3 ms·

It shouldn't, as Microsoft made sure that the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key that is trusted by the ma

by easton 5y ago

It shouldn't, as Microsoft made sure that the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key that is trusted by the major OEMs. And you can trust your own keys, per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms#security-requirements https://docs.microsoft.com/en-us/windows-hardware/drivers/br...

dataflow 5y ago
> per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. Yeah but then you can't boot into Windows? Who is actually going to go into the firmware settings to switch settings on and off for every single boot to the other OS?
- blibble 5y ago
  you can boot debian/redhat/... out of the box without disabling it, as the shim used as part of the boot process has been signed by MS if you want to sign your own kernels: the shim will also let you do that relatively easily ("machine owner keys") if you want to own your entire boot process you can replace the platform key and sub-keys with your own, and then trust whoever you want (even adding MS' keys if you wish, so Windows can boot in secure mode)
  - kelnos 5y ago
    I'm pretty sure we don't want to be in a world where we can only use one of a few Microsoft-approved Linux distros without it being a pain the the ass to deal with.
    - blibble 5y ago
      we've been in that world for about 10 years now if you don't like it... turn off secure boot, or enroll your own keys (the mok approach takes about 30 seconds)
imglorp 5y ago
What if I'm not a major distro? Why should I have to go to some company to let me use my hardware they didn't even make? What happens if one day my distro starts to anger the gatekeeper, or worse, start to compete with them? This is all wrong. Stop supporting them.
dane-pgp 5y ago
> the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key Those distros also all use systemd. Do you think they'll sign an image that doesn't include it? We're heading down a path where developers need permission to innovate, and the switching cost of running something non-standard becomes too high for even the most technical users.
- IntelMiner 5y ago
  systemd has nothing to do with secure boot. Gentoo for instance supports it and offers, and maintains OpenRC https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst...
  - swiley 5y ago
    Note that you must add your own keypair for that, as Gentoo is a source based distribution so there isn't anything for Microsoft to sign.
selfhoster11 5y ago
You're thinking at the wrong level of abstraction. Sure, Microsoft is permitting it now, but what about later?

by easton 5y ago

dataflow 5y ago

> per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. Yeah but then you can't boot into Windows? Who is actually going to go into the firmware settings to switch settings on and off for every single boot to the other OS?

blibble 5y ago
you can boot debian/redhat/... out of the box without disabling it, as the shim used as part of the boot process has been signed by MS if you want to sign your own kernels: the shim will also let you do that relatively easily ("machine owner keys") if you want to own your entire boot process you can replace the platform key and sub-keys with your own, and then trust whoever you want (even adding MS' keys if you wish, so Windows can boot in secure mode)
- kelnos 5y ago
  I'm pretty sure we don't want to be in a world where we can only use one of a few Microsoft-approved Linux distros without it being a pain the the ass to deal with.
  - blibble 5y ago
    we've been in that world for about 10 years now if you don't like it... turn off secure boot, or enroll your own keys (the mok approach takes about 30 seconds)

imglorp 5y ago

What if I'm not a major distro? Why should I have to go to some company to let me use my hardware they didn't even make? What happens if one day my distro starts to anger the gatekeeper, or worse, start to compete with them? This is all wrong. Stop supporting them.

dane-pgp 5y ago

> the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key Those distros also all use systemd. Do you think they'll sign an image that doesn't include it? We're heading down a path where developers need permission to innovate, and the switching cost of running something non-standard becomes too high for even the most technical users.

IntelMiner 5y ago
systemd has nothing to do with secure boot. Gentoo for instance supports it and offers, and maintains OpenRC https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst...
- swiley 5y ago
  Note that you must add your own keypair for that, as Gentoo is a source based distribution so there isn't anything for Microsoft to sign.

selfhoster11 5y ago

You're thinking at the wrong level of abstraction. Sure, Microsoft is permitting it now, but what about later?