5 ms·

Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and

Okay so how is an 'average' computer user supposed to install a Linux OS that they want (or another OS) on their PC without reading up on MoK keys and UEFI and delving into the key management interface? Yes, you can install the few 'blessed' distros like Ubuntu, Fedora or OpenSuSE, but what about distro X? Thus far, an average user need only pop a CD to install Majaro or FreeBSD or FreeDOS. Now...? Install their own keys? Sign their kernels and modules? This reminds me of all the anti-piracy measures. Sure, you can theoretically circumvent all the DRM. But is it practical for 90% of users? No. Sure, DRM is theoretically perfectly fine, as is Secure Boot. As is even ME. The theory is always fine. How it turns out in practice, not so much. We should be asking ourselves if this marked disparity is really just inadvertent.

Rusky 9y ago
Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.
- digi_owl 9y ago
  The line between the two is thin and ill focused...
- betterunix2 9y ago
  Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
- Santosh83 9y ago
  Yup that was mainly my point. The UI for easily installing your own keys needs to be more accessible to the average user. Also we need a Let's Encrypt like non-profit, standardised signing body who can sign off all OSes including Microsoft's, and not let the latter get a choke-hold in this vital area. I have disagree with you. DRM and ME are both fine theoretically the way I see it. Of course that's my point. Only theoretically. The way they're used in reality is far from okay, but that's not the fault of the idea in and off itself. It's just that industries and other powerful interests have twisted it into being their tool, instead of serving the users and artists.
Avery3R 9y ago
Just like you had to go into the setting menu to enable booting by usb, you go into the settings menu to disable secure boot
- Santosh83 9y ago
  It strikes me that this option was intended as a compromise for a certain transition period after which it might be removed completely, at least on consumer boards. Besides the point is to be able to use Secure Boot without having to play by Microsoft's rules and restrictions. Why not have an equivalent of Let's Encrypt for secure boot, i.e., a non-profit foundation or a cooperative committee that distributes the master key and allows everyone (including MS) to get their kernels signed? That would be the best of both worlds. Instead we're moving farther away from it gradually.
- digi_owl 9y ago
  Found getting into the settings menu on UEFI was an adventure all its won. Nope, hitting a key during boot does not do it. You have to hold a key while hitting reboot in Windows to get a menu that can trigger the UEFI settings. More and more i feel we are going through a generational change in the PC business, and i do not like what i am seeing.
  - Avery3R 9y ago
    Hitting a key during boot works for me. Check your mobo's manual
    - digi_owl 9y ago
      I did, they mentioned a key, it didn't work.
  - janc_ 9y ago
    You can disable fast boot permanently (and something like it existed on some pre-UEFI BIOS firmwares too, so it's nothing new).
johncolanduoni 9y ago
That’s my whole point; what is the justification for thinking the “practice” for Secure Boot is going to be so dystopian? I’ve been hearing the same thing about TPMs for ten years, and that never materialized. Considering even the specifically DRM-oriented features like trusted path still aren’t being used often by software that uses DRM, I think it’s jumping at shadows to cast everything with secure in the name as a DRM solution waiting in the wings.

Rusky 9y ago

Woah, wait. DRM and the ME are not fine in theory. Secure boot is. If the practice of installing your own keys is too hard, that's something we can fix. We can't fix DRM or ME without just removing them.

digi_owl 9y ago
The line between the two is thin and ill focused...
betterunix2 9y ago
Secure Boot is part of an effort to harden DRM on PCs; this is something Microsoft and Intel have pushed for over a decade, especially now that they have seen how much money is being made on mobile devices (where DRM was baked in from the beginning). There is not much benefit to users, because bootloader malware was never a major threat and malware remains a constant threat for users despite years of Secure Boot deployment (just the other day my mother-in-law asked us to deal with a ransomware'd surface pro). The real point of Secure Boot is to create a system where users do not have the freedom to install arbitrary software i.e. where all software must be installed from an app store, where it can be vetted to ensure that it does not allow users to do things like breaking DRM systems or blocking ads.
Santosh83 9y ago
Yup that was mainly my point. The UI for easily installing your own keys needs to be more accessible to the average user. Also we need a Let's Encrypt like non-profit, standardised signing body who can sign off all OSes including Microsoft's, and not let the latter get a choke-hold in this vital area. I have disagree with you. DRM and ME are both fine theoretically the way I see it. Of course that's my point. Only theoretically. The way they're used in reality is far from okay, but that's not the fault of the idea in and off itself. It's just that industries and other powerful interests have twisted it into being their tool, instead of serving the users and artists.

Avery3R 9y ago

Just like you had to go into the setting menu to enable booting by usb, you go into the settings menu to disable secure boot

Santosh83 9y ago
It strikes me that this option was intended as a compromise for a certain transition period after which it might be removed completely, at least on consumer boards. Besides the point is to be able to use Secure Boot without having to play by Microsoft's rules and restrictions. Why not have an equivalent of Let's Encrypt for secure boot, i.e., a non-profit foundation or a cooperative committee that distributes the master key and allows everyone (including MS) to get their kernels signed? That would be the best of both worlds. Instead we're moving farther away from it gradually.
digi_owl 9y ago
Found getting into the settings menu on UEFI was an adventure all its won. Nope, hitting a key during boot does not do it. You have to hold a key while hitting reboot in Windows to get a menu that can trigger the UEFI settings. More and more i feel we are going through a generational change in the PC business, and i do not like what i am seeing.
- Avery3R 9y ago
  Hitting a key during boot works for me. Check your mobo's manual
  - digi_owl 9y ago
    I did, they mentioned a key, it didn't work.
- janc_ 9y ago
  You can disable fast boot permanently (and something like it existed on some pre-UEFI BIOS firmwares too, so it's nothing new).

johncolanduoni 9y ago

That’s my whole point; what is the justification for thinking the “practice” for Secure Boot is going to be so dystopian? I’ve been hearing the same thing about TPMs for ten years, and that never materialized. Considering even the specifically DRM-oriented features like trusted path still aren’t being used often by software that uses DRM, I think it’s jumping at shadows to cast everything with secure in the name as a DRM solution waiting in the wings.