This Should Certainly be Illegal, But the Person Who Helped Microsoft Do This is Still Attacking the Critics of It

posted by Roy Schestowitz on Jul 17, 2024

Last week: More Cybercrimes Committed Today by the Misogynists Who Attack My Family and Myself

Last night: "Re: [DNG] Laptops I haven't bought yet."

Take a look, for it explains it all:

Author: Simon

Date: 2024-07-16 20:14 +100

To: Devuan ML

To: Devuan ML
Subject: Re: [DNG] Laptops I haven't bought yet.

Ian Smith <ian@???> wrote:

> I had no idea some PCs/laptops could be locked into using Microsoft
> only, to the exclusion of all other OSes.

Yes, this was something raised as soon as the secure boot facility came along and MS mandated it for Win 10.

For a laptop/desktop it’s up to the manufacturer, but for a tablet MS mandates secure boot be on and uneditable. I.e. if you buy a Win 10 tablet then AIUI it’s locked down to only boot something signed with MS’s certificate.

But back to laptops/desktops. To run Win 10 they must support secure boot, and it must default to on. With it on, you can’t boot Linux* as it’s not signed with an MS certificate.
Manufacturers are supposed to allow adding additional certificates (keys) to allow you to boot software signed with a different certificate. In principle that allows you to create your own signing certificate, sign your boot loader, and boot it by adding the appropriate part of your own certificate. Not sure whether this is part of the rules, just not specified, or what.
Also, the manufacturer can choose to allow you to turn off secure boot. If they do, then you can boot unsigned software, but you can’t boot Windows as it will refuse to load.

I vaguely recall that when secure boot came along, this “flexibility” was how MS managed to get it past the authorities who would otherwise probably have opened up an anti-trust or market power abuse case against them. Otherwise, it would fit their past behaviour patterns to have mandated PC suppliers lock everything down if they wanted to be able to sell PCs with Windows.

Like other features** that EFI allows manufacturers to lock down, this is something that you may have to a) try out, or b) study manuals/tech data in depth to figure out.

And it’s something to maintain eternal vigilance over. Given past performance, it’s not hard to imagine MS (and these days, Redhat) quietly shifting the goalposts and “encouraging” manufacturers to further lock down the systems once people have got used to it’s ubiquity.


* I recall that at one time, there was a signed version of GRUB - signed by MS, and distributed by RH ? Whether this is still a thing or not I don’t know. I recall I was slightly surprised when I read about it as it goes against the concept of secure boot having a boot loader that doesn’t enforce signing of whatever it loads !

** With EFI, the EFI system can enable/disable processor features. So, for example, a manufacturer can sell the same hardware in two versions - one that can do hardware virtualisation, and one that can’t. Absolutely no difference other than an EFI setting, but of course it allows them to charge a premium for the “server” version.

For speaking out against it we got plenty of harassment and bullying for 12 years! The Microsofters attack my entire family for having the 'audacity' to oppose this cartel-like behaviour, which in a civilised country would lead to the arrest of the perpetrators and their collaborators (it's overt market rigging).

So perhaps time for an "I told you so post"? █