Microsoft requiring Secure Boot for ARM devices, hamstringing Linux
As Windows 8 gets closer to reality, more details of Microsoft’s make-it-or-break-it effort to translate its desktop computing success to ARM-driven tablets are emerging. First, Microsoft revealed that ARM-based Windows 8 devices won”t be able to run legacy Windows software—it’ll be the Metro way, or the highway. Now, Microsoft’s Windows 8 hardware certification requirements reveal another restriction: Microsoft plans to require ARM-based Windows 8 devices use UEFI secure booting technology, dubbed Secure Boot. Although the requirement is likely intended to protect consumers from firmware attacks and prevent so-called jailbreaks of ARM-based Windows 8 tablets, it will also make it difficult or impossible for owners to use the hardware with non-Windows operating systems, like Linux.
In addition to requiring Windows 8 devices ship with Secure Boot enabled, Microsoft includes an explicit requirement that non-ARM systems to implement a way for a physically-present user to select between “Custom” and “Standard” modes in the Secure Boot setup—that means users of Intel-based Windows 8 systems will be able to modify the Secure Boot signature databases (perhaps installing keys for alternative operating systems) as well as turn off Secure Mode altogether. However, on ARM systems Microsoft is explicitly forbidding device makers to enable Custom Mode—if they do so, they will not qualify for the Windows 8 logo, and won’t be able to ship with Windows 8 pre-installed.
The requirement creates a dilemma for Linux distributions. If users can enable Custom Mode, the can disable Secure Boot and install any operating system they like—it wouldn’t be for the faint-of-heart, but it wouldn’t be any more difficult than what many Linux fans go through to get Linux running on current PCs. However, without the ability to disable Secure Boot, Linux distributions may not have many options. Creators of Linux distributions could conceivably provide signed versions of their operating systems, but going so would likely require a non-GPL bootloader.
The UEFI technology is not part of Windows 8; rather, the technology enables firmware to carry out its own security policies and verify components of an operating system are legitimate before loading the OS. Microsoft’s goal with prohibiting Custom Mode or the disabling of Secure Boot on ARM devices is likely stems from concerns for user security: users of Windows 8 ARM devices wouldn’t need to worry about portions of the operating system being swapped out for home-brew or malware versions. In that way, Windows 8 ARM devices would be a lot like Apple’s iPad and some Android devices, which have their bootloaders locked down to prevent owners from installing modified or alternative operating systems.
The requirement is potentially another sign of the gulf Microsoft seems to be creating between Windows 8 on ARM—with its consumer-friendly, Metro-only capabilities—and the version of Windows 8 for Intel-based devices, which will offer all Windows 8′s new capabilities along with support for legacy Windows software and a traditional desktop.
Microsoft has not yet responded on the record to requests for comment on Secure Boot requirements.
This article was originally posted on Digital Trends
More from Digital Trends
Don’t call Windows 8 ‘largely irrelevant’ until you actually use it
Windows 8 ARM tablets may not get the classic desktop
