Thibault Nélis writes:
On 06/01/2012 01:11 PM, Sam Varshavchik wrote:
> You are assuming that Microsoft will sign a bootloader with such
> functionality.
>
> I would not take that bet.
The plan is to make them sign a shim boot loader, which essentially
delegates the trust down to Fedora entirely, because they have no control
over what Fedora will make that shim load next. Fedora can implement
whatever they want after that.
And they will sign;
Says who?
they can't possibly review all the software
that could
follow the boot loader down the chain,
They won't have to. Once they have a signing key that boots their current
Windows OS, they have no further need for a certification process. What
value added benefit does it bring to them?
because it includes big
monolithic
kernels, so they have to trust the people who develop the software instead
of the software itself.
No, they don't have to trust anyone. Who says that Microsoft must trust a
bunch of hippies?
Hahaha.
> How about buying a laptop or a PC that will boot any damn OS you
want,
> without all this cockamamie crap?
Well any computer *will* boot any damn OS, just add a key, or don't use the
technology.
Again, you're assuming that I will be able to add my own key.
All I've heard is that OEMs will have a physical kill switch, to turn off
secure boot.
Where can I read some big name OEM's announcement of a board that will
accept user-generated keys?
Please prove me wrong. Where can I get the details of those plans?
And would you care to take my bet, for 1,000 quatloos, that Microsoft's
certification program will be a farce? They'll sign Oracle's key, that can
only boot Solaris, sure. They may very well sign an RHEL key, that will boot
a locked-down RHEL.
An open Fedora? Not going to happen.