Bonum Certa Men Certa

Microsoft Secure Boot and Intel VMD Pointless on GNU/Linux and Lenovo’s Documentation Recommends That You Turn Them Off

Guest post by Ryan, reprinted with permission from the original

Secure Boot is Microsoft trash that was designed to paper over some of the reputation of Windows as a malware plaything.



The problem is that Secure Boot doesn’t actually work. uEFI firmware has been so horrendously bad from its inception that there’s always a Secure Boot escape.



Microsoft introduced the Windows RT (ARM, not the standard x86 instruction set CPU) devices, based on Windows 8, and there was a Secure Boot escape almost immediately. It was necessary to escape Secure Boot were there to be any other operating systems for these devices, because there was no option to turn it off. Something that may be coming with new “Windows 11” PCs, since Secure Boot is required or else Windows will refuse to load.



"Sometime they lose billions of dollars and quietly write it down."Someone got Grub (the bootloader program commonly used with GNU/Linux) to work on the Surface RT, but GNU/Linux was never ported to these things due to lack of interest at the time. Nobody bought the product and it was just another Microsoft FAIL. They have many of them, like Windows Phone. Sometime they lose billions of dollars and quietly write it down.



GNU/Linux has never had a big malware problem. Microsoft pays the “tech media” to imply otherwise, but it always turns out to be a bald-faced lie. More propaganda. More Microsoft bullshit!



In these churnalism articles, EVERYTHING with an open source license inevitably becomes “Linux”, even if it has the same problem on Windows. Even if it’s a part of Windows (like OpenSSL is). In some cases, when they refer to “Linux malware”, they mean malware that runs on Windows if you use the fake Linux (virtual machine with bad performance) in Windows, called WSL/WSL2.



And frankly, I’m getting sick and damned tired of Microsoft paying for this crap to be typed up and then Googlebombing Linux as part of their most recent smear campaign.



In South Park, Mr. Garrison, as a stand in for Donald Trump, defined something called DARVO, wherein the bully denies their bad behavior, then goes on the attack by reversing the victim and offender.



"“Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling."It’s hard to come up with a better description of what Microsoft has been doing for the past two decades. “Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling.



And of course, it’s easier to try to imply that GNU/Linux has problems than it is to fix your own Windows mess.



In the past 20 years, GNU/Linux has had fewer viruses and worms than you can count on your fingers which were even worth mentioning. None of them “just happened”, either. You had to defy GNU/Linux best practices of getting signed packages from your distribution or other trusted source, and grab random unsigned software from some internet site and jam it in somehow.



Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows.



In fact, according to most antivirus companies, Windows gets that in under a typical hour.



They don’t even try to keep up with detection patterns for most specific threats because they can’t. So, antivirus on Windows becomes mostly a guessing game except for the very most prevalent threats.



And when this happens, many threats are missed.



"Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows."That’s why you hear about Ransomware attacks that mean no gasoline on the eastern seaboard of America or how a poultry plant can’t process chickens. The media, bribed by Microsoft money, never mentions Windows.



Windows Security is so godawful that they add tons and tons of fake security bullet points that are trivially bypassed and probably don’t do much except break legitimate applications that are just too old to anticipate them, or need to write somewhere and aren’t automatically allowed to.



Did you enable Controlled Folder Access to “protect against Ransomware” and now LibreOffice can’t save your documents?



Congratulations. Even though there are 4 ways to use the Windows system to evade this protection, and malware authors will do it, your LibreOffice broke.



"Disable Secure Boot and turn off Intel VMD."What’s more telling is that Lenovo’s documentation on how to install GNU/Linux recommends changing uEFI (BIOS) settings.



Specifically, they tell you to do what I did when I changed over to Debian 11 GNU/Linux on this PC.



Disable Secure Boot and turn off Intel VMD. (VMD was previously called RST. Which is pointless under Linux, hides the storage from Linux and makes it impossible for you to install and use GNU/Linux until you figure out that this is why.)



Here’s some images from their PDF for installing Ubuntu on several of their notebooks.



Ubuntu setup
Ubuntu setup manual



VMD
VMD



Secure boot
'Secure' boot



Secure Boot is a bandaid for Windows.



Lenovo knows it. They support GNU/Linux on some of their models and probably don’t want their customers calling in when something like this inevitably happens again.



The uEFI key revocation problem struck me a while back when I had been running Kubuntu on my Lenovo Yoga 900-ISK2 (older laptop) and then went to boot Fedora. Ubuntu had “updated the dbx” and ended up revoking Microsoft’s permission (yes, you heard this right) for Fedora to run on MY LAPTOP.



"Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?"So, it was at that point I disabled Secure Boot, which the Fedora Wiki said to do for the time being, as well as resetting the Secure Boot system in the BIOS, although I never turned it on again for obvious reasons. Why exactly, the hell, should Microsoft have any say over what I do with my laptop, which doesn’t even run their OS, ever?



Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?



This is another reason why dual booting with Windows is unwise and you should just let GNU/Linux completely take over the PC. Not only does Windows ultimately end up hosing Grub and causing both systems to fail, but these key revocations can be pushed by Windows Update with total disregard for whether GNU/Linux will boot up again.



It’s bad enough that this Microsoft/Intel trash, uEFI, completely screwed up the relative simplicity of installing and using operating systems that the “Legacy BIOS” provided for, but it didn’t even improve anything.



Right before uEFI became common, I bought the best computer I could afford at the time, a quad core Phenom II based system, with a Legacy BIOS, expecting early uEFI to be a disaster, and it was.



"And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken."Right off the bat, many OEMs permanently walled off the native interface and had it expose itself to the OS in (Legacy) BIOS mode because they knew their own native uEFI interfaces were too bad to trust, and the BIOS CSM sort of acted like a condom to filter what the OS was doing with the firmware, to prevent a “killer poke” that left the computer unusable.



And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken.



Ubuntu introduced the intel-spi driver in one release (I think it was an LTS, but don’t quote me.), and inadvertently caused the Yoga 900-ISK2’s settings to become read-only as soon as the pointless (to most people) driver was loaded. At the time, I was spared because it was part of the -staging tree for known bad drivers and ones that are not high enough quality to merge yet, and Fedora wasn’t building it. Many people booted Ubuntu after the new kernel went out and had to figure out how to fix their firmware after just booting the OS up even once!



"This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement."Plus, there were/are still numerous cases where operating systems use a native uEFI interface as documented and the computer never boots again.



This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement.



It’s an improvement if we rewrite the dictionary to say that a convicted software monopolist that hates Linux and wants you to have problems with it, who sponsored Garrett indirectly to put it in the kernel, and succeeded, has improved the situation. I think my computer potentially not booting because of this rat’s nest is not an improvement, but what do I know, right?



"They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation."Regardless, I think Lenovo’s advice of just shutting it off…. Look, you’re probably only going to hear me say this once or twice in my life. Listen to Lenovo!



All I can say is that the Free Software Foundation must be truly hopeless if it mostly gives awards to treacherous scumbags these days, and this is at least the second major incident. The first was when they gave Miguel de Icaza one for implementing the patent mess called Microsoft .NET Runtime on Linux. His company was bought by Microsoft as a golden parachute after Novell (his former employer, a Microsoft collaborator) went under.



In closing…



I’d like to summarize that this is a small taste of the bad behavior that continues at Microsoft. They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation.



Linus Torvalds has been put on mute even though he used to say things about Microsoft and Intel in particular that were not family-friendly.



Is there really any hope for the future of the x86 PC or are people who want their computing to work going to have to abandon it entirely in the era of Windows Vista 11?



Comments welcome.

Recent Techrights' Posts

A farewell to Finland, an occupied territory
Finland, Finland, Finland
 
You Are Not The Only One
Reprinted with permission from Cyber Show (C|S)
GNU/Linux in Monaco: From 0.3% to Almost 6%
Monaco is a small country
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, May 22, 2024
IRC logs for Wednesday, May 22, 2024
Microsoft Has Lost Cote D'ivoire (Ivory Coast), Where Android Now Exceeds 60% of the Operating Systems' 'Market Share'
According to statCounter anyway
The Rumour Said Later Today Red Hat (IBM) Might Announce Layoffs
Let's see what happens later today (or next week)
Governments That Fail Journalism
Australia is known for giving us pure garbage like Rupert Murdoch
Windows Has Fallen From 'Grace'
When you tell people that Microsoft watches their every move in Windows many of them will freak out and ask for alternatives
Serbia: GNU/Linux at Almost 4% (or Beyond if ChromeOS is Counted)
considerable growth for GNU/Linux
Links 22/05/2024: China in Other Countries' Islands, Growing Threat of Piracy
Links for the day
Gemini Links 22/05/2024: Freedom Through Limitation, Cloud Photos
Links for the day
Canonical Supports Monopoly
more of the same
Links 22/05/2024: "Copilot+" as Mass Surveillance and Microsoft Defying Consent in Scarlett Johansson's Case
Links for the day
[Meme] Escalating After Failures
4 stages of cancel culture
Red Hat Had 2+ Days to Deny Reports of Impending Layoffs. But Red Hat Chose to Keep Silent.
Red Hat DOES NOT deny layoffs on the way
Microsoft-Connected Person Was Threatening to Sue Me and to Sue My Wife (Because His Feelings Were Hurt After Had He Spent More Than a Decade Defaming Me and Violating My Family's Dignity, Privacy)
litigation was chosen and we shall defend everything we wrote
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, May 21, 2024
IRC logs for Tuesday, May 21, 2024
Attempts to Sink the Free Software Movement (Under the Guise of Saving It)
We can see who's being drowned
Czech Republic: Windows Down From 98% to 43%, GNU/Linux Rises to Over 3%
modest gains for GNU/Linux
Links 22/05/2024: Pixar Layoffs and More Speculation About Microsoft Shutdowns/Layoffs (Ninja Theory)
Links for the day
Microsoft-Connected Sites Trying to Shift Attention Away From Microsoft's Megabreach Only Days Before Important If Not Unprecedented Grilling by the US Government?
Why does the mainstream media not entertain the possibility a lot of these talking points are directed out of Redmond?
Gemini Links 21/05/2024: Caesar II for MS-DOS and Reinventing the Assertion Wheel
Links for the day
Internal Memos/Communications Hinting at "a New, But Masked, Round of Layoffs" at Red Hat
A negative outlook heads of a long weekend
Nigeria: Windows Down to 6%, Android at All-Time High of 77%
Google is becoming the "new monopoly" in some places
[Video] Microsoft's Attack on Education
Microsoft's cult-like activities and overt entryism
[Meme] Money In, No Money Out (Granting Loads of Invalid European Patents)
EPO production?
Staff Representation at the EPO Has Just Explained to Heads of Delegations (National Delegates) Why the EPO's Financial Study is Another Hoax
Here we are again 5 years later
Canonical and Red Hat Are Not Competing With Microsoft Anymore
What a shame they hired so many people from Microsoft...
Links 21/05/2024: "Hating Apple Goes Mainstream", Lots of Coverage About Julian Assange Ruling
Links for the day
Gemini Links 21/05/2024: Losing Fats and Modern XMPP
Links for the day
Microsoft Windows Used to Have Nearly 100% in China and Now Google Has 50% (With Android)
Will China bring about a faster "fall" for Microsoft?
Pursuing a Case With No Prospects (Because It's "Funny")
the perpetrators are taking a firm that's considered notorious
GNU/Linux Growing Worldwide (the Story So Far!)
Microsoft is unable to stop GNU/Linux
GNU/Linux in Honduras: From 0.28% to 6%
Honduras remains somewhat of a hotspot
Good News From Manchester and London, Plus High Productivity in Techrights
what has happened and what's coming
[Video] The 'Linux' Foundation Cannot be Repaired Anymore (It Sold Out)
We might need to accept that the Linux Foundation lost its way
Links 21/05/2024: Tesla Layoffs and Further Free Speech Perils Online
Links for the day
Gemini Links 21/05/2024: New Gemini Reader and Gemini Games
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, May 20, 2024
IRC logs for Monday, May 20, 2024