UEFI SecureBoot
Malmrose, Cathy
What, why, when, where and how SecureBoot changes the way we build F/LOSS UEFI SecureBoot - what it is at OEM level and the implications over the next 1, 5, and 10 years 1. What is UEFI? Why was it so needed? 2. Microsoft's implementation of SecureBoot and what it means for F/LOSS 3. Description of how UEFI will morph over the next 5 yrs, according to corporate law / historical evidence 4. The variety of responses from various distros 5. OEM response (I'm at OEM level at the intersection between OEMs and devs)
 They don't have to be. Any OEM who's doing hardware at the OEM level can control, can get control and maintain control. Also, you need to know what a shim is. It's the current solution to signing the bootloader's loader. Now Matthew Garrett's the one who's most prolifically talking about this. So read up on him if you are going to, if by the end of this talk you care about secure boot. Now where is it? It's actually hardwired into the motherboard in the e-prom chip. It's a little erasable programmable read-only memory. It's a little chip that you cannot remove unless you're at OEM level and you're telling the factories how to manufacture it, unfortunately. Why did we switch from the BIOS to UEFI? First of all, the BIOS was a poorly specified old pile of code, reason number one. It needed updates. It was giving everyone headaches, developers headaches, having to work with it. It was old. It was 20 to 30 years old. It was designed for computers that are funny and for some of us bring up sentimental, have sentimental value. It was designed for computers that are now in the Computer History Museum near Palo Alto, California. If you see the little TRS80 in the bottom and that brings back nostalgia, that's when the original BIOS was written. The number one reason everybody uses it was written because of security reasons. Security is an entirely different field now. It's far more sophisticated. And also, why? No further support. There's three main companies that have supported this little chip on our motherboard. There's Phoenix Technologies, which only did the old BIOS. There's American Megatrans, which did the old BIOS and is continuing with UEFI and Inside, which is the same. But we all know the main reason why we're switching is because none of us want to stick with the old hardware. We all want bigger, better, faster, stronger. And there's no going back. So why don't many of us fully understand what UEFI secure boot is doing and how to get a laptop free of signing off of the Microsoft key at the end? It's because secure boot relies on various systems in the system that usually developers are specifically interested in one segment of this. The only people who have to cross over all these different I'm not going to read this to you, but the only people who have to cross over into all of these different areas are people like us who build hardware, and generally, people who build hardware, they have to sell it. In order to sell it, you have to become a company. When you become a company, I'll get to that in a minute, your focus changes. So there really isn't anyone protecting free and open-source software on this level. OK, the simple explanation for secure boot is an encryption key that checks to see if drivers are certified with a matching key so that it only executes certified code. The general saying in the community is that the goal is admirable, but the implementation sucks. It leaves a lot to be desired. The not so simple solution is that you can use a tool to generate your own private key, and then you can sign an OS shim with your private key, and put the public key in the bios slash UEFI. People will continue referring to it as the bios, technically as UEFI. That is a very simple way of saying something that's actually very complicated, but only the most technical people who are in this room will be able to do. OK, the win of it. Historically, this started in 2000. Between 2000 and 2004, people started writing code to replace, not us, the companies inside American Megatrends, started writing code to replace the bios. Everyone knew that you can't have a 20 to 30-year-old piece of code survive into the future. It was not immortal. It needed to be replaced long time ago. So they started creating it. In 2005, the industry started transitioning to it. You started seeing UEFI. Ironically, the desktops were the first ones to adopt UEFI on their motherboards. We started seeing UEFI on some of the motherboards of the hardware we were building. And 2011 was mass industry adoption. It became a design requirement. To the point that in, this is the now of it, the state of the union for UEFI, and 2011, 2012 systems were shipping with UEFI, nobody really noticed. In August 2012 was kind of the, not really the deadline or the Windows 8 was launched, and the launch has been a lot softer than anybody thought it would be. And that's partly, it helps it go under the radar even more. But OEMs did start shipping with the secure boot enabled on all Windows 8 machines. So desktops and motherboards, most of them have UEFI, laptops, some of them do, many of them do. Servers the same, but they're already in the lockdown environment, so it doesn't really matter. Tablets have a different architecture, thankfully, and ARM doesn't have any of the same. So there's no UEFI for it. Although, let it be noted, the Microsoft tablet, you cannot boot Linux on a Windows 8 RT tablet. It's not possible. And I know there's some of you that are thinking, oh, let me try it anyway. But you'll break it. So phones use ARM, so thankfully we don't have to mention the Chromebook uses core boot, which might be a potential solution for the community. We're already running into trouble. I'm sure you all have probably everyone came across the article recently about Samsung. These are the models of the Samsung laptop that people have been trying to load Linux onto and lately it bricks it, which we'll see more of. Generally, I've found that a lot of people aren't actually aware that if they go to the store and try to buy a Windows 8 machine, they can no longer wipe it and load Linux like they used to. Here's the future. This is just a general prediction, not saying it's guaranteed, but this is the direction that we see it heading. The part I wanted to talk to you about is the last one. Now, one of the reasons I'm so passionate about the start key on the keyboard is because back in 98, I think it was, 98, 91, somewhere in the 90s, Microsoft did something brilliant. Their marketing people did something that from a marketing perspective is brilliant. I say that sarcastically within this audience. From a marketing perspective, they put their logo on the start key. You start with Windows. It's also called the home key. You go home to Windows. It was so effective that people referred to the PC, the computer, as a Windows machine. Now PC is indistinguishable from a Windows machine. Calling secure boot, secure, which it is about security, is the second time they're doing that. They are making their OS the secure OS. The irony of it blows your mind. But with the current trajectory, by 2012, Windows will be the secure OS unless we can make some changes. Now, this is my passion, is how computers are built at OEM level. I'm not going to go into huge detail because it's fascinating for me, but it's probably boring for you. So generally at OEM level, there are several ways you can do it. For desktops, there are very few hardware builders that build their own cases anymore. It's generally you get a case, you get the components, you make sure they all work with the distro you're working with, and you test it and test it and test it. And there you have a great desktop. With laptops, you can no longer go get a white box laptop and buy your own components. You might be able to in some parts of the world, but over the last five years that's been phased out. You used to be able to do that. You can't any longer. So what we do is that at the OEM level, we get them in large quantities so that we can have control over how it's built and what's put on it. OK, so another part of the how. That's how it's built. How to disable it. This is a really basic, may or may not be fully accurate, depending on your experience when you do it. If you want to disable secure boot on a computer when you get your next laptop in a couple years and you can no longer find an old laptop or a laptop without an OS on it. You go into the BIOS setup, or the UEFI setup. It's different for every system. Sometimes it's F10, Escape, or Delete. So you guys could have probably guessed all that. Now for right now, it's just that one key. Every computer will be different. Every model will be different. And the way that you get into the BIOS or UEFI is going to change. If you look at how corporations work, that will become, this is just the first step on making it for proprietary. Thank you. It will become a little more complicated. Frogs in a pot of boiling water, you've heard that analogy. It will become a little more complicated each year. Fragmenting the population so that we devote our mental energies to just treading water rather than fixing the problem. You find secure boot and disable it. You may break your machine. We don't know yet. If the system has fast boot enabled, it disables the keyboard. So for fast boots, this is by Matthew Garrett. He said that the way to do this is basically you start and restart. And I won't read that for you. There are ways around it for now. And we'll continue to find ways around it. One of the many solutions. OK, but to the next one. How would you enable it? Some people actually may want to enable it. There are, and you'll see reasons why. But just know that for now, if you turn secure boot on, in any way, it does break Hibernate. And Hibernate's been the Achilles heel of free and open source software for so long. So that's kind of sad. So doing this, what I would love to see are some better, stronger solutions to secure boot so that as a community and as a force for free and open source software, and I hate saying just free and open. Know that when I say that, I mean lib also. That I would love to see a more solid solution. And that's why I'm going to be asking you questions in the middle so that we're not wasting our energy on each different model of computer. One of my pet peeves is seeing, because we're puzzle fixers, because many of us like the puzzle of getting our favorite OS to run on whatever type of machine, and because you'll have a very high frustration tolerance level, we tend to spend a lot of our energy getting one OS working on one computer and then maybe one model and then maybe sharing that information and maybe so many other people will do that. But unfortunately, that has diluted our energy to the point where it's made us vulnerable to corporations, as you'll see in a moment. OK, so here's the who part. This is the biggest part of the talk. We're going to be talking about how the distros have reacted to secure boot, how the OEMs are handling it, the people who put the UEFI code out there, what they're doing, I'm going to talk about the hardware builders at all different levels and sizes. I'm going to talk about the leaders and you guys, developers and users. You and your friends, I'm going to start with the last one first, users, because as I said, as I quoted even in the beginning, our user base is crucial to our future. A while back, I wrote a blog post sort of tongue in cheek called Turnikit. And I wrote it right before, I think in July, right before August 2012, right when we were feeling the intensity of we'd seen secure boot coming. We knew it was coming. Windows 8 was launching in full force, all of their great advertising. And let's just say it was extremely depressing. So I wrote a blog post called Turnikit that got a pretty good response. I recommend that you read it and let me know what you think. Users, these are our future users. Now I mentioned how secure boot, how that's brilliantly named, how this little bit of proprietary code is being labeled. There are other ways to do security. You don't have to be proprietary about it. OK, this user probably will not disable secure boot. Because disabling security is bad, only bad people. And I have hacker sons. I love the hacker vibe. But in general, people have a desire for security. It's a primal need. It's a constant within human nature. Disabling security is bad. And that's a very generalized statement. But these people will probably not actively disable a secure feature. So our future users, the little six-year-old software guy who's trying to figure out what this kernel thing is, and who is the guy who started contributing to the video card to Lima when he was 10, and he's still contributing, these are the future people that we're all going to be working with, the five-year-old hardware chick who likes opening up her laptop. Things change. Perception changes when security becomes a feature instead of it just being some fun puzzle to solve. Those kids become the heavy hitters of tomorrow. They're the ones who are going to make decisions that will support or not support our distros. They're going to be sitting there saying, hey, wait a minute, do I really want to disable security? Disabling something that's secure makes you bad. Thieves disable security. Don't take me too seriously there. On a primal level, people crave security. This is a constant. And you've got to wonder, would these people have contributed if it was more than just a puzzle? Previously, pre-Windows 8, pre-August 2012, all the work that we've done has just been a puzzle. There have been legal issues, but nothing likes Secure Boot. OK, so a graphic picture is incoming. Brace yourselves. I'm going to just read a little quote from a tourniquet. When UEFI's Secure Boot is implemented at OEM level, all new PCs purchased with Windows 8. It was going to, the launch has been much softer than what we all thought it would be because they were getting bad publicity. With the intent of loading your favorite distro, we'll have Secure Boot. Since the beginning of Gino Linux in the 1980s, 1990s, up till now, we've all had the luxury of wiping and loading whatever distro we liked. This gave you the ability to flip the bird. I don't know how you say it in other languages. Does that translate universally? Flip the bird. Yes, thank you. That was the phrase I was looking for. Give them the finger to the proprietary corporations. This is what Secure Boot does as it is currently being implemented. I'm sorry, I love that picture. That's what it does. So the next part, that's our developer base. We're basically cutting ourselves off unless we find better solutions. Now, this is the most negative aspect of it. This is one way to see it. We are having our ability to wipe and load our favorite distro sliced. And that was, I don't know about all of you, I'm sure. Your laptops and your hardware are very personal. They are your laptop, if you're, I assume, is like your child. It's very personal to you. You've probably taken it apart. You've probably had fun with it in many different ways. Well, here's the upside. While it seems like this horrible thing has happened, while it seems like Secure Boot may have hurt us in the end, if we handle it right as a community and as many different nations at large, it could be what we've been needing all along. And I'm very curious about your opinions. Because it is the ultimate differentiating factor. It makes free, deep, open source software unique. And not just the thing that you put on a Windows machine. It gives it an edge that it never had before. OK, so who? Quick review of the different distros. Shuddleworth. Now, Ubuntu, why did they sign so quickly with Microsoft? Think about it. Shuddleworth. Now, I support these guys. I respect their decision. But think about it. Shuddleworth made his fortune on a key thought. It was the security code upon which all internet banking is based. He, that's his area of expertise. That's his comfort zone. So they signed. Fedora, I feel so my heart broke when I read about them making their decisions. They were stuck between a rock and a hard place. They had to decide whether to become, most distros have this decision. At their point, they were deciding whether to become obsolete and make it impossible for new, less geeky users to load their distro or sign with Microsoft. They took a path that hopefully will pan out all right. But now, I love OpenSusay's choice. Are there any OpenSusay guys here? OK, is mostly be. They're over at a different talk. I almost got them here. But they're over at the GNOME talk. Their answer to it is, and it is, because the Microsoft key that everybody's chaining back to is only part of the verification process. It's deeper than that. And they're creating a second. They have signed with Microsoft, but they're creating a second level of complexity that makes it more secure. Mint, from my point of view, actually gets it. They understand that hardware and software have to be married. They understand that the two have to go hand in hand to have stability and that freedom will reside in being able to protect it within your actual concrete hardware. So they launched their own box. CrunchBang, they're still working on how they're going to respond to it. But the people who are running it are brilliant. And I know they'll find a way. Debian. OK, does anybody know what Debian is doing? Please, right here. Can we do the mic real quick? I would love to hear your answers. Yeah, this guy right here in the red. Thank you. Debian will not provide a signed boot loader. You have to use anything else. You can get or you have to disable it. Otherwise, anything else will not go get consensus within the project. And we are not illegal entities, so we cannot obtain a signing key if we even wanted it. We had to do it through SPI. And I don't think SPI would go along with that. OK. Please, yes. Thank you. Yeah. OK. So that's the energy that's going to push forward towards more solutions that we're going to talk about in a few minutes. Thank you. OK, the next thing I want to ask you is, what do you know about the other distros? There are many more distros than what I listed. Does anybody have any other feedback on any of the other distros? To be honest, I'm busy building hardware. And we're set up in North America right now. And I just finished setting up in Australasia. We're trying to set up in the UK. Cory Doctro, you all know who he is. Cory Doctro essentially wrote a love letter about us on Boing Boing. And so while it was really sweet of him, we've been getting a lot of, why aren't you in the UK? Why aren't you in the EU? Which, we're working on it. We're going as fast as we can. So my job is working on that. So I haven't had a chance to follow what the different distros are doing as much as I would love to. Do any of you know what any of the other distros are doing? Puppy Linux, any of them? OK. Yeah, go ahead. So there was a discussion on Gen2Dev about this. I think the outcome was no real decision. So a bit of also wait and see. And that there will be, anyway, some solutions. And also the thought occurred that Gen2 users might be able to deal with the situation in a way. Since you have to start at source for Gen2 in the first place, they're going to be pushing forward. Yeah, exactly. So generally, this is kind of what I expected. I was hoping that there'd be like, oh, I know, I know, I know. But generally, do you get it? There's a general lack of, I have no clue how we're going to handle this. As of right now, as a builder, we're shipping with Secure Boot Disabled. And I'm going to talk about some solutions in a moment. If we don't talk about it. OK, so from the point of view of distros, everything when Secure Boot was implemented and when we started wrapping our minds around it, and over the next year, people will continue wrapping their minds around it. It feels a bit like what we've built has can, if you're not in control of the hardware, what you've built can fall apart. The hardware is the earth under your house. It can be taken away and Secure Boot is doing that. And the reason we're talking about it is to avoid that, regret, and frustration later. OK, so Stephen J. Von Nichols is the number one media guy who is wrapping his mind around UEFI Secure Boot. And I talked to him, and he said at the end of the day, UEFI Secure Boot is far more about locking users into windows than it is about security. It is the act of a desperate company knowing that it's losing its once iron grasp on the desktop, frantically trying to hold onto its once insurmountable lead, as tablets and smartphones and even PC sales have shown Microsoft's losing its grip. Excuse me. And one other opinion from our beloved CoriDocro. He, the way he talked about it, is that a new PC feature called UEFI is making it increasingly hard to install non-commercial OSes on your own computer. Free OSes like Fedora and Ubuntu, sorry guys, are having to pay blood money to Microsoft so their users can install and boot their OSes without having to lift the lid off their machines and change the inner workings. This is a trend that I see getting much worse before it gets better. Now pay attention to that, before it gets better. That's what we're going to be talking about in a minute. Although the right to freely choose and modify your kernel is highly esoteric and technical, that's why we love it. It is the wellspring from which all other technical freedoms arise. I'm sure you can all relate to that. So now the hardware builders. There are three different types. There are small shops that rebrand. If you go to a corner shop that builds, and you tell them to build your computer that runs whatever, they'll probably put together the components and test it and make sure it works for you. We're in the middle category. There's reasons in the middle category. The medium shops that do their own builds, they go to OEM level. They're still small. We're so really small. But they go to but actually do their own runs of hardware at OEM level who work with the manufacturers in China and elsewhere. And then there's the megacorporations like Dell and Google. I hate putting those two side by side, but those are the main two juxtaposed. All right, this is us. We're hardware builders in Berkeley, California. We're setting up little shops like this globally. Like I said, we did North America and South America. Those are some of our people. The reason why we're setting up the small shops rather than megacorporations. Now, none of you have probably ever had to call tech support. But think of the friends that you help out who do have to call tech support. You don't want to have to help them. You want them to be able to talk to this guy. You want them to be able to talk directly to the guy who built your machine or the guy who actually has an answer, who is actually very familiar with the machine. So what we're doing is we set up the company very differently with very low overhead to make sure that the person who bought it talks to the person who made it. It makes sense. So thank you. Talk to that guy. Oh, the guys are going to love that. Thank you. So hardware builders. Now, we're a corporation. So there is US corporations are evil. I'm sorry. There's no way around it. So if you hear conflict in my voice, that's why. It's very hard to be a good corporation in the US. That's why we're not building a base in the US. Technically, our base is in New Zealand. So it's governed by different laws. But having a separate, distinct base in each country allows each country to choose how those computers are governed within the country so that you actually have a voice because you're there and you help have a voice in the government. Anyway, that's the goal. So the hardware builders. You've seen the efforts towards making Free and Open. Google is, of course, making the biggest headway with its Chrome Book and Corbett, which is a potential new solution. Now, raise your hand if you have seen the corporation. Oh, come on. Come on, come on. Less than like 5% you guys. OK, I beg you. I beg you to go home and see the documentary called the Corporation. What they did. OK, so in the US, a corporation is treated as an individual. It's given the rights of a human being. So a corporation is a human being. If the company was right here, it would have the rights of an actual human. It pays taxes like a human does. It has all the rights. So what the movie makers did is they said, well, if it actually was a human being, and we sat it down in front of a psychotherapist, what would the psychotherapists say? Would they say it's a healthy human being? They say it's a kind person? They went through, it's called the DSM, it's the Diagnostic and Statistical Manual for Mental Disorders. Corporations are psychotic killers. I mean, literally, literally, because by law, they are killing their peers. Their goal is to dominate, compete. By law, the scariest part is that there is no limit to their earnings. They have to earn profit. If they do not, their shareholders can sue them. The structure, the laws that govern corporations are such that the corporations have to be evil. Now, I don't believe that everybody that works at Microsoft is bad. I'm sure there's still some good people who work there. When they first started out, they were really cool. Seriously, I grew up near Microsoft. When they first started out, they were hiring really cool programmers. They were people that we like to hang around with. And then they started hiring more lawyers than programmers, and we said, wow, we don't really like these people as much anymore. They're not that cool. So that was kind of our wake-up call, that something was awry. I beg you to watch the corporation, because it will give you some insight into how UEFI's secure boot is going to progress, and how your accessibility to free and open hardware is going to change. OK, so I'm going to make a quick analogy. Have any of you heard of Monsanto? Yes! OK, so this analogy will ring true. Thank you. There are two things that I care about, my electronics and my food. I care that they're both pure. OK, those buildings look relatively similar, huh? We got here, my husband and I got here a day early, and we drove up to the Netherlands. And lo and behold, I took a picture of that building. There's a Monsanto building just right near here. And that other building is in Redmond. Now here's the part that will also hopefully blow your mind. This is my second blow your mind point. Microsoft is a software company that controls the hardware industry. For one industry to control another but not even have a successful product in it is insane. It's a software company that has managed to position themselves in a way that it controls the hardware industry but has none of the risk. There is risk in hardware. You get bad, bad runs of things. You get bad, I don't know, memory sticks. You get bad, whatever. There is risk in supplying hardware. Monsanto did the same thing. They control the food chain, both with the herbicides or both of the pesticides and with the seeds. But they have none of the risk. If there's a drought, it's the farmers who are screwed. The parallel couldn't be better. So let's see how Monsanto is further progressed than Secure Boot is. So Monsanto provides the seeds. In many countries, I'm sure many of you have read about their sales pitch. They're pitched as magic beans. You're not allowed to. Anyway, you've heard about the suicides. You all have hopefully followed Monsanto from farmers who have unfortunately invested in these seeds and then had years of drought because they were the ones who took the risk. So I left this one. Genetically modified canola has spread into the wild. What will Monsanto do about it? Because the farmers are getting sued. And of course, Monsanto wants to sue nature. That's essentially what it is. If Monsanto, I don't know about here, but if Monsanto's seeds go into the farmland of a neighboring farmer, they can be shut down and sued. Ironically, they both start with an M. So the analogy, as far as I know, there aren't any countries yet that Monsanto has not dominated. I've set up a company in New Zealand thinking, oh, New Zealand's so pure. They don't use herbicides. They don't use pesticides. They don't use steroids for their beef. And it is very pure and very wonderful. But Monsanto is already in phase two there. So maybe some of the islands haven't been hit yet. I don't know. So the penetration of Monsanto into the market has twisted our mindset to the point where we no longer actually identify food as food. This is food. This actually isn't. It's genetically modified. If you read the list of chemicals, I'm allergic to wheat. And so a while ago, my husband wrote me a little phone app called Gluten Free Guide so that I don't get poisoned by the stuff, because it's in nearly every wheat in so many things. The list of chemicals and the amount of twisting you have to do to the original food source in order to get that is insane. I'm sure it tastes good. I wouldn't know. But it twists our perception. This is the TRS80. This is the pure computer that you can open up and you can mess with and you can have fun with. And that's where we're headed. Anyway. So another part of the Hoo chain. Now, I didn't flush this out entirely because I want more time at the end. But retailers are at the very end of this food chain. And they say generally that food is what it is. And the electronics are what they are because of what people request, because of what people ask for. But I don't know about you, but I would rather not trust the general public to keep my hardware free and open and my software free and open. That's just one part of it. I'm going to touch on another part of it. I'm going to touch on it. Since you probably haven't gone and had your own hardware built at a factory, I'll tell you firsthand that factories are beholden to no one. This is an email that we got from one of our factories. We were trying to get some hardware that we didn't. And this was in the early days. We were trying to get some hardware that we didn't have to. That didn't come with a Windows license. That we didn't have to wipe Windows off of. And this is what they told us. Don't worry about it. OK. They're beholden to no one. So if we can have, and I don't care if it's a reason or anybody else, if we can keep people who actually care about free and open source software on the front lines at the manufacturing level, then we can find ways around secure boot. Now this is my home. This is a picture of the very first Maker Faire. Have any of you been to O'Reilly's Maker Faire? Oh, yes. First year? Second year? Yes, second. OK. Third year Disney was there, and it wasn't as fun. But yeah, the first couple years were great. How many of you have ever built your own desktop? Please. Yes. OK. So you know what goes into it. Building your own desktop, you can still do. Building your own laptop? Not so much. Building your own tablet? Not really. OK, so you can do it. I mean Kickstarter, you could possibly have done something on Kickstarter. Kickstarter stopped doing runs of goods. And if you want to get a whole lot of friends who want to exact same specs you do, you could possibly get, I'm talking about solutions here, what you can do to work around secure boot. But the Maker field is too far away from where it needs to be to solve this OEM level problem. OK, news flash. Hardware and software need to unite. Floss can't ignore the problem anymore. Unfortunately, and educating the public is not the solution. If every single one of us here was able to cite off the top of our heads five ways to get around the UEFI secure boot problem on a computer that your, I don't know, your kid or your parents or something bought at Best Buy or whatever store next week, then I would say that possibly educating the public is a problem. But if as a community we're having a hard time wrapping our mind around it, that's not the way to go. OK, so summary. Quick, simple summary, UEFI is good. Secure boot is poorly implemented. It's complicated to the point of being dangerous. Some of the world's worst problems were born out of complex situations that were just a little too complex to communicate to the public. I taught French at my alma mater, and the dean of the French school said, for every grammar rule, you have to be able to explain it in one sentence with the most simple words. And if you can't, you don't understand it. The same rule applies. We have to be able to get to the point where we can understand that. If not, we have to use some crutches. We have to use some other solutions to get around this. It's doable if we cooperate. OK, so here's the part where I get to meow some of my solutions. OK, and then you get a turn. We can implement better. Now, all three of these started out with fairly poor initial implementation, and they smoothed out. That's just something we're used to. As initial bumps in the road, and then we get used to it, it goes all right. OK, so for core boot. Now, core boot was going to hopefully be the ultimate solution, and it still may be. Google is a large corporation, so we're not 100% sure about that. Pre-chrome book, we didn't have the support of hardware manufacturers. The guys who are working on core boot, the hardware manufacturers, talking with Intel and AMD and NVIDIA and all of those, is not something you can't get a direct answer to what you need unless you're a Google. Sorry. You can also do your own distro, is one of the potential solutions. Because sooner or later, there won't be any more Windows 7 pre-Windows 8 machines to buy. So sooner or later, we have to deal with this. And like you said about Gen2, they can be one of our leaders, since the users always start at the source anyway. And James Bottomley is an important one to follow also. One solution, we just thought of this on our way here, literally. I don't know why we didn't, we've been busy with other things. Distros can make their own keys. It's actually not that hard for a distro to make its own key. And the OEMs, such as us, can use that key. So if you know of any distros that want to get around it, let us know. We are a corporation, but we have no investors. We have no shareholders. We've tried to eliminate everything that makes all of the legal things that make a corporation evil. And the stuff we do every day, we don't deal with keys. We don't deal with all the proprietary stuff in the licenses and other things like that. So it makes life so much nicer. OK, so really quickly, do any of you have any other solutions? Gen2, yeah. OK, if even a third of the people in this room supported Corbuth, that would be more than sufficient as far as developer power. Go. Did you get stuck? Yeah, go ahead, please. Did you check your email the last two days? Did you check your email the last two days? That's a loaded question. It's just because I checked it doesn't mean I saw it. OK, yeah. So I sent you an email about Corbuth. Yes. OK, I'll search for it. You saw it? Kathy at Zerizim.com. It doesn't matter how you spell the Kathy, just Kathy at Zerizim.com. OK, thank you. So you didn't see it. Thank you. Thank you. Thank you. I would love to talk to you, maybe offline, maybe now, about Corbuth. I've been involved in the Corbuth project for something like 11 years. And I was at Freedom Heck in Taipei and talked to a bunch of ODMs about this. That was in 2008 or 2009, 2008. And at the moment, we didn't have, as you say, any support from hardware vendors as in AMD and Intel. We did have some support from VIA, but not enough. That has changed a bit. So AMD are very much supporting Corbuth. Good. Yes, very good. We have they have contributed a GISA code. I don't know if that means anything to you, but yeah. Their reference code that goes to the IBVs to Inside and Phoenix and AMI, the BIOS companies, to Corbuth under BSD and GPL, dual license. And they also promised to continue doing this for all Cummings chipsets as you use. They see that they have an advantage there. Doing that. So that's great. As you mentioned, Google, they have been great at contributing code for Intel. However, it's not complete. And this is true for both Intel and AMD, actually. We are now at a point where the hardware components themselves, not even the main board, but the hardware components, contain closed mini computers that need a firmware that no one has the source code for. It's similar to CPU microcode, but it's maybe even, it's taking it even one step further. And this code, not even Google had that code, even though they have the full documentation and so on. So yeah, difficult problem. You mentioned, yes, let's talk offline. I don't want to take too much time. I want to make two comments. One about Dell. I had the opportunity to talk to Shuttleworth about Corbuth some time ago, years ago. And I asked him, OK, how do you see the situation? And he said that he went to Dell and he asked them about getting Corbuth for fast boot time at the time that was his motivation. The answer he got back was that Dell is actually not a big enough customer at their ODM to get Corbuth on the reference designs that they package. Yes and no. Yeah? Yeah? Yeah, it depends on how your company is structured. And that's why I'm growing the reason as small companies. Because when a corporation like Dell, when they grow fat, when they grow large and have a large base, then their definition of large is completely different. But if you grow a company small and international, your definition of large is doable. Yes, yes, I agree. I think you're doing the right thing. That's just a different framework. Yeah, by the way, thank you so much for coming here and talking about this. This is hugely important. Thank you. Corey, could you please go back to the Corey Dr. Rose slide? Yeah, sure. Oh, crap. None of you saw that, did you? No. OK, good. That was the answer to the trivia question. Actually, could you do this while I do the trivia question? Get it going. That's fine. OK, got you. Oh, good. Thank you. OK, the trivia question, while I get there, I am going to pick the first person who I see who can raise their hand and tell me who one of the very first programmers is. And I'm talking to the ENIAC right here. No. Unfortunately, another one over here. No, unfortunately, no. I love this. This is so cool. Right here. Alan Turing. Just a second. Say it again. Alan Turing. Nope. I have my list of six here. Yes? No, no, no. You already guessed that. Nope. On the ENIAC, they had six women. And originally, they were called computers because they were women who computed. I don't know if I read. Was there a woman who made the code? I don't know. I don't know. She's not. No. Grace Hopper was not one of the first. She came a little bit later. Isn't this wild? Then we don't. Go ahead. Yes, yes. Did you look? Did you look it up? It's OK if you looked it up. It's OK. Woohoo! Can you hear this up there? So I love this. It is so funny. So there were these guy engineers with their cool glasses and their little pocket protectors. My dad was an engineer. So I totally get that. And they had the women plugging in the tubes and actually doing the computing. And they called them computers. And later, they changed the computer to be the actual hardware and the women to be the programmers. But it was just a bunch of women who are actually doing it. And they did pair programming. And I got to hear Jean Bartik, who is my favorite. I got to hear her speak at the Computer History Museum. And she's got a better memory than I am. She's 80-something and she's sparky. And originally, the reason why so few people know the original programmers is because in the article, they showed the women working on the computers. And they thought they were just models. So the first articles written about them completely ignored the fact that they were the ones actually doing the computing. And it wasn't until just, I don't know how many years ago, that a media person dug into it and said, well, actually, they're the ones actually doing this. Anyway, I just thought that's funny. So I like to do that one. OK, which quote? Corey Slye. I'm going to. Corey Slye, yes. Go ahead. Take this. It's going to take me a minute to get there. There are 50 slides here. Go ahead. Let's take this quote. Go ahead. There you go. Just really quick. Interject that. Basically, you said that the key would be in e-promchip. IE. But basically, e-promchips are the ones which are UV-erosable. So do you mean flash chip? Do you mean flash chip? I mean flash chip. Yeah, it's basically. Basically, one of the researches that I'm doing is basically modifying the stock firmware. Somehow, basically, one of the big problems in Coreboot is that the memory in it takes really a lot of effort to reverse engineer. I managed to abuse the original. What's your name? My name is Vladimir Serbinenko. I'm the underneath- I'm still not going to remember that. Of PHCoder. I'm graph maintainer. OK. Email me, please. No problem. Basically, I managed to basically put Coreboot by using some parts of original BIOS, which is interesting to have this direction could also bring, not the complete solution, but part of the answer. And it also could be a way to modify the keys on the computer to put your own key. Because from technical point of view, what the secure would, something which would be completely fine if the end user controls the key. If the end user can choose his key, there would be no problem. Right, exactly. The problem is a Microsoft key. Because of the key modifications, it could go in this direction. Yeah. And many of the people in here will be generating their own keys, I'm sure, and getting around it that way. You can generate your own key that overwrites the Microsoft key. But that doesn't solve the problem of incoming users. And I didn't focus too much on those solutions, because I want so badly for our energy to go towards making a solution that will work for our moms and dads and our kids and the people that we're always doing tech support for. But email me, please. That is brilliant. Doing it on that level could be a huge solution. I've got to go back to this guy. Go ahead. Yeah, so just quickly, running out of time. The right to freely choose and modify your kernel is highly esoteric and technical. It is the wellspring from which all other technological freedoms arise. I take that a step further, because the kernel isn't the first thing that runs on the machine. So we really need to take control over the firmware. And I would like to, as I said, I've been advocating Corbuth for a very long time. And I find that I can make my point with many individuals that I meet. But please, please support Sir Reason, because. Well, that's the problem, is that we're not in a lot of countries yet. So it's only North and South American, Australasia. So if you can, then help Sir Reason start up in more companies. Sorry, in more countries. This is the way to do it, I think. Yeah. We're trying to get set up in the UK. But anyway, I'm going to let people go. Thank you so much for coming. And come and ask me questions if you want. Thank you you.
 They don't have to be.  Any OEM who's doing hardware at the OEM level can control,  can get control and maintain control.  Also, you need to know what a shim is.  It's the current solution to signing the bootloader's  loader.  Now Matthew Garrett's the one who's most prolifically talking  about this.  So read up on him if you are going to, if by the end of  this talk you care about secure boot.  Now where is it?  It's actually hardwired into the motherboard in the e-prom  chip.  It's a little erasable programmable read-only memory.  It's a little chip that you cannot remove unless you're at  OEM level and you're telling the factories how to  manufacture it, unfortunately.  Why did we switch from the BIOS to UEFI?  First of all, the BIOS was a poorly specified old pile of  code, reason number one.  It needed updates.  It was giving everyone headaches, developers headaches,  having to work with it.  It was old.  It was 20 to 30 years old.  It was designed for computers that are funny and for some of  us bring up sentimental, have sentimental value.  It was designed for computers that are now in the  Computer History Museum near Palo Alto, California.  If you see the little TRS80 in the bottom and that brings  back nostalgia, that's when the original BIOS was written.  The number one reason everybody uses it was written  because of security reasons.  Security is an entirely different field now.  It's far more sophisticated.  And also, why?  No further support.  There's three main companies that have supported this little  chip on our motherboard.  There's Phoenix Technologies, which only did the old BIOS.  There's American Megatrans, which did the old BIOS and is  continuing with UEFI and Inside, which is the same.  But we all know the main reason why we're switching is  because none of us want to stick with the old hardware.  We all want bigger, better, faster, stronger.  And there's no going back.  So why don't many of us fully understand what UEFI secure  boot is doing and how to get a laptop free of signing off  of the Microsoft key at the end?  It's because secure boot relies on various systems in the  system that usually developers are specifically  interested in one segment of this.  The only people who have to cross over all these different  I'm not going to read this to you, but the only people who  have to cross over into all of these different areas are  people like us who build hardware, and generally,  people who build hardware, they have to sell it.  In order to sell it, you have to become a company.  When you become a company, I'll get to that in a minute,  your focus changes.  So there really isn't anyone protecting free and open-source  software on this level.  OK, the simple explanation for secure boot is an encryption  key that checks to see if drivers are certified with a  matching key so that it only executes certified code.  The general saying in the community is that the goal  is admirable, but the implementation sucks.  It leaves a lot to be desired.  The not so simple solution is that you can use a tool to  generate your own private key, and then you can sign an OS  shim with your private key, and put the public key in the  bios slash UEFI.  People will continue referring to it as the  bios, technically as UEFI.  That is a very simple way of saying something that's  actually very complicated, but only the most technical people  who are in this room will be able to do.  OK, the win of it.  Historically, this started in 2000.  Between 2000 and 2004, people started writing code to  replace, not us, the companies inside American Megatrends,  started writing code to replace the bios.  Everyone knew that you can't have a 20 to 30-year-old piece  of code survive into the future.  It was not immortal.  It needed to be replaced long time ago.  So they started creating it.  In 2005, the industry started transitioning to it.  You started seeing UEFI.  Ironically, the desktops were the first ones to adopt UEFI  on their motherboards.  We started seeing UEFI on some of the motherboards of the  hardware we were building.  And 2011 was mass industry adoption.  It became a design requirement.  To the point that in, this is the now of it, the state of the  union for UEFI, and 2011, 2012 systems were shipping with  UEFI, nobody really noticed.  In August 2012 was kind of the, not really the deadline or  the Windows 8 was launched, and the launch has been a lot  softer than anybody thought it would be.  And that's partly, it helps it go under the radar even more.  But OEMs did start shipping with the secure boot enabled on  all Windows 8 machines.  So desktops and motherboards, most of them have UEFI,  laptops, some of them do, many of them do.  Servers the same, but they're already in  the lockdown environment, so it doesn't really matter.  Tablets have a different architecture, thankfully, and  ARM doesn't have any of the same.  So there's no UEFI for it.  Although, let it be noted, the Microsoft tablet, you cannot  boot Linux on a Windows 8 RT tablet.  It's not possible.  And I know there's some of you that are thinking, oh, let me  try it anyway.  But you'll break it.  So phones use ARM, so thankfully we don't have to  mention the  Chromebook uses core boot, which might be a potential  solution for the community.  We're already running into trouble.  I'm sure you all have probably everyone came across the  article recently about Samsung.  These are the models of the Samsung laptop that people  have been trying to load Linux onto and lately it bricks it,  which we'll see more of.  Generally, I've found that a lot of people aren't actually  aware that if they go to the store and try to buy a  Windows 8 machine, they can no longer wipe it and load  Linux like they used to.  Here's the future.  This is just a general prediction, not saying it's  guaranteed, but this is the direction that we see it heading.  The part I wanted to talk to you about is the  last one.  Now, one of the reasons I'm so passionate about the start  key on the keyboard is because back in 98, I think it was,  98, 91, somewhere in the 90s, Microsoft did something  brilliant.  Their marketing people did something that from a marketing  perspective is brilliant.  I say that sarcastically within this audience.  From a marketing perspective, they put their logo on the  start key.  You start with Windows.  It's also called the home key.  You go home to Windows.  It was so effective that people referred to the PC, the  computer, as a Windows machine.  Now PC is indistinguishable from a Windows machine.  Calling secure boot, secure, which it is about security, is  the second time they're doing that.  They are making their OS the secure OS.  The irony of it blows your mind.  But with the current trajectory, by 2012, Windows will  be the secure OS unless we can make some changes.  Now, this is my passion, is how computers are built at OEM  level.  I'm not going to go into huge detail because it's  fascinating for me, but it's probably boring for you.  So generally at OEM level, there are several ways you  can do it.  For desktops, there are very few hardware builders that  build their own cases anymore.  It's generally you get a case, you get the components, you  make sure they all work with the distro you're working with,  and you test it and test it and test it.  And there you have a great desktop.  With laptops, you can no longer go get a white box laptop  and buy your own components.  You might be able to in some parts of the world, but over  the last five years that's been phased out.  You used to be able to do that.  You can't any longer.  So what we do is that at the OEM level, we get them in  large quantities so that we can have control over how it's  built and what's put on it.  OK, so another part of the how.  That's how it's built.  How to disable it.  This is a really basic, may or may not be fully accurate,  depending on your experience when you do it.  If you want to disable secure boot on a computer when you  get your next laptop in a couple years and you can no  longer find an old laptop or a laptop without an OS on it.  You go into the BIOS setup, or the UEFI setup.  It's different for every system.  Sometimes it's F10, Escape, or Delete.  So you guys could have probably guessed all that.  Now for right now, it's just that one key.  Every computer will be different.  Every model will be different.  And the way that you get into the BIOS or UEFI is going to  change.  If you look at how corporations work, that will  become, this is just the first step on making it for  proprietary.  Thank you.  It will become a little more complicated.  Frogs in a pot of boiling water, you've heard that  analogy.  It will become a little more complicated each year.  Fragmenting the population so that we devote our mental  energies to just treading water rather than fixing the  problem.  You find secure boot and disable it.  You may break your machine.  We don't know yet.  If the system has fast boot enabled, it disables the  keyboard.  So for fast boots, this is by Matthew Garrett.  He said that the way to do this is basically you start and  restart.  And I won't read that for you.  There are ways around it for now.  And we'll continue to find ways around it.  One of the many solutions.  OK, but to the next one.  How would you enable it?  Some people actually may want to enable it.  There are, and you'll see reasons why.  But just know that for now, if you turn secure boot on, in  any way, it does break Hibernate.  And Hibernate's been the Achilles heel of free and  open source software for so long.  So that's kind of sad.  So doing this, what I would love to see are some better,  stronger solutions to secure boot so that as a community  and as a force for free and open source software, and I  hate saying just free and open.  Know that when I say that, I mean lib also.  That I would love to see a more solid solution.  And that's why I'm going to be asking you questions in the  middle so that we're not wasting our energy on each  different model of computer.  One of my pet peeves is seeing, because we're puzzle fixers,  because many of us like the puzzle of getting our  favorite OS to run on whatever type of machine, and  because you'll have a very high frustration tolerance  level, we tend to spend a lot of our energy getting one OS  working on one computer and then maybe one model and then  maybe sharing that information and maybe so many other  people will do that.  But unfortunately, that has diluted our energy to the  point where it's made us vulnerable to corporations,  as you'll see in a moment.  OK, so here's the who part.  This is the biggest part of the talk.  We're going to be talking about how the distros have  reacted to secure boot, how the OEMs are handling it, the  people who put the UEFI code out there, what they're  doing, I'm going to talk about the hardware builders at all  different levels and sizes.  I'm going to talk about the leaders and you guys,  developers and users.  You and your friends, I'm going to start with the last one  first, users, because as I said, as I quoted even in the  beginning, our user base is crucial to our future.  A while back, I wrote a blog post sort of tongue in cheek  called Turnikit.  And I wrote it right before, I think in July, right before  August 2012, right when we were feeling the intensity of  we'd seen secure boot coming.  We knew it was coming.  Windows 8 was launching in full force, all of their great  advertising.  And let's just say it was extremely depressing.  So I wrote a blog post called Turnikit that got a pretty  good response.  I recommend that you read it and let me know what you think.  Users, these are our future users.  Now I mentioned how secure boot, how that's brilliantly  named, how this little bit of proprietary code is being  labeled.  There are other ways to do security.  You don't have to be proprietary about it.  OK, this user probably will not disable secure boot.  Because disabling security is bad, only bad people.  And I have hacker sons.  I love the hacker vibe.  But in general, people have a desire for security.  It's a primal need.  It's a constant within human nature.  Disabling security is bad.  And that's a very generalized statement.  But these people will probably not actively disable a  secure feature.  So our future users, the little six-year-old software guy  who's trying to figure out what this kernel thing is, and  who is the guy who started contributing to the video card  to Lima when he was 10, and he's still contributing, these  are the future people that we're all going to be working  with, the five-year-old hardware chick who likes  opening up her laptop.  Things change.  Perception changes when security becomes a feature  instead of it just being some fun puzzle to solve.  Those kids become the heavy hitters of tomorrow.  They're the ones who are going to make decisions that will  support or not support our distros.  They're going to be sitting there saying, hey, wait a  minute, do I really want to disable security?  Disabling something that's secure makes you bad.  Thieves disable security.  Don't take me too seriously there.  On a primal level, people crave security.  This is a constant.  And you've got to wonder, would these people have  contributed if it was more than just a puzzle?  Previously, pre-Windows 8, pre-August 2012, all the work  that we've done has just been a puzzle.  There have been legal issues, but nothing likes Secure Boot.  OK, so a graphic picture is incoming.  Brace yourselves.  I'm going to just read a little quote from a tourniquet.  When UEFI's Secure Boot is implemented at OEM level, all  new PCs purchased with Windows 8.  It was going to, the launch has been much softer than what  we all thought it would be because they were getting  bad publicity.  With the intent of loading your favorite distro, we'll have  Secure Boot.  Since the beginning of Gino Linux in the 1980s, 1990s, up  till now, we've all had the luxury of wiping and loading  whatever distro we liked.  This gave you the ability to flip the bird.  I don't know how you say it in other languages.  Does that translate universally?  Flip the bird.  Yes, thank you.  That was the phrase I was looking for.  Give them the finger to the proprietary corporations.  This is what Secure Boot does as it is currently being  implemented.  I'm sorry, I love that picture.  That's what it does.  So the next part, that's our developer base.  We're basically cutting ourselves off unless we find  better solutions.  Now, this is the most negative aspect of it.  This is one way to see it.  We are having our ability to wipe and load our favorite  distro sliced.  And that was, I don't know about all of you, I'm sure.  Your laptops and your hardware are very personal.  They are your laptop, if you're, I assume, is like your  child.  It's very personal to you.  You've probably taken it apart.  You've probably had fun with it in many different ways.  Well, here's the upside.  While it seems like this horrible thing has happened,  while it seems like Secure Boot may have hurt us in the  end, if we handle it right as a community and as many  different nations at large, it could be what we've been  needing all along.  And I'm very curious about your opinions.  Because it is the ultimate differentiating factor.  It makes free, deep, open source software unique.  And not just the thing that you put on a Windows machine.  It gives it an edge that it never had before.  OK, so who?  Quick review of the different distros.  Shuddleworth.  Now, Ubuntu, why did they sign so quickly with Microsoft?  Think about it.  Shuddleworth.  Now, I support these guys.  I respect their decision.  But think about it.  Shuddleworth made his fortune on a key thought.  It was the security code upon which all internet banking  is based.  He, that's his area of expertise.  That's his comfort zone.  So they signed.  Fedora, I feel so my heart broke when I read about them  making their decisions.  They were stuck between a rock and a hard place.  They had to decide whether to become,  most distros have this decision.  At their point, they were deciding  whether to become obsolete and make it impossible for new,  less geeky users to load their distro or sign with Microsoft.  They took a path that hopefully will pan out all right.  But now, I love OpenSusay's choice.  Are there any OpenSusay guys here?  OK, is mostly be.  They're over at a different talk.  I almost got them here.  But they're over at the GNOME talk.  Their answer to it is, and it is, because the Microsoft key  that everybody's chaining back to is only part  of the verification process.  It's deeper than that.  And they're creating a second.  They have signed with Microsoft, but they're  creating a second level of complexity  that makes it more secure.  Mint, from my point of view, actually gets it.  They understand that hardware and software have to be married.  They understand that the two have to go hand in hand  to have stability and that freedom will reside in being  able to protect it within your actual concrete hardware.  So they launched their own box.  CrunchBang, they're still working on how they're  going to respond to it.  But the people who are running it are brilliant.  And I know they'll find a way.  Debian.  OK, does anybody know what Debian is doing?  Please, right here.  Can we do the mic real quick?  I would love to hear your answers.  Yeah, this guy right here in the red.  Thank you.  Debian will not provide a signed boot loader.  You have to use anything else.  You can get or you have to disable it.  Otherwise, anything else will not  go get consensus within the project.  And we are not illegal entities, so we cannot obtain a signing  key if we even wanted it.  We had to do it through SPI.  And I don't think SPI would go along with that.  OK.  Please, yes.  Thank you.  Yeah.  OK.  So that's the energy that's going to push forward  towards more solutions that we're  going to talk about in a few minutes.  Thank you.  OK, the next thing I want to ask you is,  what do you know about the other distros?  There are many more distros than what I listed.  Does anybody have any other feedback  on any of the other distros?  To be honest, I'm busy building hardware.  And we're set up in North America right now.  And I just finished setting up in Australasia.  We're trying to set up in the UK.  Cory Doctro, you all know who he is.  Cory Doctro essentially wrote a love letter about us  on Boing Boing.  And so while it was really sweet of him,  we've been getting a lot of, why aren't you in the UK?  Why aren't you in the EU?  Which, we're working on it.  We're going as fast as we can.  So my job is working on that.  So I haven't had a chance to follow  what the different distros are doing as much as I would love  to.  Do any of you know what any of the other distros are doing?  Puppy Linux, any of them?  OK.  Yeah, go ahead.  So there was a discussion on Gen2Dev about this.  I think the outcome was no real decision.  So a bit of also wait and see.  And that there will be, anyway, some solutions.  And also the thought occurred that Gen2 users might  be able to deal with the situation in a way.  Since you have to start at source for Gen2 in the first place,  they're going to be pushing forward.  Yeah, exactly.  So generally, this is kind of what I expected.  I was hoping that there'd be like, oh, I know, I know, I know.  But generally, do you get it?  There's a general lack of, I have no clue  how we're going to handle this.  As of right now, as a builder, we're  shipping with Secure Boot Disabled.  And I'm going to talk about some solutions in a moment.  If we don't talk about it.  OK, so from the point of view of distros,  everything when Secure Boot was implemented  and when we started wrapping our minds around it,  and over the next year, people will continue wrapping  their minds around it.  It feels a bit like what we've built has can,  if you're not in control of the hardware, what you've built  can fall apart.  The hardware is the earth under your house.  It can be taken away and Secure Boot is doing that.  And the reason we're talking about it  is to avoid that, regret, and frustration later.  OK, so Stephen J. Von Nichols is the number one media guy  who is wrapping his mind around UEFI Secure Boot.  And I talked to him, and he said at the end of the day,  UEFI Secure Boot is far more about locking users into windows  than it is about security.  It is the act of a desperate company  knowing that it's losing its once iron grasp on the desktop,  frantically trying to hold onto its once insurmountable lead,  as tablets and smartphones and even PC sales  have shown Microsoft's losing its grip.  Excuse me.  And one other opinion from our beloved CoriDocro.  He, the way he talked about it, is that a new PC feature  called UEFI is making it increasingly hard  to install non-commercial OSes on your own computer.  Free OSes like Fedora and Ubuntu, sorry guys,  are having to pay blood money to Microsoft  so their users can install and boot their OSes  without having to lift the lid off their machines  and change the inner workings.  This is a trend that I see getting much worse  before it gets better.  Now pay attention to that, before it gets better.  That's what we're going to be talking about in a minute.  Although the right to freely choose and modify your kernel  is highly esoteric and technical, that's why we love it.  It is the wellspring from which all other technical freedoms  arise.  I'm sure you can all relate to that.  So now the hardware builders.  There are three different types.  There are small shops that rebrand.  If you go to a corner shop that builds,  and you tell them to build your computer that runs whatever,  they'll probably put together the components and test it  and make sure it works for you.  We're in the middle category.  There's reasons in the middle category.  The medium shops that do their own builds,  they go to OEM level.  They're still small.  We're so really small.  But they go to but actually do their own runs of hardware  at OEM level who work with the manufacturers in China  and elsewhere.  And then there's the megacorporations  like Dell and Google.  I hate putting those two side by side,  but those are the main two juxtaposed.  All right, this is us.  We're hardware builders in Berkeley, California.  We're setting up little shops like this globally.  Like I said, we did North America and South America.  Those are some of our people.  The reason why we're setting up the small shops rather  than megacorporations.  Now, none of you have probably ever had to call tech support.  But think of the friends that you help out who do have  to call tech support.  You don't want to have to help them.  You want them to be able to talk to this guy.  You want them to be able to talk directly  to the guy who built your machine or the guy who actually  has an answer, who is actually very familiar with the machine.  So what we're doing is we set up the company very differently  with very low overhead to make sure  that the person who bought it talks to the person who made it.  It makes sense.  So thank you.  Talk to that guy.  Oh, the guys are going to love that.  Thank you.  So hardware builders.  Now, we're a corporation.  So there is US corporations are evil.  I'm sorry.  There's no way around it.  So if you hear conflict in my voice, that's why.  It's very hard to be a good corporation in the US.  That's why we're not building a base in the US.  Technically, our base is in New Zealand.  So it's governed by different laws.  But having a separate, distinct base in each country  allows each country to choose how those computers are  governed within the country so that you actually have a voice  because you're there and you help  have a voice in the government.  Anyway, that's the goal.  So the hardware builders.  You've seen the efforts towards making Free and Open.  Google is, of course, making the biggest headway with its Chrome  Book and Corbett, which is a potential new solution.  Now, raise your hand if you have seen the corporation.  Oh, come on.  Come on, come on.  Less than like 5% you guys.  OK, I beg you.  I beg you to go home and see the documentary called  the Corporation.  What they did.  OK, so in the US, a corporation is treated as an individual.  It's given the rights of a human being.  So a corporation is a human being.  If the company was right here, it would have the rights  of an actual human.  It pays taxes like a human does.  It has all the rights.  So what the movie makers did is they said, well, if it  actually was a human being, and we sat it down in front of a  psychotherapist, what would the psychotherapists say?  Would they say it's a healthy human being?  They say it's a kind person?  They went through, it's called the DSM, it's the Diagnostic  and Statistical Manual for Mental Disorders.  Corporations are psychotic killers.  I mean, literally, literally, because by law, they are killing  their peers.  Their goal is to dominate, compete.  By law, the scariest part is that there is no limit to  their earnings.  They have to earn profit.  If they do not, their shareholders can sue them.  The structure, the laws that govern corporations are  such that the corporations have to be evil.  Now, I don't believe that everybody that works at  Microsoft is bad.  I'm sure there's still some good people who work there.  When they first started out, they were really cool.  Seriously, I grew up near Microsoft.  When they first started out, they were hiring really cool  programmers.  They were people that we like to hang around with.  And then they started hiring more lawyers than  programmers, and we said, wow, we don't really like these  people as much anymore.  They're not that cool.  So that was kind of our wake-up call, that something was  awry.  I beg you to watch the corporation, because it will  give you some insight into how UEFI's secure boot is going  to progress, and how your accessibility to free and open  hardware is going to change.  OK, so I'm going to make a quick analogy.  Have any of you heard of Monsanto?  Yes!  OK, so this analogy will ring true.  Thank you.  There are two things that I care about, my electronics and  my food.  I care that they're both pure.  OK, those buildings look relatively similar, huh?  We got here, my husband and I got here a day early, and we  drove up to the Netherlands.  And lo and behold, I took a picture of that building.  There's a Monsanto building just right near here.  And that other building is in Redmond.  Now here's the part that will also hopefully blow your  mind.  This is my second blow your mind point.  Microsoft is a software company that controls the  hardware industry.  For one industry to control another but not even have a  successful product in it is insane.  It's a software company that has managed to position  themselves in a way that it controls the hardware industry  but has none of the risk.  There is risk in hardware.  You get bad, bad runs of things.  You get bad, I don't know, memory sticks.  You get bad, whatever.  There is risk in supplying hardware.  Monsanto did the same thing.  They control the food chain, both with the herbicides or  both of the pesticides and with the seeds.  But they have none of the risk.  If there's a drought, it's the farmers who are screwed.  The parallel couldn't be better.  So let's see how Monsanto is further progressed than Secure  Boot is.  So Monsanto provides the seeds.  In many countries, I'm sure many of you have read about  their sales pitch.  They're pitched as magic beans.  You're not allowed to.  Anyway, you've heard about the suicides.  You all have hopefully followed Monsanto from farmers who  have unfortunately invested in these seeds and then had  years of drought because they were the ones who took the  risk.  So I left this one.  Genetically modified canola has spread into the  wild.  What will Monsanto do about it?  Because the farmers are getting sued.  And of course, Monsanto wants to sue nature.  That's essentially what it is.  If Monsanto, I don't know about here, but if Monsanto's  seeds go into the farmland of a neighboring farmer, they can  be shut down and sued.  Ironically, they both start with an M. So the analogy, as  far as I know, there aren't any countries yet that Monsanto  has not dominated.  I've set up a company in New Zealand thinking, oh, New  Zealand's so pure.  They don't use herbicides.  They don't use pesticides.  They don't use steroids for their beef.  And it is very pure and very wonderful.  But Monsanto is already in phase two there.  So maybe some of the islands haven't been hit yet.  I don't know.  So the penetration of Monsanto into the market has  twisted our mindset to the point where we no longer  actually identify food as food.  This is food.  This actually isn't.  It's genetically modified.  If you read the list of chemicals, I'm allergic to  wheat.  And so a while ago, my husband wrote me a little phone app  called Gluten Free Guide so that I don't get poisoned by  the stuff, because it's in nearly every wheat in so  many things.  The list of chemicals and the amount of twisting you have  to do to the original food source in order to get that  is insane.  I'm sure it tastes good.  I wouldn't know.  But it twists our perception.  This is the TRS80.  This is the pure computer that you can open up and you can  mess with and you can have fun with.  And that's where we're headed.  Anyway.  So another part of the Hoo chain.  Now, I didn't flush this out entirely because I want more  time at the end.  But retailers are at the very end of this food chain.  And they say generally that food is what it is.  And the electronics are what they are because of what  people request, because of what people ask for.  But I don't know about you, but I would rather not trust  the general public to keep my hardware free and open and my  software free and open.  That's just one part of it.  I'm going to touch on another part of it.  I'm going to touch on it.  Since you probably haven't gone and had your own hardware  built at a factory, I'll tell you firsthand that factories  are beholden to no one.  This is an email that we got from one of our factories.  We were trying to get some hardware that we didn't.  And this was in the early days.  We were trying to get some hardware that we didn't have  to.  That didn't come with a Windows license.  That we didn't have to wipe Windows off of.  And this is what they told us.  Don't worry about it.  OK.  They're beholden to no one.  So if we can have, and I don't care if it's a reason or  anybody else, if we can keep people who actually care about  free and open source software on the front lines at the  manufacturing level, then we can find ways around secure boot.  Now this is my home.  This is a picture of the very first Maker Faire.  Have any of you been to O'Reilly's Maker Faire?  Oh, yes.  First year?  Second year?  Yes, second.  OK.  Third year Disney was there, and it wasn't as fun.  But yeah, the first couple years were great.  How many of you have ever built your own desktop?  Please.  Yes.  OK.  So you know what goes into it.  Building your own desktop, you can still do.  Building your own laptop?  Not so much.  Building your own tablet?  Not really.  OK, so you can do it.  I mean Kickstarter, you could possibly have done something  on Kickstarter.  Kickstarter stopped doing runs of goods.  And if you want to get a whole lot of friends who want to  exact same specs you do, you could possibly get, I'm  talking about solutions here, what you can do to work  around secure boot.  But the Maker field is too far away from where it needs to  be to solve this OEM level problem.  OK, news flash.  Hardware and software need to unite.  Floss can't ignore the problem anymore.  Unfortunately, and educating the public is not the solution.  If every single one of us here was able to cite off the top  of our heads five ways to get around the UEFI secure boot  problem on a computer that your, I don't know, your kid or  your parents or something bought at Best Buy or whatever  store next week, then I would say that possibly educating  the public is a problem.  But if as a community we're having a hard time wrapping  our mind around it, that's not the way to go.  OK, so summary.  Quick, simple summary, UEFI is good.  Secure boot is poorly implemented.  It's complicated to the point of being dangerous.  Some of the world's worst problems were born out of  complex situations that were just a little too complex to  communicate to the public.  I taught French at my alma mater, and the dean of the  French school said, for every grammar rule, you have to be  able to explain it in one sentence with the most simple  words.  And if you can't, you don't understand it.  The same rule applies.  We have to be able to get to the point where we can  understand that.  If not, we have to use some crutches.  We have to use some other solutions to get around this.  It's doable if we cooperate.  OK, so here's the part where I get to meow some of my  solutions.  OK, and then you get a turn.  We can implement better.  Now, all three of these started out with fairly poor  initial implementation, and they smoothed out.  That's just something we're used to.  As initial bumps in the road, and then we get used to it,  it goes all right.  OK, so for core boot.  Now, core boot was going to hopefully be the ultimate  solution, and it still may be.  Google is a large corporation, so we're not 100% sure  about that.  Pre-chrome book, we didn't have the support of hardware  manufacturers.  The guys who are working on core boot, the hardware  manufacturers, talking with Intel and AMD and NVIDIA and  all of those, is not something you can't get a direct  answer to what you need unless you're a Google.  Sorry.  You can also do your own distro, is one of the  potential solutions.  Because sooner or later, there won't be any more Windows  7 pre-Windows 8 machines to buy.  So sooner or later, we have to deal with this.  And like you said about Gen2, they can be one of our  leaders, since the users always start at the source anyway.  And James Bottomley is an important one to follow also.  One solution, we just thought of this on our way here,  literally.  I don't know why we didn't, we've been busy with other  things.  Distros can make their own keys.  It's actually not that hard for a distro to make its own  key.  And the OEMs, such as us, can use that key.  So if you know of any distros that want to get around it,  let us know.  We are a corporation, but we have no investors.  We have no shareholders.  We've tried to eliminate everything that makes all of  the legal things that make a corporation evil.  And the stuff we do every day, we don't deal with keys.  We don't deal with all the proprietary stuff in the  licenses and other things like that.  So it makes life so much nicer.  OK, so really quickly, do any of you have any other  solutions?  Gen2, yeah.  OK, if even a third of the people in this room supported  Corbuth, that would be more than sufficient as far as  developer power.  Go.  Did you get stuck?  Yeah, go ahead, please.  Did you check your email the last two days?  Did you check your email the last two days?  That's a loaded question.  It's just because I checked it doesn't mean I saw it.  OK, yeah.  So I sent you an email about Corbuth.  Yes.  OK, I'll search for it.  You saw it?  Kathy at Zerizim.com.  It doesn't matter how you spell the Kathy, just  Kathy at Zerizim.com.  OK, thank you.  So you didn't see it.  Thank you.  Thank you.  Thank you.  I would love to talk to you, maybe offline, maybe now,  about Corbuth.  I've been involved in the Corbuth project for something  like 11 years.  And I was at Freedom Heck in Taipei and talked to a bunch  of ODMs about this.  That was in 2008 or 2009, 2008.  And at the moment, we didn't have, as you say,  any support from hardware vendors as in AMD and Intel.  We did have some support from VIA, but not enough.  That has changed a bit.  So AMD are very much supporting Corbuth.  Good.  Yes, very good.  We have they have contributed a GISA code.  I don't know if that means anything to you, but yeah.  Their reference code that goes to the IBVs to Inside and Phoenix  and AMI, the BIOS companies, to Corbuth under BSD and GPL,  dual license.  And they also promised to continue  doing this for all Cummings chipsets as you use.  They see that they have an advantage there.  Doing that.  So that's great.  As you mentioned, Google, they have been great at contributing  code for Intel.  However, it's not complete.  And this is true for both Intel and AMD, actually.  We are now at a point where the hardware components themselves,  not even the main board, but the hardware components,  contain closed mini computers that need a firmware that no one  has the source code for.  It's similar to CPU microcode, but it's maybe even,  it's taking it even one step further.  And this code, not even Google had that code,  even though they have the full documentation and so on.  So yeah, difficult problem.  You mentioned, yes, let's talk offline.  I don't want to take too much time.  I want to make two comments.  One about Dell.  I had the opportunity to talk to Shuttleworth about Corbuth  some time ago, years ago.  And I asked him, OK, how do you see the situation?  And he said that he went to Dell and he asked them  about getting Corbuth for fast boot time at the time that  was his motivation.  The answer he got back was that Dell is actually  not a big enough customer at their ODM  to get Corbuth on the reference designs that they package.  Yes and no.  Yeah?  Yeah?  Yeah, it depends on how your company is structured.  And that's why I'm growing the reason as small companies.  Because when a corporation like Dell, when they grow fat,  when they grow large and have a large base,  then their definition of large is completely different.  But if you grow a company small and international,  your definition of large is doable.  Yes, yes, I agree.  I think you're doing the right thing.  That's just a different framework.  Yeah, by the way, thank you so much for coming here  and talking about this.  This is hugely important.  Thank you.  Corey, could you please go back to the Corey Dr. Rose slide?  Yeah, sure.  Oh, crap.  None of you saw that, did you?  No.  OK, good.  That was the answer to the trivia question.  Actually, could you do this while I do the trivia question?  Get it going.  That's fine.  OK, got you.  Oh, good.  Thank you.  OK, the trivia question, while I get there,  I am going to pick the first person who I see who  can raise their hand and tell me who one of the very first  programmers is.  And I'm talking to the ENIAC right here.  No.  Unfortunately, another one over here.  No, unfortunately, no.  I love this.  This is so cool.  Right here.  Alan Turing.  Just a second.  Say it again.  Alan Turing.  Nope.  I have my list of six here.  Yes?  No, no, no.  You already guessed that.  Nope.  On the ENIAC, they had six women.  And originally, they were called computers  because they were women who computed.  I don't know if I read.  Was there a woman who made the code?  I don't know.  I don't know.  She's not.  No.  Grace Hopper was not one of the first.  She came a little bit later.  Isn't this wild?  Then we don't.  Go ahead.  Yes, yes.  Did you look?  Did you look it up?  It's OK if you looked it up.  It's OK.  Woohoo!  Can you hear this up there?  So I love this.  It is so funny.  So there were these guy engineers with their cool glasses  and their little pocket protectors.  My dad was an engineer.  So I totally get that.  And they had the women plugging in the tubes  and actually doing the computing.  And they called them computers.  And later, they changed the computer  to be the actual hardware and the women to be the programmers.  But it was just a bunch of women who are actually doing it.  And they did pair programming.  And I got to hear Jean Bartik, who is my favorite.  I got to hear her speak at the Computer History Museum.  And she's got a better memory than I am.  She's 80-something and she's sparky.  And originally, the reason why so few people  know the original programmers is because in the article,  they showed the women working on the computers.  And they thought they were just models.  So the first articles written about them  completely ignored the fact that they were the ones actually  doing the computing.  And it wasn't until just, I don't know how many years ago,  that a media person dug into it and said, well, actually,  they're the ones actually doing this.  Anyway, I just thought that's funny.  So I like to do that one.  OK, which quote?  Corey Slye.  I'm going to.  Corey Slye, yes.  Go ahead.  Take this.  It's going to take me a minute to get there.  There are 50 slides here.  Go ahead.  Let's take this quote.  Go ahead.  There you go.  Just really quick.  Interject that.  Basically, you said that the key would be in e-promchip.  IE.  But basically, e-promchips are the ones  which are UV-erosable.  So do you mean flash chip?  Do you mean flash chip?  I mean flash chip.  Yeah, it's basically.  Basically, one of the researches that I'm doing  is basically modifying the stock firmware.  Somehow, basically, one of the big problems in Coreboot  is that the memory in it takes really a lot of effort  to reverse engineer.  I managed to abuse the original.  What's your name?  My name is Vladimir Serbinenko.  I'm the underneath-  I'm still not going to remember that.  Of PHCoder.  I'm graph maintainer.  OK.  Email me, please.  No problem.  Basically, I managed to basically put Coreboot  by using some parts of original BIOS, which  is interesting to have this direction could also bring,  not the complete solution, but part of the answer.  And it also could be a way to modify the keys on the computer  to put your own key.  Because from technical point of view,  what the secure would, something which  would be completely fine if the end user controls the key.  If the end user can choose his key,  there would be no problem.  Right, exactly.  The problem is a Microsoft key.  Because of the key modifications,  it could go in this direction.  Yeah.  And many of the people in here will be generating their own keys,  I'm sure, and getting around it that way.  You can generate your own key that overwrites the Microsoft  key.  But that doesn't solve the problem of incoming users.  And I didn't focus too much on those solutions,  because I want so badly for our energy  to go towards making a solution that will work for our moms  and dads and our kids and the people that we're always  doing tech support for.  But email me, please.  That is brilliant.  Doing it on that level could be a huge solution.  I've got to go back to this guy.  Go ahead.  Yeah, so just quickly, running out of time.  The right to freely choose and modify your kernel  is highly esoteric and technical.  It is the wellspring from which all other technological  freedoms arise.  I take that a step further, because the kernel isn't  the first thing that runs on the machine.  So we really need to take control over the firmware.  And I would like to, as I said, I've  been advocating Corbuth for a very long time.  And I find that I can make my point with many individuals  that I meet.  But please, please support Sir Reason, because.  Well, that's the problem, is that we're not  in a lot of countries yet.  So it's only North and South American, Australasia.  So if you can, then help Sir Reason start up  in more companies.  Sorry, in more countries.  This is the way to do it, I think.  Yeah.  We're trying to get set up in the UK.  But anyway, I'm going to let people go.  Thank you so much for coming.  And come and ask me questions if you want.  Thank you you.
UEFI_SecureBoot_NsoXFvGiAas_2_0_1523.png UEFI_SecureBoot_NsoXFvGiAas_2_1524_1871.png UEFI_SecureBoot_NsoXFvGiAas_2_1872_2879.png UEFI_SecureBoot_NsoXFvGiAas_2_2880_4883.png UEFI_SecureBoot_NsoXFvGiAas_2_4884_7271.png UEFI_SecureBoot_NsoXFvGiAas_2_7272_9407.png UEFI_SecureBoot_NsoXFvGiAas_2_9408_9971.png UEFI_SecureBoot_NsoXFvGiAas_2_9972_12647.png UEFI_SecureBoot_NsoXFvGiAas_2_12648_17099.png UEFI_SecureBoot_NsoXFvGiAas_2_17100_17327.png UEFI_SecureBoot_NsoXFvGiAas_2_17328_20339.png UEFI_SecureBoot_NsoXFvGiAas_2_20340_20951.png UEFI_SecureBoot_NsoXFvGiAas_2_20952_24227.png UEFI_SecureBoot_NsoXFvGiAas_2_24228_27155.png UEFI_SecureBoot_NsoXFvGiAas_2_27156_27527.png UEFI_SecureBoot_NsoXFvGiAas_2_27528_28511.png UEFI_SecureBoot_NsoXFvGiAas_2_28512_30215.png UEFI_SecureBoot_NsoXFvGiAas_2_30216_30707.png UEFI_SecureBoot_NsoXFvGiAas_2_30708_31295.png UEFI_SecureBoot_NsoXFvGiAas_2_31296_36971.png UEFI_SecureBoot_NsoXFvGiAas_2_36972_45287.png UEFI_SecureBoot_NsoXFvGiAas_2_45288_46235.png UEFI_SecureBoot_NsoXFvGiAas_2_46236_48431.png UEFI_SecureBoot_NsoXFvGiAas_2_48432_50735.png UEFI_SecureBoot_NsoXFvGiAas_2_50736_51971.png UEFI_SecureBoot_NsoXFvGiAas_2_51972_52955.png UEFI_SecureBoot_NsoXFvGiAas_2_52956_53735.png UEFI_SecureBoot_NsoXFvGiAas_2_53736_54731.png UEFI_SecureBoot_NsoXFvGiAas_2_54732_59891.png UEFI_SecureBoot_NsoXFvGiAas_2_59892_59975.png UEFI_SecureBoot_NsoXFvGiAas_2_59976_61691.png UEFI_SecureBoot_NsoXFvGiAas_2_61692_62015.png UEFI_SecureBoot_NsoXFvGiAas_2_62016_64655.png UEFI_SecureBoot_NsoXFvGiAas_2_64656_65699.png UEFI_SecureBoot_NsoXFvGiAas_2_65700_65747.png UEFI_SecureBoot_NsoXFvGiAas_2_65748_66383.png UEFI_SecureBoot_NsoXFvGiAas_2_66384_66467.png UEFI_SecureBoot_NsoXFvGiAas_2_66468_66515.png UEFI_SecureBoot_NsoXFvGiAas_2_66516_66743.png UEFI_SecureBoot_NsoXFvGiAas_2_66744_67247.png UEFI_SecureBoot_NsoXFvGiAas_2_67248_67367.png UEFI_SecureBoot_NsoXFvGiAas_2_67368_68435.png UEFI_SecureBoot_NsoXFvGiAas_2_68436_68531.png UEFI_SecureBoot_NsoXFvGiAas_2_68532_69071.png UEFI_SecureBoot_NsoXFvGiAas_2_69072_69503.png UEFI_SecureBoot_NsoXFvGiAas_2_69504_69587.png UEFI_SecureBoot_NsoXFvGiAas_2_69588_71183.png UEFI_SecureBoot_NsoXFvGiAas_2_71184_71483.png UEFI_SecureBoot_NsoXFvGiAas_2_71484_71531.png UEFI_SecureBoot_NsoXFvGiAas_2_71532_75323.png UEFI_SecureBoot_NsoXFvGiAas_2_75324_75395.png UEFI_SecureBoot_NsoXFvGiAas_2_75396_75467.png UEFI_SecureBoot_NsoXFvGiAas_2_75468_76091.png UEFI_SecureBoot_NsoXFvGiAas_2_76092_76139.png UEFI_SecureBoot_NsoXFvGiAas_2_76140_76360.png
They don't have to be. Any OEM who's doing hardware at the OEM level can control, can get control and maintain control. Also, you need to know what a shim is. It's the current solution to signing the bootloader's loader. Now Matthew Garrett's the one who's most prolifically talking about this. So read up on him if you are going to, if by the end of this talk you care about secure boot. Now where is it? It's actually hardwired into the motherboard in the e-prom chip. It's a little erasable programmable read-only memory. It's a little chip that you cannot remove unless you're at OEM level and you're telling the factories how to manufacture it, unfortunately. Why did we switch from the BIOS to UEFI? First of all, the BIOS was a poorly specified old pile of code, reason number one. It needed updates. It was giving everyone headaches, developers headaches, having to work with it. It was old. It was 20 to 30 years old. It was designed for computers that are funny and for some of us bring up sentimental, have sentimental value. It was designed for computers that are now in the Computer History Museum near Palo Alto, California. If you see the little TRS80 in the bottom and that brings back nostalgia, that's when the original BIOS was written. The number one reason everybody uses it was written because of security reasons. Security is an entirely different field now. It's far more sophisticated. And also, why? No further support. There's three main companies that have supported this little chip on our motherboard. There's Phoenix Technologies, which only did the old BIOS. There's American Megatrans, which did the old BIOS and is continuing with UEFI and Inside, which is the same. But we all know the main reason why we're switching is because none of us want to stick with the old hardware. We all want bigger, better, faster, stronger. And there's no going back. So why don't many of us fully understand what UEFI secure boot is doing and how to get a laptop free of signing off of the Microsoft key at the end? It's because secure boot relies on various systems in the system that usually developers are specifically interested in one segment of this. The only people who have to cross over all these different I'm not going to read this to you, but the only people who have to cross over into all of these different areas are people like us who build hardware, and generally, people who build hardware, they have to sell it. In order to sell it, you have to become a company. When you become a company, I'll get to that in a minute, your focus changes. So there really isn't anyone protecting free and open-source software on this level. OK, the simple explanation for secure boot is an encryption key that checks to see if drivers are certified with a matching key so that it only executes certified code. The general saying in the community is that the goal is admirable, but the implementation sucks. It leaves a lot to be desired. The not so simple solution is that you can use a tool to generate your own private key, and then you can sign an OS shim with your private key, and put the public key in the bios slash UEFI. People will continue referring to it as the bios, technically as UEFI. That is a very simple way of saying something that's actually very complicated, but only the most technical people who are in this room will be able to do. OK, the win of it. Historically, this started in 2000. Between 2000 and 2004, people started writing code to replace, not us, the companies inside American Megatrends, started writing code to replace the bios. Everyone knew that you can't have a 20 to 30-year-old piece of code survive into the future. It was not immortal. It needed to be replaced long time ago. So they started creating it. In 2005, the industry started transitioning to it. You started seeing UEFI. Ironically, the desktops were the first ones to adopt UEFI on their motherboards. We started seeing UEFI on some of the motherboards of the hardware we were building. And 2011 was mass industry adoption. It became a design requirement. To the point that in, this is the now of it, the state of the union for UEFI, and 2011, 2012 systems were shipping with UEFI, nobody really noticed. In August 2012 was kind of the, not really the deadline or the Windows 8 was launched, and the launch has been a lot softer than anybody thought it would be. And that's partly, it helps it go under the radar even more. But OEMs did start shipping with the secure boot enabled on all Windows 8 machines. So desktops and motherboards, most of them have UEFI, laptops, some of them do, many of them do. Servers the same, but they're already in the lockdown environment, so it doesn't really matter. Tablets have a different architecture, thankfully, and ARM doesn't have any of the same. So there's no UEFI for it. Although, let it be noted, the Microsoft tablet, you cannot boot Linux on a Windows 8 RT tablet. It's not possible. And I know there's some of you that are thinking, oh, let me try it anyway. But you'll break it. So phones use ARM, so thankfully we don't have to mention the Chromebook uses core boot, which might be a potential solution for the community. We're already running into trouble. I'm sure you all have probably everyone came across the article recently about Samsung. These are the models of the Samsung laptop that people have been trying to load Linux onto and lately it bricks it, which we'll see more of. Generally, I've found that a lot of people aren't actually aware that if they go to the store and try to buy a Windows 8 machine, they can no longer wipe it and load Linux like they used to. Here's the future. This is just a general prediction, not saying it's guaranteed, but this is the direction that we see it heading. The part I wanted to talk to you about is the last one. Now, one of the reasons I'm so passionate about the start key on the keyboard is because back in 98, I think it was, 98, 91, somewhere in the 90s, Microsoft did something brilliant. Their marketing people did something that from a marketing perspective is brilliant. I say that sarcastically within this audience. From a marketing perspective, they put their logo on the start key. You start with Windows. It's also called the home key. You go home to Windows. It was so effective that people referred to the PC, the computer, as a Windows machine. Now PC is indistinguishable from a Windows machine. Calling secure boot, secure, which it is about security, is the second time they're doing that. They are making their OS the secure OS. The irony of it blows your mind. But with the current trajectory, by 2012, Windows will be the secure OS unless we can make some changes. Now, this is my passion, is how computers are built at OEM level. I'm not going to go into huge detail because it's fascinating for me, but it's probably boring for you. So generally at OEM level, there are several ways you can do it. For desktops, there are very few hardware builders that build their own cases anymore. It's generally you get a case, you get the components, you make sure they all work with the distro you're working with, and you test it and test it and test it. And there you have a great desktop. With laptops, you can no longer go get a white box laptop and buy your own components. You might be able to in some parts of the world, but over the last five years that's been phased out. You used to be able to do that. You can't any longer. So what we do is that at the OEM level, we get them in large quantities so that we can have control over how it's built and what's put on it. OK, so another part of the how. That's how it's built. How to disable it. This is a really basic, may or may not be fully accurate, depending on your experience when you do it. If you want to disable secure boot on a computer when you get your next laptop in a couple years and you can no longer find an old laptop or a laptop without an OS on it. You go into the BIOS setup, or the UEFI setup. It's different for every system. Sometimes it's F10, Escape, or Delete. So you guys could have probably guessed all that. Now for right now, it's just that one key. Every computer will be different. Every model will be different. And the way that you get into the BIOS or UEFI is going to change. If you look at how corporations work, that will become, this is just the first step on making it for proprietary. Thank you. It will become a little more complicated. Frogs in a pot of boiling water, you've heard that analogy. It will become a little more complicated each year. Fragmenting the population so that we devote our mental energies to just treading water rather than fixing the problem. You find secure boot and disable it. You may break your machine. We don't know yet. If the system has fast boot enabled, it disables the keyboard. So for fast boots, this is by Matthew Garrett. He said that the way to do this is basically you start and restart. And I won't read that for you. There are ways around it for now. And we'll continue to find ways around it. One of the many solutions. OK, but to the next one. How would you enable it? Some people actually may want to enable it. There are, and you'll see reasons why. But just know that for now, if you turn secure boot on, in any way, it does break Hibernate. And Hibernate's been the Achilles heel of free and open source software for so long. So that's kind of sad. So doing this, what I would love to see are some better, stronger solutions to secure boot so that as a community and as a force for free and open source software, and I hate saying just free and open. Know that when I say that, I mean lib also. That I would love to see a more solid solution. And that's why I'm going to be asking you questions in the middle so that we're not wasting our energy on each different model of computer. One of my pet peeves is seeing, because we're puzzle fixers, because many of us like the puzzle of getting our favorite OS to run on whatever type of machine, and because you'll have a very high frustration tolerance level, we tend to spend a lot of our energy getting one OS working on one computer and then maybe one model and then maybe sharing that information and maybe so many other people will do that. But unfortunately, that has diluted our energy to the point where it's made us vulnerable to corporations, as you'll see in a moment. OK, so here's the who part. This is the biggest part of the talk. We're going to be talking about how the distros have reacted to secure boot, how the OEMs are handling it, the people who put the UEFI code out there, what they're doing, I'm going to talk about the hardware builders at all different levels and sizes. I'm going to talk about the leaders and you guys, developers and users. You and your friends, I'm going to start with the last one first, users, because as I said, as I quoted even in the beginning, our user base is crucial to our future. A while back, I wrote a blog post sort of tongue in cheek called Turnikit. And I wrote it right before, I think in July, right before August 2012, right when we were feeling the intensity of we'd seen secure boot coming. We knew it was coming. Windows 8 was launching in full force, all of their great advertising. And let's just say it was extremely depressing. So I wrote a blog post called Turnikit that got a pretty good response. I recommend that you read it and let me know what you think. Users, these are our future users. Now I mentioned how secure boot, how that's brilliantly named, how this little bit of proprietary code is being labeled. There are other ways to do security. You don't have to be proprietary about it. OK, this user probably will not disable secure boot. Because disabling security is bad, only bad people. And I have hacker sons. I love the hacker vibe. But in general, people have a desire for security. It's a primal need. It's a constant within human nature. Disabling security is bad. And that's a very generalized statement. But these people will probably not actively disable a secure feature. So our future users, the little six-year-old software guy who's trying to figure out what this kernel thing is, and who is the guy who started contributing to the video card to Lima when he was 10, and he's still contributing, these are the future people that we're all going to be working with, the five-year-old hardware chick who likes opening up her laptop. Things change. Perception changes when security becomes a feature instead of it just being some fun puzzle to solve. Those kids become the heavy hitters of tomorrow. They're the ones who are going to make decisions that will support or not support our distros. They're going to be sitting there saying, hey, wait a minute, do I really want to disable security? Disabling something that's secure makes you bad. Thieves disable security. Don't take me too seriously there. On a primal level, people crave security. This is a constant. And you've got to wonder, would these people have contributed if it was more than just a puzzle? Previously, pre-Windows 8, pre-August 2012, all the work that we've done has just been a puzzle. There have been legal issues, but nothing likes Secure Boot. OK, so a graphic picture is incoming. Brace yourselves. I'm going to just read a little quote from a tourniquet. When UEFI's Secure Boot is implemented at OEM level, all new PCs purchased with Windows 8. It was going to, the launch has been much softer than what we all thought it would be because they were getting bad publicity. With the intent of loading your favorite distro, we'll have Secure Boot. Since the beginning of Gino Linux in the 1980s, 1990s, up till now, we've all had the luxury of wiping and loading whatever distro we liked. This gave you the ability to flip the bird. I don't know how you say it in other languages. Does that translate universally? Flip the bird. Yes, thank you. That was the phrase I was looking for. Give them the finger to the proprietary corporations. This is what Secure Boot does as it is currently being implemented. I'm sorry, I love that picture. That's what it does. So the next part, that's our developer base. We're basically cutting ourselves off unless we find better solutions. Now, this is the most negative aspect of it. This is one way to see it. We are having our ability to wipe and load our favorite distro sliced. And that was, I don't know about all of you, I'm sure. Your laptops and your hardware are very personal. They are your laptop, if you're, I assume, is like your child. It's very personal to you. You've probably taken it apart. You've probably had fun with it in many different ways. Well, here's the upside. While it seems like this horrible thing has happened, while it seems like Secure Boot may have hurt us in the end, if we handle it right as a community and as many different nations at large, it could be what we've been needing all along. And I'm very curious about your opinions. Because it is the ultimate differentiating factor. It makes free, deep, open source software unique. And not just the thing that you put on a Windows machine. It gives it an edge that it never had before. OK, so who? Quick review of the different distros. Shuddleworth. Now, Ubuntu, why did they sign so quickly with Microsoft? Think about it. Shuddleworth. Now, I support these guys. I respect their decision. But think about it. Shuddleworth made his fortune on a key thought. It was the security code upon which all internet banking is based. He, that's his area of expertise. That's his comfort zone. So they signed. Fedora, I feel so my heart broke when I read about them making their decisions. They were stuck between a rock and a hard place. They had to decide whether to become, most distros have this decision. At their point, they were deciding whether to become obsolete and make it impossible for new, less geeky users to load their distro or sign with Microsoft. They took a path that hopefully will pan out all right. But now, I love OpenSusay's choice. Are there any OpenSusay guys here? OK, is mostly be. They're over at a different talk. I almost got them here. But they're over at the GNOME talk. Their answer to it is, and it is, because the Microsoft key that everybody's chaining back to is only part of the verification process. It's deeper than that. And they're creating a second. They have signed with Microsoft, but they're creating a second level of complexity that makes it more secure. Mint, from my point of view, actually gets it. They understand that hardware and software have to be married. They understand that the two have to go hand in hand to have stability and that freedom will reside in being able to protect it within your actual concrete hardware. So they launched their own box. CrunchBang, they're still working on how they're going to respond to it. But the people who are running it are brilliant. And I know they'll find a way. Debian. OK, does anybody know what Debian is doing? Please, right here. Can we do the mic real quick? I would love to hear your answers. Yeah, this guy right here in the red. Thank you. Debian will not provide a signed boot loader. You have to use anything else. You can get or you have to disable it. Otherwise, anything else will not go get consensus within the project. And we are not illegal entities, so we cannot obtain a signing key if we even wanted it. We had to do it through SPI. And I don't think SPI would go along with that. OK. Please, yes. Thank you. Yeah. OK. So that's the energy that's going to push forward towards more solutions that we're going to talk about in a few minutes. Thank you. OK, the next thing I want to ask you is, what do you know about the other distros? There are many more distros than what I listed. Does anybody have any other feedback on any of the other distros? To be honest, I'm busy building hardware. And we're set up in North America right now. And I just finished setting up in Australasia. We're trying to set up in the UK. Cory Doctro, you all know who he is. Cory Doctro essentially wrote a love letter about us on Boing Boing. And so while it was really sweet of him, we've been getting a lot of, why aren't you in the UK? Why aren't you in the EU? Which, we're working on it. We're going as fast as we can. So my job is working on that. So I haven't had a chance to follow what the different distros are doing as much as I would love to. Do any of you know what any of the other distros are doing? Puppy Linux, any of them? OK. Yeah, go ahead. So there was a discussion on Gen2Dev about this. I think the outcome was no real decision. So a bit of also wait and see. And that there will be, anyway, some solutions. And also the thought occurred that Gen2 users might be able to deal with the situation in a way. Since you have to start at source for Gen2 in the first place, they're going to be pushing forward. Yeah, exactly. So generally, this is kind of what I expected. I was hoping that there'd be like, oh, I know, I know, I know. But generally, do you get it? There's a general lack of, I have no clue how we're going to handle this. As of right now, as a builder, we're shipping with Secure Boot Disabled. And I'm going to talk about some solutions in a moment. If we don't talk about it. OK, so from the point of view of distros, everything when Secure Boot was implemented and when we started wrapping our minds around it, and over the next year, people will continue wrapping their minds around it. It feels a bit like what we've built has can, if you're not in control of the hardware, what you've built can fall apart. The hardware is the earth under your house. It can be taken away and Secure Boot is doing that. And the reason we're talking about it is to avoid that, regret, and frustration later. OK, so Stephen J. Von Nichols is the number one media guy who is wrapping his mind around UEFI Secure Boot. And I talked to him, and he said at the end of the day, UEFI Secure Boot is far more about locking users into windows than it is about security. It is the act of a desperate company knowing that it's losing its once iron grasp on the desktop, frantically trying to hold onto its once insurmountable lead, as tablets and smartphones and even PC sales have shown Microsoft's losing its grip. Excuse me. And one other opinion from our beloved CoriDocro. He, the way he talked about it, is that a new PC feature called UEFI is making it increasingly hard to install non-commercial OSes on your own computer. Free OSes like Fedora and Ubuntu, sorry guys, are having to pay blood money to Microsoft so their users can install and boot their OSes without having to lift the lid off their machines and change the inner workings. This is a trend that I see getting much worse before it gets better. Now pay attention to that, before it gets better. That's what we're going to be talking about in a minute. Although the right to freely choose and modify your kernel is highly esoteric and technical, that's why we love it. It is the wellspring from which all other technical freedoms arise. I'm sure you can all relate to that. So now the hardware builders. There are three different types. There are small shops that rebrand. If you go to a corner shop that builds, and you tell them to build your computer that runs whatever, they'll probably put together the components and test it and make sure it works for you. We're in the middle category. There's reasons in the middle category. The medium shops that do their own builds, they go to OEM level. They're still small. We're so really small. But they go to but actually do their own runs of hardware at OEM level who work with the manufacturers in China and elsewhere. And then there's the megacorporations like Dell and Google. I hate putting those two side by side, but those are the main two juxtaposed. All right, this is us. We're hardware builders in Berkeley, California. We're setting up little shops like this globally. Like I said, we did North America and South America. Those are some of our people. The reason why we're setting up the small shops rather than megacorporations. Now, none of you have probably ever had to call tech support. But think of the friends that you help out who do have to call tech support. You don't want to have to help them. You want them to be able to talk to this guy. You want them to be able to talk directly to the guy who built your machine or the guy who actually has an answer, who is actually very familiar with the machine. So what we're doing is we set up the company very differently with very low overhead to make sure that the person who bought it talks to the person who made it. It makes sense. So thank you. Talk to that guy. Oh, the guys are going to love that. Thank you. So hardware builders. Now, we're a corporation. So there is US corporations are evil. I'm sorry. There's no way around it. So if you hear conflict in my voice, that's why. It's very hard to be a good corporation in the US. That's why we're not building a base in the US. Technically, our base is in New Zealand. So it's governed by different laws. But having a separate, distinct base in each country allows each country to choose how those computers are governed within the country so that you actually have a voice because you're there and you help have a voice in the government. Anyway, that's the goal. So the hardware builders. You've seen the efforts towards making Free and Open. Google is, of course, making the biggest headway with its Chrome Book and Corbett, which is a potential new solution. Now, raise your hand if you have seen the corporation. Oh, come on. Come on, come on. Less than like 5% you guys. OK, I beg you. I beg you to go home and see the documentary called the Corporation. What they did. OK, so in the US, a corporation is treated as an individual. It's given the rights of a human being. So a corporation is a human being. If the company was right here, it would have the rights of an actual human. It pays taxes like a human does. It has all the rights. So what the movie makers did is they said, well, if it actually was a human being, and we sat it down in front of a psychotherapist, what would the psychotherapists say? Would they say it's a healthy human being? They say it's a kind person? They went through, it's called the DSM, it's the Diagnostic and Statistical Manual for Mental Disorders. Corporations are psychotic killers. I mean, literally, literally, because by law, they are killing their peers. Their goal is to dominate, compete. By law, the scariest part is that there is no limit to their earnings. They have to earn profit. If they do not, their shareholders can sue them. The structure, the laws that govern corporations are such that the corporations have to be evil. Now, I don't believe that everybody that works at Microsoft is bad. I'm sure there's still some good people who work there. When they first started out, they were really cool. Seriously, I grew up near Microsoft. When they first started out, they were hiring really cool programmers. They were people that we like to hang around with. And then they started hiring more lawyers than programmers, and we said, wow, we don't really like these people as much anymore. They're not that cool. So that was kind of our wake-up call, that something was awry. I beg you to watch the corporation, because it will give you some insight into how UEFI's secure boot is going to progress, and how your accessibility to free and open hardware is going to change. OK, so I'm going to make a quick analogy. Have any of you heard of Monsanto? Yes! OK, so this analogy will ring true. Thank you. There are two things that I care about, my electronics and my food. I care that they're both pure. OK, those buildings look relatively similar, huh? We got here, my husband and I got here a day early, and we drove up to the Netherlands. And lo and behold, I took a picture of that building. There's a Monsanto building just right near here. And that other building is in Redmond. Now here's the part that will also hopefully blow your mind. This is my second blow your mind point. Microsoft is a software company that controls the hardware industry. For one industry to control another but not even have a successful product in it is insane. It's a software company that has managed to position themselves in a way that it controls the hardware industry but has none of the risk. There is risk in hardware. You get bad, bad runs of things. You get bad, I don't know, memory sticks. You get bad, whatever. There is risk in supplying hardware. Monsanto did the same thing. They control the food chain, both with the herbicides or both of the pesticides and with the seeds. But they have none of the risk. If there's a drought, it's the farmers who are screwed. The parallel couldn't be better. So let's see how Monsanto is further progressed than Secure Boot is. So Monsanto provides the seeds. In many countries, I'm sure many of you have read about their sales pitch. They're pitched as magic beans. You're not allowed to. Anyway, you've heard about the suicides. You all have hopefully followed Monsanto from farmers who have unfortunately invested in these seeds and then had years of drought because they were the ones who took the risk. So I left this one. Genetically modified canola has spread into the wild. What will Monsanto do about it? Because the farmers are getting sued. And of course, Monsanto wants to sue nature. That's essentially what it is. If Monsanto, I don't know about here, but if Monsanto's seeds go into the farmland of a neighboring farmer, they can be shut down and sued. Ironically, they both start with an M. So the analogy, as far as I know, there aren't any countries yet that Monsanto has not dominated. I've set up a company in New Zealand thinking, oh, New Zealand's so pure. They don't use herbicides. They don't use pesticides. They don't use steroids for their beef. And it is very pure and very wonderful. But Monsanto is already in phase two there. So maybe some of the islands haven't been hit yet. I don't know. So the penetration of Monsanto into the market has twisted our mindset to the point where we no longer actually identify food as food. This is food. This actually isn't. It's genetically modified. If you read the list of chemicals, I'm allergic to wheat. And so a while ago, my husband wrote me a little phone app called Gluten Free Guide so that I don't get poisoned by the stuff, because it's in nearly every wheat in so many things. The list of chemicals and the amount of twisting you have to do to the original food source in order to get that is insane. I'm sure it tastes good. I wouldn't know. But it twists our perception. This is the TRS80. This is the pure computer that you can open up and you can mess with and you can have fun with. And that's where we're headed. Anyway. So another part of the Hoo chain. Now, I didn't flush this out entirely because I want more time at the end. But retailers are at the very end of this food chain. And they say generally that food is what it is. And the electronics are what they are because of what people request, because of what people ask for. But I don't know about you, but I would rather not trust the general public to keep my hardware free and open and my software free and open. That's just one part of it. I'm going to touch on another part of it. I'm going to touch on it. Since you probably haven't gone and had your own hardware built at a factory, I'll tell you firsthand that factories are beholden to no one. This is an email that we got from one of our factories. We were trying to get some hardware that we didn't. And this was in the early days. We were trying to get some hardware that we didn't have to. That didn't come with a Windows license. That we didn't have to wipe Windows off of. And this is what they told us. Don't worry about it. OK. They're beholden to no one. So if we can have, and I don't care if it's a reason or anybody else, if we can keep people who actually care about free and open source software on the front lines at the manufacturing level, then we can find ways around secure boot. Now this is my home. This is a picture of the very first Maker Faire. Have any of you been to O'Reilly's Maker Faire? Oh, yes. First year? Second year? Yes, second. OK. Third year Disney was there, and it wasn't as fun. But yeah, the first couple years were great. How many of you have ever built your own desktop? Please. Yes. OK. So you know what goes into it. Building your own desktop, you can still do. Building your own laptop? Not so much. Building your own tablet? Not really. OK, so you can do it. I mean Kickstarter, you could possibly have done something on Kickstarter. Kickstarter stopped doing runs of goods. And if you want to get a whole lot of friends who want to exact same specs you do, you could possibly get, I'm talking about solutions here, what you can do to work around secure boot. But the Maker field is too far away from where it needs to be to solve this OEM level problem. OK, news flash. Hardware and software need to unite. Floss can't ignore the problem anymore. Unfortunately, and educating the public is not the solution. If every single one of us here was able to cite off the top of our heads five ways to get around the UEFI secure boot problem on a computer that your, I don't know, your kid or your parents or something bought at Best Buy or whatever store next week, then I would say that possibly educating the public is a problem. But if as a community we're having a hard time wrapping our mind around it, that's not the way to go. OK, so summary. Quick, simple summary, UEFI is good. Secure boot is poorly implemented. It's complicated to the point of being dangerous. Some of the world's worst problems were born out of complex situations that were just a little too complex to communicate to the public. I taught French at my alma mater, and the dean of the French school said, for every grammar rule, you have to be able to explain it in one sentence with the most simple words. And if you can't, you don't understand it. The same rule applies. We have to be able to get to the point where we can understand that. If not, we have to use some crutches. We have to use some other solutions to get around this. It's doable if we cooperate. OK, so here's the part where I get to meow some of my solutions. OK, and then you get a turn. We can implement better. Now, all three of these started out with fairly poor initial implementation, and they smoothed out. That's just something we're used to. As initial bumps in the road, and then we get used to it, it goes all right. OK, so for core boot. Now, core boot was going to hopefully be the ultimate solution, and it still may be. Google is a large corporation, so we're not 100% sure about that. Pre-chrome book, we didn't have the support of hardware manufacturers. The guys who are working on core boot, the hardware manufacturers, talking with Intel and AMD and NVIDIA and all of those, is not something you can't get a direct answer to what you need unless you're a Google. Sorry. You can also do your own distro, is one of the potential solutions. Because sooner or later, there won't be any more Windows 7 pre-Windows 8 machines to buy. So sooner or later, we have to deal with this. And like you said about Gen2, they can be one of our leaders, since the users always start at the source anyway. And James Bottomley is an important one to follow also. One solution, we just thought of this on our way here, literally. I don't know why we didn't, we've been busy with other things. Distros can make their own keys. It's actually not that hard for a distro to make its own key. And the OEMs, such as us, can use that key. So if you know of any distros that want to get around it, let us know. We are a corporation, but we have no investors. We have no shareholders. We've tried to eliminate everything that makes all of the legal things that make a corporation evil. And the stuff we do every day, we don't deal with keys. We don't deal with all the proprietary stuff in the licenses and other things like that. So it makes life so much nicer. OK, so really quickly, do any of you have any other solutions? Gen2, yeah. OK, if even a third of the people in this room supported Corbuth, that would be more than sufficient as far as developer power. Go. Did you get stuck? Yeah, go ahead, please. Did you check your email the last two days? Did you check your email the last two days? That's a loaded question. It's just because I checked it doesn't mean I saw it. OK, yeah. So I sent you an email about Corbuth. Yes. OK, I'll search for it. You saw it? Kathy at Zerizim.com. It doesn't matter how you spell the Kathy, just Kathy at Zerizim.com. OK, thank you. So you didn't see it. Thank you. Thank you. Thank you. I would love to talk to you, maybe offline, maybe now, about Corbuth. I've been involved in the Corbuth project for something like 11 years. And I was at Freedom Heck in Taipei and talked to a bunch of ODMs about this. That was in 2008 or 2009, 2008. And at the moment, we didn't have, as you say, any support from hardware vendors as in AMD and Intel. We did have some support from VIA, but not enough. That has changed a bit. So AMD are very much supporting Corbuth. Good. Yes, very good. We have they have contributed a GISA code. I don't know if that means anything to you, but yeah. Their reference code that goes to the IBVs to Inside and Phoenix and AMI, the BIOS companies, to Corbuth under BSD and GPL, dual license. And they also promised to continue doing this for all Cummings chipsets as you use. They see that they have an advantage there. Doing that. So that's great. As you mentioned, Google, they have been great at contributing code for Intel. However, it's not complete. And this is true for both Intel and AMD, actually. We are now at a point where the hardware components themselves, not even the main board, but the hardware components, contain closed mini computers that need a firmware that no one has the source code for. It's similar to CPU microcode, but it's maybe even, it's taking it even one step further. And this code, not even Google had that code, even though they have the full documentation and so on. So yeah, difficult problem. You mentioned, yes, let's talk offline. I don't want to take too much time. I want to make two comments. One about Dell. I had the opportunity to talk to Shuttleworth about Corbuth some time ago, years ago. And I asked him, OK, how do you see the situation? And he said that he went to Dell and he asked them about getting Corbuth for fast boot time at the time that was his motivation. The answer he got back was that Dell is actually not a big enough customer at their ODM to get Corbuth on the reference designs that they package. Yes and no. Yeah? Yeah? Yeah, it depends on how your company is structured. And that's why I'm growing the reason as small companies. Because when a corporation like Dell, when they grow fat, when they grow large and have a large base, then their definition of large is completely different. But if you grow a company small and international, your definition of large is doable. Yes, yes, I agree. I think you're doing the right thing. That's just a different framework. Yeah, by the way, thank you so much for coming here and talking about this. This is hugely important. Thank you. Corey, could you please go back to the Corey Dr. Rose slide? Yeah, sure. Oh, crap. None of you saw that, did you? No. OK, good. That was the answer to the trivia question. Actually, could you do this while I do the trivia question? Get it going. That's fine. OK, got you. Oh, good. Thank you. OK, the trivia question, while I get there, I am going to pick the first person who I see who can raise their hand and tell me who one of the very first programmers is. And I'm talking to the ENIAC right here. No. Unfortunately, another one over here. No, unfortunately, no. I love this. This is so cool. Right here. Alan Turing. Just a second. Say it again. Alan Turing. Nope. I have my list of six here. Yes? No, no, no. You already guessed that. Nope. On the ENIAC, they had six women. And originally, they were called computers because they were women who computed. I don't know if I read. Was there a woman who made the code? I don't know. I don't know. She's not. No. Grace Hopper was not one of the first. She came a little bit later. Isn't this wild? Then we don't. Go ahead. Yes, yes. Did you look? Did you look it up? It's OK if you looked it up. It's OK. Woohoo! Can you hear this up there? So I love this. It is so funny. So there were these guy engineers with their cool glasses and their little pocket protectors. My dad was an engineer. So I totally get that. And they had the women plugging in the tubes and actually doing the computing. And they called them computers. And later, they changed the computer to be the actual hardware and the women to be the programmers. But it was just a bunch of women who are actually doing it. And they did pair programming. And I got to hear Jean Bartik, who is my favorite. I got to hear her speak at the Computer History Museum. And she's got a better memory than I am. She's 80-something and she's sparky. And originally, the reason why so few people know the original programmers is because in the article, they showed the women working on the computers. And they thought they were just models. So the first articles written about them completely ignored the fact that they were the ones actually doing the computing. And it wasn't until just, I don't know how many years ago, that a media person dug into it and said, well, actually, they're the ones actually doing this. Anyway, I just thought that's funny. So I like to do that one. OK, which quote? Corey Slye. I'm going to. Corey Slye, yes. Go ahead. Take this. It's going to take me a minute to get there. There are 50 slides here. Go ahead. Let's take this quote. Go ahead. There you go. Just really quick. Interject that. Basically, you said that the key would be in e-promchip. IE. But basically, e-promchips are the ones which are UV-erosable. So do you mean flash chip? Do you mean flash chip? I mean flash chip. Yeah, it's basically. Basically, one of the researches that I'm doing is basically modifying the stock firmware. Somehow, basically, one of the big problems in Coreboot is that the memory in it takes really a lot of effort to reverse engineer. I managed to abuse the original. What's your name? My name is Vladimir Serbinenko. I'm the underneath- I'm still not going to remember that. Of PHCoder. I'm graph maintainer. OK. Email me, please. No problem. Basically, I managed to basically put Coreboot by using some parts of original BIOS, which is interesting to have this direction could also bring, not the complete solution, but part of the answer. And it also could be a way to modify the keys on the computer to put your own key. Because from technical point of view, what the secure would, something which would be completely fine if the end user controls the key. If the end user can choose his key, there would be no problem. Right, exactly. The problem is a Microsoft key. Because of the key modifications, it could go in this direction. Yeah. And many of the people in here will be generating their own keys, I'm sure, and getting around it that way. You can generate your own key that overwrites the Microsoft key. But that doesn't solve the problem of incoming users. And I didn't focus too much on those solutions, because I want so badly for our energy to go towards making a solution that will work for our moms and dads and our kids and the people that we're always doing tech support for. But email me, please. That is brilliant. Doing it on that level could be a huge solution. I've got to go back to this guy. Go ahead. Yeah, so just quickly, running out of time. The right to freely choose and modify your kernel is highly esoteric and technical. It is the wellspring from which all other technological freedoms arise. I take that a step further, because the kernel isn't the first thing that runs on the machine. So we really need to take control over the firmware. And I would like to, as I said, I've been advocating Corbuth for a very long time. And I find that I can make my point with many individuals that I meet. But please, please support Sir Reason, because. Well, that's the problem, is that we're not in a lot of countries yet. So it's only North and South American, Australasia. So if you can, then help Sir Reason start up in more companies. Sorry, in more countries. This is the way to do it, I think. Yeah. We're trying to get set up in the UK. But anyway, I'm going to let people go. Thank you so much for coming. And come and ask me questions if you want. Thank you you.
cannot remove unless you're at OEM level and it, unfortunately. Why did we switch from the understand what UEFI secure boot is doing and how Perception changes when security becomes a OK, so from the point of view of distros, over the next year, people will continue wrapping And they say generally that food is what it is. that's not the way to go. OK, so summary. Quick, project for something like 11 years. And I was at time at the time that was his motivation. The company is structured. And that's why I'm growing