ie8 fix
madison

Why do Linux fanatics want to make Windows 8 less secure?

By | October 18, 2011, 2:00pm PDT

Summary: Windows 8 isn’t even in beta yet, and already the FUD is flying fast and furious. A small group of activists are whipping up controversy over the UEFI secure boot feature even as they admit the feature is “valuable and worthwhile.” Here’s the real story.

The FUD is flying fast and furious over Windows 8, and the OS isn’t even in beta yet.

The Free Software Foundation (FSF) is organizing a petition-signing campaign over Microsoft’s announced support for the secure boot feature in next-generation PCs that use Unified Extensible Firmware Interface (UEFI) as a replacement for the conventional PC BIOS. My ZDNet colleague Steven J. Vaughan-Nichols is urging his readers to sign the petition with a bit of deliberately inflammatory language, calling it “UEFI caging.”

The crux of their argument is that Microsoft is deliberately requiring a change in next-generation hardware that will make it impossible to wipe off a Windows installation and install Linux. They are wrong, and their effort to whip up public fury is misguided at best and cynical at worst.

Allow me to illustrate by turning the argument around in an equally cynical way, with an equally inflammatory rhetorical flourish:

People who make their living in the Linux ecosystem are demanding that Microsoft disable a key security feature planned for Windows 8 so that malware authors can continue to infect those PCs and drive their owners to alternate operating systems.

Oh, wait. Now that I think about it, that’s actually pretty close to the truth.

The most disappointing part of this whole phony controversy is that its ringleaders have managed to suck in some people who should know better. Like Ross Anderson, Professor of Security Engineering at the University of Cambridge Computing Laboratory, who wrote this last month:

I hear that Microsoft (and others) are pushing for this to be mandatory, so that it cannot be disabled by the user, and it would be required for OS badging.

This is grossly incorrect. It is disappointing that a university researcher who should believe in scientific rigor and respect for facts would spread a rumor that begins “I hear that…”

He continues:

The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate. It is clearly unlawful and must not succeed.

This is pure FUD.

Here’s the reality. Malware authors are getting more creative and more vicious. A rootkit that can infect key operating system files can hide itself so thoroughly that it is virtually impossible to detect. The TDL4 rootkit is probably the best known and most deadly of the bunch. It can patch the Windows Boot Configuration Database, overwrite key system modules, and disable driver signing requirements, just for starters. It is a nightmare to clean up.

The secure boot feature pulls the rug out from under this rootkit and everything like it. Those key boot files that the rootkit tampers with are digitally signed. With Secure Boot enabled, any modification to those files is detected at startup by the UEFI code-signing check, and the system stops in its tracks. Rootkit foiled, user protected, recovery possible.

As my colleague Mary Jo Foley has noted, the initial reports came from an employee of Red Hat Linux who acknowledges that “UEFI secure boot is a valuable and worthwhile feature.”

Page 2: What do the BIOS makers say? –>

Topics

Ed Bott is an award-winning technology writer with more than two decades' experience writing for mainstream media outlets and online publications.

Disclosure

Ed Bott

Ed Bott is a freelance technical journalist and book author. All work that Ed does is on a contractual basis.

Since 1994, Ed has written more than 25 books about Microsoft Windows and Office. Along with various co-authors, Ed is completely responsible for the content of the books he writes. As a key part of his contractual relationship with publishers, he gives them permission to print and distribute the content he writes and to pay him a royalty based on the actual sales of those books. Ed's books written prior to fall 2011 have been distributed by Que Publishing (a division of Pearson Education) and by Microsoft Press. As of November 2011, Ed is a partner in the independent publishing company Fair Trade Digital Exchange, which exclusively publishes his books.

On occasion, Ed accepts consulting assignments. In recent years, he has worked as an expert witness in cases where his experience and knowledge of Microsoft and Microsoft Windows have been useful. In each such case, his compensation is on an hourly basis, and he is hired as a witness, not an advocate.

Ed does not own stock or have any other financial interest in Microsoft or any other software company. He owns 500 shares of stock in EMC Corporation, which was purchased before the company's acquisition of VMware. In addition, he owns 350 shares of stock in Intel Corporation, purchased more than two years ago. All stocks are held in retirement accounts for long-term growth.

Ed does not accept gifts from companies he covers. All hardware products he writes about are purchased with his own funds or are review units covered under formal loan agreements and are returned after the review is complete.

Biography

Ed Bott

Ed Bott is an award-winning technology writer with more than two decades' experience writing for mainstream media outlets and online publications. He's served as editor of the U.S. edition of PC Computing and managing editor of PC World; both publications had monthly paid circulation in excess of 1 million during his tenure. He is the author of more than 25 books on Microsoft Windows and Office, including the recently released Windows 7 Inside Out.

461
Comments

Join the conversation!

Just In

RE: Why do Linux fanatics want to make Windows 8 less secure?
THUFIR.HAWAT 29th Jan
@owlnet what strange concepts you have. Presumably you're referring to paid support for Redhat et. al.? Sure, you can pay Redhat, to choose just one. Or not, your choice. Whatever the point you're trying to make, you're incoherent in that you're not obligated to purchase support. If you want free support, use IRC, mailing lists and stackexchange, which, again, are free. Pardon, what's your point? Presumably you're conflating the GPL with communism, or something.
Linux is free, but the services for Linux is not free...
Why don't these hypocrites make Linux services free as well and serve mankind for a noble cause?

How do these free software advocates make a living ??? Living on benifits or goverment grant using tax payers money???
@owlnet

They make a living working for places like IBM, Google, and HP.
0 Votes
+ -
Master Joe Says...Wow
MasterJoe 19th Oct
@Michael Kelly Was that meant as a good thing? IBM's claim to fame recently was that their servers aren't 10x slower than Oracle's. They're only 6; this from IBM's own people. Google has tax issues at the moment, anti-privacy issues, and anti-trust issues, and even its own employees have begun to, allbeit accidentally, bash their products (Google+) in public, with some rather strong language. HP can't even find a fit CEO to run the company, kills off a product two months after launch, and now has an OS they spent a whole lot of money on with no means of turning a profit for them. Those sound like great places to work. If you're a consultant, IBM IS a great place to work. If you're a Linux developer, other than perhaps working with the RHEL team or with Cannonical, I'm just not seeing how you're better off than someone who is more intimately familiar with Windows, which, by the way, rules both the enterprise and consumer markets. Just my two cents on this.

--Master Joe
@Michael Kelly
I could not help to feel a kind of deja vu, that this has happened before, and it has. Linux is a threat in spite of its minuscule user base but has a big presense among web servers.
Add to this an insecure Microsoft, they know they would lose a lot of customers without using dirty tricks.
???Security??? is just an excuse. Did anyone really believe otherwise? When has MS Windows ever been anything else than totally perforated by malware?
  • Flagged
To be perfectly honest, I see this as more a preemptive attack against possible 'regular home users' switching over to something like Ubuntu. Your average user won't know how to go into BIOS to disable UEFI - and if they see that installing Linux means doing 'some dern technical thingy', they'll just not do it.

This is exactly what Ubuntu and other distributions are trying to avoid, making Linux look 'technical'. Even if EVERY OEM allows the user to disable it easily, but since they all want Windows 8 stickers they have it on by default... Microsoft has won.

The 90% of people who COULD switch to Linux (people who don't play games, or run MS-only products - people who can live with Firefox instead of IE, LibreOffice instead of MS Office, etc.) will just not switch, because they don't know how/are too lazy to mess with their BIOS, usually accompanied by something about how 'technical' it is, and 'not for them'.
@Tynach
So you're saying that adjusting BIOS settings scares potential Linux users of but installing a new OS won't? People that install Linux are 'expert' users or otherwise they will let an 'expert' friend do it for them. Really, adding an extra step inside the BIOS won't change anything.
If I'd be a novice user I would be more scared to install a completely new OS other than Windows without wrecking my computer (and that's not a stupid assumption when you're a novice) then to adjust one tiny setting.

And btw, you're talking about an EUFI option inside the BIOS but actually the BIOS will be totally replaced by EUFI. So it's an option inside EUFI. Just so you know happy
@Tynach
The average home user will never move to any version of Linux unless a major marketer of PCs and laptops promotes the platform. That is never going to happen. Hand held devices don't count.
@Tynach, if you think toggling a SecureBoot setting is going to be a roadblock to running Ubuntu, you're ignoring what it already takes to install and run Ubuntu. It's trivial.

There is nothing preventing Ubuntu's developers from updating it to be SecureBoot compliant.
@owlnet
It's not about free; it's about choice. I agree it's early to attack Win 8. They might still force OEMs to have a toggle off option.

Likewise, it's took early for the Windows fanatics to be defending Win 8 too. Microsoft may allow OEMs to turn the PC market into one like the smartphone where you are expected to only run what it comes with.
-1 Votes
+ -
It's not up to Microsoft
LiquidLearner 19th Oct
@anono

So stop trying to pin the blame on them. It is up to the OEM. Pure and simple. I know you'd really like to find something wrong with Microsoft on this but it's a fantastic feature. Anything that prevents rootkits is a fantastic feature.

Some OEMs will allow you to disable it, others won't. But it has nothing to do with Microsoft.
1 Vote
+ -
Now That's Not Correct Either
CFWhitman 19th Oct
@LiquidLearner

Considering the requirement to have this enabled by default in order to get Windows 8 certification, it's rather a stretch to say, "It has nothing to do with Microsoft." Microsoft isn't forcing manufacturers not to make the option to turn it off available, but they do have a lot to do with the feature being implemented in the first place. Just leave it at, "Microsoft isn't making the final decision."
1 Vote
+ -
@liquidlearner

Sorry, but history has shown that OEM's do whatever Microsoft tells them to. If they don't, then Microsoft just increases the price the OEM's are charged until they are out of business. Everyone in the OEM business knows that too. That's what really happened to the Linux based 'Netbooks'. There, it wasn't the Netbook market, it was the Desktop and Laptop markets that really frightened the OEMs. The only holdouts are Apple and a few Linux resellers.

In servers it doesn't matter as much because Microsoft isn't capable or running a big server. Anything over 64 processors just doesn't do Windows well at all.

Microsoft has been convicted twice in the US of using these tactics, and also convicted twice in Europe. More times than that in Asia. It's old news. It also hasn't changed.

The fear in Linux is real, and based on experience. Saying 'Oh Shucks' which is all Mr. Bott has really done does nothing to allay the suspicion.

The last time Microsoft tried this, around 12 years ago, your computer wouldn't run if you replaced any of the cards in the system.

Yes, the Linux people are concerned, but the Windows people who maintain systems should be terrified. Just think, if you add any memory, you will need to buy an new Windows license.

Now do you understand?
@anono What? Have you not read that its a simple matter of making a selection in the BIOS to turn off IUFI. Give it a rest. By default a computer should be more secure. If you want to reduce that security to run another OS, than you do it at your own risk.
@ScorpioBlue
I see it is business as usual for you, just like before under your earlier screen names.

Do you not get tired of the endless FUD campaign that you have waged since the begining? I know many of us here have tired of your endless FUD campaign.

I imagine you have a vested interest in having Windows released without it being as secured as it could be.
plain
1 Vote
+ -
No, I don't get tired of battling a monopoly
ScorpioBlue Updated - 19th Oct
A monopoly that lied, cheated and stole it's way to the top. A monopoly that's as unavoidable today as cell phones.

Better get used to it, faux pointy ears.
@Mister Spock - he was an abused child... and he's just jealous or we wouldn't have to "listen" to him.
  • Flagged
@Mister Spock
+1
happy
  • Flagged
0 Votes
+ -
@ItsTheBottomLine should know
ScorpioBlue Updated - 19th Oct
He's the one who should know... wink
@owlnet

1. Free Software is a matter of liberty, not price.
2. Business demand paid support; for accountability.
3. I, and 1000's like me, provide free support for individuals.
@asmoore82

So go to a communist country, why live in US?
  • Flagged
-1 Votes
+ -
@asmoore82 You don't miss the point. You aren't even on the board. Let's look at your points, shall we?

1. That's just a dumb thing to say. Liberty gives you free software? There's free software in China, and they aren't exactly known for their Democratic ways there.
2. Should they not? If you were going to implement a system that was critical to your business, wouldn't you want accountability? If I need support for something (such as Oracle), I sure want to know that I have an agreement in place that says they will provide me with a certain quality of support and also that they will resolve my issue, rather than just throw their hands up and walk away from it at any given time, leaving me with no recourse.
3. 1000s of Linux users vs. MILLIONS of Windows users. What's your point? I have a whole web site, as well as YouTube videos dedicated to PC security, maintenance, optimization, and other topics. That has nothing to do with paid support, which, by the way, enterprise Linux vendors are offering. RHEL support isn't free for the enterprise. And, even if you choose to go the free route, have you visited the forums lately? First, trying to use a search engine to find your issue is a pain, thanks to all of the content farms and sites just looking to drive traffic to them that come up. Then, when you do find a result, you either find the wrong answer, no answer at all, or read through fifteen pages of people saying "I have the same problem." The fact that those posts exist shows the lack of maturity on forums. No one cares if you HAVE the problem. The first post which started the thread initially gives an explanation of the problem. Unless you have some variation of that problem, or a solution, there's no reason for you to post. But, people do, and that's not likely to change.

All that said, your comment has nothing at all to do with this article. The point is that Microsoft comes out with a great new feature for both performance and security, and a bunch of angry Linux fans who hate that Microsoft Windows is on over 10 PCs for every 1 PC that Linux exists on try to make it out to be some horrible monopolistic, malicious thing, which is just a lie, plain and simple. Then, we get the morons of the media, and at least one college professor who is clearly not deserving of his status and title helping fan the flames?

If I were Microsoft, I'd move forward with this feature, and completely ignore all of this. Just stick a nice big middle finger up in the face of those who started the rumor and the meaningless minority who were dumb enough to believe it and give the rest of us who actually have a clue the best product possible.

--Master Joe
@asmoore82 Gotta Love Master Joe - Thank you Master Joe.
@BestUS and MrJoe

some people will actually do things for people without being paid. These are called 'friends'. I realize that you don't have any, so you can't understand.

However, there are people who do have friends. Some even have friends who use computers. Some people who have friends and who use computers will ask for help from people who they know and who they believe know more about computers than they do. That would be asmoore82.

Again, outside of either of your life experiences, apparently. If not, then you know that you are wrong, and are just trolling.

It might be interesting to know which it is.
@owlnet

And RedHat is about to be a billion dollar company and is do it all with linux.

@Ed Bott

Congratulations to Ed for another anti Microsoft hate article! Nobody has been "sucked in" as you stated, but see the real facts as they are. Ed, you are not even close to having the credentials compared to the individuals that you claimed were sucked in, yet you profess to be right and they are wrong? That is so egotistical of you!

If I purchase a PC and I can't run the OS of my choice on it, then I have deprived of my rights and my hard earned cash. That is illegal and violates the law in many ways. I will be notifying any legislative and government authority of this possibility and we will see what anti trust actions will be taken when the time comes.
-1 Votes
+ -
@linux for me If I purchase a PC and I can't run the OS of my choice on it, then I have deprived of my rights and my hard earned cash. That is illegal and violates the law in many ways. I will be notifying any legislative and government authority of this possibility and we will see what anti trust actions will be taken when the time comes.

Then the simple answer is do not buy a Windows 8 based PC. The slightly more complicated answer is to build your own PC and install Linux on it. You HAVE choice, you have your freedom. NO ONE is forcing you to buy a Windows 8 based PC.
@linux for me
You are absolutely hopeless.
  • Flagged
-1 Votes
+ -
@linux for me

...and is a logical fallacy.

The truth will out. I suspect like many things Linux zealots complain about this will turn out to be a tempest in a teapot (in other words, a paranoid fantasy).

Do you *really* want to be in the same boat as MacAfee and Norton when they demanded kernal access? happy
@linux for me:

The only thing that Microsoft is saying is that if an OEM wants to sell PC's branded with the Windows logo and certifications, that the PC must, when shipped by the OEM, have SafeBoot turned on. They make no assertions as to whether the OEM can provide a mechanism for a user to manually turn-off SafeBoot.

Your complaint is not with Microsoft - it is with any OEM that ships a PC without the ability to enter the BIOS and turn off SafeBoot.

Your ability to turn off SafeBoot has *NOTHING* to do with Microsoft. Get over it.
@linux for me
If you purchase a PC that you can't run the OS of your choice on, it seems to me that you've made a poor choice of hardware. That is hardly illegal, and the deprivation is one of your own choosing.

No one complains about the lack of BMW engines in Fords, even though there probably are people who would rather have that choice.

Building your own PC hardware isn't hard. Plenty of people do it and install the OS of their choice.
-1 Votes
+ -
What?
mykem 19th Oct
@linux for me :

What do credentials have to do with being right and wrong? Here are facts:

* Secure UEFI boot creates a secure path from power-on to the loading of the OS. It's plainly stated that this is the only way to prevent rootkits
* OEMs have it in their best interest to allow computer owners to enable/disable this feature to allow OSs that don't support it to be installed.
* OEMs that want to sell PCs preloaded with Windows 8 will have the feature enabled by default.
* OEMs that want to sell PCs with Windows 7, Linux, or other OSs will have the feature disabled by default.

Given these facts, why is the Linux community shouting that the sky is falling, when in fact it have nothing to do with being nefarious or less secure.

This is what the article is trying to say.
@linux for me
"
If I purchase a PC and I can't run the OS of my choice on it, then I have deprived of my rights and my hard earned cash. That is illegal and violates the law in many ways."

That could well be the dumbest thing I have ever heard. Which law does it violate? Name it....
@linux for me - if you cannot install another OS of your choice on this imaginary PC, don't buy it. Surely you can build your own and not have to be abused by criminal computer makers and software manufacturers. If you know in advance that the PC is locked into Windows 8 or whatever, you have no legal recourse.
1 Vote
+ -
Your ability to turn off SafeBoot has *NOTHING* to do with Microsoft. Get over it.

Keep telling yourself that. One day you'll believe it.
@linux for me - So if I go to Best Buy, pick up the latest laptop, and then can't run MVS, CMS, OS/400, TOPS-20, DTSS, OS/X, VMS, and whatever 'OS of my choice on it' I can sue someone - and this is an anti-trust issue for msft?
@linux for me
absolutely, where do I sue Ford for the fact Chevy spark plugs can't be installed in my Triton V8

where do I sue Sony because when my Beta machine broke I wasn't able to install VHS parts that were current at the time.

where do I sue GE because I can't replace my dryer drum with a Maytag drum

where do I sue Nikon because i can't use my Camera bag full of Minolta lenses on my D200

I've been deprived!!!!!

Don't buy a PC with Win 8 installed, problem solved. Why anyone would do that, just to install Linux on it doesn't need the money if they can just throw away a good, functional and expensive OS, just for a free one. My Gawd get those blinders off!
@all the responses below linux for me

I have a really easy solution. For every machine sold without the ability to install any operating system besides Windows 8, put a sticker, large enough to easily be seen, stating "THIS MACHINE IS RESTRICTED ONLY TO WINDOWS 8 AND SHOULD NOT BE PURCHASED IF YOU WISH TO INSTALL OR HAVE INSTALLED ANYTHING OTHER THAN WINDOWS 8".

We'll see how many of those fly off the shelf.
@linux for me No one said you can't run the OS of your choice on it. You all just assume that to be the case. The OEM can implement it so it can be disabled. So go buy a WIN8 PC, disable it, then put whatever you want on it. Is that so difficult for you?

OR, go buy a linux PC... oh wait. You probably still NEED Windows I guess? Or you can't find a linux PC worth buying?
-1 Votes
+ -
@linux for me have you even read the article???? Microsoft WON'T include such thing....

And as far as I know, the laws you're talking about only apply in Linuxland (I believe it's next to Disneyland), so good luck with fighting you're imaginary lawsuit in your court :-p let me know the verdict!
@linux for me
In addition to the points made by others, keep in mind that turning on secure boot by default is only required for Logo certification. Microsoft has not said (at least not yet) that you can't sell a PC with Win8 and secure boot disable. It just won't be Logo certified. I see plenty of non-certified PCs being sold today. I see no reason why that would change.
@linux for me

Sorry, but while you should be right, the last time that happened, Microsoft gave $50,000,000 to the Bush Presidential Campaign and even though they lost the trial, they got to write the 'settlement'. Now, we have another party president, but Microsoft has already given this one more than $100 Million Dollars.

I wouldn't count on any legal remedies here in the United States.

If you live in Europe, you may see different results, unless you live in the UK or Germany.

Sorry, old news. Besides, As Mr. Bott says, it will be the OEM s that will be left out to dry. If you do win, they go out of business due to illegal actions that are just not enforced. If you lose, then you lose.

Besides, in the world today, justice is only for the biggest bank account. That would not be you.
@owlnet
Linux gives power to the people and is not on government handouts but government investments into the future.
@The Linux Geek
Or, not! Like the worms that is hijacking our UMVs?? Might not be too much of a furture there???
@The Linux Geek - wow - two breaks in a day and "cha-ching" easy money for me.
@owlnet

That's free as in freedom, not as in beer.

(Please read this without blinkers on eyes, brain or native curiosity)
@ansak
It is not our fault! If you mean freedom then say freedom. Call it freedom software, because free to the majority of us means like beer, sun, rain, wind--get the point??
@windozefreak
"Freedom" is a noun, so "free software" is correct whereas "freedom software" is not.
@windozefreak

I think you've been drinking too many of those free beers.
@Ed Bott

Better Question:

Why do Microsoft fanatics, like Ed Bott, make inflammatory FUD articles dissing users of Linux?

Also, what is wrong with wanting choice on the computer you purchased?

What is wrong with raising concerns about those who would limit those choices (whether that is Microsoft or it's OEMs)?

Finally, Ed Bott is such a Microsoft tool. In his world, anything non-Microsoft is evil incarnate, and anyone who uses other stuff is a "fanatic".
0 Votes
+ -
@jasdude

I know!

I always take his articles with that proverbial grain of salt!

My only concern as a consumer is that,

1) If I choose to do so, I can disable 'secure boot'
2) If I want to run an alternate O/S using 'secure boot', and I can get a signed bootloader; the OEM does not prevent me from installing the needed keys into the firmware.

IOW, not M$ only for secure boot.
0 Votes
+ -
@jasdude

1) Nobody is stopping you from making a choice.
2) UEFI isnt owned by Microsoft.
3) If the choice is taken away, it is done by the OEM. You can still choose your OEM.
@owlnet what strange concepts you have. Presumably you're referring to paid support for Redhat et. al.? Sure, you can pay Redhat, to choose just one. Or not, your choice. Whatever the point you're trying to make, you're incoherent in that you're not obligated to purchase support. If you want free support, use IRC, mailing lists and stackexchange, which, again, are free. Pardon, what's your point? Presumably you're conflating the GPL with communism, or something.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
  • Business Execution: Executive Buyer's Guide There's a big difference between strategy and execution. Take a look at this white paper to learn how you can take your business strategies into the real world with the help of assets you already have access to, your employees. (SuccessFactors) Download Now
  • The Next Generation Cloud and Your Network The cloud is already on the verge of version 2.0. It's more than file storage and collaboration now. To learn more, check out this video. You'll see why the cloud is getting everyone excited, again. (Silver Peak Systems, Inc.) Download Now
  • Network+ 2011 Exam N10-005 Updates Check out this white paper to learn about the latest updates to the Network+ exam. Discover what kind of knowledge they deem essential, and make sure you're prepared. (Global Knowledge) Download Now
ie8 fix
ie8 fix