Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Couldn't all hardware that has this secure boot functionality simply include a physical switch that grants full access to the hardware? When the switch is on you can install any OS you like, when the switch is off no root kits could install themselves.

What do you think?



While not a physical switch, I believe for x86 / AMD64 computers, Microsoft is mandating that the user must have the option to disable secure boot via firmware switch (see http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the... ).

The opposite is true of ARM, however.


> The opposite is true of ARM, however.

There isn't even a non-proprietary standardized ARM platform. You have things like OMAP, but that's defined by TI:

http://en.wikipedia.org/wiki/OMAP


Fair enough. Microsoft is demanding no ARM-based platform running Win8 can have their locked-down boot mechanism disabled. In other words, Microsoft is demanding manufacturers make machines that can only run software Microsoft allows them to run.

Sounds like a really boneheaded move.


> Sounds like a really boneheaded move.

Or a market opportunity. Hard to say -- in many respects, the standardized PC is a fluke, created through clean-room reverse engineering and the resulting clone market.


Nicely put. Also, another huge factor in the standardized open PC was Microsoft licensing DOS to Compaq. That triggered the PC clones and the PC revolution which Linus leveraged with Linux and then Apple a decade and half later.


> Microsoft is mandating that the user must have the option to disable secure boot via firmware switch

They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now.

They do not for ARM machine makers that want to run Windows.


> They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now.

Wrong. The Windows 8 logo requirement specifically mandates that secure boot can be disabled by the end user, or (perhaps and...not sure on the correct conjunctive) that the end user can add new keys.


I agree that a compromise giving the best of both worlds would be the ideal outcome here.


I believe this is known as "the ChromeOS solution".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: