debutants LINUX , evitez PC avec SECURE BOOT, car aucun OS linux ne pourra booter

Secure Boot ruins any attempt to install your OS LINUX, why, and how to get rid of it
<mêmes infos en Francais, ci dessous>

Source . http://distrowatch.com/weekly.php?issue=20121126#qa

A few weeks ago my desktop computer, called it quits and I decided to go out and get myself a new desktop computer. Nothing fancy, just a nice low-end box. I settled on HP's Pavilion P6-2310. The machine arrived and realized that in my haste to get it, I had forgotten one important detail: Secure Boot.

Secure Boot is a technology which is supposed to protect computer users from malware by insuring only trusted software can boot on the machine.

How this works is, essentially, the computer comes with a security key (or keys) and any operating system or boot loader which we want to run on the machine needs to have a corresponding key.

The idea is malware won't be able to sneak onto the computer and get loaded into memory before the operating system.

If thar is basicaly a good idea for protection, nevertheless A side effect, <which many do not believe to be a coincidence>, is that / operating systems <OS> other than Windows 8 are prevented from booting too.

For some reason these details had slipped my mind when I was shopping on-line. When I hooked up the new computer and booted for the first time I was suddenly reminded of that detail in an unpleasant way.

The first symptom was that I could not boot from any device except the hard disk. I was thrown into the Windows 8 set up process. The manuals which came with the computer do not mention, in any fashion, accessing the BIOS/UEFI, changing boot order or disabling Secure Boot.

Typically in the past computers have displayed hints, such as "Press F1 to edit settings" or "Press F9 to change boot device" when they power up.....but not in this case, no hints are given and we're left to trial and error.

F10, I found, would grant me access to the machine's start-up configuration, but getting my thumb drive to boot took a few steps beyond that.

First I tried to simply change the boot order and was told this was not possible while Secure Boot was enabled. Hunting through the menus I finally found the Secure Boot feature and, selecting it, I was informed (via a big, red warning box) that disabling Secure Boot was dangerous and not recommended. Then I had to disable Secure Boot and re-enabled "Legacy" boot options in the proper order and then, finally, I was able to enable specific devices from which I wanted to boot. After that I was able to boot from my thumb drive only if I knew to hold down F9 while the computer was starting up, we're not given that information.

In short, to get to the point where we can attempt to boot an alternative operating system we need to know our way through six steps:

1 Boot machine while pressing F10
2 Find Secure Boot in the menu tree, ignore warnings
3 Disable Secure Boot feature
4 Enable legacy boot options
5 Enable specific legacy devices, such as USB devices
6 Save and reboot while holding down F9

To the more technically minded, this might not seem so bad, but keep in mind these steps are performed without documentation, with no hints and with big warning pop-ups letting the user know what a bad idea disabling Secure Boot is. This is not something the average user is going to know how to do, nor will they likely want to follow through if they read the on-screen messages.

This is a problem as much of the growth in the Linux community over the past decade has come from the ease of installing mainstream distributions. Distributions like Fedora and Ubuntu have made setting up a fresh install as simple as "Insert CD -> Click Next -> Next -> Next -> Enter a username and password->Next". Computers with Secure Boot remove that ease of use factor by throwing up hidden options, scary warnings and multiple menu items which must be accessed in a specific order before the user can even get to the "Insert CD" part of the installation process.

Certainly, system administrators and more experienced users can work around these barriers, but there is a large portion of the public which is relatively inexperienced and willing to try Linux if it is easy to set up. Secure Boot means Linux is no longer simple to install, or even try, from detachable media.

Now, you might be thinking, as I was, that it was foolish of me to purchase a machine with Secure Boot in the first place. After all, I've been warning people about it for long enough I should have been more careful.

That was what was going through my mind as I went through the long process of getting my thumb drive to be recognized as a boot device. But then, the next day, I went back to the merchant's website and discovered something..... There is no mention of Secure Boot, UEFI or Windows 8 certification anywhere on the page.

How is a consumer to know, even if they are aware of the feature, whether a machine is locked down zith Secure Bootor not ?

Software freedom requires vigilance and I fear that is more true now than it was a some time ago. Be careful when shopping for new computers, it is easy to purchase more trouble than one bargained for.

Secure Boot RUINE toutes tentatives d'installer votre OS LINUX sur votre ORDINATEUR, pourquoi ?

(Ceci n'est pas une traduction du post anglais ci dessus, qui explique comment désactiver SECURE BOOT et retrouver son BIOS ancien, au dessus du nouveau BIOS MICROSOFT WINDOW 8 appellé : UEFI : Unified Extensible Firmware Interface )

Avec Windows 8, Microsoft a fait part de sa volonté d'implémenter la dernière version de l'UEFI (Unified Extensible Firmware Interface), le successeur du BIOS. L'éditeur entend ainsi imposer aux constructeurs la fonctionnalité Secure Boot....

Cette décision de Microsoft a pour l'heure surtout provoqué une polémique. Il lui est ainsi reproché de mettre en place des barrières à l'installation d'OS alternatifs comme Linux sur les PC certifiés Windows 8.

Comment fonctionne SECURE BOOT : L'ordinateur neuf est taggé en usine par un N° de code spécial, une clé cryptée qui est installé gravé au coeur du systeme de BOOT, ainsi tous les systèmes/logiciels, etc qui utilisent le BOOT pour s'installer, devront être compatibles avec cette CLE d'usine CRYPTEE MICROSOFT s'ils veulent pouvoir s'installer sur l'ordinateur host....sans cette COMPATIBILITE....aucune installations possibles en gros...

Pour afficher la mention « conçu pour Windows 8 », les ordinateurs intégrant le successeur du BIOS, à savoir UEFI, devront comporter la fonction Secure Boot activée. Problème, cela impose au démarrage des logiciels signés, un problème pour Linux selon un développeur de Red Hat.

Les OS Linux non signés, non compatibles avec UEFI MICROSOFT, seront donc bloqués au démarrage par SECURE BOOT....et le client qui aura acheté un de ces ordinateurs ainsi équipés d'usine, n'aura aucun moyens simples de modifier ce système pour retrouver son ancien BIOS...du moins pas les clients qui ne sont pas experts informatique, (car l'article ci dessus en anglais explique comment contourner ces nouveaux blocages Microsoft window qui veut garder son monopole)

C’est en tout cas l’analyse défendue sur son blog par Matthew Garrett, développeur chez Red Hat. Selon lui, si ce draft de l’UEFI était adopté en l’état, tout ordinateur intégrant une licence OEM de Windows 8 pourrait être incapable de lancer une copie générique de Linux. En clair, c’est le dual-boot et l'installation sur clé USB de Linux en live qui se trouveraient par là pénalisés.

Le principal problème qui fait parler de lui est le fait que l'UEFI peut demander une signature pour ne démarrer que les OS certifiés et que cette signature est délivrée par Microsoft. Dans la pratique cette fonction peut être désactivée dans le UEFI, et de toute manière Cannonical (OS ubuntu etc), a trouvé une solution pour avoir des signatures valides pour Ubuntu.

Toutefois, il se peut que des fabricants proposent une machine dont la vérification de signature ne puisse pas être désactivée....donc faudra bien faire attention à l'achat....Window 7 permet encore de modifier le BIOS....à l'ancienne....

Liens en FRANCAIS pour plus d'infos.....

http://chatinux.wordpress.com/2012/06/23/uefi-et-secure-boot-gardez-moi-de-mes-amis/

http://forum.ubuntu-fr.org/viewtopic.php?id=999121

http://philippe.scoffoni.net/windows-8-apres-les-ventes-lies-les-os-lies/



La parade de Linux au Secure Boot de Microsoft

http://www.presence-pc.com/actualite/Secure-Boot-pre-loader-UEFI-49049/

comment désactiver le "Secure Boot" ?

Traduire la partie ANGLAISE du poste ci dessus, qui explique comment le desactiver...et la diffuser partout....car ce possible n'est pas inscrit dans les manuels MICROSOFT.....