Re: [GIT PULL] Load keys from signed PE binaries

[Dave Airlie <airlied@gmail.com>]

>>
>> Right. We've failed at creating an alternative. That doesn't mean that
>> we get to skip the responsibilities associated with the choice we've
>> made.
>
> Wait, who is "we" here?  The community?  The community over-all didn't
> agree with anything with Microsoft, that is between the people getting a
> signed key and Microsoft.  Again, you are trying to push your (prior)
> company's agreement between them and Microsoft onto the community, and
> now the community is pushing back, is that a surprise?

Do you not work for the LF?, Matthew doesn't work for RH, so please
leave the petty my employer said this, and he's better than your
employer and try and stick to technical details.

Maybe the LF can do something useful and get MS to sign an agreement
saying we don't require any of this extra security stuff and that if
Linux is used to root Windows Secureboot platforms, they won't revoke
the key for our bootloaders. Until then you aren't providing anything
more technical than FUD.

Its a simple argument, MS can revoke our keys for whatever reason,
reducing the surface area of reasons for them to do so seems like a
good idea. Unless someone can read the mind of the MS guy that
arbitrarily decides this in 5 years time, or has some sort of signed
agreement, I tend towards protecting the users from having their Linux
not work anymore, because we were scared of a PE loader in the kernel.

Dave.