Re: debian installation issue

From	Steve McIntyre <steve@einval.com>
Newsgroups	linux.debian.user
Subject	Re: debian installation issue
Date	2021-06-21 15:00 +0200
Message-ID	<CsrGV-4JC-1@gated-at.bofh.it> (permalink)
References	(2 earlier) <CoUet-4AT-13@gated-at.bofh.it> <CoUHw-4ZQ-11@gated-at.bofh.it> <CpOgF-5GF-3@gated-at.bofh.it> <CpOgF-5GF-3@gated-at.bofh.it> <CpPw6-6pO-7@gated-at.bofh.it>
Organization	Invalid Argument

Show all headers | View raw

[ Apologies, missed this last week... ]

tomas@tuxteam.de wrote:
>
>On Mon, Jun 14, 2021 at 09:20:52AM +0300, Andrei POPESCU wrote:
>> On Vi, 11 iun 21, 15:07:11, Greg Wooledge wrote:
>> > 
>> > Secure Boot (Microsoft's attempt to stop you from using Linux) relies on
>> > UEFI booting, and therefore this was one of the driving forces behind it,
>> > but not the *only* driving force.  If your machine doesn't use Secure Boot,
>> > don't worry about it.  It won't affect you.
>> 
>> While I'm not a fan of Microsoft:
>> 
>> https://wiki.debian.org/SecureBoot#What_is_UEFI_Secure_Boot_NOT.3F
>
>Quoting from there:
>
>  "Microsoft act as a Certification Authority (CA) for SB, and they will
>   sign programs on behalf of other trusted organisations so that their
>   programs will also run."
>
>Now two questions:
>
> - do you know any other alternative CA besides Microsoft who is
>   capable of effectively doing this? In a way that it'd "work"
>   with most PC vendors?

I've been in a number of discussions about this over the last few
years, particularly when talking about adding arm64 Secure Boot and
*maybe* finding somebody else to act as CA for that. There's a few
important (but probably not well-understood) aspect ofs the CA role
here:

 * the entity providing the CA needs to be stable (changing things is
   expensive and hard)
 * they need to be trustworthy - having an existing long-term business
   relationship with the OEMs is a major feature here
 * they need to be *large* - if there is a major mistake that might
   cause a problem on a lot of machines in production, the potential
   cost liability (and lawsuits) from OEMs is *huge*

There are not many companies who would fit here. Intel and AMD are
both very interested in enhancing trust and security at this kind of
level, but have competing products and ideas, for example.

> - is there any internationally legal binding of Microsoft for
>   them to provide that service in the future, in a fair and non
>   discriminatory way?

That is a question I *can't* answer as I've not seen anything
personally. But I would be shocked if agreements like that have not
been made with various vendors.

Having worked with Microsoft and a number of representatives from the
Linux distros, I *can* confirm that Microsoft care about Linux and SB
working well. Hell, they're even using SB (shim, etc.) themselves for
their own small Linux distro. That's not a *guarantee* of future
goodwill, but they're not about to break things here on a whim.

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
"We're the technical experts.  We were hired so that management could
 ignore our recommendations and tell us how to do our jobs."  -- Mike Andrews

Thread

debian installation issue Semih Ozlem <semihozlemlinuxuser@gmail.com> - 2021-06-11 18:40 +0200
  Re: debian installation issue Richard Owlett <rowlett@cloud85.net> - 2021-06-11 19:20 +0200
    Re: debian installation issue Semih Ozlem <semihozlemlinuxuser@gmail.com> - 2021-06-11 20:40 +0200
      Re: debian installation issue Greg Wooledge <greg@wooledge.org> - 2021-06-11 21:10 +0200
        Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-06-11 23:20 +0200
          Re: debian installation issue David Wright <deblis@lionunicorn.co.uk> - 2021-06-22 18:00 +0200
            Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-06-24 06:30 +0200
              Re: debian installation issue David Wright <deblis@lionunicorn.co.uk> - 2021-06-29 18:20 +0200
                Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-06-29 19:30 +0200
                Re: debian installation issue David Wright <deblis@lionunicorn.co.uk> - 2021-07-04 17:30 +0200
                Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-07-05 05:40 +0200
        Re: debian installation issue Semih Ozlem <semihozlemlinuxuser@gmail.com> - 2021-06-12 00:00 +0200
          Re: debian installation issue Greg Wooledge <greg@wooledge.org> - 2021-06-12 00:10 +0200
        Re: debian installation issue Andrei POPESCU <andreimpopescu@gmail.com> - 2021-06-14 08:30 +0200
          Re: debian installation issue <tomas@tuxteam.de> - 2021-06-14 09:50 +0200
            [Off topic thoughts] Re: debian installation issue "Thomas Schmitt" <scdbackup@gmx.net> - 2021-06-14 10:50 +0200
              Re: [Off topic thoughts] Re: debian installation issue <tomas@tuxteam.de> - 2021-06-14 11:50 +0200
                Re: [Off topic thoughts] Re: debian installation issue Joe <joe@jretrading.com> - 2021-06-14 13:20 +0200
              Secure Boot in QEMU (was Re: debian installation issue) Kenneth Parker <sea7kenp@gmail.com> - 2021-06-14 12:10 +0200
                Re: Secure Boot in QEMU (was Re: debian installation issue) "Andrew M.A. Cater" <amacater@einval.com> - 2021-06-14 13:40 +0200
            Re: debian installation issue Steve McIntyre <steve@einval.com> - 2021-06-21 15:00 +0200
              Re: debian installation issue tomas@tuxteam.de - 2021-06-21 16:40 +0200
              Re: debian installation issue Richard Hector <richard@walnut.gen.nz> - 2021-06-23 09:50 +0200
                Re: debian installation issue Andrei POPESCU <andreimpopescu@gmail.com> - 2021-06-23 14:30 +0200
      Re: debian installation issue Joe <joe@jretrading.com> - 2021-06-11 21:20 +0200
        Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-06-12 00:30 +0200
          Re: debian installation issue Joe <joe@jretrading.com> - 2021-06-12 09:00 +0200
            Re: debian installation issue songbird <songbird@anthive.com> - 2021-06-12 13:50 +0200
              Re: debian installation issue "Andrew M.A. Cater" <amacater@einval.com> - 2021-06-12 13:50 +0200
                Re: debian installation issue Joe <joe@jretrading.com> - 2021-06-12 14:20 +0200
                Re: debian installation issue songbird <songbird@anthive.com> - 2021-06-12 15:10 +0200
              Re: debian installation issue Joe <joe@jretrading.com> - 2021-06-12 14:10 +0200
            Re: debian installation issue Felix Miata <mrmazda@earthlink.net> - 2021-06-12 23:00 +0200
        Re: debian installation issue Steve McIntyre <steve@einval.com> - 2021-06-12 17:30 +0200

csiph-web