4 ms·
> So (ignoring whether these features are useful or good) in order to be able to run Linux on modern hardware these types of features are necessary. TBH, I fin
by AshamedCaptain 7y ago
> So (ignoring whether these features are useful or good) in order to be able to run Linux on modern hardware these types of features are necessary.
TBH, I find the argument "we are locking down your choice here because of Microsoft pressure" to be ridiculous at best.
The correct arguments should be more in line of "you can turn this off", but these arguments do not answer the very valid question of "what if it is my hardware vendor --like Google -- that is forcing me to turn this on?".
- mjg59 7y agoWhich Google devices force you to turn this on? (genuine question, I work at Google but not on any hardware product teams)
- AshamedCaptain 7y agoI don't know either, but they will use this sooner or later. And Google specifically: They are not the worst since they tend to address these questions; but they are not the best either since they tend to fall in the "my way or the highway" camp where you can "enable security and let Google control it" or "disable security", lacking the obvious middle option (e.g. the developer switch on chromebooks).
- mjg59 7y agoIf you remove the write-protection from the read-only flash on Chromebooks, you can replace the verification keys and re-enable security based on your own root of trust.
- AshamedCaptain 7y agoAnd then can you turn the write-protection back on with a physical switch?
- mjg59 7y agoOn modern systems the write-protection is gated via the security chip, which responds to various key combinations. My understanding is that it's possible to re-enable the write protection after flashing and the machine will behave identically (other than that updates from Google will fail to apply due to the system no longer considering Google a trusted authority)