[Discuss] UEFI secure boot pre-loader security considered further Re: Fwd: [linux_forensics] Did you see this ? - Linux Foundation Announces Secure Boot Solution ....

[Rich Pieri]

On Mon, 05 Nov 2012 13:00:56 -0400
Tom Metro <tmetro+blu at gmail.com> wrote:

> I haven't seen any recent articles that have made this claim. What I

The Linux Foundation article that sparked this thread repeatedly made
precisely this claim.

> have seen expressed is a concern that non-technical users that aren't
> comfortable changing BIOS settings will find the requirement to turn
> off secure boot too high of a barrier to trying out a Linux CD.

This is a legitimate concern, true, but it has nothing to do with UEFI
Secure Boot per se. BIOS and EFI changes were required in the early
days of SATA disks due to lack of driver support in the Linux kernel.
These changes sometimes still are required, notably on computers using
soft RAID drivers and Intel RST.


> The dual-boot issue Jerry mentioned I hadn't heard of before. I agree
> that further confirmation is required before that is declared a
> problem.

Agreed, and this is a thing that requires verifiable testing. "Some web
site I read said..." doesn't cut it. This is something I intend to do
but I need time to do it right and materials to ensure that I have a
viable backout plan.

 
> I don't understand what you mean by "lack of hardware support." Have
> you seen the wide range of ARM-based devices that Linux has been
> ported to? Do you really believe it would take more than a few weeks

I've seen more ARM devices that don't have Linux ports (Newton, the
entire line of Windows Phone devices for examples) along with plenty of
incomplete ports (like the iPAQ and Palm Tungsten lines). Given that it
took a team of clever folks several years to get Familiar into a usable
state on iPAQ, and that's only a portion of the devices sold under that
brand, I genuinely do not expect anyone will get a working Linux
deployment on ARM Surface with just a few weeks worth of effort.

-- 
Rich P.