EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

02.27.13

Microsoft Much Worse Than Proprietary With ‘Secure Boot’ Scam, Pretends to be ‘Open’

Posted in Free/Libre Software, Microsoft at 1:50 pm by Dr. Roy Schestowitz

Emergency phone

Summary: Some of Microsoft’s latest technical attacks on Linux and some responses to EEE (embrace, extend, extinguish) tactics and FUD

Torvalds clearly refuses to give up by putting blobs and keys (similar to but worse than firmware) by adding Microsoft interfaces for Microsoft-signed keys inside the kernel, especially if these are Microsoft’s. This is major news that got the attention of journalists and a known Microsoft booster incites against Torvalds over this (just see headline and image here). Red Hat has been getting close to Microsoft again, so as one blogger put it:

  • Linus Bites RedHat

    It’s great that Linus does not support the idea of making M$ the keeper of the keys. We’ve had enough of that in IT for decades. Free Software needs to remain free of M$ and anyone else who wishes to lock out competition. Linus is not a great lover of FLOSS. His views are based on practicality. It’s stupid to lock Linux into M$. Does RedHat really believe it’s a great thing if millions of GNU/Linux boxes quit booting if M$ revokes a key via firmware upgrade etc.? Do they really think “secure boot” is about security of the world’s IT rather than perpetuation of M$’s monopoly on legacy x86 stuff? Using the damned keys to induce the world to take another step on the Wintel treadmill is just too tempting a fruit to trust M$ to leave it alone.

  • Closed !== Open

    I don’t think so. In the immortal words of Paul Maritz, “* to combat Nscp. we have to have position the browser as “going away” and do deeper integration on Windows. The stronger way to communicate this is to have a “new release“ of windows and make a big deal out of it. We will thus position Memphis as “Windows 98′. * IE integration will be most compelling feature of Memphis.“ Nathan Myhrvold wrote, “I think that it is CRUCIAL to make the statement we ask people about in the survey, or the statement we ask them to sign etc. is worded properly. Saying “put the browser in the OS” is already a statement that is prejudical to us. The name “Browser” suggests a separate thing. I would NOT phrase the survey. or other things only in terms of “put the browser in the 0S’‘. Instead you need to ask a more neutral question about how Internet technology needs to merge with local computing. I have been pretty successful in trying this on various joumalists and industry people.“ To sum up, is the company that brought waves of malware to the world of IT by integrating a totally insecure web browser with their OS in order to mess with competitors to be trusted as “open”? No. M$ is a closed corporation with closed products intending to close out competition by fair means or foul. Pretending to be open is just a means to delay the shift to real openness, FLOSS, or to slow that shift.

Even more Microsoft-apologetic circles accepted Torvalds’ skepticism. To quote one:

As it turned out, almost all of the Windows 8 machines that first appeared had Secure Boot implemented in such a way that Linux was locked out. Workarounds have appeared, but they are based on Microsoft-signed keys. As the maker of the dominant Windows operating system, Microsoft has a responsibility to protect fair play in a way that it didn’t here. In this day of virtualization and usage of multiple operating systems, it’s unfair to build an operating system around a methodology that allows for complete and utter lockout of other platforms. Torvalds’ reactions are only protests at the end of the chain reaction that all of this represented. The fact is that if Microsoft wants to be accepted as playing more fairly with open source these days than it ever has, it has carry that concept through to how it deals with everything it builds and how it deals with hardware makers.

Microsoft pretends to be open, but it’s not working. Here is another new embrace-and-extend attempt:

The expanded partnership between Microsoft and Hadoop distribution specialist Hortonworks has borne fruit with the release of a beta of Hortonworks’ Hadoop Data Platform for Windows.

With its hidden patches and a deal with Sourcefire Microsoft must have hoped to diss Linux some more. Watch this nonsense:

But simple vulnerability counts can give a distorted view. The Linux kernel is considered to be one monolithic project across the entire period, for example, while every version of Windows is a separate project. The total count of vulnerabilities for all Windows versions exceeds Linux. But then Windows is more than just a kernel. Add in all the software included in Linux distributions, and Linux goes back into the doghouse. Younan counted just the high-severity vulnerabilities, those with a Common Vulnerability Scoring System (CVSS) score of 7 or higher. Windows XP tops that list. “Windows Vista is at the number five position, even though Microsoft put a lot of effort into securing Windows Vista,” he said. “The Linux kernel isn’t even in the top ten.” Vista was the first version of Windows to benefit from Microsoft’s Security Development Lifecycle (SDL), the software development process created after Bill Gates’ Trustworthy Computing memo of January 2002. Yet from the vulnerability perspective, Vista looks like little more than a rough draft of Windows 7. Counting high-severity vulnerabilities alone, Flash Player is back in the top 10, at number five. The count of high-severity vulnerabilities doesn’t exhibit that 2012 uptick, only the steady post-2006 decline. However when looking at just critical vulnerabilities, those with a CVSS of 10, there’s no sign of a decline at all.

What silly way to count vulnerabilities. As one of the many comments points out: “I largely agree with Alex in Comment 3 (I also agree with Myth in Comment 1 that 22 != 25, but I digress). Without knowing which kernels had which CVEs reported against it, and which distros shipped with those kernels and how many people used the vulnerable kernel and the averages of people updating on install… ‘simply’ citing the Linux CVEs are practically meaningless.” The FUD against Linux recently seems like part of a trend this month, with Microsoft partners behind it.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

4 Comments

  1. mjg59 said,

    February 27, 2013 at 2:57 pm

    Gravatar

    The patches in question do not include any blobs or keys. You should correct your first paragraph.

    Dr. Roy Schestowitz Reply:

    “The way we have come up with to get around this is to embed an X.509 certificate containing the key in a section called “.keylist” in an EFI PE binary and then get the binary signed by Microsoft. The key can then be passed to the kernel by passing the signed binary” -David Howells at LKML

    mjg59 Reply:

    Yes. It adds an additional keyloading interface to the kernel, alongside the keyloading interface that already exists. The only thing it changes is that it allows you to use a different key format. It adds no keys or blobs to the kernel.

    Dr. Roy Schestowitz Reply:

    I’ll amend the post.

What Else is New


  1. Bristows LLP/IP Kat Carrying on With Dead UPC Jingoism

    The same old tune from Bristows not only gets played in Bristows' 'alternate reality' blog but also in other blogs where Bristows staff is 'contributing' (to confusion and misconceptions)



  2. Links 16/12/2017: Mesa 17.2.7, Wine 3.0 RC2, Kdenlive 17.12.0, Mir 0.29

    Links for the day



  3. Patrick Corcoran is Innocent, Yet Battistelli Will/May Have the Power to Sack Him Next Month (in DG1)

    The EPO's Administrative Council does not want to even mention Patrick Corcoran, as merely bringing that up might lead to the suggestion that Benoît Battistelli should be fired (yes, they can fire him), but to set the record straight, at the EPO truth-tellers are punished and those whom they expose are shielded by the Administrative Council



  4. Patent Trolls Are Going Bust in the United States (Along With the 'Protection' Racket Conglomerates)

    RPX continues its gradual collapse and patent trolls fail to find leverage now that software patents are kaput and patent opportunists struggle to access Texan courts



  5. IBM's Manny Schecter is Wrong Again and He is Attempting to Justify Patent Trolling

    In yet another dodgy effort to undermine the US Supreme Court and bring back software patents, IBM's "chief patent counsel" (his current job title) expresses views that are bunk or "alternative facts"



  6. EPO Administrative Council Disallows Discussion About Violations of the Law by Benoît Battistelli

    The EPO crisis is not ending for the Administrative Council does not want to tackle any of the obvious problems; Patrick Corcoran is a taboo subject and Ernst is coming across as another protector of Benoît Battistelli, based on today's meeting (the second meeting he chairs)



  7. Links 13/12/2017: GIMP 2.9.8, Fedora 25 End Of Life, AltOS 1.8.3

    Links for the day



  8. Judge Corcoran Got His User ID/Desk Back (as ILO Asked), But Cannot Perform Actual Work

    The latest update regarding Patrick Corcoran, whose 3-year ordeal is far from over in spite of ILO's unambiguous rulings in his favour



  9. The End of Software Patents and PTAB's Role in Enforcing That End

    Software patents are fast becoming a dying breed and the appeal board (PTAB) of the USPTO accelerates this trend, irrespective of patent immunity attempts



  10. No, China Isn't Most Innovative, It's Just Granting a Lot of Low-Quality Patents

    Patent extremists are trying to make China look like a role model or a success story because China grants far too many patents, spurring an explosion in litigation



  11. Battistelli-Campinos Transition Will Be a Smooth One as the Administrative Council Remains the Same and the Boards Still Besieged

    A rather pessimistic (albeit likely realistic) expectation from tomorrow's meeting of the Administrative Council, which continues to show that no lessons were learned and no strategy will be altered to avoid doom (low-quality patents and stocks running out)



  12. Links 12/12/2017: New BlackArch ISO and Stable Kernels

    Links for the day



  13. German Media Helps Cover Up -- Not Cover -- the Latest EPO Scandal

    EPO-Handelsblatt attention diversion tricks may be effective as German media barely shows interest in one of the EPO's biggest scandals to date



  14. PTAB Haters Fail to Guard Bogus Patents, But They Still Try

    Three Affiliated Tribes probably won't enjoy sovereign immunity from PTAB, Dennis Crouch won't manage to slow down PTAB, and patent litigation will stagnate as bad patents perish before they even land in a lawsuit



  15. Team UPC's Tilmann Defends Rogue Vote at 1 AM in the Morning With Just 5% of Politicians (Those With Vested Interests) Attending

    Just when German democracy is being stolen by a legislative coup (in the dead of night when 95% of politicians are absent/asleep) there's someone 'courageous' enough to rear his ugly head and attempt to justify that coup



  16. The Mask Falls: Lobbyist David Kappos Now Composes Pieces for the Patent Trolls' Lobby (IAM)

    David Kappos, a former USPTO Director who is now lobbying for large corporations that derive revenue from patent extortion, is writing for IAM even if his views are significantly biased by his aggressive paymasters (just like IAM's)



  17. The EPO Protest Tomorrow Isn't Just About Judge Corcoran But About the EPO as a Whole

    PO staff is about to protest against the employer, pointing out that "Battistelli is still showing a total and utter lack of respect not only for his staff and their rights but also for the Administrative Council and for the Tribunal"



  18. Claim: Judge Corcoran to Be Put Under Benoît Battistelli's Control in DG1

    Benoît Battistelli, who openly disregards and refuses to obey judges (while intervening in trials and delivering 'royal decrees' whenever it suits him), may soon gain direct control over the judge he hates most



  19. The European Patent Organisation Refrains (For Nearly a Week) From Speaking About Battistelli's Abuses as Judged by ILO Tribunal

    The EPO's silence on the matter of Patrick Corcoran is deafening; to make matters worse, the EPO continues to pollute media and academia with money of stakeholders, with the sole intention of lobbying and misleading news coverage (clearly a disservice to these stakeholders)



  20. Carl Josefsson Lets Judge Patrick Corcoran Come Back to Work at the EPO

    After initial reluctance to obey/respect the rulings from the ILO (security staff declining access) there is official permission for Patrick Corcoran to enter and resume work (following 3 years of injustice against him)



  21. Bristows is Being Hammered With Negative Comments For Its Unitary Patent (UPC) Lies

    The Unified Patent Court (UPC) is practically dead in the UK and Ireland; Bristows, nevertheless, continues with its desperate spin



  22. Links 11/12/2017: Linux 4.15 RC3, Debian 8.10 and Debian 9.3

    Links for the day



  23. Judge Corcoran Turns to His Government for Help and EPO 'House Ban' is Finally Lifted

    Sources that are very reliable say that Patrick Corcoran is coming back to work, however it's now clear when and how long for



  24. Raw: Battistelli's Control/Domination Over the Boards of Appeal

    An old EPO document internally voicing concerns about the lack of independence at the Boards of Appeal



  25. Raw: Conflicts of Interest of EPO Vice-President

    An old EPO concern regarding structural collisions and mixed loyalties



  26. Microsoft-Connected Patent Trolls Are Increasingly Active and Microsoft is Selling 'Protection' (Azure Subscriptions)

    There are several indications that Microsoft-connected shells, which produce no products and are threatening a large number of companies, are inadvertently if not intentionally helping Microsoft sell "indemnification" ("Azure IP Advantage," which echoes the Microsoft/Novell strategy for collecting what they called "patent royalties" one decade ago)



  27. Yes, RPost is Definitely a Patent Troll and Its Software Patents Are at Risk Thanks to Alice

    The latest whitewashing (or reputation-laundering) pieces from Watchtroll, which tries to justify patent-trolling activities with software patents, typically in the Eastern District of Texas



  28. The Latest Scams in the Patent World

    Examples of 'dirty laundry' of the patent microcosm, which it understandably does not like covering (as it harms confidence in their services/advice)



  29. Patents Are Becoming a Welfare System for the Rich and Powerful

    A culture of litigation and more recently the patenting of broad industry standards may mean that multi-billion dollar corporations are cashing in without lifting a finger



  30. Unlike the Mobile Domain, When it Comes to Cars Patent Lawsuits Remain Rare

    An optimistic note regarding the relatively low-temperature legal landscape surrounding advanced automobiles, even though patents are being amassed on software in that domain


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts