Hacker News new | past | comments | ask | show | jobs | submit login
Secure Boot isn't the only problem facing Linux on Windows 8 hardware (mjg59.dreamwidth.org)
227 points by Danieru on May 29, 2013 | hide | past | favorite | 167 comments



FWIW, As a lawyer, I have a lot of trouble believing that assent to a contract you can't avoid, done specifically for the purpose of removing the contracted software, would ever be held to bind you to the terms and conditions of that contract.

In fact, i'd go so far as to say that if Microsoft ever actually tried to enforce, it would run them into serious regulatory trouble.

If push came to shove, i'm sure they would take the position that this was a hardware issue, and not their legal intention.

(I completely agree this is a ridiculous situation, and you shouldn't have to agree to anything. But it actually makes for great facts to fight a clickwrap fight on)


Thanks for that. That leaves just one legal issue that really needs to be raised:

How is it legal to _deny_ me full access (defined by the removal of all Microsoft software, something the European Commission has repeatedly upheld) until I have completed some Microsoft-controlled procedure? I don't want Windows on the machine.

Assuming I buy from the 3 largest vendors, excluding Apple, is it not anti-competitive to _lock_ me into it since no other option is offered?

Note: I realize that it may seem redundant to beat this dead horse again, but there's a really good reason so many are upset about Secure Boot. Of course, Microsoft mandates that Secure Boot can be disabled for Win8 logo compliance, which is neatly avoided in this case.


You seem to be under the impression that this setup was created for the express purpose of denying you access to the hardware until you have agreed to the EULA.

However that is a direct contradiction of the person you are responding to, who mentions that this is a vestige of a certain set of configuration options that are common on Windows 8 machines.

This is not intended, and will likely be patched if enough complaints are heard. Remember they are just requiring that you accept their EULA to boot their OS, denying you access to the firmware was never their intent.


No, I'm not countering DannyBee. I'm collecting the list of legal arguments that might be used if/when this is litigated.

Lovely as it is that Microsoft didn't mean for it to work like this, they're the one who will get the service of process saying "please appear in court and defend your position," if/when this is litigated. That is the kind of complaint they might actually "hear" that would get a response.

I don't care about their good intentions. Get out of my hardware, get out of my life, Microsoft.


> denying you access to the firmware was never their intent.

Unlikely. With a new person or company it's sporting to give them the benefit of the doubt. With Microsoft if you're still ignoring everything illegal and anti-competitive they do you're on the payroll.

Microsoft specifically modified its products to sabotage a competitor, and lied about it. Microsoft faked evidence to use in Federal court and Bill presented that evidence though it was clearly wrong to anyone who'd used windows.

Why on Earth would anyone give them the benefit of the doubt?

The BSA, which they support, wouldn't give you the benefit of the doubt.


It's generally legal (at least in the US) to contract for almost anything. Consideration does not have to be money, it can be foregoing something.

So for example, a contract for sale that said "i give you a copy of windows, and you agree not to marry anyone for 3 years and give me $50" would generally be valid, at least in the US.

Everything else is an argument about whether the contract is "against public policy", or whether the use of that contract constitutes "anticompetitive behavior".

These are two very difficult questions, and in general very fact/doctrinal specific. The Sherman Antitrust act in the US is a very vague piece of law that, if read strictly, outlaws all contracts (Since it outlaws contracts in restraint of trade, but basically all contracts are restraints on trade in one way or another)

Fun fact: Technically you can get 10 years in jail for violating antitrust law.


I still think a case could be made, since the purchaser of a computer has not entered any sort of contract with Microsoft, but is forced to navigate a Microsoft-controlled maze.


> In fact, i'd go so far as to say that if Microsoft ever actually tried to enforce, it would run them into serious regulatory trouble.

And Microsoft probably knows this, and would avoid it at all costs. But having an overly broad EULA helps them push around the n00b Linux installer who doesn't know any better.


And the big corporation with too much to lose to feel safe rolling the dice even on a sure thing.


I completely agree that they would do this, right up until the point it got hairy for them.


It's too bad they can choose to stop once they've started. Like the patent trolls new-egg is fighting.

New-egg should essentially be able to take the trolls to court and part them out for sale, down to their CEO's organs, for trying this in the first place.


It appears to me that both

  System.Fundamentals.Firmware.FirmwareSupportsUSBDevices
  System.Fundamentals.Firmware.FirmwareSupportsBootingFromDVDDevice
are required for Windows Logo Certification for both Windows 7 and 8: http://msdn.microsoft.com/en-us/library/windows/hardware/jj1...

Doesn't that directly contradict the hypothetical scenario presented in the article? Additionally, there's Windows 8 hardware out there already. Can the author provide no examples of this happening in real life?


From System.Fundamentals.Firmware.FirmwareSupportsUSBDevices:

The USB controller and USB devices must be fully enumerated when: * Anything other than the Windows Boot Manager is at the top of the system boot order. * A boot next variable has been set to boot to something other than the Windows Boot Manager. * On a system where the Windows Boot Manager is at the top of the list, an error case has been hit, such that the firmware fails over from the Windows Boot Manager to the next item in the list. * Resuming from hibernate, if the system was hibernated when booted from USB. * Firmware Setup is accessed.

ie, it's not required for most normal boots on systems that already have Windows installed. System.Fundamentals.Firmware.FirmwareSupportsBootingFromDVDDevice merely states that the system must support booting from DVD, not that it must attempt to by default. And yes, I've observed this behaviour on real hardware.


I believe you, but can you please name and shame? I'd hate to accidentally purchase hardware which by design makes entering firmware setup impossible[1]. With online ordering this isn't always something you can check in advance.

[1] I'm assuming that if a working OS install is required to access it, should anything go wrong you're screwed.


The Microsoft spec says that any fallback to the Windows rescue environment should trigger full USB enumeration. The Samsung Series 5 I tested had this behaviour, but given I had to return it after managing to kill the firmware I can't give you the exact model number…


Does this mean that the hardware is pretty much guaranteed to boot slower if not booting Windows too, in order to do USB initialisation, even when not going to the boot screen?


I wouldn't have thought so - I'd think that Linux would be perfectly capable of utilizing the same 'fast boot' logic as Windows has.

I think it only applies to "getting into a USB boot / install environment".


The spec says that the feature should be disabled if any UEFI boot entry other than "Windows Boot Manager" is chosen. Whether that's actually implemented, I don't know.


Regardless, it should be possible for the third party loader to claim to be "Windows Boot Manager".

I can't imagine that there would be any cryptographic verification that the boot loader is actually "Windows Boot Manager". This is because the crypto logic is essential to check that the binary is signed by a trusted key. This process would happen before the UEFI thinks about entering the boot loader. It would also not make sense for the crypto section to make any associations between the keys and who signed them (apart from giving the user information).

Still, it seems like a bad spec to create special cases for named hardware. Hopefully, we will arrive at a standard where the OS can signal if the feature should be disabled, or make it a toggleable setting (which, from what I understand of UEFI, the OS can toggle). Unfourtuantly, depending on how strict MS is with their certification standards, this would prevent the computers from being certified.


It's entirely possible to do that, but that's a string that's (often) visible to the user. Now I'd have to remember which "Windows Boot Manager" is Windows and which is Linux.


This is a perfect example of why I don't want UEFI; I spent a long time learning how to do all of this in GRUB, and now they are putting these basic features in the firmware where they belong. Get off my lawn.

Anyway, if this is a problem, you should still be able to use a bootloader to provide the selection menu. I think it should be possible for this bootloader to leverage UEFI to avoid increasing the boot time noticeably. But I do agree that hardcoding names like "Windows Boot Manager" is horrible spec design (and maybe grounds for an anti-trust suit?).

A think I am more open to this type of workaround because I already have set up simmilar systems on my computer. For example, Java does not play nice with window managers that do not re-parent. This caused a problem in Sun's window manager "LG3D", which was non-re-parenting, so they hardcoded a special case for LG3D so things would work. So now, if software asks, I am running LG3D.

You can also look through the Linux kernel device drivers for many special cases.


Apparently, yes, which is something I hadn't noticed before.


Additionally, as point (18) on the page you linked to states:

    Mandatory. Enable/Disable Secure Boot.
      On non-ARM systems, it is required to implement the
      ability to disable Secure Boot via firmware setup. A
      physically present user must be allowed to disable 
      Secure Boot via firmware setup without possession of 
      PKpriv.
Doesn't this mean that (definitely on certified non-ARM systems, and possibly on some ARM systems) you can just enter the UEFI, disable secure boot, and boot your OS of choice?


As the article (clearly) says, since USB is not set up fast enough to recognize a keyboard before the bootloader has handed control to the OS, there's no way to interrupt boot to do so; Windows will let you reboot to another OS, but only after you click through a license agreement.


Surely a physically present user (mentioned by the requirement of point 18) can disconnect the boot device in order to prevent Windows from booting. The firmware then has ample time to set up USB and allow the user to enter firmware setup.

Alternatively, as a workaround, find someone who has already accepted said agreement elsewhere and have them accept it on your device, disable secure boot and wipe the boot device.


Not if the default is to boot from an SSD soldered onto the mainboard, or tucked away in a device that is not designed to be opened.


> a physically present user (mentioned by the requirement of point 18) can disconnect the boot device in order to prevent Windows from booting.

I believe that would void most warranties.


In the case of a general purpose computer, I'm willing to bet you'd be wrong. We're not talking about a Surface tablet here.


Have you looked at an Ultrabook? Getting at the hard drive involves disassembling the entire machine, something that's almost impossible to do without either specialised tools or a willingness to inflict some amount of cosmetic damage.


Honestly, no I didn't think about that, but I would say that you might be starting to leave the realm of general there.


Yes, as long as you can get into the firmware menu in the first place. Which, on some hardware, requires you to agree to the Windows EULA.


> and possibly on some ARM systems

Disabling Secure Boot is forbidden on ARM systems. Point 18 ends with:

    Disabling Secure Boot must not be possible on ARM systems.


This is idiotic. The requirement should be that the user can disable it entirely OR replace the private key. And it should require implementation of an optional password protection.


That is actually the case. Point 17 states:

    Mandatory. On non-ARM systems, the platform MUST implement 
    the ability for a physically present user to select
    between two Secure Boot modes in firmware setup: "Custom"
    and "Standard".


My mistake. Carry on.


Could the boot failure mechanism be exploited? I presume that Microsoft has a boot failure mechanism; after N failures to boot, firmware should turn off fast-boot. Is the display of the EULA screen considered a boot success? IOW, can you just reset the machine when you see the EULA screen a few times to get the ability to stop and adjust the firmware?


I suspect the EULA is considered a boot success, as it is bassicly just a program running in userspace. Having said that, you could still power-off during the actuall boot process. Or, if it behaves like BIOS fastboot, making minor changes to hardware configuration should trigger a full boot.


> In fact, i'd go so far as to say that if Microsoft ever actually tried to enforce, it would run them into serious regulatory trouble.

The main interest of Microsoft is to keep their OEMs in control. Even if it is legal for the end-user to circumvent the protection, the following will probably still hold true:

- Microsoft can still contractually bind their OEMs to implement the protection scheme

- Microsoft can still prevent installations on machines without protection

So, in the best case regulatory action will allow users with hardware implementing the protection scheme to install custom OS (i.e. free them from prosecution when cracking the protection scheme). There is no way of forcing Microsoft to allow installations or usage on devices not implementing the protection scheme or on devices where the protection scheme has been circumvented and this circumvention can be detected by the affected Microsoft OS.


Requesting for the linked page I get a message telling this resource is restricted by Russian Government because it "contains information restricted for propagation in Russian Federation". That's Rostelecom ISP. I could get the page using another ISP and don't see any "restricted information". Hm.


JFYI the whole dreamwidth.org is restricted, http://www.zapret-info.gov.ru should contain info what web resources are restricted in Russian Federation but it's taking too much time to load and times out.


http://antizapret.info/site.php?id=763

It because http://stervozzinka.dreamwidth.org/15580.html contains information that it is possible to kill itself by shooting into head.


Finally I managed to reach zapret-info.gov.ru and found that IP 69.174.244.50 has been banned on 2013/04/18.


My motherboard is Windows 8 certified and my USB keyboard works perfectly fine during boot. Additionally you can get Windows 8 to give you more boot options if you just keep rebooting while it is trying to start up. Eventually it will give up and attempt to repair your computer before asking what you want to do next.

Has anyone experienced the problems described in the article actually in practice or is the article purely theoretical?


The requirements only apply to systems that are Windows 8 certified, not individual components. If you built your system then it may support Fast Boot but not have it enabled out of the box. Motherboard manufacturers are unlikely to turn it on by default because it requires you to have a graphics card with a UEFI option ROM rather than a traditional VGA BIOS, and there's something of a chicken and egg problem in turning it off if you're using an older card.


I paid money (I don't know how much, but will be close to 50-100 dollars) for Windows 8 when I bought my Dell Inspiron Special Edition because it had good hardware, but Dell didn't provide an option to get it without the OS. It was the only affordable laptop available with 1080p screen. After a week of many annoyances, I decided to delete all the Windows partitions. After installing Ubuntu using Legacy boot, I tried to install a pirated Windows, but couldn't because there it couldn't be installed on a GPT partition. Installing an OS used to be easy.


I paid money for Windows 8 when I bought my Dell

Dell almost certainly preloaded some software in exchange for compensation that almost certainly exceeded what Dell paid for their Windows license. Even ignoring the testing, support and return issues people usually bring up, Dell probably couldn't sell the computer for a lower price with no OS or a free OS without losing money.

In short, third parties effectively paid for Windows 8 when you bought your Dell, not you.


Dell probably couldn't sell the computer for a lower price with no OS or a free OS without losing money

I find this hard to believe, even when considering all the mechanisms you mentioned. Do you have any evidence for this very counter-intuitive hypothesis?

IOW: Citation needed


Perhaps you need to change the way you think about the PC industry and the way it produces integrated machines?

Even if you skip the huge cost of qualifying parts for a different operating system, and sell PCs without any hardware or software support, there are still extra tracking and stock-keeping costs, and probably extra marketing costs. These will be high, in unit terms, because of the small number of units shipped.

Not being a lawyer, I've no idea whether an OEM could get away with refusing to support the systems it sells. If it can't, you'd have to add the cost of testing and qualifying parts, and I'm not sure how you'd do that. Could you do it for a single version of Linux? Would you have to test for _anything_ the user might install? I don't want to open that can of worms....


Plenty of machines have shipped with buggy drivers, poor OS support for the hardware and similar problems. I've never heard of a consumer PC manufacturer having legal liability for issues like that, and can't imagine it would be different with no preloaded OS or an explicitly unsupported preloaded OS.

The Windows 8 EULA says:

The manufacturer or installer and Microsoft exclude all implied warranties, including those of merchantability, fitness for a particular purpose, and non-infringement.

It's my understanding (IANAL) that laws in the US and most other developed countries attach a warranty to all products sold that they're suitable for sale (merchantability) and for use the way a reasonable person would expect (fitness for a particular purpose). I believe software usually gets around that requirement by being licensed with such terms included rather than sold.

I think there's a good counterargument here to the claim I often see on HN that a PC with Windows preloaded is an integrated product rather than two independent products sold as a bundle. The license terms very clearly state that the Windows part is not guaranteed to work as expected, or indeed to do anything at all. The hardware, on the other hand generally comes with a written warranty stating that it will work, or the manufacturer will repair or replace it.


> The Windows 8 EULA says:

Which is absolutely irrelevant for example in Germany, as customers (a) buy the computer/license before agreeing to the EULA and (b) most of the statements in the EULA (no warranties, e.g.) cannot be legally included in any contract with a customer/end-user.


A PC has an infinite number of uses and no company can guarantee that it will meet all those needs. Especially if people make them up after they've made the purchase, and don't specify them beforehand.

Otherwise, you should just be an honest buyer. If you don't want a Windows laptop, don't buy one. It's that simple.


Which part is counter-intuitive?

A windows license costs Dell $X. Each trial software they preload earns Dell $Y.

If they preload enough stuff, the sum of the $Y amounts can exceed $X.


What is counter intuitive about:

1) companies paying to have their software preinstalled on a laptop

2) the previously mentioned companies software only working on windows

To me this seems like one of the, if not the most, plausible explanation for windows systems being cheaper than Ubuntu


When I was shopping for laptops I found several Dell models with Ubuntu, all of them were 100 USD more expensive than with Windows.


I have a Dell Vostro 2420 I got with Ubuntu for around $50 less than the same machine with Windows ~6 months ago.

However, it seems this is no longer possible. I've searched Dell's site and the only Vostro 2420 I see with Ubuntu has different hardware (i3 vs celeron). Very disappointing. I will not pay the MS tax.


Interesting, considering I knocked quite a few dollars off the price of my current desktop when I bought it from Dell with Ubuntu preinstalled six years ago. Thanks Dell for losing money for me.


There will always be an option to install Linux on x86 somehow. But I found really disturbing growing number of locked ARM systems. Perhaps we could start 'green' campaign; freely installing Linux on such devices expands their moral life-time and causes less emission.


See: Lenovo K800, Lava XOLO X900, or any of the new-ish X86 phones (Atom SoCs) with locked bootloaders that will only boot the pre-installed Android, or whatever originally came with the phone. You may revise and say "Sure, but I meant on the desktop..." but if current trends continue, tablets and phones will continue to supplant if not replace desktops/laptops for most users. Unless consumers put on the breaks and steer strongly towards open hardware, we're looking at a future with a lot of single-purpose/corporate-owned appliances IMHO. As usual, money talks, so: buy freedom.


Locked down ARM systems have far longer history than this fairly recent Win8 debacle. One of the most notable examples is TiVo, which led to the phrase "tivoization". I'd argue that the number of "open" ARM devices is what is growing with RasPi and others like it.


The problem is that locked ARM is becoming defacto standard. Soon most main-stream laptops will be ARM based and locked down. Compared to that current issues such as "should I accept EULA?" looks very small.


"always". What is this always scenario look like if MS decides to drop the "must allow legacy boot / disabling SB / enrolling key" requirement and only enroll theirs?

Not saying that will happen, I honestly don't think Microsoft cares that much (my own opinion, speculation based on Linux's market share despite my own love of it).

Just... "always" is a strong word. People used that word when talking about secure bootloaders on devices like Droid2, etc. Things that were ultimately only circumvented by kexec. Something that would be much different in a SecureBoot scenario.


Theirs may already be the only key used in practice, particularly with Linux companies embracing their signing key.


Hm, interesting point. They've effectively made themselves the perfect gate keeper. Even for people like us on HN, I highly highly doubt hardly anyone outside of mjg59 has ever enrolled their own key.

I'm even highly interested in PKI and SecureBoot and have been quelling FUD about it for sometime but if I ever buy a non Pixel/MBA device, I'll leave the MS key in there almost assuredly.


I will try to verify this with the next Win 8 Ultrabook I get for testing. I am not sure, though, at least on my desktop (with EFI Bios), my USB keyboard gets initialized right away - might be different on notebooks.


How can Microsoft prove that you agreed to the EULA? AFAIK, they don't upload your acceptance to a server (accepting works without a network connection). So once you wipe the system and install another OS, you've also eliminated any evidence that you accepted the EULA, so how could Microsoft start a legal action against without evidence that you accepted the EULA?


If you managed to install another OS then you managed to get to the BIOS therefore you must have accepted the EULA...


I don't see why that's true. You could have removed the SSD and reformatted it outside the machine.


What happens if you disagree with the EULA? (Does it have a disagree button?)

What happens if you crtl-alt-del at the EULA prompt?


Or what if a 9 year old girl clicks through? She can not enter into any legal agreements (unless she is an emancipated youth). USA laws.


Ubuntu installation requirements: 2 gb ram, 1 ghz processor, 20 gb free hard drisk space, a 9-year-old girl


I've always been very annoyed by the firmware initialize -> kernel reinitialize delay. If only we had open source standardized firmware on x86 there could be a common data structure to pass through validated firmware and its associated memory ranges to the payload. Maybe even an OS could write its device initialization library to ROM so the firmware could do diagnostic checks on all the present hardware before trying to do dangerous disk reads (hey coreboot).


The legal implications or the initial setup are not what worry me. But rather the issue when the OS gets hosed, and you have no method of booting into a recovery media.


What's wrong with agreeing to the EULA?


I shouldn't have to agree to a contract for an OS I don't care to use in order to boot into the OS of my choice. Nor should I have to read the thing in order to see what I'm agreeing to just to boot into the OS of my choice.

Make no mistake, I have not been one of the hand-wringers over this whole secure boot thing. But this recent development could turn me into one.


Why should I have to agree to whatever terms MS has set forth just to be allowed to wipe their operating system off of my hard drive?


It's not ideal, but what are the actual effects?


A EULA is a legal document, it can contain myriad of terms. Indeed, most EULAs bind you to future as-yet-disclosed terms as well. That's no small thing.


Most EULAs cannot validly bind consumers to future as-yet-disclosed terms.

As above, in this specific situation, where you are agreeing because that is the only way to effectively remove the software, i have trouble seeing any court holding you to those terms.

If you were trying to get around agreeing to the license but still using windows 8, sure.


Going to court at all is a loss. Why should I have to risk having to pay for a lawyer and take time out of my day to convince a judge that I shouldn't be bound to the terms.


You can always be taken to court, they just don't often take you when they are going to lose. Since that is, here, independent of whether you agree, ...


Note that I commented above that I am in disagreement the way MSFT arranged this. However, to be fair to the one posing the question, the actual outcome of clicking through the EULA to install the OS of your choice is probably nothing (well, you won't be getting your money back for that Windows license). EULA or not, nothing will happen. It's "the principal of the thing". In this case, it's a pretty big matter of principal, though.


It doesn't matter that the outcome is nothing. What matters is that you agreed to give up your rights. It's an opening for them if they should choose to pursue action against you.


As DannyBee said, I doubt a court would hold you to those terms.


What's wrong with me setting my user-agent to "By allowing me access, you waive all rights and policies regarding my access." and then viewing your website? Hint: it's about as enforceable as a EULA, but just as obnoxious and offensive because it presumes too much and oversteps bounds. Still, in the grand scheme of things, my UA string makes more sense, as putting something online is practically tantamount to putting it in the public domain, whereas you can't perform perfectly reasonable and otherwise legal acts with your legally owned property unless you violate most EULAs.


This EULA is unlikely to be unenforceable, as you have the option of returning the product to the manufacturer if you don't want to agree to it.


MS was the creator of the license that was 'activated' by opening the box in which the license resided. No way to even view the license without 'activating' it.


Because you might not agree with the terms in it?


I don't see why this comment is being downvoted. Certainly, agreeing clicking through the EULA isn't ideal, but is it anything other than a theoretical nuisance?

I'm genuinely curious - does there exist some relevant and concerning precedent here?

If this turns out to actually become an issue, it would probably harm Microsoft more than anyone - and would be a boon to manufacturers willing to bundle Linux on pre-built machines (such as the Alienware x51 or "developer" x13). However, I sincerely can't see anything coming of this threat.


If this turns out to actually become an issue, it would probably harm Microsoft more than anyone . . .

It would probably harm Microsoft eventually. It would harm whoever gets turned into a legal test case immediately - which is the sort of thing you avoid by not electronically signing randomly selected legal documents.


If you agree to the EULA, then you can't get a refund for the Windows license that comes with the computer.


This would actually be a wonderful case that i'm sure lawyers would love to take on.

Given your actual intent is to get the keyboard working enough to boot from CD (or whatever), not to agree to the agreement, and you didn't actually avail yourself of any of the benefits of the software, any retailer on the other side would have a hard time winning any class action lawsuit.

Among other things, assent must be meaningful


Fair. This is a legitimate concern. I guess I'm a fairly uninformed consumer, as I've never actually sought a refund for a Windows license (nor known this was a possibility).


With Windows 8 it no longer is.


'PC' ('personal computer') is a general purpose computing device, based on the original IBM architecture. The point is, it was never tied to any particular operating system.

Any attempt to 'tie' the hardware to a proprietary OS can be met with a legal challenge on these grounds. So, regardless of what manufacturers would like customers to think, it is possible to obtain an OS-free computer, even if it entails refusing an EULA and getting a refund for the unused OS.

Many people think this argument applies to Apple, too. But that's a mistake: Apple computers are not marketed as 'PCs'; and their computing system, from hardware to OS, is Apple throughout.

Microsoft works with PC manufacturers to pull off this anti-competitive hoodwink on an ignorant computing public. If it were tested properly in court, the whole corrupt practice would be torn to pieces.


Historically correct (IBM offered three different operating systems) but it stopped being true a long time ago. PCs are sold as integrated systems, and they are designed and manufactured to run Windows.

You can claim it's an "anti-competitive hoodwink" but Microsoft just spent a decade with the US Justice Department's foot on its neck, specifically to prevent any anti-competitive hoodwinking.

There's also nothing to prevent PC manufacturers shipping whatever they like. Many if not most now sell Android tablets, some sell Chromebooks, the server suppliers support Linux, and so on. Some sell Linux on PCs, including Dell and Asus.

The idea that the market failure of Linux is down to some sort of evil conspiracy might make you feel better but it doesn't square with the facts.


I'm drawing attention to the fact that tying an OS to (what should be) generic hardware is anti-competitive, and in many countries, illegal. If it the hardware is OS-specific, it shouldn't be marketed as a 'PC'.

Furthermore, the fact is that if I want a particular laptop PC, Windows is bundled in almost every instance, and I have to jump through hoops to force the manufacturer to take it back.

It's not a conspiracy. But it is illegal.


Your understanding is wrong: there is no generic hardware. Nowadays, companies design laptops and qualify parts specifically to build Windows laptops. They follow design demands and specifications laid down by Microsoft and Intel, which is why they are all doing UEFI and many did netbooks and Ultrabooks.

Also, these are integrated packages so the idea that the OEM should take Windows back is illogical and nonsensical. It is a delusion that bears no relation to reality.

If you want a comforting thought, price is largely a function of volume, so you are getting massive benefits by riding on the back of the economies of scale created specifically by and for Windows. You are gaining far more in real cash savings than the trivial amount that you pay the OEM for its version of Windows.

In the long term, however, you should try to see this for what it is: a very pragmatic business. It's not religion.


You appear to be entirely unaware that Microsoft has spent the best part of a decade responding and working with a Justice Department who was acting on behalf of frustrated or outraged consumers and competitors who believed exactly that. They came to a partial agreement with your position, whilst dismissing other claims entirely.


Conversely, in 2010 I had to resort to issuing a court summons to Samsung (UK) before they finally relented and gave me a refund on the unwanted Windows OS that was bundled with my laptop.

It was annoying. Reading the headline, it appears that a similar annoyance is continuing even now.


They'd have been better off taking it back and charging you a restocking fee, and if the court actually considered the issue, it got it wrong. I'd be interested to know whether you said you didn't want Windows in the first place, or whether you were, in effect, a deceptive customer.

Either way, dealing with unprofitable customers is a losing strategy for any business.


What if the EULA forbids you from installing a third-party OS?


Speaking of the EULA, couldn't I just lie to my tablet?

Assume there's no communication back to Microsoft and no need for a license under copyright law. Couldn't I just click the "I agree" button while not actually accepting the EULA? Surely, the tablet itself can't be a party to a contract, right?


I do this all the time when I'm signing contracts, I just lie to the paper and sign my name even though I don't agree with it.

Right.


Well, in this case, the signed paper is never actually delivered to the other party, and the other party has no knowledge that you ever signed it in the first place.

A signed piece of paper is neither necessary nor sufficient to form a contract. It's prima facie evidence that an agreement took place, but that's not the same thing.


At least in previous versions of Windows you could click "no" to the EULA and you could use the draconian terms as an argument to get a Windows refund.


What are the benefits of Secure Boot?


Secure Boot is ostensibly a security feature, making it impossible to load kernel-level code that hasn't been signed by an authority recognized by the device's hardware. The idea is that this makes it harder for nefarious actors to do nefarious things to your system, because they'll be blocked from the most basic access to the system hardware and be forced through normal OS security channels.

In practice, of course, it's just about solidifying lock-in with a cover story that's obviously weak to those with technical experience but is justifiable to politicians and regulators who would otherwise be all over MS for facilitating this kind of funny business.


Secure Boot isn't about lock-in, at least not on PCs. To qualify for the Windows Logo program, it must be possible to disable Secure Boot.


As TFA notes, this may involve repeated resets during boot, added hardware and a whole lot of steps my mother wouldn't take. She'd just be coerced to use Windows.


I find it hard to believe that there are a lot of people who are tech savvy enough to be able to install, partition disks and configure Linux and bootloader on a Windows 7 machine, but are suddenly unable to turn off one setting in the BIOS setup on a Windows 8 machine. And to enable them, we need to make every Windows PC insecure by default and leave hundreds of millions of people vulnerable to undetectable bootkit viruses?


There are lots of Linux distributions (for instance, Ubuntu) that makes all of that very simple. Some of them will even install inside of a Windows partition, or resize it for you.


It prevents you from using Windows Loader to pirate Windows. (That's a benefit... to Microsoft.)


Not really, since you can just disable Secure Boot and run a hacked copy of Windows Loader, or enrol the hash of said hacked Windows Loader and boot with Secure Boot enabled.


> That's a benefit... to Microsoft

That's debatable. For Microsoft, it's preferable you run a pirated Windows (and, hopefully, a pirated Office) than become part of a non-Microsoft ecosystem. Network effects apply and, as soon as too many people switch to non-Microsoft ecosystems, the value of using Microsoft decreases.


They're absolutely out of their fucking minds if they think this is a good idea. People are already slowly oozing towards better operating systems, and if they actually manage to remove the possibility to run their shitty OS without any cost, they're totally screwed.


where did they remove the possibility? To be honest, anyone who is able to install another OS should be able to check the BIOS.


Theoretically, secure boot could help prevent bootkits (e.g. the "evil maid" attack). Although I have no idea whether this works in practice.


It does, if the stars align.

The default setup of these computers (no full-disk encryption, easy to disable secure boot) typically means that it offers no such security. Look at Chromebook for an example of apparently doing it right.


The Chromebook is doing it right? Really?

It wipes your hard disk if you enable developer mode(which is a painful process in itself). And then at every single boot you either have to wait thirty seconds to go past a very scary warning or press Ctrl-D. Every single time you boot. If you switch back to ChromeOS, the hard disk is wiped again.

I would love to see HN commenters' reactions if on disabling Secure Boot, the Windows 8 partition is wiped along with any documents and files you saved locally and if you wanted Windows 8 back, it wiped your Linux partition in the name of security.


Where "doing it right" is defined as making the computer safe against maid attacks? Yes, this is how that looks.

I'm not saying it's actually secure; I haven't analyzed it in that kind of detail, and I don't even own one.


"I would love to see HN commenters' reactions if on disabling Secure Boot, the Windows 8 partition is wiped along with any documents and files you saved locally"

The equivalent to a Windows 8 partition on ChromeOS is cloud storage like Google Drive, Dropbox or Skydrive. This cloud storage is not being wiped when you switch to or from developer mode.

The local storage is just a temporary storage for downloads and caching.

Oh, and entering developer mode on my Pixel was as easy as holding 3 keys down at the same time.


[deleted]


This is not Secure Boot. Secure Boot is only one feature of EFI. You are describing EFI.


[to] verify the integrity of the operating system and prevent unauthorized programs such as bootkits from infecting the device

https://en.wikipedia.org/wiki/Windows_8#Secure_boot


You sure there was any ? It's not even secure !


It means you can have a crazy BIOS screen heavy with customised images that looks all 3li7e and stuff for the gamer crowd.

My PC has one such thing, and it's garbage. I managed to find out how to put it into some sort of 'information' mode with less graphics and more info... but isn't a BIOS screen supposed to be a wholly info thing anyway?


That has absolutely nothing to do with Secure Boot.

If anything, what you're talking about has more to do with EFI


Not even EFI, just regular BIOS...


Yeah, I got it wrong, that's EFI's fault. Though it should probably be also mentioned that I forgot HN has poor humour detection.


Someone should probably update this article with the above finding: https://en.wikipedia.org/wiki/Bundling_of_Microsoft_Windows


It shouldn't take all that long to set up USB. Getting the host controller running is probably a few hundred microseconds of initialization. After that, it's all about enumerating hubs and finding devices; there isn't much there that requires delays. You're probably gated by the firmware on the keyboard.

I imagine the USB stacks are full of paranoid "let things settle for 200ms" sleeps that make more crappy devices work, or that give external HDDs time to spin up. I'll bet you could remove those if all you care about is a keyboard.


I don't understand why Linux users want Win8- or WinRT Pads.

Not only are they pretty expensive but there already are many cheap good Android Pads running a Linux kernel. There are also plain Linux pads on the market, and even Ubuntu plans to sell a Ubuntu pad soon.

So, what's the gain?


It's not limited to tablets. This applies to all Windows 8-certified client hardware.


I still don't get it. Microsoft is not that important anymore today as it had been for decades. There are extremely cheap ARM boards (Raspberry, Beagle Bone, etc.) that are almost suitable for Internet and Office applications right now. And I think soon we will have the next generation of Raspberry and Beagle Bones with 1.5 GHz dualcore or quadcore, and we can even built our own cluster of these boards for servers -- for instance, this one with 32 nodes:

http://t3n.de/news/raspberry-pi-cluster-467237/


What use is a Pi when I'm sitting on a plane?


That's your reason to buy a WinRT pad and put Linux on it?


It's my reason for owning a laptop that came with Windows 8. This particular one isn't affected by the problem discussed here, but many other laptops are.


Does the Windows 8 OOB setup environment support Shift+F10 to open a command prompt, or one of the keyboard shortcuts to open the task manager? If so, it might be possible to boot into UEFI from there.


This is a big problem, I have a lenovo u310 and I have not been able to boot from usb. And I don't have a cd drive.


That really should not be an issue at all on that device... (although once you are booted, you'll need to do some work in dmraid on account of the HDD situation)


And in practice how many keyboards will this actually apply to?


It isn't the keyboard that is the problem, it is that the USB bus the keyboard is on won't be initialized.


Are you sure? I understand not waiting for slow hardware to settle, but the entire usb bus is going to get skipped, even the most lightning-quick hardware?


Yes. USB init won't happen until the Windows kernel starts.


I find that very hard to believe atleast based off my experience. How else are you supposed to do USB boot ups? Almost all OS I installed recently has been through USB Drives and not to mention I use a USB keyboard to key into the BIOS.


If the system is configured to boot off USB then the firmware will do full USB initialisation. To get into the firmware, you choose the option from the Windows 8 shutdown menu.


He's saying that the entire USB system won't be initialized, which means no keyboards that use USB.


So, uh.. what do you do if your system locks up at OS init?


Is it even that common to find hardware that will take a non-USB keyboard anymore? I've got some, but it's old.


Many desktop machines still do, and most of the modern motherboards in full or mid-tower size still have a PS/2 port or two, for laptops PS/2 support is almost non-existent.


I don't think that even thinkpad docking stations have PS/2 anymore. PS/2 support on modern laptops from non-obscure manufactures (leaving myself some wiggle room for whatever weird Chinese thing you might be able to buy on ebay) may very well be extinct.


Thinkpad T430s: Standard PS/2 Keyboard.

At least the device manager in Windows says so.


That's the built-in keyboard, right? I thought those were USB for some reason, I guess not. I guess it would be more accurate to say that PS/2 connectors proper (6-pin mini-DIN) are likely extinct in laptops.


I think it was only common for a mouse, and the PS/2 keyboard controller was only designed to allow one keyboard and one mouse, meaning that the laptops supporting this try to merge the two inputs into one, which is error-prone, particularly when dealing with for example wheel mouse when the packet size changes. Raymond Chen has a blog post, and there is a comment from Ray Trent (then of Synaptics) for more about the problems: http://blogs.msdn.com/b/oldnewthing/archive/2004/09/17/23083...


Any/all motherboards serious about gaming with have a PS/2 port due to N-key rollover and interrupt-speed typing.


Also due to fans of the old IBM Model M keyboards.


Laptops are often still an approximation of PS/2.


Saw title and was expecting to see something about the miserable state of touch support.


Microsoft is doing the same thing as Apple with their iPhone and geeks get upset. Apple is not allowing arbitrary OS to run on their system unless you find an security hole and manage to work around the protection. I don't hear claims that Apple is having an uncompetitive behavior but obviously the difference is that they didn't take that away, iPhones have been locked down from day one.

That said, I'm very much in the geeks' camp. "Secure Boot" doesn't really protect the end-user, viruses and trojan mostly operate in the user-space and exploit kernel security holes anyways. This term is misleading, what it secures is Microsoft's position, letting them dictate whatever they want to manufacturers.


Many of us do dislike that Apple lock their hardware down. So I vote with my wallet and buy less locked down devices. The concern is that it will become increasingly difficult to find a computer that does not include this behaviour.


Apple's notebooks and desktops are the opposite of locked down. You want to install another OS on it? They even provide the Boot Camp tool to make it easy for you.

Want to scrub the system and start from scratch? Use rEFIt (http://refit.sourceforge.net) and replace the loader.


Very fair point. A Mac will probably be my next laptop at this point. I was more talking about iPhone/iPad style locked down devices though :)


The probable reason the iOS devices are locked down is because that's where Apple's money is now.

If Apple encouraged jail-breaking that would dramatically alter the nature of their product line-up. If the jail-broken phones developed a reputation for crashing, for apps not working properly, or for being a vehicle for rampant piracy, that would taint their brand.

It's a tough position they're put in. As an enthusiast I'd really like to see the iOS hardware sold without locks, specifically for hacking, but Apple isn't interested in that market.

The good news is that whatever Apple pushes hard, be it iPads or iPhones or iPods, puts enormous pressure on the supply channel to deliver parts at scale. Where touch-screen panels used to be stupidly expensive, you can buy them for under $50 from many vendors.

Like an ice-breaker, Apple's enormous volume causes the price of components to plunge across the board. Everything they touch becomes commoditized in time. This is good for consumers, they get better products from third parties, and amazing for hardware hackers that want to build or customize their own gear. Want a quad-core ARM CPU? It's a couple of bucks. Think about that.

You can get an OEM tablet from some random vendor in China that's as good as an iPad 2 hardware-wise, and you can get them cheap. For a little extra, you can get them customized. This is not a bad thing.

Apple will keep their hardware locked down, it's their call, but it opens up enormous opportunities in the open-hardware arena.


> Apple is not allowing arbitrary OS to run on their system

Microsoft is not allowing arbitrary OSs to run on Dell's, Acer's, Lenovo's and Toshiba's hardware. If Microsoft wants to limit what Microsoft hardware can do, I'm fine with it - I just won't buy from them.


I think the point I was trying to make is that once Microsoft takes over the last commoditized land of unlocked hardware, buying a specialist's computer is going to be more expensive.


What a whiner! Maybe it's different for laptops, but for desktops, you can still go almost anywhere and have a custom-built system made without any Windows install at all! Huge hard drive, flaming fast GPU, RAM up tha wazoo, studio-grade sound card and as many cores as Intel or AMD can cram onto a chip these days. Hell, if you want a Linux laptop, buy a Sputnik from Dell!


It is imperative to fight for principles when it first occurs not when your own ass is in the fire.

We lost the apple devices as general purpose, android is not much better and the walled gardens are encroaching the PC.


What if, in the interests of appeasing Microsoft, only Windows 8 certified Secure Boot motherboards are made by the big manufacturers?

What if the EFI is so locked down, the hardware so Windows-specific, you can't make Linux work on it?

That's the future people are trying to avoid.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: