3 ms·

Isn't the Microsoft key the only mandatory key in UEFI Secure Boot? So I guess they are still the boss of the (non-Apple) modern x86 PC architecture.

• coldtea 10y ago
  So, add a distro's keys (to the firmware) or use a distro signed with the default (MS) key. Or get those Linux community to organize, and establish some body to create, and secure, keys for Linux that will be installed by default alongside MSs. As someone who suffered from at least a couple BIOS-based malware back on Windows PCs back in the day, I'm all for securing the bootloaders...
  • marcosdumay 10y ago
    Or get to learn something about key management. A centralized key is not secure. A secure key is not centralized. If you want any security, the computer owner must be the only person allowed to install keys on the boot sequence - what is the exact opposite of what MS mandates.
    • coldtea 10y ago
      >Or get to learn something about key management. A centralized key is not secure. A secure key is not centralized. A centralized key IS secure, just not AS secure as a not private key. (That's theoritically: in practice it can be even safer than a private key, because most end users are incompetent in managing their keys much more than the central entity would usually be). And it's wrong to think it as a key in the sense of a physical key. It actually used as a signature. You can't have "private signatures" because the very purpose of a signature is to verify that the thing it signs is signed by a specific (and in the case of operating systems, central: the vendor) entity. An OS the user signs itself is worthless, as the OS data he signed could have come from anywhere or tampered, etc, before the signing.
      • coldtea 10y ago
        Correction: "A centralized key IS secure, just not AS secure as a private key".