| According to the logic used by Shuttleworth and others, one malicious person
could force Debian to release all their private signing keys, which is
absurd.
The malicious person could use a non-GPL boot loader that uses secure
boot and boots into a locked-down version of Linux that only uses SecureApt to fetch and install
updates. This would put Debian in the same position Shuttleworth is trying to
avoid. The same logic Shuttleworth uses would say that this malicious person
could then force Debian to release their private signing keys.
If we
extend Shuttleworth's logic further, then one single, malicious individual could
prevent all distributors and creators of GPL-3 software from signing their code.
These absurdities all stem from imagining that people upstream can be held
liable for actions taken by other people downstream.
BTW: I don't
understand why warranties would be involved at all but in any case the simple,
easy, and obvious answer to all of these potential complaints is for the OEM to
update their BIOS so it allows the owner to use custom keys and/or allows the
owner to bypass Secure Boot entirely. Since the problem was entirely created by
the OEM, the OEM is responsible for fixing it.
---
Our job is to
remind ourselves that there are more contexts
than the one we’re in now — the one that we think is reality.
-- Alan Kay [ Reply to This | Parent | # ]
| 
