subject:"Re\: \[arch\-general\] Campaign against Secure Boot"

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Ralf Mardorf

On Mon, 2012-06-25 at 22:29 -0400, Manolo Martínez wrote:
 On 06/26/12 at 12:55am, Karol Babioch wrote:
  I have only the following criticism: Given the relatively low cost of
  getting a signed certificate from Microsoft (to my knowledge it will
  cost about 100 USD), it might fail to achieve what it is proposed to.
  Obviously Microsoft will try to prevent any sort of abuse, but even if
  Microsoft only hands out signed certificates after some extensive checks
  to trustworthy companies/organisations, it can't control it from there
  on any more.
 
 Just for clarification: you seem to be endorsing a model in which
 organizations (linux distros?) pay Microsoft for the right to install
 non-Microsoft software in PCs. Is that correct?

First of all: Apologize for my OT noise.
Second: Yes, FLOSS users are willing to pay 99 USD to an organization
to use free as in beer software.

I can't resist: http://www.youtube.com/watch?v=4IXmHqPWxUw ;D

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Ralf Mardorf

On Tue, 2012-06-26 at 10:28 +0200, Ralf Mardorf wrote:
 On Mon, 2012-06-25 at 22:29 -0400, Manolo Martínez wrote:
  On 06/26/12 at 12:55am, Karol Babioch wrote:
   I have only the following criticism: Given the relatively low cost of
   getting a signed certificate from Microsoft (to my knowledge it will
   cost about 100 USD), it might fail to achieve what it is proposed to.
   Obviously Microsoft will try to prevent any sort of abuse, but even if
   Microsoft only hands out signed certificates after some extensive checks
   to trustworthy companies/organisations, it can't control it from there
   on any more.
  
  Just for clarification: you seem to be endorsing a model in which
  organizations (linux distros?) pay Microsoft for the right to install
  non-Microsoft software in PCs. Is that correct?
 
 First of all: Apologize for my OT noise.
 Second: Yes, FLOSS users are willing to pay 99 USD to an organization
 to use free as in beer software.
 
 I can't resist: http://www.youtube.com/watch?v=4IXmHqPWxUw ;D

In Germany we already have organizations that take money for not being
interested in their films and music, GEZ and GEMA. It takes a lawyer to
completely get rid of the GEZ, since they are stalking, once you get out
of this mafia and there's no way to get rid of the GEMA. As soon as you
buy any empty data media to store your data, your audio and video
productions, you need to pay to archive your own work. So Prince and
Madonna get money from Germans who never ever would listen to their
crap. Free downloads are not what artists make suffering, Prince,
Madonna and Metallica are the vampires who get money for the work of CC 
(Creative Commons)
artists. So let's pay M$ for not using M$. A business model that should be 
supported and perhaps you like to be fucked by 
http://de.wikipedia.org/wiki/Godwin%E2%80%99s_law too.

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Karol Babioch

Hi,

Am 26.06.2012 04:29, schrieb Manolo Martínez:
 Just for clarification: you seem to be endorsing a model in which
 organizations (linux distros?) pay Microsoft for the right to install
 non-Microsoft software in PCs. Is that correct?
Yeah, I see that this creeps the shit out of some of you. However can
anybody come up with a better model? Again, I can't. And I definitely
want to take advantage of Secure boot, so only signed code is run at
some point in the future.

Maybe for the sake of objectiveness we would be better of when some
neutral organization would take care of that, but for the time being I
can live with the fact that Microsoft is doing it. I don't expect them
to be too unfair here. And I don't think that they will make that much
money out of it. Furthermore they probably will have to invest some
serious amount of money in order to build a robust infrastructure for this.

Just compare the situation with SSL/TLS. Here you also have to invest
some money (which can cost up to a couple of thousand USD when dealing
with EV certificates) in order to provide your users/customers with
basic security. Archlinux sets a good example here.

Remember: You can always (by specification) turn off Secure boot, so
even small distributions won't be ruled out. As these small
distributions are probably used mainly by advanced users anyway, I don't
see much trouble here.

Personally I can totally live with the solution, which is proposed right
now. I'm also willing to donate some money to Arch, when they will have
struggle to come up with 100 USD for their certificate, if they choose
to get one in the future.

Best regards,
Karol Babioch



signature.asc
Description: OpenPGP digital signature

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Lars Madson

Karol ... don't ever accept the unacceptable because it's shaped as the
best proposition ever. Make your own. Microsoft should not ask people to
pay anything for a technology they impose, the new economy is about giving
what you produce, I guess we'll receive a lot and lower down the quantity
of shit productions. How have we done without secure boot until now ? So
you fix the hole at the begining of the process, but when does the process
really begin ? Did you install some malware yourself ? Ho, god, maybe we
should pay microsoft so they disable the ignorants neurones in our brains.
Karol please think a bit deeper and longer.

Future is beautiful
Laurent

2012/6/26 Karol Babioch ka...@babioch.de

 Hi,

 Am 26.06.2012 04:29, schrieb Manolo Martínez:
  Just for clarification: you seem to be endorsing a model in which
  organizations (linux distros?) pay Microsoft for the right to install
  non-Microsoft software in PCs. Is that correct?
 Yeah, I see that this creeps the shit out of some of you. However can
 anybody come up with a better model? Again, I can't. And I definitely
 want to take advantage of Secure boot, so only signed code is run at
 some point in the future.

 Maybe for the sake of objectiveness we would be better of when some
 neutral organization would take care of that, but for the time being I
 can live with the fact that Microsoft is doing it. I don't expect them
 to be too unfair here. And I don't think that they will make that much
 money out of it. Furthermore they probably will have to invest some
 serious amount of money in order to build a robust infrastructure for this.

 Just compare the situation with SSL/TLS. Here you also have to invest
 some money (which can cost up to a couple of thousand USD when dealing
 with EV certificates) in order to provide your users/customers with
 basic security. Archlinux sets a good example here.

 Remember: You can always (by specification) turn off Secure boot, so
 even small distributions won't be ruled out. As these small
 distributions are probably used mainly by advanced users anyway, I don't
 see much trouble here.

 Personally I can totally live with the solution, which is proposed right
 now. I'm also willing to donate some money to Arch, when they will have
 struggle to come up with 100 USD for their certificate, if they choose
 to get one in the future.

 Best regards,
 Karol Babioch

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Lars Madson

And remember one day when the Disable Secure Boot button is not present.
Well we have right to not allow that too.

2012/6/26 Lars Madson rwx...@gmail.com

 Karol ... don't ever accept the unacceptable because it's shaped as the
 best proposition ever. Make your own. Microsoft should not ask people to
 pay anything for a technology they impose, the new economy is about giving
 what you produce, I guess we'll receive a lot and lower down the quantity
 of shit productions. How have we done without secure boot until now ? So
 you fix the hole at the begining of the process, but when does the process
 really begin ? Did you install some malware yourself ? Ho, god, maybe we
 should pay microsoft so they disable the ignorants neurones in our brains.
 Karol please think a bit deeper and longer.

 Future is beautiful
 Laurent


 2012/6/26 Karol Babioch ka...@babioch.de

 Hi,

 Am 26.06.2012 04:29, schrieb Manolo Martínez:
  Just for clarification: you seem to be endorsing a model in which
  organizations (linux distros?) pay Microsoft for the right to install
  non-Microsoft software in PCs. Is that correct?
 Yeah, I see that this creeps the shit out of some of you. However can
 anybody come up with a better model? Again, I can't. And I definitely
 want to take advantage of Secure boot, so only signed code is run at
 some point in the future.

 Maybe for the sake of objectiveness we would be better of when some
 neutral organization would take care of that, but for the time being I
 can live with the fact that Microsoft is doing it. I don't expect them
 to be too unfair here. And I don't think that they will make that much
 money out of it. Furthermore they probably will have to invest some
 serious amount of money in order to build a robust infrastructure for
 this.

 Just compare the situation with SSL/TLS. Here you also have to invest
 some money (which can cost up to a couple of thousand USD when dealing
 with EV certificates) in order to provide your users/customers with
 basic security. Archlinux sets a good example here.

 Remember: You can always (by specification) turn off Secure boot, so
 even small distributions won't be ruled out. As these small
 distributions are probably used mainly by advanced users anyway, I don't
 see much trouble here.

 Personally I can totally live with the solution, which is proposed right
 now. I'm also willing to donate some money to Arch, when they will have
 struggle to come up with 100 USD for their certificate, if they choose
 to get one in the future.

 Best regards,
 Karol Babioch

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Kevin Chadwick

I understand that given Microsoft's record in the past, some of you are
worried, but when looking in the specifications (as Thomas already
pointed out) it is quite clear that Microsoft wants to do the right
thing here.

Personally I couldn't come up with a better way/infrastructure than the
one that is going to be implemented.

http://www.linuxfoundation.org/sites/main/files/lf_uefi_secure_boot_open_platforms.pdf

So basically the relative low price of 100 USD will mean that there
might be a lot of organizations with a signed certificate. It would only
take a breach into one of those organizations to get your code booted on
basically every machine. It is something like the current situation with
root CAs in SSL/TLS, but at least from my understanding there is not
necessarily a way of revoking certificates.

I agree with a lot of what you have said. There is nothing to stop this
$100 rising though.

The best part is it will likely force Motherboard manufacturers to raise
their security game.

UEFI is actually originally from Intel I believe but in order to get the
Windows 8 badge you need to adhere to Microsofts requirements and so
most motherboard/bios manufacturers will probably follow that. There
will be better and worse bioses, the question is what can the average
user do. I presume some security bioses will hardcode more aspects to
mitigate attacks not covered by Microsoft's spec even and not caring
about this badge.

Really I need to find the time to more than skim through this spec
and Intels or others.

http://download.microsoft.com/download/A/D/F/ADF5BEDE-C0FB-4CC0-A3E1-B38093F50BA1/windows8-hardware-cert-requirements-system.pdf

Which states.

MANDATORY. The platform shall ship with an initial, possibly empty,
forbidden signature database (EFI_IMAGE_SECURITY_DATABASE1) created
with the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_ACCESS attribute. When a
signature is added to the forbidden signature database, upon reboot,
any image certified with that signature must not be allowed to
initialize/execute.

So revocation is possible likely even through Windows update.

AND

a) It shall be possible for a physically present user to use the Custom
Mode firmware setup option to modify the contents of the Secure Boot
signature databases and the PK.

!!
This may be implemented by simply providing the option to clear all
Secure Boot databases (PK, KEK, db, dbx) which will put the system into
setup mode.
!!

I haven't checked this as apparently the spec is like 2000 pages.

This link says setup mode spec makes no mention of key installation by
users being possible.

http://mjg59.dreamwidth.org/13713.html?replyto=521361

The problem is On/OFF is the only requirement but microsofts keys must
be recoverable if removed (even though 'database' suggests a multiple
key feature is possible). Chances are many will do the least possible
to adhere. There are no setup mode requirements as far as I can tell
but maybe they are.

It will come down to bios vendors but it would be best to have a USER
EDITABLE whitelist option (assuming the bios and password uses decent
password encryption and write protection) to prevent things like rogue
certs such as the recent windows update patch fixed or perhaps if your
security policy banned Windows ;-).

I have a few questions I'd investigate.

I believe Microsoft could use it as a selling or anti competition point
i.e. your company can use secure boot but only if you use Windows on
this cheap hardware you desire or bought last year. what's more is
there is no technical reason for this situation.

Can you sign keys as Tom mentioned? I hope so, the word import or
signed keys are not in Microsofts document atleast.

As you can disable it completely with a password you should be able to
install non OEM firmware such as Openbios.

Key import via password or even usb key auth would solve all of
these issues. I can't believe that has been overlooked without reason or
shall we say preference. It may be the disable option was an
afterthought must. It's not Microsoft's job to mandate good bios
practice but I'd say the right thing includes thinking about all
possible users especially when it will cost little more to be a
responsible party.

Considering Microsoft have stated they will provide security updates to
even pirated copies of Windows and yet require online! validation to
download the recent key signing security patch. I still don't trust
the vendor that started with stolen code. I can't see the requirment
for online validation being simply a mistake when I've also found more
than one friends machines seriously out of date without security warning
until WGA was installed.

Why not do something good every day and install BOINC.

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Kevin Chadwick



Having looked again at the fsfs campaign.

We, the undersigned, urge all computer makers implementing UEFI's
so-called Secure Boot to do it in a way that allows free software
operating systems to be installed. To respect user freedom and truly
protect user security, manufacturers must either allow computer owners
to disable the boot restrictions, or provide a sure-fire way for them
to install and run a free software operating system of their choice. We
commit that we will neither purchase nor recommend computers that strip
users of this critical freedom, and we will actively urge people in our
communities to avoid such jailed systems.

The latest spec (may 9th) mandates disabling, not sure if it has
changed in that respect? IN which case their may be light for the
following.


 I believe Microsoft could use it as a selling or anti competition point
 i.e. your company can use secure boot but only if you use Windows on
 this cheap hardware you desire or bought last year. what's more is
 there is no technical reason for this situation.
 
 
 
 Can you sign keys as Tom mentioned? I hope so, the word import or
 signed keys are not in Microsofts document atleast.

Ensuring users can add keys and allowing multiboot and reasonably easy
usage of livecds without disabling secureboot all together should be
the current campaign.

-- 


 Why not do something good every day and install BOINC.

Re: [arch-general] Campaign against Secure Boot

2012-06-26 Thread Kevin Chadwick

 Ensuring users can add keys and allowing multiboot and reasonably easy
 usage of livecds without disabling secureboot all together should be
 the current campaign.

And openbios installation. I wonder if Dell will only allow Dell
Windows?

-- 


 Why not do something good every day and install BOINC.

Re: [arch-general] Campaign against Secure Boot

2012-06-25 Thread Geoffroy PLANQUART


On Jun 25, 2012, at 6:24 AM, David C. Rankin wrote:

 On 06/22/2012 09:09 PM, Manolo Martínez wrote:
 Is Arch going to sign [this 
 petition](http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/statement)?
  I, for one humble user, would like it (us, whatever) to.
 
 Manolo

Did anyone sign it? I've got problem once submitting, I'm redirected to 
crm.fsf.org which says that I must be logged in :/

Am I the only one?

Re: [arch-general] Campaign against Secure Boot

2012-06-25 Thread fredbezies

2012/6/25 Geoffroy PLANQUART geoff...@planquart.fr


 On Jun 25, 2012, at 6:24 AM, David C. Rankin wrote:

  On 06/22/2012 09:09 PM, Manolo Martínez wrote:
  Is Arch going to sign [this petition](
 http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/statement)?
 I, for one humble user, would like it (us, whatever) to.
 
  Manolo

 Did anyone sign it? I've got problem once submitting, I'm redirected to
 crm.fsf.org which says that I must be logged in :/

 Am I the only one?


It worked for me this morning.



-- 
Frederic Bezies
fredbez...@gmail.com

Re: [arch-general] Campaign against Secure Boot

2012-06-25 Thread Patrick Burroughs

On Mon, Jun 25, 2012 at 12:49 AM, Geoffroy PLANQUART
geoff...@planquart.fr wrote:
 Did anyone sign it? I've got problem once submitting, I'm redirected to 
 crm.fsf.org which says that I must be logged in :/

 Am I the only one?

You're definitely not the only one, I'm having the same issue.

~Celti

Re: [arch-general] Campaign against Secure Boot

2012-06-25 Thread Arno Gaboury


On 06/25/2012 09:58 AM, Patrick Burroughs wrote:

On Mon, Jun 25, 2012 at 12:49 AM, Geoffroy PLANQUART
geoff...@planquart.fr wrote:

Did anyone sign it? I've got problem once submitting, I'm redirected to 
crm.fsf.org which says that I must be logged in :/

Am I the only one?

You're definitely not the only one, I'm having the same issue.

~Celti

I confirm same issue here.

Are fsf servers maybe running on windows servers?? :-)

43 matches

Mail list logo