, or they don't know because no one in their life has cared enough about the subject to tell them.
** I know I had the source for this statement bookmarked, but it went out with my old hard drive, so I'll keep looking for it. In short, Crouton invites some security concerns which were detailed in a healthy read, which I think was on Github.
bester69 wrote:There is nothing to install in linux, from time to time i go to google searching for something fresh to install in linux, but, there is nothing
the crunkbong project: scripts, operating system, the list goes on...

User avatar
dasein
Posts: 7680
Joined: 2011-03-04 01:06
Location: Terra Incantationum

Re: "Nail in the coffin" for Linux

#9 Post by dasein »

Mm. Thanks for the brain candy. :D

My years in UX convince me beyond doubt that, for most folks, convenience will trump technology every time. When you make a phone call, you don't want to think about (and certainly don't want to have to think about) the complex web of interconnected technologies that make modern telephony possible; you just want to punch in a number and have the call go through. And for good or ill, the average user thinks about computers the way most folks think about telephones: as an appliance. (Ever notice how many people call ATMs "cash machines," as if dispensing cash was the only thing they did?)

And that, BTW, is a large part of why "the year of the desktop" never materialized. Linux is for people who either like thinking about underlying technologies, or at least don't mind doing it. (That's also why desktop Linux is so consistently ~2% adoption year after year: that's the percentage of folks whose interest in a(ny) subject qualifies them as an enthusiast.)

Given your thinking, if you've not yet read Cory Doctrow's essay on the war against general computing, you might find it worth your while. (Caution: it's definitely not a short/casual read. But it's both thought-provoking and disturbing. http://boingboing.net/2012/01/10/lockdown.html)

Afterthought: Slight hijack: Dunno if/how well they kept up with it, but the folks at HTC announced an "easy root" policy a few years back.)

User avatar
cpoakes
Posts: 99
Joined: 2015-03-29 04:54

Re: "Nail in the coffin" for Linux

#10 Post by cpoakes »

As already pointed out, mobo/laptop manufacturers will act to maximize profits. The best way to do this? ensure linux compatiblity. (Or find "someone" to pay you to lock it down.)

Also, mobo/laptop manufacturers do not write their own BIOS. They contract with a handful of BIOS suppliers. AMI and Phoenix are two that immediately come to mind. Each manufacturer implements a range of features and each OEM "ticks the boxes" for desired features and supplies artwork for the boot screen. The BIOS folks will supply whatever they want. As the secure boot library is already developed, I cannot imagine this being cost prohibitive in a new bios - probably already included in a standard package.

User avatar
JLloyd13
Posts: 394
Joined: 2012-06-29 04:08
Location: Halifax NS Canada

Re: "Nail in the coffin" for Linux

#11 Post by JLloyd13 »

cpoakes wrote:(Or find "someone" to pay you to lock it down.)
which would almost certainly lead to let another anti-trust lawsuit, which is why it's beneficial for literally no one, even microsoft, to force people to lock it down. The tiny market percentage we take is not worth a lawsuit. Especially since all it means is we'll buy from whatever vendors don't lock it down.
Laptop: Debian GNU/Linux 9 'Stretch' 64bit
Read: https://wiki.debian.org/DontBreakDebian/
We are the Universal OS. Be patient, give help, teach the Debian way.

Post Reply