EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

02.27.13

Microsoft Much Worse Than Proprietary With ‘Secure Boot’ Scam, Pretends to be ‘Open’

Posted in Free/Libre Software, Microsoft at 1:50 pm by Dr. Roy Schestowitz

Emergency phone

Summary: Some of Microsoft’s latest technical attacks on Linux and some responses to EEE (embrace, extend, extinguish) tactics and FUD

Torvalds clearly refuses to give up by putting blobs and keys (similar to but worse than firmware) by adding Microsoft interfaces for Microsoft-signed keys inside the kernel, especially if these are Microsoft’s. This is major news that got the attention of journalists and a known Microsoft booster incites against Torvalds over this (just see headline and image here). Red Hat has been getting close to Microsoft again, so as one blogger put it:

  • Linus Bites RedHat

    It’s great that Linus does not support the idea of making M$ the keeper of the keys. We’ve had enough of that in IT for decades. Free Software needs to remain free of M$ and anyone else who wishes to lock out competition. Linus is not a great lover of FLOSS. His views are based on practicality. It’s stupid to lock Linux into M$. Does RedHat really believe it’s a great thing if millions of GNU/Linux boxes quit booting if M$ revokes a key via firmware upgrade etc.? Do they really think “secure boot” is about security of the world’s IT rather than perpetuation of M$’s monopoly on legacy x86 stuff? Using the damned keys to induce the world to take another step on the Wintel treadmill is just too tempting a fruit to trust M$ to leave it alone.

  • Closed !== Open

    I don’t think so. In the immortal words of Paul Maritz, “* to combat Nscp. we have to have position the browser as “going away” and do deeper integration on Windows. The stronger way to communicate this is to have a “new release“ of windows and make a big deal out of it. We will thus position Memphis as “Windows 98′. * IE integration will be most compelling feature of Memphis.“ Nathan Myhrvold wrote, “I think that it is CRUCIAL to make the statement we ask people about in the survey, or the statement we ask them to sign etc. is worded properly. Saying “put the browser in the OS” is already a statement that is prejudical to us. The name “Browser” suggests a separate thing. I would NOT phrase the survey. or other things only in terms of “put the browser in the 0S’‘. Instead you need to ask a more neutral question about how Internet technology needs to merge with local computing. I have been pretty successful in trying this on various joumalists and industry people.“ To sum up, is the company that brought waves of malware to the world of IT by integrating a totally insecure web browser with their OS in order to mess with competitors to be trusted as “open”? No. M$ is a closed corporation with closed products intending to close out competition by fair means or foul. Pretending to be open is just a means to delay the shift to real openness, FLOSS, or to slow that shift.

Even more Microsoft-apologetic circles accepted Torvalds’ skepticism. To quote one:

As it turned out, almost all of the Windows 8 machines that first appeared had Secure Boot implemented in such a way that Linux was locked out. Workarounds have appeared, but they are based on Microsoft-signed keys. As the maker of the dominant Windows operating system, Microsoft has a responsibility to protect fair play in a way that it didn’t here. In this day of virtualization and usage of multiple operating systems, it’s unfair to build an operating system around a methodology that allows for complete and utter lockout of other platforms. Torvalds’ reactions are only protests at the end of the chain reaction that all of this represented. The fact is that if Microsoft wants to be accepted as playing more fairly with open source these days than it ever has, it has carry that concept through to how it deals with everything it builds and how it deals with hardware makers.

Microsoft pretends to be open, but it’s not working. Here is another new embrace-and-extend attempt:

The expanded partnership between Microsoft and Hadoop distribution specialist Hortonworks has borne fruit with the release of a beta of Hortonworks’ Hadoop Data Platform for Windows.

With its hidden patches and a deal with Sourcefire Microsoft must have hoped to diss Linux some more. Watch this nonsense:

But simple vulnerability counts can give a distorted view. The Linux kernel is considered to be one monolithic project across the entire period, for example, while every version of Windows is a separate project. The total count of vulnerabilities for all Windows versions exceeds Linux. But then Windows is more than just a kernel. Add in all the software included in Linux distributions, and Linux goes back into the doghouse. Younan counted just the high-severity vulnerabilities, those with a Common Vulnerability Scoring System (CVSS) score of 7 or higher. Windows XP tops that list. “Windows Vista is at the number five position, even though Microsoft put a lot of effort into securing Windows Vista,” he said. “The Linux kernel isn’t even in the top ten.” Vista was the first version of Windows to benefit from Microsoft’s Security Development Lifecycle (SDL), the software development process created after Bill Gates’ Trustworthy Computing memo of January 2002. Yet from the vulnerability perspective, Vista looks like little more than a rough draft of Windows 7. Counting high-severity vulnerabilities alone, Flash Player is back in the top 10, at number five. The count of high-severity vulnerabilities doesn’t exhibit that 2012 uptick, only the steady post-2006 decline. However when looking at just critical vulnerabilities, those with a CVSS of 10, there’s no sign of a decline at all.

What silly way to count vulnerabilities. As one of the many comments points out: “I largely agree with Alex in Comment 3 (I also agree with Myth in Comment 1 that 22 != 25, but I digress). Without knowing which kernels had which CVEs reported against it, and which distros shipped with those kernels and how many people used the vulnerable kernel and the averages of people updating on install… ‘simply’ citing the Linux CVEs are practically meaningless.” The FUD against Linux recently seems like part of a trend this month, with Microsoft partners behind it.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

4 Comments

  1. mjg59 said,

    February 27, 2013 at 2:57 pm

    Gravatar

    The patches in question do not include any blobs or keys. You should correct your first paragraph.

    Dr. Roy Schestowitz Reply:

    “The way we have come up with to get around this is to embed an X.509 certificate containing the key in a section called “.keylist” in an EFI PE binary and then get the binary signed by Microsoft. The key can then be passed to the kernel by passing the signed binary” -David Howells at LKML

    mjg59 Reply:

    Yes. It adds an additional keyloading interface to the kernel, alongside the keyloading interface that already exists. The only thing it changes is that it allows you to use a different key format. It adds no keys or blobs to the kernel.

    Dr. Roy Schestowitz Reply:

    I’ll amend the post.

What Else is New


  1. 'Reform' at the EPO Means Destroying the Staff Union, Crushing Patent Examiners, and Imposing on Europe a System It Does Not Want (UPC)

    The chaotic transition at the EPO -- a transition from something which has been workable to something intolerable -- and the role of the Unitary Patent (UPC), which lurks in the shadows and threatens to harm the whole of Europe



  2. Shakeup Against Patent Parasites in the US and More Rumours/Speculations About USPTO Director Michelle Lee After Trump's Inauguration

    The US patent system is becoming ever more hostile towards patent trolls, owing in part to reforms introduced under Michelle Lee's tenure, but people are still not certain that she will maintain her job and continue to fix the system



  3. EPO Abuses Now Make the Netherlands Look Like a Facilitator of Human/Labour Rights Abuses

    Rather than crack down on human rights abuses, the Dutch government now sends out the signal that it's an island for those wish to violate human rights whilst enjoying immunity (EPO)



  4. Links 20/1/2017: Docker 1.13, Linux 4.4.44 LTS

    Links for the day



  5. “Federal Circuit Had Affirmed on Every Issue in 77.4% of the Patent Trial and Appeal Board Appeals it Had Seen” in 2016

    The Federal Circuit (CAFC) and Patent Trial and Appeal Board (PTAB) continue to squash a lot of patents on software, in contrast to that fake news from patent maximalists



  6. Kudelski Group Not Only Acts Like a Patent Troll But Also Run by Intellectual Ventures Person; Mobile Market in Dire State of Patent Armageddon

    The patent thicket which pervades everything that is used by billions of people, mobile technology in particular, can be traced back to a lot of non-practicing parasites (or patent trolls)



  7. Watchtroll and His Swamp Still Blame Google (Where Michelle Lee Came From) for Improving and Gradually Fixing Aspects of the US Patent System

    Shooting the messengers (even wrongly associating yours truly with Google) in an effort to undermine patent reform when it is so desperately needed due to serious injustices



  8. In an Age of Necessary Patent Reform and Permanent Uncertainty for Software Patents the Patent Microcosm Looks for Workarounds and Spin

    Commentary on the status quo in the Michelle Lee era and some examples of bias from the patent microcosm, as well as news regarding the NFL getting sued by the Kudelski Group



  9. Michelle Lee, USPTO Director, Should Recognise That the Patent Microcosm is Her Enemy Which Hates Her

    The latest outburst from the patent microcosm, which has a temper issue and notorious disdain for judges it does not agree with, is more of what we have come to expect



  10. Battistelli is an Autocrat Above the Law and It's OK, Holland's High Council Says

    Battistelli's autocratic tendencies will not be challenged by Dutch authorities, in spite of sheer condemnation from many groups all across Europe and the entire world



  11. Beware Fake News About the Unitary Patent (UPC)

    The UPC is dead, deadlocked, stuck, in a limbo and so on; those who claim otherwise are merely lobbying (in disguise of "analysis" or "news")



  12. Shame on MapR for Pursuing Software Patents While Pretending to Stand for Free/Open Source Software

    The patents gold rush sees another company joining the 'fun', albeit this company should campaign hard against software patents rather than pursue any



  13. Doomsday Scenario in the Back Mirror as Michelle Lee Keeps Her Job (and Much-Needed Patent Reform) at the USPTO

    The future of patent reform, i.e. tackling overpatenting and patent trolls, looks somewhat more promising with today's confirmation of Lee's 'extended tenure' at the Office



  14. Links 19/1/2017: PulseAudio 10.0, Linux 4.9 Longterm Kernel

    Links for the day



  15. Corporate (Wall Street) Media Agrees That Brexit Dooms the Unitary Patent (UPC)

    The nonstop lies or the fake news about the UPC starting "real soon now" don't quite pass a reality check or a basic assessment based on fundamental concepts, such as the UPC's facilitation of subordination (to Europe) in the United Kingdom



  16. Farce of an 'Independence' for the Boards of Appeal as Another Ally of Benoît Battistelli Enters as Parasite Inside the 'Overseer'/Host

    The latest cluster of lies from the President of the European Patent Office (EPO) and direct refutation of false claims of independence for the Boards of Appeal, where the former Vice-Presidents can flock, just like the Mini Minion (Minnoye) of Battistelli



  17. Links 18/1/2017: Red Hat's OpenShift 3.4, Mozilla's New Logo/Branding

    Links for the day



  18. Union-Busting Action by Team Battistelli Takes Heavy Toll, Techrights Will Continue to Expose EPO Injustices to the World

    The Staff Union of the European Patent Office, SUEPO, which faced unprecedented and probably illegal (based on local laws) attacks, is being weakened by the worst President ever, whose own management team seems to be collapsing along with the institution he is destroying in just a few years



  19. A Lot More Fake News About the UPC, Trying to Convince People That the UK is Ratifying (It's Not, It Cannot)

    Response to some of the latest misleading (self-serving) whispers about the fate of the Unified Patent Court (UPC), which is in a deadlock due to Brexit



  20. Rumours Suggest That EPO Management is Aware of Decline in Patent Quality and is Thus Actively Lying About it to the Media/Public

    Whenever Battistelli brags about patent quality he may be consciously and deliberately lying through his teeth if the latest rumours are correct



  21. Links 17/1/2017: GIMP Plans, New Raspberry Pi Product

    Links for the day



  22. Resumption of EPO Propaganda ('Meet the President') Officially Starts Tomorrow

    Yet another one of these foolish 'Meet the President' stunts, scheduled to take place tomorrow morning



  23. Caricature: Battistelli's New Year's Resolution (More EPO Lies)

    The latest cartoon being circulated within the European Patent Office (EPO)



  24. Donald Trump Gives New Hope to Patent Aggressors and Patent Trolls

    Pessimism about the prospects of patent progress or patent reform in an age of staunchly pro-business Conservatives and glorification of protectionism



  25. More Fake News About the Unified Patent Court (UPC) Based on Lobbying Tactics From Bristows UPC and the Preparatory Committee

    Unified Patent Court (UPC) lobbying has gotten so bad that it now infiltrates general media outlets, where people are asked to just blindly assume that the UPC is coming and is inevitable, even though it's clearly in a limbo and is unlikely to see the light of day



  26. EPO Totally Silent for a Month, But Deep Inside There Are Serious Cracks

    The situation at the EPO seems to be pretty grim, even at the top-level management, and the EPO has gone into permanent silence mode



  27. Links 16/1/2017: Linux 4.10 RC4, Linux Mint 18.1 'Serena' KDE Edition Beta

    Links for the day



  28. 'Financial Director' Publishes Fake News About the Unitary Patent (UPC)

    Response to some of the latest UPC propaganda, which strives to misinform Financial Directors so as to enrich the author and his firm



  29. Independent and Untainted Web Sites About Patents Are Still Few and Rare

    Commentary about news sources that we rely on, as well as the known pitfalls or the vested interests deeply ingrained in them



  30. The 20% Rule: Patent Trolling Suffers Double-Digit Declines and Patent Troll Technicolor is Collapsing

    Significant demise or total catastrophe for the modus operandi (method) of going after companies with a pile of patents and threats of litigation


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts