Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Wait wait wait...

So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user...

So these Linux-computer companies either buy laptops from manufacturers directly or produce their own, but somehow the laptops they're buying are unable to have Secure Boot turned off even though that is the industry standard and literally what every single laptop retailer's laptops do?

This whole thing makes no logical sense at all.

I totally doubt that anyone is producing x86 laptops where you cannot disable Secure Boot, if for no other reason that it would make these laptops ineligible for Windows/Microsoft certification which consumers care about.

These companies might be going out of business, but trying to tie it to Secure Boot is nonsensical.

Plus on top of everything I just said several Linux distributions now support Secure Boot out of the box. So these companies don't even have to go into the BIOS/uEFI and change the settings, just install Ubuntu like they always have.

So OP: PROVE that Secure Boot is the cause of these companies going under? Or at least explain the logic to it.



Proof: Manufacturers MUST ship with SB turned on - that's why they can't get the hardware. (http://blog.fpmurphy.com/2012/09/lenovo-t430-t530-now-suppor...)

There are costs involved in preparing a Linux system, which makes many manufacturers opt to simply abandon their non-OS/Linux lines.

Also some indirect proof:

* timing: secure boot gets introduced, suddenly all Linux shops here close * M$ has a track record of abusing its monopoly

The enormous number of articles on the web shows turning off secure boot isn't always that easy either:http://www.zdnet.com/2013-installing-linux-on-windows-8-pc-i...


I think it is amusing that your first link shows just how easy it is to disable Secure Boot, disproving the point you were trying to make by linking it...

Also if you click through to the "Windows Certification Program" you'll find this Microsoft requirement (for the Windows 8 logo program):

> Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems.

So your links are really hurt you a lot here.

> The enormous number of articles on the web shows turning off secure boot isn't always that easy either:http://www.zdnet.com/2013-installing-linux-on-windows-8-pc-i....

That article doesn't say what you claim it says. In fact it says quite the opposite.

It lists several distributions which work "out of the box" with no modifications to the system at all. It then goes on to talk about disabling Secure Boot.

It does quite correctly whine that you cannot install Windows on Surface RT hardware, which is a valid complaint, but outside the scope of this thread.


Manufacturers MUST ship with SB turned on

Yes, Win 8 won't boot without it. You can disable the feature in the BIOS if you are going to install a different OS.


Windows 8 does boot without secure boot enabled.


Sorry for spreading misinformation, I was under the impression it was an install-time setting. After a little Googling it appears you are correct.


> "So Microsoft demands(!) that all x86 PCs and laptops which are sold in its certification program have to have Secure Boot easily disable-able in the BIOS/uEFI by the end user..."

You say "easily disable-able" but that's not the case. The process of disabling SecureBoot is anything but easy, and it's undocumented.


On my motherboard I go:

Security (tab) -> Secure Boot -> Disabled -> Save

And it is documented. It is right there in the manual. This is an ASRock motherboard produced in the last few years.

It literally is as complicated as turning on and off the internal sound or networking, or switching on USB legacy mode.

PS - This web-site shows a different ASRock motherboard with the same-ish setup: http://www.eightforums.com/tutorials/17058-secure-boot-enabl...


My experience has been: Enter uEFI > Navigate to Security > Select SecureBoot > Disable

What has your terrible experience been and on what model of computer?


Why on earth you you say that? Its just a bios setting. OK, may be average non techie person might be scared of bios settings, but if they are, there is literally no way they would or should be trying to replace Windows with Linux.


"The process of disabling SecureBoot is anything but easy, and it's undocumented"

Making things up does not somehow make your argument more convincing, it reflects poorly on you for anyone who actually uses a laptop/desktop with uEFI. If an end-user knows how to get into a BIOS, they can find the plain-text labeled option to disable.


I have a ASUS machine, I want to install Fedora from USB (but it does not work with UEFI)

Can you tell me how to disable it? I tried everything, and it did not worked...

Yes, the BIOS does have a option to disable secure boot there, but even using that option, secure boot still stays active and refuse to boot anything unsigned.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: