Redhat/Fedora selling out to Microsoft

[tux99]

The last option wasn't hugely attractive, but is probably the least worst. Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access), but it's cheaper than any realistic alternative would have been. It ensures compatibility with as wide a range of hardware as possible and it avoids Fedora having any special privileges over other Linux distributions. If there are better options then we haven't found them. So, in all probability, this is the approach we'll take. Our first stage bootloader will be signed with a Microsoft key.

http://mjg59.dreamwidth.org/12368.html

My reply to this:

This is completely unacceptable to me. I'm very disappointed with Redhat.

Redhat is a billion dollar company with a large market share in the server market, therefore has a lot of influence on hardware manufacturers (a lot of server manufacturers also make laptops and desktops), therefore Redhat should have used its influence to force a solution that would be acceptable to the FOSS world.

I will NEVER buy any hardware where 'secure boot' cannot be FULLY DISABLED (either by a BIOS option or by flashing a custom BIOS or with a hardware dip-switch) and if that means I will be stuck with 2012 hardware then so be it.


I hope you all make your voice heard too!

BTW, what is Mageia planning to do?

I hope Mageia isn't planning to pay Microsoft and become dependant on Microsoft's graciousness too?

[boklm]

The last option wasn't hugely attractive, but is probably the least worst. Microsoft will be offering signing services through their sysdev portal. It's not entirely free (there's a one-off $99 fee to gain access), but it's cheaper than any realistic alternative would have been. It ensures compatibility with as wide a range of hardware as possible and it avoids Fedora having any special privileges over other Linux distributions. If there are better options then we haven't found them. So, in all probability, this is the approach we'll take. Our first stage bootloader will be signed with a Microsoft key.

http://mjg59.dreamwidth.org/12368.html

My reply to this:

This is completely unacceptable to me. I'm very disappointed with Redhat.

Redhat is a billion dollar company with a large market share in the server market, therefore has a lot of influence on hardware manufacturers (a lot of server manufacturers also make laptops and desktops), therefore Redhat should have used its influence to force a solution that would be acceptable to the FOSS world.

That was one of the options explored but not adopted for the reasons explained in that blog post. Did you read it ?

I will NEVER buy any hardware where 'secure boot' cannot be FULLY DISABLED (either by a BIOS option or by flashing a custom BIOS or with a hardware dip-switch) and if that means I will be stuck with 2012 hardware then so be it.

Maybe you should read that blog post :
all x86 Windows machines will be required to have a firmware option to disable this or to permit users to enrol their own keys

[tux99]

That was one of the options explored but not adopted for the reasons explained in that blog post. Did you read it ?

Yes of course I read it, but the article contains an opinion and a choice made by Redhat, not absolute unavoidable reasons.

Redhat could have chosen to fight this and instead they chose the path of least resistance and gave in to what others (primarily Microsoft) are imposing.

Everything is negotiable and Redhat has a lot more power and influence than they seem to think they have.

This is a clear sell out of FOSS users, the 'solution' suits Redhat but is in no way acceptable from a FOSS user point of view.

all x86 Windows machines will be required to have a firmware option to disable this or to permit users to enrol their own keys

Like I already said as long as it will be complete disabling of 'secure boot' then I would be satisfied with that, but being forced to deal with my own keys is not a viable solution at all.

But I guess you know the saying about boiling the frog slowly...

This is being sold as a safety measure (unbelievably even by Redhat, I can't believe they are promoting the MS spin!) but in reality it's all about taking control away from the users.

"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
Benjamin Franklin



What is Mageia going to do? Will Mageia cave in to Microsoft's 'solution' too?

[doktor5000]

Well, i'm glad that everybody is entitled to have his own opionion. Seems you read more into that article and totally forgot to tell f.ex. about their fair reasoning regarding other linux distributions for example.

[wobo]

Do we already have "Saure-Gurken-Zeit"?

A German expression for the time in summer when only few exciting news are coming up because everybody is on holiday - during this time newspapers tend to warm up things like Nessie or the Yeti being caught (or Roswell)

If, that's a big IF, there will come a time when things will really be as you describe I will be all on your side and stick to the last machine which will be totally under my control until my life ends. But I'm not sure which will happen first.

As for your question, I haven't heard yet that Mageia (the board, council, community) even thought about "having a position" here.

[tkmm]

I will be all on your side and stick to the last machine which will be totally under my control until my life ends.

Me too! Linux has already slipped from it's original intent and values that spawned its creation and it seems before much longer we will be in need a new alternative... Richard Stallman of the Free Software Foundation seems to have predicted the Microsoft-ization of linux and has compiled this list http://www.gnu.org/distros/free-distros.html of fully free linux distributions.

I'm not sure when linux became a 'thing,' but I tend to blame Ubuntu. I know many Ubuntu users who like to drop the word 'linux,' but want a distribution that might as well be windows. One of my friends who likes to namedrop linux uses Ubuntu and can barely get a root shell even with sudo...I know Ubuntu has it's good points as well and I'm not trying to start anything here, but I tire of people not grasping the concept of 'free software' - (Someone not making money by closing off source-code rather than 'no-cost' software) - which is fine, but It hurts to see what seems like a majority of linux-users having this attitude (or is it aptitude?).

I fear the future of computing will become much like Orwell's 1984... I shan't wax political and must stop myself here... I agree tho, that it is frightening and disheartening to see this kind of totalitarian/monopolist licensing happening all over again.



tux99: If you haven't already read it, you may enjoy 'The Hacker Ethic.' A nice (somewhat dated in some respects) view of the history and somtimes future of computing.

http://www.amazon.com/The-Hacker-Ethic- ... 464&sr=8-1

[ghmitch]

I think we DO have to be concerned about this whole issue. BUT! We also have to try to avoid being too apocolyptic in our thinking about it. I think I was one of the first around here to sound the alarm about this whole secure boot fiasco. I think we can all agree that its a real pain the way it is being implemented ... and, of course, MS is ALWAYS a pain (they seem to pride themselves of their abilities in that department). BUT ... technology is ALWAYS in flux. MS can be on top one day ... and on the bottom the next. AND ... I am sure that Red Hat has ways to be a pain to MS as well. But they are not going to publicize that side of the equation. So ... here and there there will be minor concessions. But the point is not who wins the battle, but rather who wins the war. And I am not AT ALL convinced that we are at risk of losing the war on this issue. In the mean time there ARE institutional users who are DEMANDING that Red Hat supply a key to them. Thus Red Hat is simply doing what they have to do to keep their customers happy. And that, in the long term, is the kind of thing that is going to help us win the war. - George

[andreano]

Wow! This must be the greatest incentive ever for the European Union to charge Microsoft €€€€€€€€€€€€€ for uncompetitive practices.

EU has previously charged Microsoft big money to make them sell versions of Windows without Windows Media Player, and with a browser choice, for reasons I honestly think were silly. But this!

Microsoft is twisting hardware manufacturers around their little finger, with devastating consequences for the little competition that we are. I'm sure Microsoft have their reasons, but turning cryptography against other operating systems? Maybe 98% of the public don't see this as unfair competition, because they don't realise Microsoft has competition at all. Let people know.

I believe this deserves to be mentioned on Wikipedia:
http://en.wikipedia.org/wiki/Vendor_lock-in#Microsoft

As I see it, what survives on Wikipedia in the long run is ultimately the truth. That is how we, the community, govern the truth. EU will follow…

[zxr250cc]

I read a web site called slashdot a lot (http://www.slashdot.org) and they have been discussing the coming changes related to hardware security and boot loaders. I include one of the posts below since it offers a fair amount of information about the process that seems to be evolving.

Is security in a system good. Yes. Is the coming system the best way to do it? I am not sure.

I am sure that wild diatribes that sound like raving are not the solution to how we will all deal with this in future.

gcd

quoted below from /.

'MS doesn't control the keys; it's just that they're the ones driving the requirement OEM has a reason to ship a system with security enabled and not have the MS key.

The requirements for x86 hardware are that the system must ship with restrictions enabled, but the user must be allowed to disable the restrictions or add their own keys. In other words, there is nothing preventing you (the owner) from doing whatever you want with the machine. If you don't want the restrictions, simply turn them off and install whatever code you like.

The only issue is that machines with the Windows 8 logo will be required to ship with the restrictions enabled and RedHat doesn't want installation instructions that start with "disable UEFI security" or "enroll the RedHat public key".

Other options they rejected are:

1. Get all manufacturers to ship with RedHat's key in the firmware (in addition to MS's). The manufacturers had no problem with this, but there's no way they could possibly find every OEM to get them to do it, and they didn't want to be in a privileged position ("install RedHat because it's trusted by your OEM").

2. Get all Linux distros to coordinate on a single Linux key and have the OEMs add it to their hardware. This is undesirable because nobody wants to be responsible for maintaining the One True Key, and even then there would still be OEMs who don't ship with it.

In the end, the easiest thing is to pay a one-time fee of $99 to MS and have them sign a mini-bootloader that can start up grub. That doesn't sound like such a big deal to me.

Note that the issue with having only one signature on a file is unrelated. That just means a user can't realistically remove the MS key from their system because lots of drivers will be signed with it. Allowing multiple signatures on a file would not change RedHat's position.

dom'

[zxr250cc]

Here is a link to the full discussion:

http://linux.slashdot.org/story/12/05/3 ... strictions

Cheers,

gcd

[zxr250cc]

Here is how UBUNTU are planning to deal with boot loader changes:

http://www.phoronix.com/scan.php?page=n ... px=MTEyNDY

cheers,

gcd

[madeye]

In the end, the easiest thing is to pay a one-time fee of $99 to MS and have them sign a mini-bootloader that can start up grub. That doesn't sound like such a big deal to me.

Actually what I have been able to find out it is not MS that will get the $99. It's Verisign. They are the authority for signing the keys.

Let's face it. Nobody in their right mind would trust a key signed by MS anyway

Regarding the coming of secure boot. I am of two minds about it. I would need to try and work with it before deciding if I would say it's OK or if I would throw a brick in the face of the people responsible for it.
Security is always important. And even if an attack can get through this, it is one more layer of security. I have said it before and I will say it again. You cannot secure a system 100%. It's impossible. But you can put as many stumbling blocks as possible in the way of the attacker in the hope that he will eventually give up.

[zxr250cc]

Hi all,

I personally did not say to pay $99 to MS. That might have been in the quote I took from /. but not from me. I guess the quote marks don't show so well in my first post.

I was aware that the ONE TIME $99 fee did not go to MS. I was adding this data because it seemed more reasonable than the diatribe that started this thread.... It will be possible to use Linux with the new motherboards. That is the real info in all of this. We are essentially in this position now since we are not offered a secure boot and when we have a new secure motherboard with the secure boot turned off it will apparently work like a current motherboard. In effect, there will be no change from the present for a Linux user.

So much noise, so little actual content...

Cheers

gcd

[madeye]

I should have made that clear as well. I had read your post, and knew you had included that information from another source.
But as you say the important thing is that the user will have a choice.
For the people using computers around me it will not be a problem. They wouldn't want to install an operating system anyway. They leave that to me
So if there is something that needs to be done about secure boot. I will be responsible for it.
And that is also why I am interrested to see the inner workings of it. Now I just need to find a motherboard with this feature.

[zxr250cc]

I have been in Denmark for business in the past. Wonderful place...

gcd

[Max]

I've been following the MS Secure Boot thingy on Slashdot as well.
My take from it?
The next computer I will buy will certainly not come preloaded with Windoze. Ever since I've been introduced to Linux, whenever buying a new computer I would face this dilemma. Ultimately I always decide to buy with Windoze, as the incremental cost is relatively low, and I can keep it as a dual boot for when I need it. (For example: I have several college courses that require Visual Studio 2010 and Windoze compilers). And there really is no harm done to me.
But now? Definitely not. Why should I continue to support a company that is doing its damnedest to make things difficult for me? My next computer will either be a blank slate or come with some preloaded version of Linux which I'll erase.

[mmix]

First of all, have been there, i am pretty sad.

http://forums.fedoraforum.org/showthread.php?t=281524.

it is really crazy shit, nobody enforce fedora to do such a stupid thing..
just sad, AISB, it some kind of suicide..

[mmix]

non-uefi mobo, or new kind of pc or another android/iphone machine gain the momentum, then.
i would never buy/install any of uefi, linux distro!

[zxr250cc]

Hi mmix...

I wonder if English is not a native language for you since it seems that you have missed the correct meaning of the Fedora posts you sent us to see and other posts in here and other sites about secure boot option coming for x86 computers. (I am not making fun of your skills with English; I am merely wondering if you understand the posts you have read by others and links posted yourself?)

At present we do not have a secure boot option for x86 computers. In the future an x86 based computer that has the option to have secure boot is REQUIRED to be able to shut off that feature so it can boot any software OS that does not have the keys to work with secure boot.

We don't have it now and we can turn it off later and use the computer in the same manner that we do now. Why all the noise?

Not liking Microsoft is an understood idea but getting overwrought about a feature that doesn't actually keep us from using computers in the future seems to be yelling FIRE in a crowded room when there is no fire at the moment. This is not a money less world where everything can be totally free forever without some amount of money changing hands at some point to get something to function. Red Hat chose to spend $99 on a ONE TIME PAYMENT to make use of Fedora possible on a motherboard with the secure boot feature TURNED ON. That is a part of the coming standard. It is not the end of the world and Microsoft did not receive that nominal payment for the feature anyway. If companies choose to use the standard then the fee is reasonable. No one forced them to do it when they chose to join the consortium. They freely chose to do it and it seems the hope for the standard is greater security for computers in the future.

Intel started the secure boot idea with a consortium of companies. MS make the software that will be the number one software used for the hardware but they do not make any of that hardware and other software will be usable on the hardware. Trying to demonize Red Hat for being pragmatic and planning to do BUSINESS as a software services company makes very little sense because they are in fact a business.

This is software, not religion... relax a little.

ymmv

Cheers,

gcd

[mmix]

We don't have it now and we can turn it off later and use the computer in the same manner that we do now. Why all the noise?

we can? i am not sure.

[ghmitch]

As long as the system you purchase is NOT an ARM chip system, you will be able to disable secure boot. ARM chip systems, on the other hand, will be locked down IF they carry the Windows logo. I think it is VERY likely that there will be ARM chip mobos available that are NOT locked down as well. So THE SKY IS NOT FALLING ... at least not yet. Ubuntu is taking a different course. They will be setting up their own secure boot system directly with the hardware vendors. BUT that carries its own perils. ANY system, including LINUX SYSTEMS, become locked down once they implement secure boot. That means that you cannot add either hardware or software that is not pre-keyed for your secure boot system. This is why some major linux distributors are questioning whether the benefits of secure boot are even worth the price. - George

[mk]

I guess this topic will remain hot for a bit longer than C# and Mono. :)

Ok, my 1 cent.

Yes, every x86 base machine will be able to disable SB, no problem. Complaints about having to go to EFIed 'BIOS' to disable it are rather funny if we talk about Linux users though.
On one side, Linux users want complete control over their systems, I got that, I like it too. Why else I would use just openbox with gmrun for all my needs then.
But on the other, they complain about such a trivial thing, sorry, I'm missing some pieces here.

In general, the whole SB issue is just a waste of people's time, much more than Linux trademark was. Like it or not, we live in a world driven by money. MS has money and a BIG desktop market share, thus huge influence over OEMs selling desktop machines.
This whole thing is only about OEMs, not MS at all. MS as a company has no rights to tell users what to do if they buy an retail MB from somewhere. And here is the catch. Actually, it's good OEMs who want to have the W8 logo must provide the off switch, because no doubt, majority of them will want to have it. In case they would be free to do whatever they want (OEMs not caring about W8 logo can of course), we may likely end up with much more mobos that will not allow to disable SB. In this case, MS actually helps.
But sure, it's not because MS being *nix friendly, no no. Simple reason for x86 being able to get rid of SB is, yeah, you guessed it - older MS op. systems. 7,Vista and XP (support of which ends in 2014) know nothing about SB and people having those OSes would be angry on MS. No other reason behind it. MS can't afford cornering some *nix users and loosing much more of it's own customers by doing so. Again, money driven decision, but in *nix favor this time. Hmm, thinking about it, when such an MS' decision happened last time? :)

RH/Fedora selling out to MS, aaaahh.
OK, it may seem rather obscure to have MS key on your system, but really, after getting rid of the religious view, there is nothing wrong about it. If for nothing else, than just because MS has the resources to prevent the key from being exposed, hard to say if any *nix based company has the same kind of resources, but I would say not. Well, the way I see it is, money is the loyalty factor here. Verisign needs to live somehow, MS is well, MS, so it's not a good idea to even allow some small chance of the key being exposed. Also, those 99$ are going to Verisign, not MS.
Reading Garret's blog, I found the reasoning behind RH's decision perfectly logical. I admit there can be some part of RedHat influence in regards to it's profit, but again, we live in such world and without RH, no Fedora. I would love to see decisions being made without money concerns, but that is unfortunately impossible. But again, I'm talking about in-between-lines possibility, I'm not implying anything.
It's like the mentioned C# issue. RH declared that they will never support it. I guess it has something to do with those known license concerns (namely WinForms related), because in case they get real, RH could be in trouble, but Fedora can't, it's not a commercial entity, so they provide Mono without problem, although it's not installed by default.
It's rather sad, C# is great stuff to work with, namely in terms of cross-platform development, especially if you graphical app uses GTK#, simply installing Mono with GTK# on Windows machine is usually enough to directly run it there, if you chose GTK# as the toolkit of choice.
Comparison between porting C/C++ and C# code is out of question here. Than there are reasons not to use it like the fact it's managed code, sigh. Java,Python, PHP, Ruby - the same, yet no problem. Religion is always a problem.
But I got where I didn't intend to, sorry. :)

[mmix]

Free Software Foundation recommendations for free operating system distributions considering Secure Boot

https://www.fsf.org/campaigns/secure-bo ... epaper-web

https://www.gnu.org/distros/free-distros.html

We will continue to build public support around our statement against Restricted Boot. Over 31,000 people and 25 organizations have signed this statement, pledging not to buy any computer that they cannot install a free operating system on, and to advise others to do the same. We were pleased last week to add Debian GNU/Linux as an official organizational supporter of the statement. Subsequently, Trisquel and gNewSense have also added their signatures. When further actions need to be taken to stand up for this freedom as Secure Boot and Restricted Boot are rolled out, we will call upon this base of support. If you haven't yet signed, please do.

We will fight Microsoft's attempt at enforcing Restricted Boot on ARM devices like smartphones and tablets. Like any other computer, users must be able to install free software operating systems on these devices. We will monitor Microsoft's behavior to make sure they do not deceive the public again by expanding these restrictions to other kinds of systems.

We will work with (and when necessary, pressure) manufacturers and distributors to make the user instructions for working with Secure Boot on all systems extremely clear, so that users will be able to disable it and modify the approved keys with little difficulty and no bias. We will also work to make sure that users can change all of the software running on their machine, including the boot firmware itself.

We will offer our licensing and compliance resources to any free software developers to help them make sure they are complying with the GPL and other licenses as they implement Secure Boot. We will monitor distributions of signed GPLv3 software to ensure that they respect the necessary user freedoms, including providing installation instructions and materials.

We have already started exploring ways in which the FSF can work with manufacturers on behalf of the entire free software community to make free software operating systems installable with default Secure Boot hardware settings.

We will continue to work with companies like Lemote, Freedom Included, ZaReason, ThinkPenguin, Los Alamos Computers, Garlach44, and InaTux to make computers available that are preinstalled with fully free GNU/Linux distributions.

We will help provide information about which computers and components are most compatible with free software, including making people aware of which machines have Restricted Boot. Much of this information will be found at http://h-node.org.

[mk]

I believe, that I wrote someting similar on Mandriva forum some time ago. This is a quote from one article, full version here

George Hotz, the man who cracked Sony’s attempts to keep third party operating systems and unlicensed games off of the PlayStation 3, sees Torvalds’ point. But he downplays the issue. “Overall, I don’t see it as the sky is falling,” he tells Wired.

He takes the wider view that secure boot is just one of so many ways Microsoft is trying to keep Windows relevant in a world that’s moving elsewhere. “I think Windows 8 is a last ditch attempt by Microsoft to try to cling to ownership of the dominant API that they lost when the Web rose to prominence.”

It's true. MS is still somewhere in '98 where nothing else mattered.
Even ex-MS employee and Valve founder Gabe Newell thinks win8 is not the way to go and Steam WILL be available on Linux before the end of the year, with Source engine OpenGL port finished.
I'm not a big fan of Steam, but this can mean something rather big.

Sky is not falling on Linux, but on MS :)

[mmix]

personally, i don't believe anyone who involved in wired.