“Something has gone seriously wrong,” dual-boot systems warn after MS update

https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/

by WaitWaitWha • 2 years ago

78 70 2 years ago

arstechnica.com

oldpersonintx• 2 years ago

reinstall with only linux, problem solved

get rid of secure boot, more problems solved

if you run Windows in 2024 you deserve all the misery you get

Kokouane2• 2 years ago

This is great when you completely discount almost all gamers or people doing graphical work? Proton is only so good and many games are still completely broken.

GoofballJones2• 2 years ago

They'll always come back with "Just use GIMP. It's as powerful as Photoshop." Yeah, maybe Photoshop in 1999.

daft_pink5• 2 years ago

i’m just so over microsoft. mac is expensive, but otherwise great. nixos is awesome. have to use a windows vm for work, but thankfully IT deals with it. when microsoft launched wsl, I thought it would be amazing, but all their forced bing integration has driven me nuts and i’m out on them.

unshavedyak3• 2 years ago

I'm on nixos but honestly tempted to move to mac and nix. I love Nix as an idea and it's flawless for me most of the time, but that little friction i get trying something new is a bit of a pain.

daft_pink5• 2 years ago

Nix is so awesome. I use Claude ai refactor parts of my os into modules so I can just turn them on and off and it does an awesome job!

My concern with using Nix on Mac is that the uninstall is not as good so you can’t just comment out something and the Mac will just eliminate it from your system and it will be gone, but I’m considering switching to Nix darwin as well. Let me know how it goes for you!

GoofballJones2• 2 years ago

Every Mac I've used for the past 5 years haven't been expensive. I switched away from Windows 5 years ago, and not looking back. Heck, some of the video cards for Windows costs more than my entire system here.

daft_pink5• 2 years ago

If the base model will work for you, then it can be super cheap, but when you need upgrades, it gets expensive super fast.

I’m optimistic that the M4 chip based Macs will have better IO across the line and better RAM specs for AI, and overall not get us sucked into upgrades for no purpose. If you use multiple displays, you basically have to get pro or ultra chips, but rumor is M4 will offer way better options in this regard with more display engines and thunderbolt ports.

krackers• 2 years ago

Apple had an equally egregious bug a year back that soft-bricked anyone upgrading with promotion disabled

ocodo2• 2 years ago

mac is expensive, but otherwise great.

Someone who doesn't care that /usr/bin is on a READ ONLY partition... (and no you can't change it.)

tedajax• 2 years ago

One of the more satisfying things I do with new computers is disable secure boot.

JohnFen• 2 years ago

That's the first thing I do, too. Given my own security needs, secure boot brings much more pain than benefit to me.

pepa652• 2 years ago

Secure Boot can be leveraged to more securely boot anything you choose, but it does require some setup effort, so I get it if you choose to keep things simple (but less secure).

gpvos• 2 years ago

Why would anyone use GRUB to boot only Windows?

adrian_b• 2 years ago

In my opinion there is no reason for using GRUB for any purpose.

I have considered it obsolete and I have stopped using it more than a decade ago.

For the purpose of booting multiple operating systems on the same computer, including with multiple versions of the Linux kernel, I just keep a set of small USB memories, one for each operating system that I want to boot, which are formatted with FAT32 and which contain, in the case of Linux, the kernel, the initramfs file and syslinux to boot them.

This is much safer and much more foolproof than having a multiple boot configuration on the computer, which can be damaged by Windows at any time.

Even for people who do not want to boot from external memories, GRUB is not needed, because now multiple boot can be done from the UEFI menu, which can boot directly a Linux kernel without any extra boot manager.

asveikau• 2 years ago

Syslinux? Has that been ported to efi? I have one machine, maybe a year old, that won't boot legacy bios anymore. Edit: yes, apparently there is a kind of barebones UEFI port.

In that scenario syslinux is doing the work of grub. There is nothing about grub inherently saying you need to multiboot with it.

suby• 2 years ago

There is a limit to how much time I want to spend learning how to do things like that, and then configuring and dealing with a broken system when my exploration goes awry. It's a valid reason.

bubblesnort• 2 years ago

Because last time I installed MS-Windows 10 it had the most beautiful unlimited blinking cursor in the corner and nothing else. Until I installed GRUB from a GNU+Linux live CD whose root fs wasn't an actual device and that broke grub-probe. But fortunately grub-mkconfig is a shell script.

I don't know why it failed but it did and Grub saved the day.

jeroenhd• 2 years ago

but for unclear reasons, Microsoft patched it only last Tuesday

I think it's obvious why Microsoft has only recent patched the issue: because Linux distros really lag behind on se curie issues like these. Hence the warning some people receive: they're still using a vulnerable boot configuration that was fixed two years ago.

In a similar vein, Microsoft waited a year before automatically releasing a secure boot related patch that affected Windows, so system administrators wouldn't be blindsided: https://msrc.microsoft.com/blog/2023/05/guidance-related-to-...

The impact of these patches is minor for most consumer devices, but for corporate environments where IT may need to go around entering Bitlocker recovery keys in some edge cases (and where recovery media needs to be made using a recent ISO or it won't work), people need a reasonable time to prepare.

bediger4000• 2 years ago

As someone who remembers 1990-2000, I'm always amazed that these little bugs always seem to just randomly favor Microsoft. It's kind of miraculous, really. A Windows update roaches the Linux part of dual boot. How about that, nothing could be done.

nerdjon• 2 years ago

I am a bit curious how exactly Microsoft planned to identify that a machine was dual booting linux.

Looking for certain files on a random partition? A list of distros and versions? A partition type? Anything seems to be error prone and likely to miss something.

abhinavk• 2 years ago

Check the files in EFI partition.

https://en.wikipedia.org/wiki/EFI_system_partition

not_doctorq• 2 years ago

Based on the article, but I’m still not sure if this is the case, it seems like they checked for a specific shim(s), which would be on the EFI partition that everything shares.

diggan• 2 years ago

Maybe port `os-prober` to Windows? Has been a relatively stable solution for me for probably decades at this point, and hasn't missed anything yet, but maybe I'm not doing enough esoteric setups.

pepa652• 2 years ago

In an UEFI-centered world, you can just look where the bios would look.

mook• 2 years ago

I wonder if they were checking for extra entries in the Windows boot config database instead (i.e. Windows chain loading grub), but most people go the other way?

jansommer3• 2 years ago

Lots of hate on Microsoft for doing this, but SBAT was made exactly for this reason: To deny boot loaders with known vulnerabilities to boot an operating system that might not be the one you think.

Might as well disable secure boot if that's not a concern, or make sure the boot loader is up to date if dual booting Windows 11. I can't imagine new machines shipping without SB.

InDubioProRubio• 2 years ago

It all boils down to- is there someone, who is willing to put in the money to review available boot options, manually.. cause if that is not the case. Might aswell deactivate secure-boot.

jansommer3• 2 years ago

Wouldn't rely on SB 100% but I think Shim + UKI is Good Enough for most consumers...

practicemaths• 2 years ago

Genuine question. What's the practical difference between duel-booting and running Win-11 in VM?

I understand there's some performance differences, obviously. And VM requires perhaps a bit more setup and understanding.

However, is it reasonable to VM Win-11 to mediate SB concerns AND be able to have access to basic windows software and services since they're used a lot by industry and universities?

i.e. that is I just need access to Onedrive and MS office for the most part.

not_the_fda• 2 years ago

If its just basic apps, there is no reason to dual boot, a VM is less of a hassle.

If you want to run games, then dual-booting may be necessary if proton won’t work for the game you want to run in Linux.

jansommer3• 2 years ago

It would work great if NVIDIA, AMD and Intel made high end consumer GPU's that could be shared between host and guest. So far we can only share Intel iGPU's - at least on paper, because I haven't managed to make it work.

... Or hack NVIDIA gpu's and potentially brick your 2000$ card...

dwattttt• 2 years ago

It prevents Windows from running under it's own hypervisor, which it does to provide additional security (some configurations allow certain crypt operations to happen "outside" Windows).

tristor• 2 years ago

Saw a lot of people get nailed by this in the Framework community. On the flip-side, if you eschew Microsoft products completely, I've had a really good experience (for the most part) using Secure Boot with custom keys on Linux on my Framework 13 AMD laptop. I am using Arch, and have it setup to build UKIs that are signed automatically via a post-build hook using `sbctl` and EFI booting using systemd-boot. As much as I generally dislike SystemD, if you go all-in on it, it does work relatively well on modern hardware.

Shim is really only required on Linux when dual-booting, and really only because the entire Trusted Computing Platform architecture is not user-centric and is designed around the needs of Microsoft more than any other entity. But because they at least paid lip-service to users, you have the ability to just eliminate Microsoft keys entirely on your system and go all-in on custom Secure Boot w/ Linux. I am hard-pressed to find a reason for any moderately technical user to still be running Windows in 2024, as most important productivity tools are primarily or at least optionally web-based, and Linux is significantly better in every other capacity.

neilv2• 2 years ago

This is another reason not to do dual-boot, but to just use Linux.

Here's a good litmus test for a company we're considering joining: do at least their engineers (if not their PowerPoint+Excel biz people) use Linux for their laptops, not only for their servers? If they do use Linux, I'm just going to assert that they're likely more clueful than average.

Similar with startup hiring. Two options for this: (1) give a resume-screening boost to people who seem to have bought into Linux; or (2) announce in your job posts that the company pragmatically uses Linux for everything, to attract people who see that as clueful, and scare away a lot of others.

(Unfortunately, #2 also alienates some mostly-clueful people who really like Macs, and maybe even some clueful people who, through some cruel accident of history and gaming rigs, only know how to do Windows.)

(Actually, even more than Linux, I suspect that a startup using a BSD would probably be more technically clueful than the average Linux shop. Because some fringe tech seems to attracts the smartest and/or best-motivated techies disproportionately. But I'd say Linux is a sweeter spot overall for more startups.)

orev• 2 years ago

This is a terrible way to evaluate companies/people, and it comes off as a “Linux person” who refuses to understand why companies use Windows.

The fact is that Windows has leagues more control features (Group Policy, etc.) than Linux does, and those features are required for any kind of sane management of an IT landscape, and are also required in many industries for compliance reasons. And no, Ansible etc. is not the same thing.

The better way to evaluate is to discuss why they chose that tool for any particular job. Linux is often the right answer for servers, and Windows often the right answer for end user computers. But there may be cases where a specific case is better suited to a different tool.

neilv2• 2 years ago

and it comes off as a “Linux person” who refuses to understand why companies use Windows.

One comment in, and I think the litmus test is already working well.

OJFord• 2 years ago

GP said their engineers; I absolutely sympathise with not wanting to work somewhere with mandatory Windows, I might forget to ask, but I can't/am unwilling to work like that. MacOS I can get by with, but in web software engineering at least I would say Windows is unusual, and being someone who 'refuses to understand why' a company would force its engineers to use Windows is not going to be that restrictive for someone in that industry.

It's my primary tool really, and it affects all the others!

Der_Einzige• 2 years ago

I should do this with Amiga so I get actual software chads instead of r/unixporn arch Linux ricers.

kelnos• 2 years ago

I think that's a pretty weak heuristic, and you'd be venting yourself the chance to work at quite a few excellent places to work if you poo-pooed them because the developers don't all run Linux.

For me, though, if they won't let me run Linux, then I won't work for them.

pete762• 2 years ago

Your litmus test fails simply because John Carmack prefers Windows.

t0bia_s3• 2 years ago

You cannot switch to linux if your work is done in proprietary software, ie Adobe.

gradientsrneat• 2 years ago

Hanlon's razor comes to mind, but it seems like a huge oversight for Debian and Debian-based distros like Ubuntu and Mint to break. That's a large proportion of the Linux userbase. I wonder if this affects Debian more generally or does the installation method matter?

Fire-Dragon-DoL• 2 years ago

And I was definitely hit by this on Kubuntu LTS fully updated. I still keep Windows for gaming.

lousken• 2 years ago

hopefully everyone with dual boot asks themselves if they still need windows after doing this stuff

ocodo2• 2 years ago

Set a bios password so that Windows can't screw around with UEFI.

“Something has gone seriously wrong,” dual-boot systems warn after MS update

Related Stories