07.17.12

Gemini version available ♊︎

TechBytes Episode 69: Richard Stallman on Restricted Boot (UEFI), Coreboot, GRUB, and Boot Freedom

Posted in TechBytes at 8:22 am by Dr. Roy Schestowitz

Techbytes 2012

Direct download as Ogg (0:13:28, 5.5 MB)

Summary: The first part of our interview with Richard Stallman covers Restricted Boot and related issues

I first interviewed Richard Stallman about 5 years ago. Yesterday I spoke to him about the subject of much debate in the Free software world right now. Here is a transcript of our conversation.

Dr. Roy Schestowitz: I want to know how big a threat you think the so-called “secure” boot is considered to be to the Free software movement.

Richard StallmanDr. Richard Stallman: It’s a disaster. Well, except that it’s not secure boot that’s a disaster, it’s restricted boot. Those are not the same. When it’s front of the control of the user, secure boot is a security feature. It allows the user to control what programs can run on a machine and thus prevent — you might say — unexpected malware from running. We have to distinguish the unexpected malware such as viruses from the expected malware such as Windows or Mac OS or Flash Player and so on, which are also malware; they have features that hurt the user but users know what they are installing. In any case, what secure boot does is that it causes the machine to only work with (?) programs that are signed with a certain key, your keys. And as long as the user controls which keys they are, then it’s a security feature. However, it can be chained into a set of digital handcuffs when the user doesn’t control the keys. And this [is] happening.

“We have to distinguish the unexpected malware such as viruses from the expected malware such as Windows or Mac OS…”Microsoft demands that ARM computers sold for Windows 8 be set up so that the user cannot change the keys; in other words, turn it into restricted boot. Now, this is not a security feature. This is abuse of the users. I think it ought to be illegal.

It’s a matter of control by the vendor of course, not control by the user himself

Exactly, and that’s why it’s wrong. That’s why non-free software is wrong. The users deserve to have control of their computers/

I think that not only Windows is going to be an issue in fact, if you consider the fact that even a modified kernel is going to be in a position where it’s perhaps not seen as verified for execution. Right, I’m saying, it might not only be a malicious feature in case of something like Windows running on it, it’s also for — let’s say — a user of the offered operating system but it’s free if the user wants to modify the operating system, for example…

The thing is, if the user doesn’t control the keys, then it’s a kind of shackle, and that would be true no matter what system it is. After all, why is GNU/Linux better than Windows? Not just ’cause it has a different name. The reason it’s better is because it’s freedom-respecting Free software that the users control. But if the machine has restricted boot and the users can’t control the system, then it would be just as bad as Windows. So, if the machine will only run a particular version of GNU/Linux, that is a restriction feature. And I haven’t heard anyone doing that yet with GNU/Linux, but that’s what Red Hat and Ubuntu are proposing to do things — somewhat like that — for future PCs that are shipped for Windows. But it’s not exactly that. And my reason is, the users will be able to change the keys. They will be able to boot their own modified version of the system of Fedora or Ubuntu if they want. So, what Fedora and Ubuntu were proposing doesn’t go all the way there. They’re proposing to do things to make it more convenient for users to install the standard version of those systems. But if things go as it has been announced, users will still be able to change the keys and boot their own versions. So, if all the restricted boot — but it will be something that goes sort of half-way there — it’s somewhat distasteful.

“The thing is, if the user doesn’t control the keys, then it’s a kind of shackle, and that would be true no matter what system it is.”On the other hand, with Android, which is another mostly Free operating system which contains Linux but doesn’t contain GNU, it’s quite common for the product to have something equivalent to restricted boot, and people have to struggle to figure out how they can install a modified and more free version of Android. So, the presence of the kernel Linux in a system doesn’t guarantee it’s going to be better. And I’ve heard someone say — oh, it hasn’t been checked — that a particular or kind of Android device is actually using an Intel chip with restricted boot.

One of the concerns that I think is worth raising is the fact that, as far as I know, with many of the embedded devices, especially those based on ARM, I believe it’s not even possible to get into boot menu to disable so-called “secure”…

That’s where Microsoft is really going all out, because Microsoft has ordered essentially — demanded — that those shipping ARM devices for Windows 8 make it restricted boot with no way to get around it.

Yeah, which also means of course waste of… all sorts of impacts on the environment. Any time that hardware become obsolete with the operating system itself is not being used of course…

“So it’s a very damaging thing that Microsoft is doing and so we need to look for every possible way to stop them or tweak what they’re doing.”Well, it’s worse than that. It means basically that those devices, you have to throw them out if you want to escape to the free world. And this — in the past — we were able to install, to liberate a computer by installing Free software on it instead of its user-restricting operation system, and this of course was tremendously helpful to the spread of GNU/Linux because it meant that users could move to freedom. It would be much harder if they had to buy another computer to do so. So it’s a very damaging thing that Microsoft is doing and so we need to look for every possible way to stop them or tweak what they’re doing.

Well, I wanted to ask you, one of our readers — his name is Will — is asking me if you have seen any new good hardware that can take coreboot.

I’m sorry, what?

One of my readers — a guy called Will — he has asked me if you have seen any new good hardware that can take coreboot.

“So, what we really need to do is make coreboot libre, just as we make Linux libre (which doesn’t have the blobs)…”I don’t know. Basically, I don’t keep track of hardware models. I only remember their names anymore, except for the one I use, which is, the Lemote Yeelong and it doesn’t run coreboot but it will run timar [?] in GRUB, it has a Free BIOS. When it comes it has a Free BIOS, which is why I chose it. But in terms of running coreboot, well, the machine which you run coreboot on are Intel-type machines. Now, there are a couple of… there is a problem, and that is, a lot of the Intel — and also AMD — CPUs require a microcode blob, and coreboot has these microcode blobs, which is the same kind of problem as firmware blobs in Linux. So, what we really need to do is make coreboot libre, just as we make Linux libre (which doesn’t have the blobs), keep (?) the coreboot libre (which doesn’t have the blobs) and then we need to see which processors actually run adequately without any microcode blob. And we’re looking for somebody who wants to lead this project ’cause it takes work. Now, leading this project doesn’t mean that you personally get all these kinds of hardware; oh, no, it would be asking the whole community to test things, but somebody has got to ask the community to do it, spread the word, receive the responses, put them together, and publish the list. Would (?) he like to do that? If he is really interested in having the answer to this question, maybe he’d like to help get the answer, and that would help the whole community.


More from Stallman is to be published in coming days.

We hope you will join us for future shows and consider subscribing to the show via the RSS feed. You can also visit our archives for past shows. If you have an Identi.ca account, consider subscribing to TechBytes in order to keep up to date.

As embedded (HTML5):

Keywords: UEFI Coreboot GRUB GNU FSF

Download:

Ogg Theora

Past shows in this series:

Show overview Show title
Episode 66: Tim and Roy TechBytes Episode 66: First of the Second Series
Episode 67: Tim and Roy TechBytes Episode 67: Nokia Down, Android Up
Episode 68: Roy TechBytes Episode 68: Solo With Patents, Apple Bans, and Android World Domination
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. [Meme] Looting Europe and Taking Away From the Office

    The staff of the EPO is being robbed by corrupt officials, who arrogantly assume that they can get away with anything (because they have facilitators all over Europe)



  2. IRC Proceedings: Sunday, September 19, 2021

    IRC logs for Sunday, September 19, 2021



  3. Formally Challenging the EPO and Microsoft for Apparent Efforts to Suppress Reporting With Evidence of Crimes, Including Violations of EPO Data Protection Guidelines

    The largest cross-institutional European den of corruption, the EPO, will be hearing from lawyers and hopefully from public officials too. The criminal behaviour is long overdue for review and the Administrative Council too should be investigated (for repeatedly abetting this behaviour, for personal gain).



  4. Links 20/9/2021: Linux 5.15 RC2 and pgAdmin 4 5.7 Released

    Links for the day



  5. [Meme] Warning - Tree Felling in Progress

    Warming up for our next EPO series



  6. Links 19/9/2021: Sparky 2021.09, Whisker Menu 2.6.0, HarfBuzz 3.0, and gThumb 3.12

    Links for the day



  7. EPO Management is Hiding Under the 'Cloud' While Violating Privacy Laws

    Facing a barrage of scrutiny for outsourcing the EPO's systems to Microsoft, the EPO has just arranged yet another expensive PR stunt, looking to somehow 'normalise' the unacceptable and the likely illegal



  8. Maintenance and Development Updates

    We've been doing a lot of work on the back end (or operations) of Techrights, more so this past month, and we're almost ready to resume the normal publication pace



  9. [Meme] Microsoft Says Its Paying Clients (Like EPO) Don't Violate Privacy Law

    The ever-so-docile EPO will gladly oblige when companies like Microsoft lie about the legality of their industrial espionage operations, masked as “clown” computing (and other buzzwords)



  10. Coming Soon: EPO Series on Lawlessness

    Some time soon we’ll start an important series about the EPO, seeing that the management of the EPO is panicking and trying to put out the fire created by prior ones (more on that shortly)



  11. Links 19/9/2021: Jolla's Sailfish OS 4.2 and FreeBSD Technology Roadmap

    Links for the day



  12. IRC Proceedings: Saturday, September 18, 2021

    IRC logs for Saturday, September 18, 2021



  13. Links 18/9/2021: LibreOffice 8.0 Plans and Microsoftcosm Uses WSL to Badmouth 'Linux'

    Links for the day



  14. Links 18/9/2021: GIMP 2.10.28 Released and Azure Remains Back Doored

    Links for the day



  15. IRC Proceedings: Friday, September 17, 2021

    IRC logs for Friday, September 17, 2021



  16. Links 17/9/2021: Ubuntu 18.04.6 LTS, Manjaro 21.1.3, “2021 is the Year of Linux on the Desktop”

    Links for the day



  17. Links 17/9/2021: WSL Considered Harmful

    Links for the day



  18. [Meme] Microsoft Loves Linux Bug/Back Doors

    Microsoft is just cementing its status as little but an NSA stooge



  19. Lagrange Makes It Easier for Anybody to Use Gemini and Even Edit Pages (With GUI)

    Gemini protocol and/or Gemini space are easy for anyone to get started with or fully involved in (writing and creating, not just reading); today we take a look at the new version of Lagrange (it was first introduced here back in March and covered again in April), which I installed earlier today because it contains a lot of improvements, including the installation process (now it’s just a click-to-run AppImage)



  20. IBM is Imploding But It Uses Microsoft-Type Methods to Hide the Demise (Splits, Buybacks, and Rebranding Stunts)

    A combination of brain drain (exodus) and layoffs (a lack of budget combined with inability to retain talent or attract the necessary staff with sufficiently competitive salaries) dooms IBM; but the media won't be mentioning it, partly because a lot of it is still directly sponsored by IBM



  21. IRC Proceedings: Thursday, September 16, 2021

    IRC logs for Thursday, September 16, 2021



  22. [Meme] 70 Days of Non-Compliance

    António Campinos would rather fall on his sword than correct the errors or work to undo the damage caused by Team Battistelli, which is still at the EPO



  23. EPO “Board 28” Meeting: Imaginary Dialogue Between EPO President Campinos and the Chair of the Administrative Council, Josef Kratochvíl

    The EPO‘s chaotic state, which persists after Benoît Battistelli‘s departure, is a state of lawlessness and cover-up



  24. Links 16/9/2021: Linux Mint Has New Web Site, LibreOffice 7.2.1, KDE Plasma 5.23 Beta, and Sailfish OS Verla

    Links for the day



  25. If Git Can be Done Over the Command Line and E-mail, It Can Also be Done Over Gemini (Instead of Bloated Web Browsers)

    In order to keep Git lean and mean whilst at the same time enabling mouse (mousing and clicking) navigation we encourage people everywhere to explore gemini://



  26. Techrights Examines a Wide Array/Range of Gemini Clients/Browsers

    After spending many months examining an array of different types of software for Gemini (including but not limited to clients/browsers) we take stock of what exists, what's supported (it varies a bit), and which one might be suitable for use by geeks and non-geeks



  27. Links 16/9/2021: KStars 3.5.5 and Chafa 1.8

    Links for the day



  28. Trusting Microsoft With Security is a Clown Show

    A quick and spontaneous video about this morning's post regarding a major new revelation that reaffirms a longstanding trend; Microsoft conflates national security (back doors) with security



  29. IRC Proceedings: Wednesday, September 15, 2021

    IRC logs for Wednesday, September 15, 2021



  30. Microsoft Azure and Back/Bug Doors in GNU/Linux: Fool Me Once (Shame on You) / Fool Me Twice (Shame on Me)

    "Fool me once, shame on you; fool me twice, shame on me," goes the old saying...


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts