FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > ArchLinux > ArchLinux General Discussion

 
 
LinkBack Thread Tools
 
Old 06-25-2012, 11:43 PM
Ralf Mardorf
 
Default Campaign against Secure Boot

On Tue, 2012-06-26 at 01:29 +0200, Ralf Mardorf wrote:
> On Tue, 2012-06-26 at 00:55 +0200, Karol Babioch wrote:
> > Hi,
> >
> > seems to be a classical case of Godwin's law .
>
> I've got no time to read your mail now, I'll do it later, but regarding
> to the first sentences, Godwin's law is another issue. When talking
> about different opinions there often is a confusion with fascism. But
> the discussion is about "freedom" in FLOSS, a real discussion where
> fascism might or might nor be involved. Btw. Mr. Goldwin
> http://upload.wikimedia.org/wikipedia/commons/thumb/8/8d/Mike_Godwin_at_Wikimedia_2010.jpg/220px-Mike_Godwin_at_Wikimedia_2010.jpg is not that smart as some people guess that he is, since a rule already pretentious implemented a "thingy". Does Mr. Goldwin stand above others? IMO he's just a smartass. His statement suffers from pretensions. A gobshite is unimpeachably, hence he doesn't have any opinion. To jump on bandwagons is easy.
>
> I might be mistaken regarding to my opinion or any other person might be
> mistaken to her/his opinion, but Godwin's law is just contemptuous, it's
> absolutely incorrect. Using such a unreflected law is a paradox, since
> it's the most evil fascism in itself, because it's a stupid
> generalisation.

In German I'm eloquent, my English is terrible broken. Godwin simply is
an asshole. It's easy to pronounce sentence of death, but living a
secure stiffs live without risking anything for humanity.

People can mistaken, but it's important that they risk something. Godwin
just is a somebody else wearing designer glasses, just talking ... at
least he seems to be, I don't know him personal.
 
Old 06-26-2012, 12:05 AM
Ralf Mardorf
 
Default Campaign against Secure Boot

On Tue, 2012-06-26 at 01:43 +0200, Ralf Mardorf wrote:
> On Tue, 2012-06-26 at 01:29 +0200, Ralf Mardorf wrote:
> > On Tue, 2012-06-26 at 00:55 +0200, Karol Babioch wrote:
> > > Hi,
> > >
> > > seems to be a classical case of Godwin's law .
> >
> > I've got no time to read your mail now, I'll do it later, but regarding
> > to the first sentences, Godwin's law is another issue. When talking
> > about different opinions there often is a confusion with fascism. But
> > the discussion is about "freedom" in FLOSS, a real discussion where
> > fascism might or might nor be involved. Btw. Mr. Goldwin
> > http://upload.wikimedia.org/wikipedia/commons/thumb/8/8d/Mike_Godwin_at_Wikimedia_2010.jpg/220px-Mike_Godwin_at_Wikimedia_2010.jpg is not that smart as some people guess that he is, since a rule already pretentious implemented a "thingy". Does Mr. Goldwin stand above others? IMO he's just a smartass. His statement suffers from pretensions. A gobshite is unimpeachably, hence he doesn't have any opinion. To jump on bandwagons is easy.
> >
> > I might be mistaken regarding to my opinion or any other person might be
> > mistaken to her/his opinion, but Godwin's law is just contemptuous, it's
> > absolutely incorrect. Using such a unreflected law is a paradox, since
> > it's the most evil fascism in itself, because it's a stupid
> > generalisation.
>
> In German I'm eloquent, my English is terrible broken. Godwin simply is
> an asshole. It's easy to pronounce sentence of death, but living a
> secure stiffs live without risking anything for humanity.
>
> People can mistaken, but it's important that they risk something. Godwin
> just is a somebody else wearing designer glasses, just talking ... at
> least he seems to be, I don't know him personal.

PPS: I'm still the idiot, however, for some hardware UEFI can't be
disabled. I never mentioned Hitler. Again, good luck, I'm still using
Intel and/or AMD boards, where it should be possible to disable UEFI.
Should I be quiet, just because there aren't issues for me? I'm only
installing Linux distros, no Windows 8.

Simple, later I read all mails and if needed I'll excuse, if I should
notice that I was mistaken. M$ never ever will excuse, but being quiet
as Microsoft is, seems to be the more accepted way, even on Linux
mailing lists?

Pleas can anybody quote something where Mr. Godwin has risk his own
ass?!
 
Old 06-26-2012, 02:29 AM
Manolo Martínez
 
Default Campaign against Secure Boot

On 06/26/12 at 12:55am, Karol Babioch wrote:
> I have only the following criticism: Given the relatively low cost of
> getting a signed certificate from Microsoft (to my knowledge it will
> cost about 100 USD), it might fail to achieve what it is proposed to.
> Obviously Microsoft will try to prevent any sort of abuse, but even if
> Microsoft only hands out signed certificates after some extensive checks
> to trustworthy companies/organisations, it can't control it from there
> on any more.

Just for clarification: you seem to be endorsing a model in which
organizations (linux distros?) pay Microsoft for the right to install
non-Microsoft software in PCs. Is that correct?

Manolo
 
Old 06-26-2012, 06:42 AM
"saearea-test@yahoo.com"
 
Default Campaign against Secure Boot

Von: Ralf Mardorf <ralf.mardorf@alice-dsl.net>
An: General Discussion about Arch Linux <arch-general@archlinux.org>
CC: ubuntu-studio-users <ubuntu-studio-users@lists.ubuntu.com>
Gesendet: 15:08 Montag, 25.Juni 2012
Betreff: Re:
Campaign against Secure Boot

On Debian user mailing list somebody mentioned that hitting "Enter"
instead of using the "Save" button did work for him to sign up at
fsf.org.

IIRC the "Save" button did work for me this morning.


--
Ubuntu-Studio-users mailing list
Ubuntu-Studio-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-studio-users



Neither has worked for me.
--
Ubuntu-Studio-users mailing list
Ubuntu-Studio-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-studio-users
 
Old 06-26-2012, 08:28 AM
Ralf Mardorf
 
Default Campaign against Secure Boot

On Mon, 2012-06-25 at 22:29 -0400, Manolo Martínez wrote:
> On 06/26/12 at 12:55am, Karol Babioch wrote:
> > I have only the following criticism: Given the relatively low cost of
> > getting a signed certificate from Microsoft (to my knowledge it will
> > cost about 100 USD), it might fail to achieve what it is proposed to.
> > Obviously Microsoft will try to prevent any sort of abuse, but even if
> > Microsoft only hands out signed certificates after some extensive checks
> > to trustworthy companies/organisations, it can't control it from there
> > on any more.
>
> Just for clarification: you seem to be endorsing a model in which
> organizations (linux distros?) pay Microsoft for the right to install
> non-Microsoft software in PCs. Is that correct?

First of all: Apologize for my OT noise.
Second: Yes, FLOSS users are willing to pay 99 USD to an organization
to use free as in beer software.

I can't resist: http://www.youtube.com/watch?v=4IXmHqPWxUw ;D
 
Old 06-26-2012, 09:07 AM
Ralf Mardorf
 
Default Campaign against Secure Boot

On Tue, 2012-06-26 at 10:28 +0200, Ralf Mardorf wrote:
> On Mon, 2012-06-25 at 22:29 -0400, Manolo Martínez wrote:
> > On 06/26/12 at 12:55am, Karol Babioch wrote:
> > > I have only the following criticism: Given the relatively low cost of
> > > getting a signed certificate from Microsoft (to my knowledge it will
> > > cost about 100 USD), it might fail to achieve what it is proposed to.
> > > Obviously Microsoft will try to prevent any sort of abuse, but even if
> > > Microsoft only hands out signed certificates after some extensive checks
> > > to trustworthy companies/organisations, it can't control it from there
> > > on any more.
> >
> > Just for clarification: you seem to be endorsing a model in which
> > organizations (linux distros?) pay Microsoft for the right to install
> > non-Microsoft software in PCs. Is that correct?
>
> First of all: Apologize for my OT noise.
> Second: Yes, FLOSS users are willing to pay 99 USD to an organization
> to use free as in beer software.
>
> I can't resist: http://www.youtube.com/watch?v=4IXmHqPWxUw ;D

In Germany we already have organizations that take money for not being
interested in their films and music, GEZ and GEMA. It takes a lawyer to
completely get rid of the GEZ, since they are stalking, once you get out
of this mafia and there's no way to get rid of the GEMA. As soon as you
buy any empty data media to store your data, your audio and video
productions, you need to pay to archive your own work. So Prince and
Madonna get money from Germans who never ever would listen to their
crap. Free downloads are not what artists make suffering, Prince,
Madonna and Metallica are the vampires who get money for the work of CC (Creative Commons)
artists. So let's pay M$ for not using M$. A business model that should be supported and perhaps you like to be fucked by http://de.wikipedia.org/wiki/Godwin%E2%80%99s_law too.
 
Old 06-26-2012, 10:12 AM
Karol Babioch
 
Default Campaign against Secure Boot

Hi,

Am 26.06.2012 04:29, schrieb Manolo Martínez:
> Just for clarification: you seem to be endorsing a model in which
> organizations (linux distros?) pay Microsoft for the right to install
> non-Microsoft software in PCs. Is that correct?
Yeah, I see that this creeps the shit out of some of you. However can
anybody come up with a better model? Again, I can't. And I definitely
want to take advantage of Secure boot, so only signed code is run at
some point in the future.

Maybe for the sake of objectiveness we would be better of when some
neutral organization would take care of that, but for the time being I
can live with the fact that Microsoft is doing it. I don't expect them
to be too unfair here. And I don't think that they will make that much
money out of it. Furthermore they probably will have to invest some
serious amount of money in order to build a robust infrastructure for this.

Just compare the situation with SSL/TLS. Here you also have to invest
some money (which can cost up to a couple of thousand USD when dealing
with EV certificates) in order to provide your users/customers with
"basic" security. Archlinux sets a good example here.

Remember: You can always (by specification) turn off Secure boot, so
even "small" distributions won't be ruled out. As these "small"
distributions are probably used mainly by advanced users anyway, I don't
see much trouble here.

Personally I can totally live with the solution, which is proposed right
now. I'm also willing to donate some money to Arch, when they will have
struggle to come up with 100 USD for their certificate, if they choose
to get one in the future.

Best regards,
Karol Babioch
 
Old 06-26-2012, 10:46 AM
Lars Madson
 
Default Campaign against Secure Boot

Karol ... don't ever accept the unacceptable because it's shaped as the
best proposition ever. Make your own. Microsoft should not ask people to
pay anything for a technology they impose, the new economy is about giving
what you produce, I guess we'll receive a lot and lower down the quantity
of shit productions. How have we done without secure boot until now ? So
you fix the hole at the begining of the process, but when does the process
really begin ? Did you install some malware yourself ? Ho, god, maybe we
should pay microsoft so they disable the ignorants neurones in our brains.
Karol please think a bit deeper and longer.

Future is beautiful
Laurent

2012/6/26 Karol Babioch <karol@babioch.de>

> Hi,
>
> Am 26.06.2012 04:29, schrieb Manolo Martínez:
> > Just for clarification: you seem to be endorsing a model in which
> > organizations (linux distros?) pay Microsoft for the right to install
> > non-Microsoft software in PCs. Is that correct?
> Yeah, I see that this creeps the shit out of some of you. However can
> anybody come up with a better model? Again, I can't. And I definitely
> want to take advantage of Secure boot, so only signed code is run at
> some point in the future.
>
> Maybe for the sake of objectiveness we would be better of when some
> neutral organization would take care of that, but for the time being I
> can live with the fact that Microsoft is doing it. I don't expect them
> to be too unfair here. And I don't think that they will make that much
> money out of it. Furthermore they probably will have to invest some
> serious amount of money in order to build a robust infrastructure for this.
>
> Just compare the situation with SSL/TLS. Here you also have to invest
> some money (which can cost up to a couple of thousand USD when dealing
> with EV certificates) in order to provide your users/customers with
> "basic" security. Archlinux sets a good example here.
>
> Remember: You can always (by specification) turn off Secure boot, so
> even "small" distributions won't be ruled out. As these "small"
> distributions are probably used mainly by advanced users anyway, I don't
> see much trouble here.
>
> Personally I can totally live with the solution, which is proposed right
> now. I'm also willing to donate some money to Arch, when they will have
> struggle to come up with 100 USD for their certificate, if they choose
> to get one in the future.
>
> Best regards,
> Karol Babioch
>
>
 
Old 06-26-2012, 10:51 AM
Lars Madson
 
Default Campaign against Secure Boot

And remember one day when the "Disable Secure Boot" button is not present.
Well we have right to not allow that too.

2012/6/26 Lars Madson <rwx700@gmail.com>

> Karol ... don't ever accept the unacceptable because it's shaped as the
> best proposition ever. Make your own. Microsoft should not ask people to
> pay anything for a technology they impose, the new economy is about giving
> what you produce, I guess we'll receive a lot and lower down the quantity
> of shit productions. How have we done without secure boot until now ? So
> you fix the hole at the begining of the process, but when does the process
> really begin ? Did you install some malware yourself ? Ho, god, maybe we
> should pay microsoft so they disable the ignorants neurones in our brains.
> Karol please think a bit deeper and longer.
>
> Future is beautiful
> Laurent
>
>
> 2012/6/26 Karol Babioch <karol@babioch.de>
>
>> Hi,
>>
>> Am 26.06.2012 04:29, schrieb Manolo Martínez:
>> > Just for clarification: you seem to be endorsing a model in which
>> > organizations (linux distros?) pay Microsoft for the right to install
>> > non-Microsoft software in PCs. Is that correct?
>> Yeah, I see that this creeps the shit out of some of you. However can
>> anybody come up with a better model? Again, I can't. And I definitely
>> want to take advantage of Secure boot, so only signed code is run at
>> some point in the future.
>>
>> Maybe for the sake of objectiveness we would be better of when some
>> neutral organization would take care of that, but for the time being I
>> can live with the fact that Microsoft is doing it. I don't expect them
>> to be too unfair here. And I don't think that they will make that much
>> money out of it. Furthermore they probably will have to invest some
>> serious amount of money in order to build a robust infrastructure for
>> this.
>>
>> Just compare the situation with SSL/TLS. Here you also have to invest
>> some money (which can cost up to a couple of thousand USD when dealing
>> with EV certificates) in order to provide your users/customers with
>> "basic" security. Archlinux sets a good example here.
>>
>> Remember: You can always (by specification) turn off Secure boot, so
>> even "small" distributions won't be ruled out. As these "small"
>> distributions are probably used mainly by advanced users anyway, I don't
>> see much trouble here.
>>
>> Personally I can totally live with the solution, which is proposed right
>> now. I'm also willing to donate some money to Arch, when they will have
>> struggle to come up with 100 USD for their certificate, if they choose
>> to get one in the future.
>>
>> Best regards,
>> Karol Babioch
>>
>>
>
 
Old 06-26-2012, 02:26 PM
Kevin Chadwick
 
Default Campaign against Secure Boot

> I understand that given Microsoft's record in the past, some of you are
> worried, but when looking in the specifications (as Thomas already
> pointed out) it is quite clear that Microsoft wants to do the right
> thing here.
>
> Personally I couldn't come up with a better way/infrastructure than the
> one that is going to be implemented.
>

http://www.linuxfoundation.org/sites/main/files/lf_uefi_secure_boot_open_platforms.pdf

>
> So basically the relative low price of 100 USD will mean that there
> might be a lot of organizations with a signed certificate. It would only
> take a breach into one of those organizations to get your code booted on
> basically every machine. It is something like the current situation with
> root CAs in SSL/TLS, but at least from my understanding there is not
> necessarily a way of revoking certificates.

I agree with a lot of what you have said. There is nothing to stop this
$100 rising though.

The best part is it will likely force Motherboard manufacturers to raise
their security game.

UEFI is actually originally from Intel I believe but in order to get the
Windows 8 badge you need to adhere to Microsofts requirements and so
most motherboard/bios manufacturers will probably follow that. There
will be better and worse bioses, the question is what can the average
user do. I presume some security bioses will hardcode more aspects to
mitigate attacks not covered by Microsoft's spec even and not caring
about this badge.

Really I need to find the time to more than skim through this spec
and Intels or others.

http://download.microsoft.com/download/A/D/F/ADF5BEDE-C0FB-4CC0-A3E1-B38093F50BA1/windows8-hardware-cert-requirements-system.pdf

Which states.

MANDATORY. The platform shall ship with an initial, possibly empty,
"forbidden" signature database (EFI_IMAGE_SECURITY_DATABASE1) created
with the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_ACCESS attribute. When a
signature is added to the forbidden signature database, upon reboot,
any image certified with that signature must not be allowed to
initialize/execute.

So revocation is possible likely even through Windows update.

AND

a) It shall be possible for a physically present user to use the Custom
Mode firmware setup option to modify the contents of the Secure Boot
signature databases and the PK.
__________________________________________________ ______________________
!!
This may be implemented by simply providing the option to clear all
Secure Boot databases (PK, KEK, db, dbx) which will put the system into
setup mode.
!!

I haven't checked this as apparently the spec is like > 2000 pages.


This link says setup mode spec makes no mention of key installation by
users being possible.

http://mjg59.dreamwidth.org/13713.html?replyto=521361

__________________________________________________ ______________________


The problem is On/OFF is the only requirement but microsofts keys must
be recoverable if removed (even though 'database' suggests a multiple
key feature is possible). Chances are many will do the least possible
to adhere. There are no setup mode requirements as far as I can tell
but maybe they are.


It will come down to bios vendors but it would be best to have a USER
EDITABLE whitelist option (assuming the bios and password uses decent
password encryption and write protection) to prevent things like rogue
certs such as the recent windows update patch fixed or perhaps if your
security policy banned Windows ;-).


I have a few questions I'd investigate.

I believe Microsoft could use it as a selling or anti competition point
i.e. your company can use secure boot but only if you use Windows on
this cheap hardware you desire or bought last year. what's more is
there is no technical reason for this situation.



Can you sign keys as Tom mentioned? I hope so, the word import or
signed keys are not in Microsofts document atleast.



As you can disable it completely with a password you should be able to
install non OEM firmware such as Openbios.

Key import via password or even usb key auth would solve all of
these issues. I can't believe that has been overlooked without reason or
shall we say preference. It may be the disable option was an
afterthought must. It's not Microsoft's job to mandate good bios
practice but I'd say the right thing includes thinking about all
possible users especially when it will cost little more to be a
responsible party.

Considering Microsoft have stated they will provide security updates to
even pirated copies of Windows and yet require online! validation to
download the recent key signing security patch. I still don't trust
the vendor that started with stolen code. I can't see the requirment
for online validation being simply a mistake when I've also found more
than one friends machines seriously out of date without security warning
until WGA was installed.

--
__________________________________________________ ______

Why not do something good every day and install BOINC.
__________________________________________________ ______
 

Thread Tools




All times are GMT. The time now is 09:54 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org