Fedora 18 and UEFI

[Kevin Wilson]

Hi, everyone,
I have a question about UEFI in fedora 18: I see in lwn.net article:

"Fedora's strategy is to enroll in Microsoft's developer program,
which allows the project to purchase an approved $99 key through
Verisign, a key which will be recognized by UEFI secure boot. The key
will be used to sign the shim bootloader, which is a "trivial UEFI
first-stage bootloader" whose only job is to boot GRUB2. Fedora will
also sign the GRUB2 bootloader and the kernel, although the latter two
binaries can be signed with the Fedora project's own keys.

see
http://lwn.net/Articles/503803
 That this means that from F18 on, fedora will cost 99$ for every installation?

rgs,
Kevin

[EGO-II.1]

On 07/08/2012 03:43 AM, Heinz Diehl wrote:
>  On 08.07.2012, suvayu ali wrote:
>
> > PS: If you are wondering, what I took from the thread, it's going to be
> >      a pain if at some point the optional requirement to secure boot is
> >      removed.
>  This reminds me on the past, before the mainboard/BIOS manufacturers
>  picked it up as an sales-idea: people (overclockers)had to search for, download and
>  flash/burn a modified BIOS for their mainboards to get access to CPU-
>  memory- and busclock settings. Now you can buy mainboards which even
>  have "dynamic overclocking", and nearly all BIOSes contain a bunch of
>  tunables to shoot yourself in the foot.
>
>  I have no difficulties to imagine a similar scenario, where people buy
>  their mainboard because they know that a modified BIOS exists for,
>  which reinforces the "disable secure boot"...
>  
I'm more concerned with IF those types of boards will be available 
immediately of if it will take some time before the "modding" community 
brings forth the desired boards. As I've witnessed from in the past, 
sometimes unless there's enough of a modding community involved with 
something then mainstream manufacturers might not alter their design. 
(As in the overclocking examples!) I'm not really worried about not 
being able to use Linux, as I'm in the process of getting ahold of both 
a laptop and a desktop with no secure boot feature, the laptop has a 
5OOGB HD and will be running Fedora 17, while the desktop will have a 
1TB HD and will be running Linux Mint, granted I might not be abl to 
obtain updates and upgrades somewhere along the line, but maybe by the 
time I'm ready to upgrade again, there'll be some kind of modification 
or workaround that will have propagated to the world wide web, which 
will permit me to do what I please when I please and how I please 
without having to bow down to the Microsoft Altar!....


EGO II

[Joe Zeff]

On 07/08/2012 09:07 AM, Chris Adams wrote:
>  Well, they're the 800 lb. gorilla in the_desktop PC_  room. 
> They're
>  also a large gorilla in the x86 server room, but they're more like a
>  small gnat in the tablet room (and maybe a large dog in the smartphone
>  room). 
Actually it's probably more like the 300 lb. orangutan in the server 
room.  Not as much raw power or presence as the gorilla, maybe, but 
still a force to be reckoned with.  And, when the Librarian goes "Oook," 
it's a very good idea to listen.

[Chris Adams]

Once upon a time, Dave Ihnat <dihnat(a)dminet.com&gt; said:
>  Once, long ago--actually, on Sun, Jul 08, 2012 at 12:20:02AM
> +0100--Alan Cox (alan(a)lxorguk.ukuu.org.uk) said:
>  > Many Android ARM based devices are already locked down. In shouting at
>  > Microsoft on the ARM issue you need to point fingers at a lot of other
>  > people too.
>  
>  Quite true, and I'm happy to.  The main reason Microsoft catches so much
>  flak for this is simple--they're the 800 lb. (363 Kg) gorilla in the room. 
Well, they're the 800 lb. gorilla in the _desktop PC_ room.  They're
also a large gorilla in the x86 server room, but they're more like a
small gnat in the tablet room (and maybe a large dog in the smartphone
room).

The tablet/smartphone market has already decided to sell locked-down
devices (see the 800 lb. fruity gorilla in those markets).  Microsoft is
just joining in the existing fun there.  We don't like the result, but
it is hard to blame Microsoft for aping what the rest of the market is
already doing (and apparently most consumers accept as the norm).

-- 
Chris Adams <cmadams(a)hiwaay.net&gt;
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

[Heinz Diehl]

On 08.07.2012, Eddie G.O'Connor Jr-I wrote: 

>  This is why I consider Linux the "better"
> technology!....not many other
>  vendors of software would ALLOW you to hack away at their code just for your
>  own personal achievement! 
Jupp! Using Wind*ws and Endnote (which my University provides gratis), 
I would just load the universities citation style (which they offer
gratis) into Endnote and all would be 100% correct within seconds..  :-)

[Heinz Diehl]

On 08.07.2012, suvayu ali wrote: 

>  PS: If you are wondering, what I took from the thread, it's going
> to be
>      a pain if at some point the optional requirement to secure boot is
>      removed. 
This reminds me on the past, before the mainboard/BIOS manufacturers
picked it up as an sales-idea: people (overclockers)had to search for, download and
flash/burn a modified BIOS for their mainboards to get access to CPU-
memory- and busclock settings. Now you can buy mainboards which even
have "dynamic overclocking", and nearly all BIOSes contain a bunch of
tunables to shoot yourself in the foot.

I have no difficulties to imagine a similar scenario, where people buy
their mainboard because they know that a modified BIOS exists for,
which reinforces the "disable secure boot"...

[EGO-II.1]

On 07/07/2012 10:17 AM, Heinz Diehl wrote:
>  On 07.07.2012, Reindl Harald wrote:
>
> > do not buy the cheapest consumer crap and you are on the safe side
> > in the BUSINESS market microsoft has nothing to say, really!
>  Here in Norway, ~99% of all institutions use Windows. Both Windows 7
>  for their desktop environment, and Windows server for their networks.
>  Linux is used, but doesn't play an important role.
>
>  Even at university/college they are using it. All is Windows-based:
>  Endnote, Mathlab, SPSS... you name it. As a Linux guy you are
>  on your own. I spent more than a week hacking on both the Zotero
>  sourcecode and .CSL-scripts to adopt my universities citation style...
>  
This is why I consider Linux the "better" technology!....not many other 
vendors of software would ALLOW you to hack away at their code just for 
your own personal achievement!


EGO II

[EGO-II.1]

On 07/07/2012 09:21 AM, Reindl Harald wrote:
>  Am 07.07.2012 15:05, schrieb Fernando Cassia:
> > Thus, for starters, RedHat´s decision to pay for a signing key is the
> > practical approach, so users will be able to boot Fedora without
> > tweaking their BIOS/CMOS settings.
> >
> > But what I think could be challenged with antitrust regulators is
> > Microsoft CHARGING for it. To keep it a level playing field MSFT
> > should issue free keys to any OS development firm that asks for one,
> > whether commercial or open source.
>  well, and this is what makes "secure boot"  practically useless
>
>  * using it: too many restrictions
>  * doing like you said: over the long untrusted
>
>  BTW:
>  are you aware that the key itself is from verisign?
>  the will not give microsoft unlimited keys for free
>
>  the whole "secure boot" idea is crap
>
>
>
>  
Just another way for M$ to take your money for something that should be 
free to begin with!...


EGO II

[EGO-II.1]

On 07/07/2012 08:55 AM, Fernando Cassia wrote:
>  On Sat, Jul 7, 2012 at 9:34 AM, Heinz Diehl <htd(a)fritha.org&gt;
> wrote:
> > We're not. Micr*soft dominates, and they can virtually do anything
> > they like.
>  Not if the US DOJ and the Federal Trade Comission gets involved.
>
>  Remember the US-DOJ trial with judge Thomas Penfield Jackson found
>  MSFT GUILTY. The fact that later a new administration came in and
>  allowed them to turn the breakup into a set of ´remedies´ which
>  included opening up MSFT protocols to third parties (which for
>  instance, allowed Samba NTLM authentication to interoperate with
>  MSFT´s) is besides the point... Microsoft is a convicted monopolist,
>  and as such there´s a thin line they must walk on...
>
>  I´m not a lawyer but I guess some antitrust lawyer could conclude that
>  this is an abuse of dominant position.
>
>  See for instance the recent MSFT-Nokia deal, now an antitrust lawyer says:
>
>  http://www.huffingtonpost.com/david-balto/nokia-microsoft_b_1582227.html
>
>  "The European Commission will hopefully open an investigation and the
>  U.S. regulators will follow suit."
>
>  I hope the EFF, the CDT or other advocacy groups get involved to get
>  the FTC briefed about the implications of this.
>
>  Just my $0.02
>  FC 
I agree with you Fernando! I believe if more people would look into this 
matter seriously and see through all the smoke & mirrors....then maybe 
there would be someone....somewhere trying to stop it!


EGO II

[EGO-II.1]

On 07/07/2012 04:08 AM, Kevin Wilson wrote:
>  Hi,
>  Than a lot for your quick answer!
>  kevin
>  On Sat, Jul 7, 2012 at 11:07 AM, Frank Murphy <frankly3d(a)gmail.com&gt; wrote:
> > On 07/07/12 08:57, Kevin Wilson wrote:
> >> see
> >> http://lwn.net/Articles/503803
> >>    That this means that from F18 on, fedora will cost 99$ for every
> >> installation?
> >>
> > Discussion on fedora-devel is still ongoing:
> > https://lists.fedoraproject.org/pipermail/devel/2012-June/167732.html
> >
> > But from what I gather,
> > the fedoraproject as vendor,
> > will pay Microsoft who will provide a signing service.
> >
> > The fedora end-use will pay nothing.
> > But read the thread for the to and fro.
> >
> > --
> > Regards,
> > Frank
> > "Jack of all, fubars"
> >
> >
> > --
> > users mailing list
> > users(a)lists.fedoraproject.org
> > To unsubscribe or change subscription options:
> > https://admin.fedoraproject.org/mailman/listinfo/users
> > Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
> > Have a question? Ask away: http://ask.fedoraproject.org 
I agree with everything
said on this website link! I don't support M$ in 
ANY of their endeavours!...although they may have the greatest market 
share in regards to OS'es and different applications and products, to me 
they are just a money hungry faceless corporation that should not be 
allowed to dictate to the entire computing community about what THEY 
feel is the proper way to do things!


EGO II

[EGO-II.1]

On 07/07/2012 08:44 PM, Dave Ihnat wrote:
>  Once, long ago--actually, on Sun, Jul 08, 2012 at 12:20:02AM
> +0100--Alan Cox (alan(a)lxorguk.ukuu.org.uk) said:
> > Many Android ARM based devices are already locked down. In shouting at
> > Microsoft on the ARM issue you need to point fingers at a lot of other
> > people too.
>  Quite true, and I'm happy to.  The main reason Microsoft catches so much
>  flak for this is simple--they're the 800 lb. (363 Kg) gorilla in the room.
>  Their insistence has more effect, even if they're not the leader in tablets
>  or phones, than any other single vendor.
>
>  Cheers,
>  --
>  	Dave Ihnat
>  	dihnat(a)dminet.com 
You mean Fedora's going the way of Ubuntu & Red
Hat?.....uh 
oh!.....guess I'll just have to be stuck with whatever 
laptop.....desktop or server I already have....running whatever OS its 
got on it!.....



EGO II

[Dave Ihnat]

Once, long ago--actually, on Sun, Jul 08, 2012 at 12:20:02AM +0100--Alan Cox
(alan(a)lxorguk.ukuu.org.uk) said:
>  Many Android ARM based devices are already locked down. In shouting
> at
>  Microsoft on the ARM issue you need to point fingers at a lot of other
>  people too. 
Quite true, and I'm happy to.  The main reason Microsoft catches so much
flak for this is simple--they're the 800 lb. (363 Kg) gorilla in the room.
Their insistence has more effect, even if they're not the leader in tablets
or phones, than any other single vendor.

Cheers,
--
	Dave Ihnat
	dihnat(a)dminet.com

[Alan Cox]

On Sat, 7 Jul 2012 09:27:34 -0500
Dave Ihnat <dihnat(a)dminet.com&gt; wrote:

>  Once, long ago--actually, on Sat, Jul 07, 2012 at 02:54:11PM
> +0200--Reindl Harald (h.reindl(a)thelounge.net) said:
>  > Micorsoft is NOT in teh position to close the x86 market only for
>  > them because if the would try it history repeats and these days the
>  > EU would be the next killing their business in whole europe
>  
>  I concur that MS can't lock down the x86/x64 market.  However, they ARE
>  trying to lock down the ARM market--at least, any devices built to run MS
>  software.  Considering the burgeoning mobile markeplace, this is a matter
>  for some concern; it's not inconceivable that Intel & clones are going to
>  be marginalized, or at least minimalized, moving forward in that arena. 
Many Android ARM based devices are already locked down. In shouting at
Microsoft on the ARM issue you need to point fingers at a lot of other
people too.

[Richard Vickery]

On Sat, Jul 7, 2012 at 9:27 AM, Frank Murphy <frankly3d(a)gmail.com&gt; wrote:

>  On 07/07/12 17:03, Richard Vickery wrote:
>
> >
> > One can always go through Dell to get a Linux computer without the
> > Micros**t crap. It comes with Ubuntu preinstalled, but one  has the
> > option of installing Fedora.
> >
> >
>  From what I gather before Dell stopped pushing the Dell\Ubuntu desktops,
>  they were even then not on par spec with the MS equipped Dell Desktop.
>
>
>
>  
I have a portable computer, as opposed to a Desktop; having purchased it in
2006 through distinctly stating that I wanted a Linux computer, more to my
point is Torvald's stated in his address recently to a university class
that Dell still offers these, but you have to ask them for it.

[Suvayu Ali]

On Sat, Jul 7, 2012 at 8:50 PM, Joe Zeff <joe(a)zeff.us&gt; wrote:
>  On 07/07/2012 03:21 AM, suvayu ali wrote:
> >
> > I am more worried about "free" as in freedom. I don't quite grasp the
> > implications as an end user. For example consider the following
> > scenarios.
>
>
>  Didn't we hash this out less than a month ago?  I know you've been on the
>  list long enough to have seen it and participated.  Why bring it up again?
>  
Well, I did follow that thread and the noise level was rather high to
extract the practical details. For example, I wasn't sure if the disable
secure boot option was mandated by MS or not. Given the option, I'll
disable it for sure but I wasn't sure if I would have the option to
disable. Hence all my questions were with regards to how I can run my
system given secure boot is enabled.

The following comment from Rahul answers my question.

>  On x86 systems, the ability to disable secure boot is mandated by
>  Microsoft and needed to debug Microsoft drivers ... 
And for the record, I did not start the thread. I just asked a question
in the context of the thread. I hope that clears up any doubts.

PS: If you are wondering, what I took from the thread, it's going to be
    a pain if at some point the optional requirement to secure boot is
    removed.

-- 
Suvayu

Open source is the future. It sets us free.

[Mateusz Marzantowicz]

On 07.07.2012 13:58, Itamar Reis Peixoto wrote:
>  On Sat, Jul 7, 2012 at 7:21 AM, suvayu ali
> <fatkasuvayu+linux(a)gmail.com&gt; wrote:
> > I realise I can turn Secure Boot off, but hardware manufacturers have
> > often dropped the ball on complying with standards. What if the next
> > generation of motherboards/laptops make it harder to turn off secure
> > boot? Just to make it clear, the questions above are not rhetorical. I
> > just want to understand better the implications as an end-user.
> >
>
>  I think we are bigger enough to say no and buy only hardware compatible.
>
>  
It is clearly seen in video card market how "bigger" you are.


Mateusz Marzantowicz

[Joe Zeff]

On 07/07/2012 03:21 AM, suvayu ali wrote:
>  I am more worried about "free" as in freedom. I don't
> quite grasp the
>  implications as an end user. For example consider the following
>  scenarios. 
Didn't we hash this out less than a month ago?  I know you've been on 
the list long enough to have seen it and participated.  Why bring it up 
again?

[Kevin Fenzi]

On Sat, 07 Jul 2012 18:14:19 +0530
Rahul Sundaram <metherid(a)gmail.com&gt; wrote:

>  On 07/07/2012 03:51 PM, suvayu ali wrote:
>  
>  > 
>  > I am more worried about "free" as in freedom. I don't quite grasp
>  > the implications as an end user. For example consider the following
>  > scenarios.
>  > 
>  > Can I freely choose to use proprietary (or for that matter
>  > alternative free) drivers for my hardware from whatever source I
>  > prefer?
>  
>  On x86 systems, the ability to disable secure boot is mandated by
>  Microsoft and needed to debug Microsoft drivers and since all the
>  hardware manufacturers want to comply to this specification, you can
>  be rest assured they will provide this functionality and once you
>  disable secure boot (instructions for this will likely be in a Fedora
>  wiki page), then you are free to load up any custom kernel/kernel
>  module of your choice.  Also Fedora will provide the tools that the
>  project itself uses within the official repository (ie) will be free
>  and open source and instructions to use your own key in custom mode. 
I'll add here something that people seem to be missing a fair bit also: 

MS has setup guidelines for hardware vendors that wish to get a
"Windows 8 Client ready" sticker. Note the "client" here. They are
not
requiring secure boot for any hardware targeted for servers. 

kevin

[Kevin Fenzi]

On Sat, 7 Jul 2012 09:34:21 -0500
Dave Ihnat <dihnat(a)dminet.com&gt; wrote:

>  Once, long ago--actually, on Sat, Jul 07, 2012 at 03:21:09PM
>  +0200--Reindl Harald (h.reindl(a)thelounge.net) said:
>  > the whole "secure boot" idea is crap
>  
>  Hmm...no, it's not.  It's crap *as implemented*.
>  
>  Want a not-crap implementation?
>  
>    o Firmware ships with a non-MS form of UEFI. 
windows 8 client certified hardware will allow you to remove the MS
key. 

>    o You install your OS-of-choice; at this point in time, you know
>  it's clean & safe.
>
>    o Run a utility to generate a key that gets installed in the UEFI
>      firmware.  Preferably, this utility would know or be told what
>  	components in the OS, drivers, etc. should be considered when
>  	generating the key. 
Fedora plans to make all the infrastructure to create and enroll your
own keys available and usable for end users.

So, you can create your own key, sign the bootloader and grub2 and
kernel with it. 
>  
>    o Disable the UEFI update.  Ideally, this would be an actual
>  hardware switch--something that CAN'T be suborned in software or
>  firmware. 
No idea if this is possible. 

>    o Whenever you update your OS, drivers, or other components that
> are
>      considered by the UEFI boot, turn off the switch and re-run the
>  keygen utility.
>  
>  From this point on, you're running "blessed" software, so Bad
>  Guys(TM) will be stopped as for the current UEFI.  But the entire
>  dance is in *your* control, not any vendor.
>  
>  But, of course, MS couldn't tolerate this. 
Sure they do. You should be able to do this with Fedora if the current
plans all work out as expected. Most users probibly won't bother, but
the plan is to have all this available for those that do want to. 

kevin

[Patrick O'Callaghan]

On Sat, 2012-07-07 at 10:57 +0300, Kevin Wilson wrote:
>  I have a question about UEFI in fedora 18: I see in lwn.net article:
Wrong list. Ask on the Test list, not here.

poc

[Antonio Olivares]

>  > http://lwn.net/Articles/503803
>  >   That this means that from F18 on,
>  fedora will cost 99$ for every installation?
>  > 
>  
>  Discussion on fedora-devel is still ongoing:
>  https://lists.fedoraproject.org/pipermail/devel/2012-June/167732.html
>  
>  But from what I gather,
>  the fedoraproject as vendor,
>  will pay Microsoft who will provide a signing service. 
Verisign not Micro$oft
right?

Some folks did not agree with Red Hat on this one:

http://techrights.org/2012/06/13/red-hat-closed/

>  
>  The fedora end-use will pay nothing.
>  But read the thread for the to and fro.
>   
Canonical(Ubuntu) has taken another approach to the UEFI problem 

http://lwn.net/Articles/503995/rss

http://www.teknoids.net/content/ubuntus-plans-implement-uefi-secureboot-n...

http://www.teknoids.net/content/ubuntu-cant-trust-fsfs-secure-boot-solution

Who is right?  What will happen later on?

As soon as Windows 8 is released will we be able to figure this out right?  

Regards,


Antonio

[Suvayu Ali]

Hi Rahul,

On Sat, Jul 7, 2012 at 2:44 PM, Rahul Sundaram <metherid(a)gmail.com&gt; wrote:
> > Can I freely choose to use proprietary (or for that matter
> alternative
> > free) drivers for my hardware from whatever source I prefer?
>
>  On x86 systems, the ability to disable secure boot is mandated by
>  Microsoft and needed to debug Microsoft drivers and since all the
>  hardware manufacturers want to comply to this specification, you can be
>  rest assured they will provide this functionality and once you disable
>  secure boot (instructions for this will likely be in a Fedora wiki
>  page), then you are free to load up any custom kernel/kernel module of
>  your choice.  Also Fedora will provide the tools that the project itself
>  uses within the official repository (ie) will be free and open source
>  and instructions to use your own key in custom mode. 
Thanks a lot for the clarification.

-- 
Suvayu

Open source is the future. It sets us free.

[Frank Murphy]

On 07/07/12 17:03, Richard Vickery wrote:
>  One can always go through Dell to get a Linux computer without the
>  Micros**t crap. It comes with Ubuntu preinstalled, but one  has the
>  option of installing Fedora.
>  
 From what I gather before Dell stopped pushing the Dell\Ubuntu desktops,
they were even then not on par spec with the MS equipped Dell Desktop.


-- 
Regards,
Frank
"Jack of all, fubars"

[Richard Vickery]

On Sat, Jul 7, 2012 at 5:46 AM, Carroll Grigsby <cgrigs986(a)att.net&gt; wrote:

>  On Sat, 7 Jul 2012 08:58:31 -0300
>  Itamar Reis Peixoto <itamar(a)ispbrasil.com.br&gt; wrote:
>
>  > On Sat, Jul 7, 2012 at 7:21 AM, suvayu ali
>  > <fatkasuvayu+linux(a)gmail.com&gt; wrote:
>  > >
>  > > I realise I can turn Secure Boot off, but hardware manufacturers
>  > > have often dropped the ball on complying with standards. What if
>  > > the next generation of motherboards/laptops make it harder to turn
>  > > off secure boot? Just to make it clear, the questions above are not
>  > > rhetorical. I just want to understand better the implications as an
>  > > end-user.
>  > >
>  >
>  >
>  > I think we are bigger enough to say no and buy only hardware
>  > compatible.
>  >
>  >
>
>  Good luck with that!  I've been thinking about replacing this computer
>  with something newer, so when I was in my local computer store
>  yesterday, I asked if they had any motherboards or systems that did
>  not have this UEFI/Microsoft crap installed. Nope. None. Nil. Zilch.
>  Nada. Ain't no such critter. All gone. It's hiding with Judge
>  Crater and Jimmy Hoffa. You get the message...
>
>  
One can always go through Dell to get a Linux computer without the
Micros**t crap. It comes with Ubuntu preinstalled, but one  has the option
of installing Fedora.

[Suvayu Ali]

Hi Rahul,


On Sat, Jul 7, 2012 at 12:02 PM, Rahul Sundaram <metherid(a)gmail.com&gt; wrote:
>  Certificate authority is Verisign and this is purely between Red Hat
> and
>  the vendor. There is no money charged for users.  Users will never be
>  asked to pay money to install or use Fedora. 
I am more worried about "free" as in freedom. I don't quite grasp the
implications as an end user. For example consider the following
scenarios.

Can I freely choose to use proprietary (or for that matter alternative
free) drivers for my hardware from whatever source I prefer?

A few years back I was in a situation where my USB Wi-Fi dongle was not
yet supported by Fedora and I had to get the binary blob firmware from
the linux kernel wireless page and manually install and load it by hand
to use my hardware. Will I be able to do that with ease in the future?

Similarly, can I choose to install proprietary drivers or kernel modules
not distributed with Fedora from what ever source I wish (RPMFusion,
Vendor etc.)?

I realise I can turn Secure Boot off, but hardware manufacturers have
often dropped the ball on complying with standards. What if the next
generation of motherboards/laptops make it harder to turn off secure
boot? Just to make it clear, the questions above are not rhetorical. I
just want to understand better the implications as an end-user.

-- 
Suvayu

Open source is the future. It sets us free.

[Rahul Sundaram]

On 07/07/2012 02:00 PM, Hakan Koseoglu wrote:
>  Kevin,
>  On 7 July 2012 08:57, Kevin Wilson <wkevils(a)gmail.com&gt; wrote:
> > http://lwn.net/Articles/503803
> >  That this means that from F18 on, fedora will cost 99$ for every installation?
>  As I understand it, it's a one-off $99 payment for the dev portal
>  access for the signing service, in the end actual money goes to the
>  certificate authority but I can't remember which one. It is a decision
>  I dislike but it is not 99 per installation nor any costs are passed
>  to end-users. 
Certificate authority is Verisign and this is purely between Red Hat and
the vendor. There is no money charged for users.  Users will never be
asked to pay money to install or use Fedora.

Rahul

[Reindl Harald]

Am 07.07.2012 16:17, schrieb Heinz Diehl:
>  On 07.07.2012, Reindl Harald wrote:
>  
> > do not buy the cheapest consumer crap and you are on the safe side
> > in the BUSINESS market microsoft has nothing to say, really!
>  
>  Here in Norway, ~99% of all institutions use Windows. Both Windows 7
>  for their desktop environment, and Windows server for their networks.
>  Linux is used, but doesn't play an important role. 
oh yeah, there will surely run any mail/web/ftp-server with windows
never, not in norway nor somewhere else

and yes, all this machines are maintained by people which
needs and wants non 19" hardware for play around with their
things beside production

however, MS is not permitted to lock down the x86 market
not in the united states and not in the european union

http://en.wikipedia.org/wiki/United_States_v._Microsoft
http://en.wikipedia.org/wiki/European_Union_Microsoft_competition_case

so microsoft has nothing to say

[Dave Ihnat]

Once, long ago--actually, on Sat, Jul 07, 2012 at 03:21:09PM +0200--Reindl Harald
(h.reindl(a)thelounge.net) said:
>  the whole "secure boot" idea is crap 
Hmm...no, it's not.  It's crap *as implemented*.

Want a not-crap implementation?

  o Firmware ships with a non-MS form of UEFI.

  o You install your OS-of-choice; at this point in time, you know it's
    clean & safe.

  o Run a utility to generate a key that gets installed in the UEFI
    firmware.  Preferably, this utility would know or be told what
	components in the OS, drivers, etc. should be considered when
	generating the key.

  o Disable the UEFI update.  Ideally, this would be an actual hardware
    switch--something that CAN'T be suborned in software or firmware.

  o Whenever you update your OS, drivers, or other components that are
    considered by the UEFI boot, turn off the switch and re-run the keygen
	utility.

> From this point on, you're running "blessed" software,
> so Bad Guys(TM) will 
be stopped as for the current UEFI.  But the entire dance is in
*your*
control, not any vendor.

But, of course, MS couldn't tolerate this.
--
	Dave Ihnat
	dihnat(a)dminet.com

[Dave Ihnat]

Once, long ago--actually, on Sat, Jul 07, 2012 at 02:54:11PM +0200--Reindl Harald
(h.reindl(a)thelounge.net) said:
>  Micorsoft is NOT in teh position to close the x86 market only for
>  them because if the would try it history repeats and these days the
>  EU would be the next killing their business in whole europe 
I concur that MS can't lock down the x86/x64 market.  However, they ARE
trying to lock down the ARM market--at least, any devices built to run MS
software.  Considering the burgeoning mobile markeplace, this is a matter
for some concern; it's not inconceivable that Intel & clones are going to
be marginalized, or at least minimalized, moving forward in that arena.

Food for thought,
--
	Dave Ihnat
	dihnat(a)dminet.com

[Heinz Diehl]

On 07.07.2012, Reindl Harald wrote:

>  do not buy the cheapest consumer crap and you are on the safe side
>  in the BUSINESS market microsoft has nothing to say, really! 
Here in Norway, ~99% of all institutions use Windows. Both Windows 7
for their desktop environment, and Windows server for their networks.
Linux is used, but doesn't play an important role.

Even at university/college they are using it. All is Windows-based:
Endnote, Mathlab, SPSS... you name it. As a Linux guy you are
on your own. I spent more than a week hacking on both the Zotero
sourcecode and .CSL-scripts to adopt my universities citation style...

[Reindl Harald]

Am 07.07.2012 15:05, schrieb Fernando Cassia:
>  Thus, for starters, RedHat´s decision to pay for a signing key is
> the
>  practical approach, so users will be able to boot Fedora without
>  tweaking their BIOS/CMOS settings.
>  
>  But what I think could be challenged with antitrust regulators is
>  Microsoft CHARGING for it. To keep it a level playing field MSFT
>  should issue free keys to any OS development firm that asks for one,
>  whether commercial or open source. 
well, and this is what makes "secure boot"  practically useless

* using it: too many restrictions
* doing like you said: over the long untrusted

BTW:
are you aware that the key itself is from verisign?
the will not give microsoft unlimited keys for free

the whole "secure boot" idea is crap

[Fernando Cassia]

On Sat, Jul 7, 2012 at 9:44 AM, Rahul Sundaram <metherid(a)gmail.com&gt; wrote:
>  On x86 systems, the ability to disable secure boot is mandated by
>  Microsoft and needed to debug Microsoft drivers and since all the
>  hardware manufacturers want to comply to this specification, you can be
>  rest assured they will provide this functionality and once you disable
>  secure boot (instructions for this will likely be in a Fedora wiki
>  page 
Yes, but notice the evil in Microsoft´s wording. Who wants to disable
"SECURE" booting? Secure ´feels good´. Lack of ´secure´ does not. It´s
like asking "do you want to disable secure landing"? on an airplane.
;)

Of course 99.9% of the people will think "why do I have to disable
SECURE boot to run this? I don´t want my system to have INSECURE
booting... please give me secure! in fact, I´d like extra secure if
possible" ;). -even if they don´t know what secure booting means to
begin with- ;)

Thus, for starters, RedHat´s decision to pay for a signing key is the
practical approach, so users will be able to boot Fedora without
tweaking their BIOS/CMOS settings.

But what I think could be challenged with antitrust regulators is
Microsoft CHARGING for it. To keep it a level playing field MSFT
should issue free keys to any OS development firm that asks for one,
whether commercial or open source.

FC

[Fernando Cassia]

On Sat, Jul 7, 2012 at 9:34 AM, Heinz Diehl <htd(a)fritha.org&gt; wrote:
>  We're not. Micr*soft dominates, and they can virtually do
> anything
>  they like. 
Not if the US DOJ and the Federal Trade Comission gets involved.

Remember the US-DOJ trial with judge Thomas Penfield Jackson found
MSFT GUILTY. The fact that later a new administration came in and
allowed them to turn the breakup into a set of ´remedies´ which
included opening up MSFT protocols to third parties (which for
instance, allowed Samba NTLM authentication to interoperate with
MSFT´s) is besides the point... Microsoft is a convicted monopolist,
and as such there´s a thin line they must walk on...

I´m not a lawyer but I guess some antitrust lawyer could conclude that
this is an abuse of dominant position.

See for instance the recent MSFT-Nokia deal, now an antitrust lawyer says:

http://www.huffingtonpost.com/david-balto/nokia-microsoft_b_1582227.html

"The European Commission will hopefully open an investigation and the
U.S. regulators will follow suit."

I hope the EFF, the CDT or other advocacy groups get involved to get
the FTC briefed about the implications of this.

Just my $0.02
FC

[Reindl Harald]

Am 07.07.2012 14:46, schrieb Carroll Grigsby:
>  On Sat, 7 Jul 2012 08:58:31 -0300
>  Itamar Reis Peixoto <itamar(a)ispbrasil.com.br&gt; wrote:
> > I think we are bigger enough to say no and buy only hardware
> > compatible.
>  
>  Good luck with that!  I've been thinking about replacing this computer
>  with something newer, so when I was in my local computer store
>  yesterday, I asked if they had any motherboards or systems that did
>  not have this UEFI/Microsoft crap installed. Nope. None. Nil. Zilch.
>  Nada. Ain't no such critter. All gone. It's hiding with Judge
>  Crater and Jimmy Hoffa. You get the message... 
you should realize that UEFI has origin nothing to do
with Microsoft and secure boot, all my workstations
are supporting UEFI and are completly microsoft-free
and were even shipped with a HP branded Debian

Micorsoft is NOT in teh position to close the x86
market only for them because if the would try it
history repeats and these days the EU would be
the next killing their business in whole europe

http://en.wikipedia.org/wiki/United_States_v._Microsoft

[Carroll Grigsby]

On Sat, 7 Jul 2012 08:58:31 -0300
Itamar Reis Peixoto <itamar(a)ispbrasil.com.br&gt; wrote:

>  On Sat, Jul 7, 2012 at 7:21 AM, suvayu ali
>  <fatkasuvayu+linux(a)gmail.com&gt; wrote:
>  >
>  > I realise I can turn Secure Boot off, but hardware manufacturers
>  > have often dropped the ball on complying with standards. What if
>  > the next generation of motherboards/laptops make it harder to turn
>  > off secure boot? Just to make it clear, the questions above are not
>  > rhetorical. I just want to understand better the implications as an
>  > end-user.
>  >
>  
>  
>  I think we are bigger enough to say no and buy only hardware
>  compatible.
>  
>   
Good luck with that!  I've been thinking about replacing this computer
with something newer, so when I was in my local computer store
yesterday, I asked if they had any motherboards or systems that did
not have this UEFI/Microsoft crap installed. Nope. None. Nil. Zilch.
Nada. Ain't no such critter. All gone. It's hiding with Judge
Crater and Jimmy Hoffa. You get the message...

Ok, so Fedora has worked out one way forward. Ubuntu is going in
another direction. I haven't seen anything about any of the other
distros. Has anyone heard anything about Debian?

-- cmg

[Rahul Sundaram]

On 07/07/2012 03:51 PM, suvayu ali wrote:

>  
>  I am more worried about "free" as in freedom. I don't quite grasp the
>  implications as an end user. For example consider the following
>  scenarios.
>  
>  Can I freely choose to use proprietary (or for that matter alternative
>  free) drivers for my hardware from whatever source I prefer? 
On x86 systems, the ability to disable secure boot is mandated by
Microsoft and needed to debug Microsoft drivers and since all the
hardware manufacturers want to comply to this specification, you can be
rest assured they will provide this functionality and once you disable
secure boot (instructions for this will likely be in a Fedora wiki
page), then you are free to load up any custom kernel/kernel module of
your choice.  Also Fedora will provide the tools that the project itself
uses within the official repository (ie) will be free and open source
and instructions to use your own key in custom mode.

On ARM systems that follow the MS specification,  there is no such
ability to disable secure boot and such locked down devices will simply
be not supported by Fedora at all.  We have plenty of other ARM systems
that will be since Linux ecosystem in ARM is strong, it isn't a
immediate concern.

Rahul

[Reindl Harald]

Am 07.07.2012 14:34, schrieb Heinz Diehl:
>  On 07.07.2012, Itamar Reis Peixoto wrote: 
>  
> > I think we are bigger enough to say no and buy only hardware compatible.
>  
>  We're not. Micr*soft dominates, and they can virtually do anything
>  they like.  
we are!

do not buy the cheapest consumer crap and you are on the safe side
in the BUSINESS market microsoft has nothing to say, really!

[Heinz Diehl]

On 07.07.2012, Itamar Reis Peixoto wrote: 

>  I think we are bigger enough to say no and buy only hardware
> compatible. 
We're not. Micr*soft dominates, and they can virtually do anything
they like.

[Reindl Harald]

Am 07.07.2012 14:19, schrieb Frank Murphy:
>  On 07/07/12 12:58, Itamar Reis Peixoto wrote:
> >
> > I think we are bigger enough to say no and buy only hardware compatible.
> >
>  Not my first choice.
>  Been left with Old hardware as only option no thanks. 
who said that?

there is a big enough market with customers which will
make the pressure to the manufacturers to produce
recent hardware where you can urn off secure boot

do you really think vendors like HP would be stoopid enough
to ignore their business customers? and yes the business
machines have much better quality and are not too expensive
or in many cases cheaper than the customer-crap most people
buy

http://www8.hp.com/de/de/products/desktops/product-detail.html?oid=5037949
a year ago with the SPECS below: 1600 €

it is the choice of the customer buy cheapest crap and pray
your OS will run fine or buy good hardware and that will not change

these days you can have this machine even with a HP branded
debian setup pre-installed
______________________

* Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
* 16 GB RAM
* 2x4 TB Disk

00:00.0 Host bridge: Intel Corporation 2nd Generation Core Processor Family DRAM
Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200/2nd Generation Core Processor Family
PCI Express Root Port (rev 09)
00:02.0 VGA compatible controller: Intel Corporation 2nd Generation Core Processor Family
Integrated Graphics
Controller (rev 09)
00:19.0 Ethernet controller: Intel Corporation 82579LM Gigabit Network Connection (rev
04)
00:1a.0 USB Controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced
Host Controller #2 (rev 04)
00:1b.0 Audio device: Intel Corporation 6 Series/C200 Series Chipset Family High
Definition Audio Controller (rev 04)
00:1c.0 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root
Port 1 (rev b4)
00:1c.4 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root
Port 5 (rev b4)
00:1c.6 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root
Port 7 (rev b4)
00:1c.7 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root
Port 8 (rev b4)
00:1d.0 USB Controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced
Host Controller #1 (rev 04)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev a4)
00:1f.0 ISA bridge: Intel Corporation Q67 Express Chipset Family LPC Controller (rev 04)
00:1f.2 SATA controller: Intel Corporation 6 Series/C200 Series Chipset Family 6 port SATA
AHCI Controller (rev 04)
00:1f.3 SMBus: Intel Corporation 6 Series/C200 Series Chipset Family SMBus Controller (rev
04)
01:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection
02:00.0 USB Controller: NEC Corporation uPD720200 USB 3.0 Host Controller (rev 03)
03:00.0 Network controller: Atheros Communications Inc. AR5008 Wireless Network Adapter
(rev 01

[Heinz Diehl]

On 07.07.2012, suvayu ali wrote: 

>  Can I freely choose to use proprietary (or for that matter
> alternative
>  free) drivers for my hardware from whatever source I prefer? 
As long as you use UEFI/secure boot, your driver has to be signed.
So you have to build and deploy your own keypair/signatures on your whole
system. Alternatively, you could switch off secure boot, if you have
hardware which allows this.

>  A few years back I was in a situation where my USB Wi-Fi dongle was
> not
>  yet supported by Fedora and I had to get the binary blob firmware from
>  the linux kernel wireless page and manually install and load it by hand
>  to use my hardware. Will I be able to do that with ease in the future? 
Both your kernel and your drivers have to be signed. See above.
 
>  Similarly, can I choose to install proprietary drivers or kernel
> modules
>  not distributed with Fedora from what ever source I wish (RPMFusion,
>  Vendor etc.)? 
See above.
 
>  I realise I can turn Secure Boot off, but hardware manufacturers
> have
>  often dropped the ball on complying with standards. What if the next
>  generation of motherboards/laptops make it harder to turn off secure
>  boot? 
Then you're f*cked up and HAVE to build your own keys and re-sign
your whole system.

[Frank Murphy]

On 07/07/12 12:58, Itamar Reis Peixoto wrote:
>  I think we are bigger enough to say no and buy only hardware compatible.
>
>  
Not my first choice.
Been left with Old hardware as only option no thanks.
I think Linux is pragmatic, rather than dogmatic.


-- 
Regards,
Frank
"Jack of all, fubars"

[itamar]

On Sat, Jul 7, 2012 at 7:21 AM, suvayu ali <fatkasuvayu+linux(a)gmail.com&gt; wrote:
>  I realise I can turn Secure Boot off, but hardware manufacturers have
>  often dropped the ball on complying with standards. What if the next
>  generation of motherboards/laptops make it harder to turn off secure
>  boot? Just to make it clear, the questions above are not rhetorical. I
>  just want to understand better the implications as an end-user.
>  

I think we are bigger enough to say no and buy only hardware compatible.


-- 
------------

Itamar Reis Peixoto
msn, google talk: itamar(a)ispbrasil.com.br

[Hakan Koseoglu]

Kevin,
On 7 July 2012 08:57, Kevin Wilson <wkevils(a)gmail.com&gt; wrote:
>  http://lwn.net/Articles/503803
>   That this means that from F18 on, fedora will cost 99$ for every installation? 
As
I understand it, it's a one-off $99 payment for the dev portal
access for the signing service, in the end actual money goes to the
certificate authority but I can't remember which one. It is a decision
I dislike but it is not 99 per installation nor any costs are passed
to end-users.

[Kevin Wilson]

Hi,
Than a lot for your quick answer!
kevin
On Sat, Jul 7, 2012 at 11:07 AM, Frank Murphy <frankly3d(a)gmail.com&gt; wrote:
>  On 07/07/12 08:57, Kevin Wilson wrote:
> >
> > see
> > http://lwn.net/Articles/503803
> >   That this means that from F18 on, fedora will cost 99$ for every
> > installation?
> >
>
>  Discussion on fedora-devel is still ongoing:
>  https://lists.fedoraproject.org/pipermail/devel/2012-June/167732.html
>
>  But from what I gather,
>  the fedoraproject as vendor,
>  will pay Microsoft who will provide a signing service.
>
>  The fedora end-use will pay nothing.
>  But read the thread for the to and fro.
>
>  --
>  Regards,
>  Frank
>  "Jack of all, fubars"
>
>
>  --
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>  Have a question? Ask away: http://ask.fedoraproject.org

[Frank Murphy]

On 07/07/12 08:57, Kevin Wilson wrote:
>  see
>  http://lwn.net/Articles/503803
>    That this means that from F18 on, fedora will cost 99$ for every installation?
>  
Discussion on fedora-devel is still ongoing:
https://lists.fedoraproject.org/pipermail/devel/2012-June/167732.html

But from what I gather,
the fedoraproject as vendor,
will pay Microsoft who will provide a signing service.

The fedora end-use will pay nothing.
But read the thread for the to and fro.

-- 
Regards,
Frank
"Jack of all, fubars"

[EGO-II.1]

On 07/07/2012 09:05 AM, Fernando Cassia wrote:
>  On Sat, Jul 7, 2012 at 9:44 AM, Rahul Sundaram
> <metherid(a)gmail.com&gt; wrote:
> > On x86 systems, the ability to disable secure boot is mandated by
> > Microsoft and needed to debug Microsoft drivers and since all the
> > hardware manufacturers want to comply to this specification, you can be
> > rest assured they will provide this functionality and once you disable
> > secure boot (instructions for this will likely be in a Fedora wiki
> > page
>  Yes, but notice the evil in Microsoft´s wording. Who wants to disable
>  "SECURE" booting? Secure ´feels good´. Lack of ´secure´ does not. It´s
>  like asking "do you want to disable secure landing"? on an airplane.
>  ;)
>
>  Of course 99.9% of the people will think "why do I have to disable
>  SECURE boot to run this? I don´t want my system to have INSECURE
>  booting... please give me secure! in fact, I´d like extra secure if
>  possible" ;). -even if they don´t know what secure booting means to
>  begin with- ;)
>
>  Thus, for starters, RedHat´s decision to pay for a signing key is the
>  practical approach, so users will be able to boot Fedora without
>  tweaking their BIOS/CMOS settings.
>
>  But what I think could be challenged with antitrust regulators is
>  Microsoft CHARGING for it. To keep it a level playing field MSFT
>  should issue free keys to any OS development firm that asks for one,
>  whether commercial or open source.
>
>  FC 
Microsoft could always argue that their "technology" is proprietary and 
therefore not subject to the monopoly laws and anti-trust rules that 
exist.....I'm almost certain M$ has done their homework this time 
around, and that they'll continue to do all in their power to make it 
harder for anyone else to circumvent their products!


EGO II