Microsoft pulled a Sony!

The guys who control more than ninety percent of the market are purposefully trying to restrict people's computer usage, extort money from third-party developers and make next-gen hardware either windows-only or with an OS whitelist, and you remain unconcerned?

edited 22nd Sep '11 1:37:54 PM by SavageHeathen

Unconcerned? I'm vaguely annoyed, but not really concerned.

Microsoft needs a good TR hammer strike to the face (AKA we throw the anti-trust book at them). However, in the absence of this, people could, you know, not buy PC.

In the meantime, they aren't doing anything illegal or even wrong, IMO. If I were to design something, decide some other, competing product that could be compatible with my product is something I don't like, and thus not put this compatibility in anymore, well, that's my right as the designer.

It's a matter of hardware design, not software design- Microsoft is basically saying that certified Windows 8 computers (ones that get the nice sticker) have to boot only signed code. Note that Microsoft does not build the physical computers.

"Signed Code" means that a specific piece of code has been cryptographically vouched for by an authority the UEFI firmware recognizes. Note that while presumably Microsoft would have their public key installed (recognizing them as an authority), it should be possible for other authorities to be included, so you could still run code as long as you ensure it is vouched for by one of the installed keys.

The advantage is that viruses and rootkits can't modify core operating system files without breaking the signature, thus preventing them from taking over the system.

The concern is that manufacturers might get lazy and include neither signing keys that could be used to load a Linux system, nor ways to install your Linux distribution (or yourself if you assemble your own system) as a trusted authority. Which would mean that system would be Windows-only, similar to how iPads are locked to iOS.

edited 22nd Sep '11 1:48:59 PM by Tangent128

Well, the thing about all these silly countermeasures is that none of them are perfect. Even the most overengineered encryption scheme has an insecure channel somewhere, and the goal is to make it difficult to break, not impossible — and time and again, various schemes have fallen either by brute-forcing the keys, or finding holes in the implementation that are relatively easy to exploit.

Real security requires procedures, monitoring, and most of all, actual locks — none of which are really feasible on consumer-level equipment unless you really want people to play video games in what amounts to a SCIF. So this arms race will continue, and the content providers will keep losing.

What about homebrew software, code you write yourself, fan-written game mods, et cetera?

I would be cool with the only signed code idea if there was an: I know it's unsigned, do it anyway and don't tell anybody option.

edited 22nd Sep '11 1:51:16 PM by SavageHeathen

...

So we're complaining that they're doing what Apple does with iPod and iPad?

~shrug~

Throw the book at them if there's a legal case. Otherwise, it's not something we can do anything about.

The target here is boot sector viruses. Nothing more, nothing less.

And yes, Apple tends to be more anti-competitive than Microsoft to a large degree.

Apple lost the jailbreak lawsuit: Circumventing provisions that prevent yourself from loading unsigned code on your hardware is kosher, specifically fair use. Long story short: If we have a legal right to jailbreak it, the lock was wrongful in the first place.

In Microsoft's case, considering that they're the dominant market player, slamming the lock shut results in blocking the competition from most hardware, a clear monopolistic move (specifically, enforcing your defacto monopoly to quash competition).

You sure Windows 8 is going to allow people to run non-Microsoft-approved code, or programs whose devs don't pay royalties to Microsoft? They've said they're going the iOS way, effectively turning the average computer at the hardware level into a walled garden of their own.

edited 22nd Sep '11 1:57:39 PM by SavageHeathen

(Less boot sector viruses, more rootkited kernels, but it's not an important distinction in this case.)

Not to defend Apple's practices there, but at least Apple does make their own hardware. Microsoft is telling other manufacturers what to do in this case.

Though as long as the vendors offer a "I know this is insecure" switch somewhere, or at least a way to add your own keys to the firmware, then this is a non-issue.

Savage, I think you're right (although almost certainly not to the extent that you'd like to be right). I don't know if there's legal ground to enact that position, however.

If there is, I guess you can call the ACLU or something and get them to throw the book at Microsoft. Finally.

Yup.

This code is unsigned and potentially unsafe. What do you want to do? *Run Away! (Recommended) *I know what I'm doing, authorize it with my user key and run it anyway (You sure?) would be optimal from a security standpoint.

The tech has non-evil uses, but I think they're gonna go for the evil ones.

edited 22nd Sep '11 2:00:50 PM by SavageHeathen

The signed code thing's already a substantial problem, it's just that it only really applies to drivers right now. You already can't install unsigned drivers without the ultimate edition of Windows Vista/7, if even then. At least XP just asked if you want to continue anyway.

Hahaha No. Apple uses basically the exact same hardware as any other OEM (Which also tend not to make their own hardware) with a few differences. They just assemble it and issue specifications for anything Mac specific.

Yeah, that's more of what they should do.

edited 22nd Sep '11 2:02:22 PM by Balmung

The drivers thing I can understand. Drivers get more or less root access to the entire system and the underlying hardware. You're unlikely to need more than one driver for a certain device. Hardware manufacturers can certainly afford to have their drivers certified.

Most run-of-the-mill programs don't get root access to nuthin' (and they shouldn't). Requiring apps to be signed is evil.

edited 22nd Sep '11 2:07:38 PM by SavageHeathen

When was this about requiring user-level apps to be signed? That's idiotic. Signing kernel-level stuff is a very strong security measure that I approve of.

If you're so concerned about Freedom and Human Dignity, consider the ratio of users who install Linux on a Win8 box to users who get infected by malware. Yeah, I'll take the extra security, thank you.

It still kind pisses me off that I can't tun ATI Tool or the drivers from Atmel needed for the software to program an ATMega32 and I can't override the "no unsigned drivers" thing (the big problem is that it costs money to get your driver signed.)

http://www.emoneydaily.com/microsoft-corporation-nasdaqmsft-planning-windows-8-app-monopoly/69818497/

http://www.pcworld.com/article/240301/microsoft_looks_to_join_apple_as_worlds_biggest_app_censor.html#tk.rss_news

Here, enjoy. I'm not talkin' off my butt, y'know? They are actually going to turn Win8 into an iOS-like walled garden, extorting totally undeserved royalties from devs and potentially having to ban apps at the government's request. In short, they're gonna become a tech censor. That's why I'm worked up about the whole issue: It goes deeper than a we need a non-GPL wrapper for GRUB 2 with a certified key to load ubuntu in a new laptop

edited 22nd Sep '11 2:21:20 PM by SavageHeathen

To make sure I know what I'm talking about, I read the article. I understand the issue that incorporating code signing requirements at the hardware level and requiring that hardware manufacturers support UEFI rather than BIOS will make it effectively impossible to use a homegrown boot loader, kernel, or drivers.

As I said earlier, I approve of this as far as the focus on stopping malware is concerned — it will be a lot harder to get your system infected at the boot/kernel level if there's a hardware level block on unsigned or invalidly signed code.

From a technical standpoint, I wonder how this will affect upgrading existing hardware to Win8. I don't see the article discussing this, but does any existing PC hardware meet their requirements? Maybe I misunderstand, but it seems that if your hardware doesn't support UEFI and is capable of having its firmware upgraded to support signed code, you're hosed. Am I off-base here? Because Microsoft is going to shoot itself in the face if you have to buy a new computer to get Win8.

The Linux/homegrown drivers concern is almost incidental to these other issues, as far as I'm concerned.

How about this, Savage.

Ignoring the ethical argument, is there a legal case here against Microsoft?

What about our drive virtualization drivers, the drivers that allow folks like me to mount their Linux data drives from Win and that kinda jazz?

They're third-party drivers for stuff that Microsoft doesn't necessarily like at all. They would be able to block that.

Lemme put it that way: If they go the App Store way, Valve will sue and Micro$oft will, in all likelihood, have its collective corporate butt ravished by an antitrust court.

edited 22nd Sep '11 2:24:08 PM by SavageHeathen

Don't they already block drivers like that?

The let Microshaft do it. They could stand to get knocked down a few pegs.

edited 22nd Sep '11 2:25:05 PM by Balmung

Hang on, perhaps I'm not up to speed on Win8, but what is this "Metro" thing? It seems like Microsoft is going to have a tablet/smartphone-style app framework analogous to Android/iOS that can only run apps downloaded from the App Store, but it says nothing about other software on PC's and laptops. In other words, it seems like we'll get two app environments in home boxes, one restricted and the other not; whereas the tablet/smartphone version will only have the restricted environment.

I see nothing fundamentally wrong with this; Steam would still work, it just couldn't install apps in the Metro interface.

edited 22nd Sep '11 2:27:52 PM by Fighteer

Ok...

Does that mean we can throw the book at Apple, too? I've been waiting for that...

Well, I dual boot Ubuntu and Windows 7 and Win 7 never gave me any trouble with sptd or ext2fsd, so perhaps they're not going to be evil.

I wouldn't have any problem with this kind of signing if it was free to acquire, but as I understand it, driver signing is already expensive and I don't imagine this new kind's gonna be cheap, either.

edited 22nd Sep '11 2:28:21 PM by Balmung

Yeah, but is there really a huge market for third-party Windows drivers? Other than for Linux, I mean.