(no title)
mjevans | 21 days ago
From that mindset what makes sense are hardware vendors including a cache of trusted third party root certificates from known other vendors. Today this would include Microsoft, the same said hardware vendor, probably various respected Linux organizations/groups (Offhand, Linux Foundation, ArchLinux, Debian, IBM/RedHat, Oracle, SUSE, etc), similar for BSD...
Crucially the end user should then be ASKED which to enable. None should be enrolled out of the box. They might also be enabled only for specific things. E.G. HW vendor could be enabled only for new system firmware signatures (load using the existing software) rather than generic UEFI boot targets. The user should also be able to enroll their own CA certs as well; multiple of them. Useful for Organization, Division Unit, and system local signatures.
It would also, really, be nice if UEFI mandated a uniform access API (maybe it does) for local blobs stored in non mass-storage space. This would be a great place to stash things like UEFI drivers for accessing additional types of hardware drivers, OS boot bits + small related files, etc. I would have said 1GB of storage would be more than sufficient for this - however Microsoft has proven that assumption incorrect. Still it'd be nice to have a standard place and a feature that says the system ships with this much reliable secondary storage included (or maybe 1-2 micro-SD card slots, etc).
NekkoDroid|21 days ago
IMO systems should be shipped in "Setup Mode" by default with no keys preinstalled. On first boot which ever OS you decide to install should be able to enroll its keys.
This way it is entirely agnostic of any cherrypicked list of "trust me" vendors. You'd still have most of the benefits of easy secure boot enrolling for those that don't know what it even is/how to do it while also allowing easy choosing of other OSes (at least on initial first boot).
The main problem currently is option-ROM which has a tendency to cause the system to not even POST if secure boot is enabled without MS keys. Recently bricked a MoBo this way and even though it has 2 BIOS I can't actively choose which one to boot, it just has some "trust me, I know when" logic that chooses... well guess how well that is working for me...). The Asrock board I replaced it with though has an option for what it should do with such option-ROM when secure boot is active (don't run, always run, run if signed, ...)
> The user should also be able to enroll their own CA certs as well; multiple of them. Useful for Organization, Division Unit, and system local signatures.
Isn't this already the status quo??
> It would also, really, be nice if UEFI mandated a uniform access API (maybe it does) for local blobs stored in non mass-storage space. [...]
I think UEFI is already complex enough and most of this can in a way already somewhat be handled by the EFI System Partition, e.g. systemd-boot can tell the UEFI to load (file system) drivers off of it (https://wiki.archlinux.org/title/Systemd-boot#Supported_file...), I don't know if UEFI technically supports other types of drivers to be loaded.
gruez|21 days ago
Sounds like browserchoice.eu but even more pointless. For the normies who don't care about what keys they want installed, it doesn't make a difference. For people who want to switch to linux, it also doesn't make a difference because unless they're setting up their computer for the first time, because the windows key would already be installed. The only thing it does is make setting up a new computer marginally easier for one specific case (ie. you want to install a non-windows operating system AND you don't want to dualboot), and ticks off a box for being "vendor agnostic" or whatever.
Sophira|19 days ago
Let's be clear here. Most computers ship with Windows pre-installed, thanks to Microsoft's exclusivity deals with OEMs and the general assumption of Windows as the default OS.
Most users, even those who want to use Linux exclusively, will never be able to utilize the first-OS-install functionality you propose, because the OEM will already have installed Windows on their behalf.
bitwize|21 days ago
Nobody wants to "install" an operating system. Computers should come with an OS preinstalled and ready to run. Everything else is a dead letter in terms of the marketplace.
josephg|21 days ago
I don’t think this works with the security model of secure boot. The secure boot rom is supposed to sit above the OS - as in, it’s more privileged than the OS. A compromise in the OS can’t lead to a compromise in secure boot. (And if it could, why even bother with secure boot in the first place?)
If the OS could enrol whatever keys it wants, then malware could enrol its own malware keys and completely take over the system like that. And if that’s possible then secure boot provides no value.
mistrial9|21 days ago
except, on the other side of the "strange fellows" are people who rose to executive authority by ruthless focus on control of every aspect of their business, and profit including excluding others who did actual work. There is zero point zero chance of any argument that relies on "should" to work IMHO
this is a political situation by definition -- vastly different yet connected members of society and economics, seeking the rule of law to enable stable markets. hint- some of the same decision makers are the ones that pay to put spy code in your large new TV or appliances.
netdevphoenix|20 days ago
This doesn't work for literally 99.9% of the users out there. This is a classic HN's Dropbox symptom.
You need overridable defaults.
Joker_vD|21 days ago
The "user" and "hardware owner" are not necessarily the same person.
bitwize|21 days ago
The end user wants to be able to just pick up a computer from Best Buy and have it work, out of the box.
Microsoft can't even conceptualize why you would want to run anything but the Windows that came with the machine. If the expected Windows kernel and files aren't there, or have been altered, that is evidence of malicious tampering—malware that must be stopped. (I'm deliberately steelmanning their perspective here.)
Streaming services want a secure content path. Game vendors want protection against cheating. In order to comply with local/regional/national laws, web sites need you to verify your age, and they need to know your computer is not lying (remote attestation). Nobody wants to be hacked.
The incentives for everyone else besides techies align against techies getting to run arbitrary code on their devices. The Secure Boot system is working precisely as designed.
dist-epoch|21 days ago
Gamers, gamers want anti-cheats. Vendors couldn't care less.
UltraSane|21 days ago
RupertSalt|21 days ago
Every time I see someone campaigning to exercise their civil liberties via hardware or software, I wonder if their devices are connected to any network.
Because once you connect to a network, especially a WAN, your liberties are tempered by the rights of all other users.
If your device hosts malware, botnets, scammers, spammers, or other malicious activity, no you do not have a right to the liberty of your hardware. The network and the service providers have a fiduciary responsibility of harm reduction and threat mitigation.
Sure, some hackers are very very good at preventing malware and keeping the botnets at bay. You may be better at it than cloud providers or your ISP. In fact, it is the inexperienced users that we can't really trust. They'll get pwned and their browser will have a million toolbars with spyware. Their PC will join botnets and host CSAM. It is their ignorance and ineptitude that gets them into trouble.
And so because WANs, particularly the public Internet, are common property, and not your private domain or sandbox, this is why things like device trust and attestation are being added. Because you could do all you wanted with your Commodore 64 and your Apple ][. The blast radius was limited to your family and every friend who traded cracked software.
But once you're hooked up on a network, you need to stop swinging your fists at my nose.