Opinion: It's time to boot out the bad stuff

Opinion: It's time to boot out the bad stuff

Jon Honeyball sticks his neck out and says he doesn't see why the majority of PC users should be at risk just because an alternative OS won’t support secure boot

 

There’s been much online hoo-hah about the secure UEFI (Unified Extensible Firmware Interface, the modern replacement for the old BIOS) boot procedure, which is supported by Windows 8.
 
The purpose behind this is straightforward, because one of the prime routes for malware to get into a machine is by masquerading as part of the boot-up process. Secure boot prevents this mode of ingress, since it prevents code that isn’t digitally signed from being able to boot. This is going to be a switch set inside the UEFI, which makes it check the boot code against digital certificates held within the UEFI; if any don’t validate, the machine won’t boot. 
 
Platform options
 
The problem arises if you want to boot a machine whose UEFI might not allow unsecure booting, using an operating system that doesn’t support secure boot. Let’s think about this for a moment. If you buy a machine with Windows 8 preinstalled, I’d hope that secure boot is enabled by default – and although it isn’t impossible to imagine that some vendors might disallow unsecure booting, why would they really want to do that? What if a corporate customer wanted to blow away Windows 8 and put standard Windows 7 64-bit on it instead? 
 
Now we have to consider the platform options. While I have no problem understanding that all Intel boxes will support switchable secure boot for UEFI, I could easily imagine that the forthcoming ARM hardware might well only permit UEFI secured boot. After all, there will be no previous Windows or other legacy OS that any corporate customer might want to reinstall instead. 
 
Protecting the masses
 
Most of the squealing has come from the Linux users who fear that their OS might be locked out on future hardware once Windows 8 has shipped.  Now I’m going to really stick my neck out – it isn’t reasonable for the majority of PC users to have to put up with unsecured booting, simply because an alternative OS vendor can’t be bothered to go down the same route. I accept that there are enthusiasts who sit at home and happily compile their own OS kernels, and these might ultimately get squeezed out from the latest hardware if secure boot becomes mandatory, but I can’t see this happening any time soon for the majority of hardware. 
 
Frankly, I want Windows 8 to be as secure as possible, and if there’s an effective new security feature such as secure boot available, I want it turned on by default, and implemented in such a way that malware can’t turn it off again behind my back. I want Windows 8 to run only digitally signed code, please. I know this will lock out a lot of historical applications, but I can always run them in a virtual machine – after all, Windows 8 for Intel will come with a full instance of Hyper-V baked right into the OS. It really is time to put this past decade of malware fear and loathing behind us and travel onward. While I accept that this will force all the security software vendors to scrutinise their collective navels intensely, and come up with something new and interesting – hey, these are talented guys and I’m sure they’ll think of something eventually...
 
Historical code
 
The reality is that Windows 7, armed with the free security technologies on offer from Microsoft, is probably about as secure as you can get today. I say “probably” because your mileage may vary, and you might be able to point to certain circumstances where it still isn’t safe enough. Move this forward to a Windows 8 environment where we have secure boot, signed drivers and code, IE10 browsing, and things just got better. Historical code is just that – it deserves to run in a VM, protected from any hardware or base OS. Wrap in the new feature in Windows 8 that enables you to refresh all the OS components from the original installation partition, while leaving all your applications and user data intact, and it will be better still. Concerned about the integrity of your Windows installation? Just refresh the OS and sweep out anything that might be dodgy. 
 
Surely this has to be a better way? Surely it’s time we had this level of confidence in our desktop PCs? If it means that some code enthusiasts are restricted in their hardware choices to only those devices that support unsecured boot, then so be it. There’s a greater need here, and hundreds of millions of existing Windows 7 computers out there that will be running for another decade or more – it isn’t as though they’ll be limited in their choice of future machine purchases. 
 
Have an opinion? Add your comment below.
 
Also read:
 
 
 
 
 
 

 

This News article appeared in the Jan, 2012 issue of PC & Tech Authority Magazine

Source: Copyright © PC Pro, Dennis Publishing

See more about:  opinion  |  windows  |  win8  |  uefi  |  bios  |  boot  |  linux
 
 

Readers of this article also read...

First Look: MSI Z87 Mpower MAX Motherboard 

First Look: MSI Z87 Mpower MAX Motherboard

 
Exclusive First Look: Gigabyte's Z87X-UD3H 

Exclusive First Look: Gigabyte's Z87X-UD3H

 
Samsung Galaxy S4 hits Australia this Saturday 

Samsung Galaxy S4 hits Australia this Saturday

 
Preparing for the future - How the evolution of the PC highlights the importance of the NBN 

Preparing for the future - How the evolution of the PC highlights the importance of the NBN

 
Unboxed: LG's Optimus G "Superphone" 

Unboxed: LG's Optimus G "Superphone"

 
Comments: 20
ory_zm
14 December 2011
Well written and to the point, couldn't agree more.


Comment made about the PC & Tech Authority article:
Opinion: It's time to boot out the bad stuff?
Jon Honeyball sticks his neck out and says he doesn't see why the majority of PC users should be at risk just because an alternative OS won’t support secure boot

What do you think? Join the discussion.
ian_from_oz
14 December 2011
This article says, "I'm a MS fanboi and I see no reason why my hardware shouldn't be pwned by Microsoft."

In the mean time, the author forgets that the weakest link IS Windows. Ensuring that only Windows will boot will not make the computer more secure.
rubaiyat
14 December 2011
I think the only thinking response to UEFI is:

"No way! Apple implemented that in OSX ages ago! So it must be no good!"
woogaman
14 December 2011
G'Day all. A lot of good things(programs) have came from the likes of Linux & I bet there is more to come.
If I buy hardware I think I own the right to put what OS on it I like. Even win 7 isn't the silver bullet of OS's.
I still have machines that run 95 & earlier. Linux will run on those machines happily. But get to ME & it won't go on a machine with a cpu smaller than 150MHz.
There are always going to be different size computers for different jobs. I don't want to see the wintel monopoly getting any bigger. We still need a little spice in our lives & being a slave to wintel just spells bad future for personal computing. You still will be able to buy hardware that suits your needs.Not wintels needs. So why do we have to be hard core to have choice with our computers. I like that Orion Laptop.Shame they didn't put psi express slot into it & that would of made it. They had plenty of room to put it. Locking your bios just to boot on M$ software is just a big con like all these app stores selling rubbish.All started with the big money makers. It just seems they think they don't have enough money.
Let the people have the choice. Because if we didn't want the stuff where would these big companies be?? ;-)

Cheers Dan
photohounds
15 December 2011
+1 Woogaman.

It IS your hardware. It will be reverse-engineered the day after it becomes a problem.

NO proprietary company should own your hardware like ONE already tries to ... no need for a second.
Dumb_computergeek
15 December 2011
I think the issue is more how to manufacturers make it work for both kinds of people. Those who want it on and those who want it off. Desktops are easy. dip switch on the MB. But what about notebooks and possibly tablets. Where it's harder to crack them open to flick a switch. Maybe a sub BIOS that isn't flashable with this option in it and only a few others.
photohounds
15 December 2011
Mutton dressed up a lamb ... from a bloke who actually knows a bit about this:

http://kerneltrap.org/node/6884

"Btw, that's not totally new. I think some people played around with EFI on x86 even before Apple came around. And don't get me wrong - the problem with EFI is that it actually superficially looks much better than the BIOS, but in practice it ends up being one of those things where it has few real advantages, and often just a lot of extra complexity because of the "new and improved" interfaces that were largely defined by a committee."




The REAL issue is entirely possible that only certain "brands" will have recognised signed kernels. Not a problem for system builders anyway, only the proprietary boxes that are sold.

The fact is that ALL Linux distros have the ability to participate - UNLESS there's a greed-motivated duopoly-centric reason to EXCLUDE legitimate Distribution authors.

There's a reason the military often use http://en.wikipedia.org/wiki/Security-focused_operating_system these for Secret+ installations ... closed source solutions have repeatedly been demonstrated to be the LEAST secure because you CANNOT easily see what it is doing.

Open source exposes the bugs and vulnerabilities (which ALL software has) to MORE scrutiny and are thus faster to correct.

Buying a closed-source OS is like having confidence in buying a car with the bonnet welded shut, and for which the manual only offers a SELECTIVE description.
rubaiyat
15 December 2011
Both you and Linus are barking up the wrong tree here.

We are talking about UEFI, not the older EFI.

UEFI can run on top of or instead of BIOS and should, when set up properly, allow easy launching of multiple OSes which would be an advantage to the less used implementations.

BIOS is one of the principle vulnerabilities of PCs. I'd thought you'd be happy to be jack of it.
photohounds
15 December 2011
Seeing I rarely rin WIN outside a VM it's not such a big deal (to me).

The protection aspect is GOOD, the potentially exclusionary aspect of it is EVIL, designed to benefit the closed-source vendors.

These restrictive practices do NOT benefit the consumer, (as DESIGNED). The marketing is an entirely different matter.

The more secure nature of open source is NOT barking up the wrong tree, however. It's use in sensitive installations proves that beyond doubt.
rubaiyat
15 December 2011
UEFI is not as I see it excluding anyone, in fact it is bringing advantages to PC owners that have long been in Macs and SPARC workstations. Many of them plain commonsense, something severely lacking on the PC.

1. It lets you boot from larger disks over 2 TB. The number of times Windows has stuffed this up is laughable.

2. It is faster to boot up, one of the principle reasons Macs trash PCs at this.

3. It is CPU independent. Surel that is a good thing.

4. Similarly it has CPU independent drivers

5. It makes it easy to implement in varying pre-OS set-ups, even over networks

6. It is modular in design so easier to build

7. It does not prescribe any particular file system

The trouble with PC users is that they are so used to wading in shit you think the shit is not a byproduct of their systems but is essential to its operation.

For better or worse Apple has regularly had major house cleaning, with radical changes in both architecture and Operating Systems. They are not afraid to throw out the old to gain the advantages of the new. Microsoft and Windows users drag around multiple decades of cruft with them, wherever they go.

ory_zm
15 December 2011
ribaiyat, I tend to agree with you on the benefits of UEFI. I just wanted to point out that you claim to not be an Apple fanboi however your comments mark you as such.
photohounds
15 December 2011
Ruby, much of what you say, as usual, makes sense.
But it IS exclusionary - this is just one bloke who can back that up.

http://mjg59.livejournal.com/2011/09/23/

M$ has made a lot of missteps along the way, marketing wins.

Apple are doing it too, now and trying to tie competitors up in (often) pointless lawsuits.





Edited by photohounds: 15/12/2011 01:59:57 PM
willtell
15 December 2011
While I do agree with rubaiyat that UEFI is the way to go, some of your comments are a little misleading.

The limitation in installing Windows on anything larger than 2TB has everything to do with an older BIOS and limitations in a very old OS (Windows XP's MBR) rather than anything recent. This issue doesn't apply with Windows 7. Win 7 will happily boot from a 3TB drive if you have a UEFI or a secondary controller. Having a dig at Windows on this isn't accurate unless of course if you want to compare a newer OS to something that's more than 10 years old.

Faster boot times have nothing to do with the way UEFI works. It still has a BIOS, it's just hidden behind the pretty interface. Boot times will be affected by the way the UEFI is implemented. Mac's win on boot times because the system has a set configuration and doesn't need test all the options during POST. If you have a custom built system you'll find that there is next to zero difference in boot times between a traditional BIOS and a UEFI. It's only manufacturer specific units (such as all the new Ultrabooks) that hit this criteria.

Installing an OS via a network couldn't be easier using a traditional BIOS. You just hit F12 on boot and press enter. How can that get any easier by adding a graphical interface?

The rest, I agree with. However I'm not a fan of the graphical interface. I find working through a traditional BIOS a LOT faster - but that's just my personal preference.
tonemarky
21 December 2011
I desire the concern is more how to producers succeed for both types of individuals. Those who want it on and those who want it off. Personal computers are simple. dip swap on the MB. But what about laptops and perhaps pills. Where it's tougher to split them start to film a swap. Maybe a sub BIOS that isn't flashable with this choice in it and only a few others.
rubaiyat
21 December 2011
ory_zm wrote:
ribaiyat, I tend to agree with you on the benefits of UEFI. I just wanted to point out that you claim to not be an Apple fanboi however your comments mark you as such.


You misinterpret what I write here, which basically is a PC website, as ALL I write.

On Apple sites I enjoy disturbing the complacency of the cider drinkers.

Wouldn't it be nice if we had the best of all possible worlds instead of what frequently we end up with.

"Heaven is where the police are British, the cooks are French, the mechanics are German, the lovers are Italian and it is all organised by the Swiss. Hell is where the police are German, the cooks are English, the mechanics are French, the lovers are Swiss, and it is all organised by the Italians”.

Edited by rubaiyat: 21/12/2011 11:52:54 AM
rubaiyat
21 December 2011
willtell wrote:
While I do agree with rubaiyat that UEFI is the way to go, some of your comments are a little misleading.

The limitation in installing Windows on anything larger than 2TB has everything to do with an older BIOS and limitations in a very old OS (Windows XP's MBR) rather than anything recent. This issue doesn't apply with Windows 7. Win 7 will happily boot from a 3TB drive if you have a UEFI or a secondary controller. Having a dig at Windows on this isn't accurate unless of course if you want to compare a newer OS to something that's more than 10 years old.


OSX is now 12 years old. Prior to OSX the Mac OS still had addressable memory far in advance of DOS or Windows. It also didn't stuff up post millennium dates which put the frighteners up the global IT industry and cost everyone unthinkably large amounts of money.

It all comes down to good design, fore-planning, common sense and having more than 2 brain cells to rub together.

Quote:
Installing an OS via a network couldn't be easier using a traditional BIOS. You just hit F12 on boot and press enter. How can that get any easier by adding a graphical interface?

The rest, I agree with. However I'm not a fan of the graphical interface. I find working through a traditional BIOS a LOT faster - but that's just my personal preference.


Can't see it, can't remember the non-mnemonic, random combination to access a feature?

THAT's what GUI is for.
ory_zm
21 December 2011
rubaiyat wrote:
"Heaven is where the police are British, the cooks are French, the mechanics are German, the lovers are Italian and it is all organised by the Swiss. Hell is where the police are German, the cooks are English, the mechanics are French, the lovers are Swiss, and it is all organised by the Italians”.

Nice one, who said that?
willtell
21 December 2011
rubaiyat wrote:
OSX is now 12 years old. Prior to OSX the Mac OS still had addressable memory far in advance of DOS or Windows. It also didn't stuff up post millennium dates which put the frighteners up the global IT industry and cost everyone unthinkably large amounts of money.


What's addressable memory got to do with hard disk storage? Addressable memory comes down to whether or not your OS is 16, 32 or 64bit. This has nothing to do with drive storage.

rubaiyat wrote:
Can't see it, can't remember the non-mnemonic, random combination to access a feature? THAT's what GUI is for.


Perhaps if you aren't aware or are incapable of accessing a BIOS or knowing POST keyboard commands, you probably shouldn't be the person trying to run an OS install via the network. Otherwise, I can see how using a keyboard can be too challenging. Pressing F12 can be quite a challenge for some.



rubaiyat
21 December 2011
ory_zm wrote:
rubaiyat wrote:
"Heaven is where the police are British, the cooks are French, the mechanics are German, the lovers are Italian and it is all organised by the Swiss. Hell is where the police are German, the cooks are English, the mechanics are French, the lovers are Swiss, and it is all organised by the Italians”.

Nice one, who said that?


Attributed to some British Hotelier
rubaiyat
21 December 2011
willtell wrote:
rubaiyat wrote:
OSX is now 12 years old. Prior to OSX the Mac OS still had addressable memory far in advance of DOS or Windows. It also didn't stuff up post millennium dates which put the frighteners up the global IT industry and cost everyone unthinkably large amounts of money.


What's addressable memory got to do with hard disk storage? Addressable memory comes down to whether or not your OS is 16, 32 or 64bit. This has nothing to do with drive storage.


Nit picker. Addressable memory/hard drives. Windows still can't get the basic volume naming right. Under the pantomime horse costume it is still A, B, C etc drives.

Quote:
rubaiyat wrote:
Can't see it, can't remember the non-mnemonic, random combination to access a feature? THAT's what GUI is for.


Perhaps if you aren't aware or are incapable of accessing a BIOS or knowing POST keyboard commands, you probably shouldn't be the person trying to run an OS install via the network. Otherwise, I can see how using a keyboard can be too challenging. Pressing F12 can be quite a challenge for some.


You can make it arbitrarily hard or you can make it commonsense easy.

OSX also has keyboard shortcuts, at least they are memorable:

Option key on startup you can choose startup HDs or Systems

Holding down the C key starts off the CDROM/DVD

P & R together zaps the PRAM

D puts you into diagnostics

Whats clever about choosing a stupid shortcut that bears no relationship to the function like Alt 4 for quit? Windows is full of them. I even used to know the ALT combinations for bullets and other extraneous characters or the start/end selection shortcuts in WordStar. What a waste of time. That's why PCs used to have yellow sticky notes stuck all over their monitors. Most of that is now unnecessary because Windows added menus and most of the Mac's keyboard shortcuts.

I know how to type all the accented characters in OSX because they are related to the vowels/consonants. If I don't know it I can have a damn good guess. You think you are a genius because you can't work out a commonsense scheme, but have learnt some pointless and very limited set of rules that varies depending where you are?

I can count in Finnish, Hungarian, Arabic, Cantonese, Italian, Spanish, Germany, French and Serbo-Croatian. All of which I consider more useful than F12 to get you into BIOS.

THAT is why watching PC users at "work" puts my teeth on edge. I just want to tell them "Get off that thing and I'll show you how to get real work done." Stuffing around endlessly to produce crap is not working hard, it is working stupid.
Comments have been disabled for this article.

Latest Comments

Latest Poll

Which side are you choosing in the new console wars?



or View results
The Xbox One
  25%
 
The PlayStation 4
  29%
 
A console? Good Lord no - PC for me thanks!
  45%
TOTAL VOTES: 130

Vote now
Ads by Google

From our Partners

PC & Tech Authority Downloads