Linux developers working on Windows UEFI secure boot problem
Summary: With Windows 8 PCs with UEFI secure boot locked PCs on its way, Linux developers are working on addressing its problems. — Follow @sjvn — We all know that Windows 8 PCs will come locked up tight Microsoft's UEFI …
Context & Ripple Effects
The Secure Boot fight has been brewing since September 2011, when Microsoft cleared up Linux confusion over Windows 8's Secure Boot feature and insisted the firmware requirement would not lock out alternative operating systems. With Windows 8 machines now approaching release, that assurance is being put to the test: the Linux community is no longer debating whether Secure Boot ships, but engineering its way around it.
The stakes are concrete — every new Windows 8 PC will arrive with UEFI secure boot enabled by default, meaning unsigned bootloaders simply will not run unless developers find a signing path or a workaround before launch.
First-order effects
- Linux distribution makers must either obtain code-signing credentials for their bootloaders or ship installation instructions for disabling Secure Boot, or their media will fail to boot on default-configured Windows 8 hardware.
- PC buyers who want to dual-boot lose the out-of-the-box experience they had under BIOS-era firmware; installing Linux alongside Windows 8 becomes a deliberate configuration step rather than a default.
Second-order effects
- OEMs face a fork in their firmware menus: whether to expose a 'disable Secure Boot' option on consumer machines, a choice that determines how much of the Linux install base each vendor can retain.
- Signing authorities and bootloader projects become gatekeepers in the PC supply chain — whoever controls the keys controls which operating systems are legitimate on certified hardware.
Third-order effects
- If the pattern holds, x86 PCs converge toward the locked-firmware model long familiar from tablets and phones, with alternative-OS access negotiated through signing programs rather than guaranteed by an open boot path.
- A durable split emerges between 'Windows-certified' machines with enforced Secure Boot and enthusiast or server-class hardware where the lock can be turned off, fragmenting what was previously one uniform PC platform.
The trend: PC firmware is shifting from an open BIOS tradition to a signed, vendor-controlled boot chain, forcing alternative operating systems to earn legitimacy through key management instead of assuming it.