The FUD is flying fast and furious over Windows 8, and the OS isn’t even in beta yet.
The Free Software Foundation (FSF) is organizing a petition-signing campaign over Microsoft’s announced support for the secure boot feature in next-generation PCs that use Unified Extensible Firmware Interface (UEFI) as a replacement for the conventional PC BIOS. My ZDNet colleague Steven J. Vaughan-Nichols is urging his readers to sign the petition with a bit of deliberately inflammatory language, calling it “UEFI caging.”
The crux of their argument is that Microsoft is deliberately requiring a change in next-generation hardware that will make it impossible to wipe off a Windows installation and install Linux. They are wrong, and their effort to whip up public fury is misguided at best and cynical at worst.
Allow me to illustrate by turning the argument around in an equally cynical way, with an equally inflammatory rhetorical flourish:
People who make their living in the Linux ecosystem are demanding that Microsoft disable a key security feature planned for Windows 8 so that malware authors can continue to infect those PCs and drive their owners to alternate operating systems.
Oh, wait. Now that I think about it, that’s actually pretty close to the truth.
The most disappointing part of this whole phony controversy is that its ringleaders have managed to suck in some people who should know better. Like Ross Anderson, Professor of Security Engineering at the University of Cambridge Computing Laboratory, who wrote this last month:
I hear that Microsoft (and others) are pushing for this to be mandatory, so that it cannot be disabled by the user, and it would be required for OS badging.
This is grossly incorrect. It is disappointing that a university researcher who should believe in scientific rigor and respect for facts would spread a rumor that begins “I hear that…”
He continues:
The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate. It is clearly unlawful and must not succeed.
This is pure FUD.
Here’s the reality. Malware authors are getting more creative and more vicious. A rootkit that can infect key operating system files can hide itself so thoroughly that it is virtually impossible to detect. The TDL4 rootkit is probably the best known and most deadly of the bunch. It can patch the Windows Boot Configuration Database, overwrite key system modules, and disable driver signing requirements, just for starters. It is a nightmare to clean up.
The secure boot feature pulls the rug out from under this rootkit and everything like it. Those key boot files that the rootkit tampers with are digitally signed. With Secure Boot enabled, any modification to those files is detected at startup by the UEFI code-signing check, and the system stops in its tracks. Rootkit foiled, user protected, recovery possible.
As my colleague Mary Jo Foley has noted, the initial reports came from an employee of Red Hat Linux who acknowledges that “UEFI secure boot is a valuable and worthwhile feature.”



