Windows 10 to make the Secure Boot alt-OS lock out a reality

jeremy · 03-24-2015, 10:31 AM

Quote:

Those of you with long memories will recall a barrage of complaints in the run up to Windows 8's launch that concerned the ability to install other operating systems—whether they be older versions of Windows, or alternatives such as Linux or FreeBSD—on hardware that sported a "Designed for Windows 8" logo.

To get that logo, hardware manufacturers had to fulfil a range of requirements for the systems they built, and one of those requirements had people worried. Windows 8 required machines to support a feature called UEFI Secure Boot. Secure Boot protects against malware that interferes with the boot process in order to inject itself into the operating system at a low level. When Secure Boot is enabled, the core components used to boot the machine must have correct cryptographic signatures, and the UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system won't boot.

This is a desirable security feature, but it has an issue for alternative operating systems: if, for example, you prefer to compile your own operating system, your boot files won't include a signature that Secure Boot will recognize and authorize, and so you won't be able to boot your PC.

However, Microsoft's rules for the Designed for Windows 8 logo included a solution to the problem they would cause: Microsoft also mandated that every system must have a user-accessible switch to turn Secure Boot off, thereby ensuring that computers would be compatible with other operating systems. Microsoft's rules also required that users be able to add their own signatures and cryptographic certificates to the firmware, so that they could still have the protection that Secure Boot provides, while still having the freedom to compile their own software.

This all seemed to work, and the concerns that Linux and other operating systems would be locked out proved unfounded.

This time, however, they're not.

At its WinHEC hardware conference in Shenzhen, China, Microsoft talked about the hardware requirements for Windows 10. The precise final specs are not available yet, so all this is somewhat subject to change, but right now, Microsoft says that the switch to allow Secure Boot to be turned off is now optional. Hardware can be Designed for Windows 10 and can offer no way to opt out of the Secure Boot lock down.

More at Ars...

Will this mark the return to the bad old days of needing to seriously vet all hardware for Linux compatibility before purchase, or will most OEMs include the optional support?

--jeremy

schneidz · 03-24-2015, 10:43 AM

in the us i think most states allow two weeks for items to be returned. i usually go to stores with a live-usb. sometimes the sales associate will say its not allowed.
i would mention i would buy it and if it doesnt work i'll just return it (they wouldnt be allowed to resell it as new (refurb) -- some stores have a restocking fee).

metaschima · 03-24-2015, 11:25 AM

It's a problem, but I don't think even with this they can lock out Linux. You already have many options that allow you to boot in secure boot mode in Linux.

jefro · 03-25-2015, 03:17 PM

Some company will find out there will be a market for non-OEM motherboard and bios switchs for linux and Qnx and BSD's. Still many larger companies will use servers and workstations on alt OS's.

dugan · 03-26-2015, 12:34 PM

Quote:

Originally Posted by jeremy

Will this mark the return to the bad old days of needing to seriously vet all hardware for Linux compatibility before purchase...

Sounds like it to me.

John VV · 03-26-2015, 04:59 PM

i hope OEM's are READY for BOYCOTTS on a massive scale
and a ton of very bad press