ie8 fix

Linux and Open Source

Steven J. Vaughan-Nichols & Paula Rooney

Free Software Foundation urges OEMs to say no to mandatory Windows 8 UEFI cage

By | October 18, 2011, 1:26pm PDT

Summary: The Free Software Foundation is asking OEMs to give users a choice on Microsoft anti-Linux Windows 8’s United Extensive Firmware security “feature.”

The FSF wants to free you from Windows 8's UEFI cage.

The FSF wants to free you from the Windows 8 UEFI cage.

If you buy Microsoft’s explanation for the company requiring a version of UEFI (Unified Extensible Firmware Interface) on PCs that can run Windows 8, it’s there to protect users from next-generation malware. If you think that’s the only reason for the UEFI to be in there, I have a nice bridge in Brooklyn to sell you. The UEFI requirement is also there to block Linux and other alternative operating systems from booting on Windows 8 PCs. In response to this open-source operating system threat, the Free Software Foundation (FSF) has started a petition to urge original equipment manufacturers (OEM)s to give people a way to easily opt out of Microsoft’s Windows 8 UEFI cage.

The FSF fears, with reason, that Microsoft will make it difficult, if not impossible, for end-users to install other operating systems, such as Ubuntu 11.10 on Windows 8 systems. So it is that the FSF is asking users to “Stand up for your freedom to install free software” by signing a petition asking that UEFI be installed on Windows 8 systems in a way that will allow users to install Linux or other alternative open-source operating systems such as FreeBSD or OpenIndana, the successor operating system to OpenSolaris.

Specifically, the FSF is urging “all computer makers implementing UEFI’s so-called ‘Secure Boot’ to do it in a way that allows free software operating systems to be installed. To respect user freedom and truly protect user security, manufacturers must either allow computer owners to disable the boot restrictions, or provide a sure-fire way for them to install and run a free software operating system of their choice. We commit that we will neither purchase nor recommend computers that strip users of this critical freedom, and we will actively urge people in our communities to avoid such jailed systems.”

The reasons for this petition, the FSF, explained is that since “Microsoft has announced that if computer makers wish to distribute machines with the Windows 8 compatibility logo, they will have to implement a measure called ‘Secure Boot.’ However, it is currently up for grabs whether this technology will live up to its name, or will instead earn the name Restricted Boot.”

While admitting that “When done correctly, ‘Secure Boot’ is designed to protect against malware by preventing computers from loading unauthorized binary programs when booting.” The FSG continued, “In practice, this means that computers implementing it won’t boot unauthorized operating systems–including initially authorized systems that have been modified without being re-approved.”

That’s fine, as far as the FSF is concerned so “long as the user [is] able to authorize the programs she wants to use, so she can run free software written and modified by herself or people she trusts. However, we are concerned that Microsoft and hardware manufacturers will implement these boot restrictions in a way that will prevent users from booting anything other than Windows. In this case, we are better off calling the technology Restricted Boot, since such a requirement would be a disastrous restriction on computer users and not a security feature at all.”

Thus, “It is essential that manufacturers get their implementation of UEFI right. To respect user freedom and truly protect user security, they must either provide users a way of disabling the boot restrictions, or provide a sure-fire way that allows the computer owner to install a free software operating system of her choice.”

Amen.

While Steven Sinofsky, Microsoft’s president of the Windows division can say that “OEMs are free to choose how to enable this support,” given Microsoft’s long history of strong-arming OEMs and, indeed Bill Gates will soon be appearing in court again to defend how Microsoft used to attack competitors in the 90s, do we really have any reason to trust Microsoft today? I think not.

As Red Hat engineer Matthew Garrett said when he dug into the problems that UEFI posed for Linux, “The truth is that Microsoft’s move removes control from the end user and places it in the hands of Microsoft and the hardware vendors.” If you’d like to make sure the control about what runs on your PC remains in your hands and not Microsoft’s, I urge you to sign the FSF petition.

Related Stories:

Microsoft to stop Linux, older Windows, from running on Windows 8 PCs

Microsoft: Don’t blame us if Windows 8’s secure boot requirement blocks Linux dual-boot

Microsoft tries to block Linux off Windows 8 PCs

Will Windows 8 block users from dual-booting Linux? Microsoft won’t say

Yes, UEFI ’secure boot’ could lock out Linux from Windows 8 PCs

Caged animal image by <A HREF=”http://www.flickr.com/photos/vinothchandar/”> VinothChandar, </A>, CC 2.0.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system

Disclosure

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols is a freelance writer. He does not own stocks or other investments in any technology company.

Biography

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system; 300bps was a fast Internet connection; WordStar was the state of the art word processor; and we liked it!

His work has been published in everything from highly technical publications (IEEE Computer, ACM NetWorker, Byte) to business publications (eWEEK, InformationWeek, ZDNet) to popular technology (Computer Shopper, PC Magazine, PC World) to the mainstream press (Washington Post, San Francisco Chronicle, BusinessWeek).

94
Comments

Join the conversation!

Just In

RE: Free Software Foundation urges OEMs to say no to mandatory Windows 8 UEFI cage
grdetil 21st Oct
@black_bart
That's exactly what the FSF's awareness campaign, and their public statement to computer manufacturers, governments, and Microsoft, are trying to accomplish. But without this action, the most likely end result would be the manufacturers happily implementing the bare minimum Microsoft requires for Windows 8 certification, which would be shipping with UEFI secure boot enabled, but no requirement for a way to turn it off. They listen to Microsoft because of its huge marketing clout. They haven't historically listened to smaller players unless they raise a big stink about things that will potentially lock them out.
0 Votes
+ -
Like the new Sony PS3 that won't run Linux, JUST DON'T BUY THEM!
0 Votes
+ -
There will not be a choice.....
linux for me 19th Oct
@kd5auq

OEM's margins are so small, they will not make two versions of each model PC they sell. Therefore there will no longer be any choice at all.

This is nothing more than a power grab from Microsoft to keep from continuing to lose market share to Apple and to Linux. This is almost the same strategy that Microsoft used when taken to court for anti-trust violations in the past. I see that happening all over again, only I hope that this time Microsoft does get chopped into 2 or more pieces, which should have occurred last time.
@linux for me - I agree and I will sue MS and the OEM for exactly this. If I buy a laptop or motherboard that will not run what OS I choose, I will sue. Simple as that! I'll either get my OS running or I'll get rich... Either way, I win happy
@kd5auq The OEM's can always configure an option for each bootable partition, certificate or not. That way, if you boot partition #1, the certificate is passed in, if you boot partition #4 it is not.
@BrentRBrian
But it's only what they will do that ultimately matters.
0 Votes
+ -
More FUD from SJVN
Cylon Centurion Updated - 18th Oct
Say no to UEFI! Say YES to boot sector malware! ;)

"The UEFI requirement is also there to block Linux and other alternative operating systems from booting on Windows 8 PCs."

Sure, sure. You forgot to mention it also blocks previous versions of Windows. But who cares about that?
@Cylon Centurion : thats also to MS's benefit so they can drop the older versions
@deaf_e_kate

Microsoft already knows that doesn't happen like they wish, and they have already admitted Windows 8 will be run along side Windows 7.

Now, Windows 7 has support for UEFI boot, but lacks the keys to be booted with secured boot turned on. So, if they're admitting Windows 7 will still be here while Windows 8 is around, why would they shoot themselves by locking out Windows 7?
@Cylon Centurion : never trust what they say now, they have bottled out of many a hype over the years.
What about Vista and Xp? they are still around.
0 Votes
+ -
@Cylon Centurion
And Win7 is a MS product. So I'm sure that MS will find a way for users to secure-boot Win7, as required.

What does this have to do with users wanting to install their own OS?
@deaf_e_kate

What about XP and Vista? I don't get the question.

@Zogg
"And Win7 is a MS product. So I'm sure that MS will find a way for users to secure-boot Win7, as required."

I'm fairly sure that would require changing the boot process, which they wouldn't do.
@Cylon Centurion
It's not as if the existing Win7 installer understands UEFI and secure boot, is it? So MS will have some work to do anyway, and the UEFI will already contain the MS key, so that won't be a problem.
@Zogg

Windows 7 x64 is compatible with UEFI. But there is no reason to believe Microsoft would go back and alter the Windows 7 boot process to use secured boot.
0 Votes
+ -
There is every reason!
Zogg Updated - 19th Oct
@Cylon Centurion
"But there is no reason to believe Microsoft would go back and alter the Windows 7 boot process to use secured boot."

Don't be absurd! Win8 machines will use UEFI and secure boot, so there is every reason to suppose that MS will allow Win7 to be installed on them too. Why not create a Win7 installer that will use secure boot? The only problem would be getting its certificate in the UEFI, except that MS's certificate is guaranteed to be there already.
@Cylon Centurion But nobody cares about previous versions of Windows. It's Linux we care about.
Chromebooks also use secured boot. Where's the outrage there?
@Cylon Centurion Man !!! You are talking too many sensible things. It is not allowed here !!!!
@Cylon Centurion A link from a Googler with instructions for installing Ubuntu on a Cr-48:

http://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/cr-48-chrome-notebook-developer-information/how-to-boot-ubuntu-on-a-cr-48
"The Cr-48's boot process does not support initrd, which is required by Ubuntu. That leaves us three possibilities:
1. Use the existing Chrome OS kernel with the Ubuntu rootfs.
2. Recompile the Ubuntu kernel to do without initrd (ugh).
3. Modify the Chrome OS bootstub to handle initrd (double-ugh).

Looks like fun. This may end up taking desktop Linux back to the '90s, where only geeks used it.
0 Votes
+ -
RE: Free Software Foundation urges OEMs to say no to mandatory Windows 8 UEFI cage
LoverockDavidson_-24231404894599612871915491754222 18th Oct
I don't see a problem with the lockout. It prevents people from hosing up their PCs with linux. Microsoft is doing you a favor by enabling this. Its not like anyone would willingly want to run linux anyway, and if you don't like it buy hardware that doesn't have this UEFI on it. FSF and linux users have nothing better to do than complain and its all that negative energy that drives people away.
@LoverockDavidson_

So you are never going to set up virtualized servers using VMWare?
@benched42

LoverockDavidson_ is a troll. Don't feed it.
@LoverockDavidson_ I am posting the f**k you from a "willingly booted on Linux" computer.
@Ale82
Lovey just forgot to close his telnet port as usual.
0 Votes
+ -
Vote YES to UEFI
lazysquirrell 18th Oct
I want it, do you?

Linux who?
0 Votes
+ -
Stop being paranoid
Michael Alan Goff 18th Oct
If this had anything to do with blocking out other Operating Systems, they wouldn't have a way for other ones to get signed and allowed to pass the secure boot. If this was all about locking others out, specifically linux, they would be doing more than they are.

They would also try to take away the option to turn it off, which they have not.

This isn't about trying to take away my Linux, your Linux, or anyone else's Linux. This is about taking steps to do something to actually secure their Operating System.

Isn't your biggest complaint that Windows is less secure than Linux? Why are you complaining when they finally do something about it?
0 Votes
+ -
the old "deflect and change the subject" trick
thx-1138_@... Updated - 19th Oct
" ... Why are you complaining when they finally do something about it? "

You make it out like people are actually complaining about Windows, per se, which is actually off topic. If MS do indeed hold a proverbial gun to the OEMs' collective heads, do you think any OEM isn't going to play along with a mandatory, locked down, always-on UEFI BIOS?

You either are completely blinded to subtext .. or you're blissfully optimistic or just downright rosy-color-spectacled about the very real chance the worse case scenario turns out to be right.

Irony of ironies ... it's typically, the sanguine-minded folks like you that are first to jump from their "beloved ship" soon after the massive iceberg (...seen all too late) hooves in alongside.
"Irony of ironies ... it's typically, the sanguine-minded folks like you that are first to jump from their "beloved ship" soon after the massive iceberg (...seen all too late) hooves in alongside."

I have no 'beloved ship'.

I want to see how this goes before I cast stones on either side.

"You make it out like people are actually complaining about Windows, per se, which is actually off topic. If MS do indeed hold a proverbial gun to the OEMs' collective heads, do you think any OEM isn't going to play along with a mandatory, locked down, always-on UEFI BIOS?"

If, if, if.

Listen, if they do that... I'll be on your side of the fence yelling at them. I like using Ubuntu, and right now I can't do that with Wubi. I really do hope that this gets fixed, since I like Wubi.
@Michael Alan Goff My biggest complaint is Windows sucks. Always did, always will. Linux doesn't need UEFI in order to be secure. Why can't Microsoft learn how to code an OS? You know I haven't run Windows in over 15 years now but it still manages to screw with me. Why is that?

I know life isn't fair but come on!
You haven't run Windows in over 15 yrs, but you know it sucks. You also say that it has "screwed you over". How? Aside from the fact that you can upgrade anything that isn't the processor, and I think there might even be a way to upgrade that, you never really need to buy a computer from the store again.

On the other hand, you could always buy a computer from one of the places that put together Linux machines. I don't see why they are used by so few people, since the average Linux fan seems to dislike Windows for whatever reason.
If users want an alternate operating system then they should buy it pre-installed!!!!!!
@jatbains : why? some of us are not lemmings, we like to make our own decisions.
@deaf_e_kate You Linux zealots don't want Windows anyway. So buy your own Linux PC and forget Windows.
@jhammackHTH
That's crap and you know it. I'm a dual user and given the ubiquity of Windows, we can't forget.
@jatbains Why should I be forced to BUY anything? I reject your cult of consumerism.
0 Votes
+ -
Remember, operating systems should be hard!`
Cynical99 Updated - 18th Oct
besides, if someone is smart enough to install Linux, they can disable the security settings on their own. Yippee, let the technocrats do their own thing. FSF on the other hand is clueless as usual.

Besides, as an OEM it costs me money to support the systems after they leave my warehouse. If I lock them down so the end user can screw them up, I save money. Since most of them don't know how to spell Linux or XP, locking saves me a boatload.

Security ON! It's a no brainer.
0 Votes
+ -
"Security ON! It's a no brainer.
Rabid Howler Monkey 18th Oct
@Cynical99 Not only that, but let's take costs a little further. HP has recently made noise about getting out of the PC business because the margins are so low and making a reasonable profit is difficult. The other OEMs, Dell, Lenovo, etc., must be feeling similar pressure, especially those lacking an enterprise business unit like HP has.

The OEMs should consider making the ability to disable boot restrictions a paid option, say $50 to $100. You know, on the drop-down list one sees when customizing their PC while purchasing it online. This will help their bottom line a bit as most Linux users don't purchase Microsoft Office, internet security and other software when they purchase a PC. And while they're at it, they can add an option for no operating system pre-installed. That's right, no Microsoft Windows 8. Any cost savings will, of course, be canceled out by their inability to install crapware on the desktop PC.

And when the desktop Linux and other users complain, the OEMs can direct them to the Apple Store (retail or online) where they can buy a Mac to install their desktop Linux or otherwise on. Because even with the added $50 to $100, Macs will still be more expensive than desktop PCs.
@Rabid Howler Monkey

That brings to mind another scenario... What if the user already has a Mac and wants to dual-boot with Windows 8?
@Rabid Howler Monkey HP is having a hard time scraping up 400 million dollar bonuses for all of their CEOs these days are they? Cry me a river!
@Cynical99 I'll help you with your money problems. None from me for you to have to worry about! I really hope you fall down in the gutter and die from lack of food. You deserve it.
0 Votes
+ -
Dirty Tricks
oraqol Updated - 18th Oct
If it can be disabled by OEM then not a big deal. But why not just give end user option and set it to ON by default? This reeks of sketch. Tho really, who's going to buy 8 anyway? They're all gonna stick with 7 instead of upgrading, just like they did with XP instead of Vista; if new hardware can't run 7, then OEMs will disable lockdown in order to move product. MS is trying to survive via patent trolling, hardware lockdowns and just general shadiness, but they're end products are basically poop: desktop, handheld and especially server. Fun to watch MS flail about, trying desperately to stay relevant. Xbox is still cool tho.

PS: These MS trolls are funny, I swear I've seen the same few comments on at least 3 other sites almost verbatim. And they call US fanboys! XD
@oraqol

The end user has no interest in jumping through hoops to get gadgets working. If it comes off by default, I can guarantee you it would remain off for the entire life of that machine.
0 Votes
+ -
Umm, yeah...
oraqol 18th Oct
@Cylon Centurion That's why I said ship it ON by default...
@oraqol

"But why not just give end user option and set it to ON by default?"

Sounds as if you want the option to have the user turn it on. AKA, it's off by default. Sorry for the misunderstanding.
Sounds as if you want the option to have the user turn it on. AKA, it's off by default. Sorry for the misunderstanding.

There isn't going to be a default. Not if they want that Windows 8 sticker there won't. MS will make sure of that.
@oraqol Good God where do the retards come from. One of the dumbest posts ever.
0 Votes
+ -
U mad, bro?
oraqol 19th Oct
@jhammackHTH Cool story, tho.
Open Source guy M Garret says of Linux working on secure boot...
"Adding support is probably about a week's worth of effort at most."
@JeffMcClintock Good post. Here are two links to Matthew Garrett's writings on UEFI and Linux:

"Supporting UEFI secure boot on Linux: the details
http://mjg59.dreamwidth.org/6054.html

"UEFI secure booting
http://mjg59.dreamwidth.org/5552.html

For those interested in bypassing all the hype.
@Rabid Howler Monkey
Thank you for the links.
I think most of the hype is based on mistrust of Microsoft.
They have over the years earned a fair bit of mistrust and sometimes rightfully so.
Linux fans of yesteryear: Microsux is killing Linux by FORCING the OEMs to run Winblows! ANTI-TRUST!

Linux fans today: Microsux is killing Linux by NOT FORCING the OEMs to have the option to disable secured boot! ANTI-TRUST!
@black_bart
That's exactly what the FSF's awareness campaign, and their public statement to computer manufacturers, governments, and Microsoft, are trying to accomplish. But without this action, the most likely end result would be the manufacturers happily implementing the bare minimum Microsoft requires for Windows 8 certification, which would be shipping with UEFI secure boot enabled, but no requirement for a way to turn it off. They listen to Microsoft because of its huge marketing clout. They haven't historically listened to smaller players unless they raise a big stink about things that will potentially lock them out.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix