4 ms·

> They said it about UEFI - and yet I run Linux on UEFI systems all the time. Not just any UEFI, UEFI with SecureBoot enabled specifically. On SecureBoot-enabl

by hvdijk 5y ago

> They said it about UEFI - and yet I run Linux on UEFI systems all the time. Not just any UEFI, UEFI with SecureBoot enabled specifically. On SecureBoot-enabled systems, you're booting a Microsoft-signed executable that chainloads Grub, which then loads Linux. This has given Microsoft a power they should not have: the power to refuse to sign future versions of that first executable.

martinflack 5y ago
FWIW, you can setup your machine to boot using your keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/ https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/
eecc 5y ago
Uhm, but on my Thinkpad I have to add keys to load Linux in trusted mode (installer asks to choose a password to lock these keys in order to establish their legitimacy when rebooting.) Also Ventoy needs to install user-defined keys into UEFI to make it work with Secure Boot. So my assumption is that - at least on Thinkpads - you can add your own user-defined keys; the only Caudine Fork where a Microsoft blessed loader might be involved is the one used by the distro installer. Or am I missing something
- michaelmrose 5y ago
  When this was first discussed in the early 2000s the very legitimate worry was that it would be introduced as optional and gradually become mandatory terminating in machines where the user had as little control over the hardware/software as a game console. There is no reason to believe that this wasn't implemented thus far because of the high ethical standards Microsoft folks have historically adhered to and while we are to believe Microsoft has turned over a new leaf much of the current leadership was involved at the executive level in old bad Microsoft.
vladvasiliu 5y ago
As others have said, this is either FUD or limited to specific systems with broken UEFI implementations. I think the whole "MS-signed Grub" is a way by Ubuntu (and possibly others) to facilitate Linux installation by "non pros". And it's not that bad, I think. I, personally, use Arch Linux and the installer isn't signed with anything. They have a "do your own signing" policy. I had to disable SecureBoot to install it, because I couldn't be bothered to create a new ISO, but then I registered my own keys to the UEFI and boot directly my own signed kernel [0], without using GRUB at all. I did all this on multiple generation HP "enterprise" laptops and desktops and it worked without any issue. And those systems don't come with any sort of Linux support from HP. --- [0] For the curious, this is EFISTUB combined with sbsign, that bundles the kernel image, initrd and CPU microcode in a single EFI binary and signs it. This is then booted directly by the UEFI, and you can even register multiple binaries and have them show up in the UEFI boot selection menu.
- hvdijk 5y ago
  > As others have said, this is either FUD Pointing out the power that MS have is not FUD. If I suggested that there is a chance they would abuse it, that might be, but I didn't do that. > or limited to specific systems with broken UEFI implementations. A very quick Google search suggests there are quite a few of those, from mainstream vendors such as Dell and Lenovo. > I, personally, use Arch Linux and the installer isn't signed with anything. True, I oversimplified. The major distros use MS-signed shims, the rest mostly don't.

by hvdijk 5y ago

martinflack 5y ago

FWIW, you can setup your machine to boot using your keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/ https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/

eecc 5y ago

Uhm, but on my Thinkpad I have to add keys to load Linux in trusted mode (installer asks to choose a password to lock these keys in order to establish their legitimacy when rebooting.) Also Ventoy needs to install user-defined keys into UEFI to make it work with Secure Boot. So my assumption is that - at least on Thinkpads - you can add your own user-defined keys; the only Caudine Fork where a Microsoft blessed loader might be involved is the one used by the distro installer. Or am I missing something

michaelmrose 5y ago
When this was first discussed in the early 2000s the very legitimate worry was that it would be introduced as optional and gradually become mandatory terminating in machines where the user had as little control over the hardware/software as a game console. There is no reason to believe that this wasn't implemented thus far because of the high ethical standards Microsoft folks have historically adhered to and while we are to believe Microsoft has turned over a new leaf much of the current leadership was involved at the executive level in old bad Microsoft.

vladvasiliu 5y ago

As others have said, this is either FUD or limited to specific systems with broken UEFI implementations. I think the whole "MS-signed Grub" is a way by Ubuntu (and possibly others) to facilitate Linux installation by "non pros". And it's not that bad, I think. I, personally, use Arch Linux and the installer isn't signed with anything. They have a "do your own signing" policy. I had to disable SecureBoot to install it, because I couldn't be bothered to create a new ISO, but then I registered my own keys to the UEFI and boot directly my own signed kernel [0], without using GRUB at all. I did all this on multiple generation HP "enterprise" laptops and desktops and it worked without any issue. And those systems don't come with any sort of Linux support from HP. --- [0] For the curious, this is EFISTUB combined with sbsign, that bundles the kernel image, initrd and CPU microcode in a single EFI binary and signs it. This is then booted directly by the UEFI, and you can even register multiple binaries and have them show up in the UEFI boot selection menu.

hvdijk 5y ago
> As others have said, this is either FUD Pointing out the power that MS have is not FUD. If I suggested that there is a chance they would abuse it, that might be, but I didn't do that. > or limited to specific systems with broken UEFI implementations. A very quick Google search suggests there are quite a few of those, from mainstream vendors such as Dell and Lenovo. > I, personally, use Arch Linux and the installer isn't signed with anything. True, I oversimplified. The major distros use MS-signed shims, the rest mostly don't.