4 ms·

Embrace, extend, extinguish

by twiclo 5y ago

dathinab 5y ago
> TPM 2.0, Secure Boot, and a camera/microphone. Non of this prevent you from e.g. running Linux, I have been running Linux with Secure Boot since 5+ years. The problem is: - not being able to select a alternate boot device (for install medium, diagnostics etc., even a major problem if you only run windows IMHO) - not being able to set a custom platform key - the EFI "missing" some "standard" keys especially if combined with the previous point Sure temporary disabling secure boot for making Linux installs easier is nice, but not required for functionality. Similar legacy boot mode can be nice, but I haven't used it in ~10 years or so. As a side note you can use TPM for some usages comparable to e.g. a Yubikey (with drawbacks). So having a TPM can be quite useful, even on Linux.
- bitwize 5y ago
  > Sure temporary disabling secure boot for making Linux installs easier is nice, but not required for functionality. For as long as Microsoft deigns to allow the signed shim to boot. Microsoft is the only key authority allowed by the main PC manufacturers. If you wish to become a key authority yourself, to allow your OS to boot on Secure Boot enabled devices without asking the end user to install additional keys (note: some devices may not allow this), then you must go to the OEMs individually and petition to be added to their key authority list. Prices from the OEMs that allow this are in the millions of dollars.
  - dathinab 5y ago
    > - not being able to set a custom platform key In which case this doesn't matter. (i.e. if you can set a custom platform key) Also Microsoft would not only need to stop signing shims but revoke all existing signatures.
    - blibble 5y ago
      it's very, very easy for them revoke the signatures (the "dbx" variable) if you run windows update it's happened dozens of times on your machine without you realising it for example: they blacklisted a load of linux bootloaders last year due to the boothole vunerability as a result: on a machine that's run windows update you now can't boot pre-2021 linux (both existing installs and installation media) they could be nefarious very easily if they wanted to: 1. refuse to sign new builds 2. wait for the inevitable exploits 3. block all bootloaders capable of booting Linux as a security measure
      - bitwize 5y ago
        The "Other OS" feature of your PC has been disabled because of security issues.
      - dathinab 5y ago
        Through in practice they can't really do so. Or they already would have done it years ago. What is holding them back is regulatory oversight, and the fear of it. So if they ever do so, it's not a fault of "secure boot" and similar, but 100% the fault of politicians seriously messing up their job. EDIT: You can also blame Apple, for constantly pushing in a direction where such regulatory oversight is removed. (END EDIT) IMHO Secure Boot and TPM are features I want in my system if properly implemented. A laptop not supporting some form of secure boot and TPM would be for me a reason for not buying it. (Through being able to use custom platform keys is also a must have for me.)
- alerighi 5y ago
  A lot of distributions doesn't support secure boot, or it's difficult to setup, look at the guide to setup secure boot on ArchLinux. A lot of distributions supports secure boot trough generating your CA, using it to sign the bootloader and the kernel and installing it in the UEFI, to do this you need to put the UEFI in "setup mode", that is a mode that permits the OS to add/remove keys, and then put it back in "user mode". Of course not being able to disable secure boot will not allow you to do so. As far as I know the only distributions that supports secure boot without the need to put the firmware in setup mode and install custom keys is Ubuntu, since they bought keys from Microsoft. But that is just as bad as running Windows... You can say, but I can simply turn off secure boot. If the firmware allows it, you can. The problem is if you have a dual boot with Windows: you would need to enable secure boot each time you want to boot into Windows and disable it to boot back into Linux. That is a complication that would make some potential new Linux users just stick with Windows (you have the WSL and you can run all the Linux programs into Windows, why would you need to install it really? That seems to me the policy of Microsoft).

Embrace, extend, extinguish

by twiclo 5y ago

Embrace, extend, extinguish

> TPM 2.0, Secure Boot, and a camera/microphone. Non of this prevent you from e.g. running Linux, I have been running Linux with Secure Boot since 5+ years. The problem is: - not being able to select a alternate boot device (for install medium, diagnostics etc., even a major problem if you only run windows IMHO) - not being able to set a custom platform key - the EFI "missing" some "standard" keys especially if combined with the previous point Sure temporary disabling secure boot for making Linux installs easier is nice, but not required for functionality. Similar legacy boot mode can be nice, but I haven't used it in ~10 years or so. As a side note you can use TPM for some usages comparable to e.g. a Yubikey (with drawbacks). So having a TPM can be quite useful, even on Linux.

bitwize 5y ago
> Sure temporary disabling secure boot for making Linux installs easier is nice, but not required for functionality. For as long as Microsoft deigns to allow the signed shim to boot. Microsoft is the only key authority allowed by the main PC manufacturers. If you wish to become a key authority yourself, to allow your OS to boot on Secure Boot enabled devices without asking the end user to install additional keys (note: some devices may not allow this), then you must go to the OEMs individually and petition to be added to their key authority list. Prices from the OEMs that allow this are in the millions of dollars.
- dathinab 5y ago
  > - not being able to set a custom platform key In which case this doesn't matter. (i.e. if you can set a custom platform key) Also Microsoft would not only need to stop signing shims but revoke all existing signatures.
  - blibble 5y ago
    it's very, very easy for them revoke the signatures (the "dbx" variable) if you run windows update it's happened dozens of times on your machine without you realising it for example: they blacklisted a load of linux bootloaders last year due to the boothole vunerability as a result: on a machine that's run windows update you now can't boot pre-2021 linux (both existing installs and installation media) they could be nefarious very easily if they wanted to: 1. refuse to sign new builds 2. wait for the inevitable exploits 3. block all bootloaders capable of booting Linux as a security measure
    - bitwize 5y ago
      The "Other OS" feature of your PC has been disabled because of security issues.
    - dathinab 5y ago
      Through in practice they can't really do so. Or they already would have done it years ago. What is holding them back is regulatory oversight, and the fear of it. So if they ever do so, it's not a fault of "secure boot" and similar, but 100% the fault of politicians seriously messing up their job. EDIT: You can also blame Apple, for constantly pushing in a direction where such regulatory oversight is removed. (END EDIT) IMHO Secure Boot and TPM are features I want in my system if properly implemented. A laptop not supporting some form of secure boot and TPM would be for me a reason for not buying it. (Through being able to use custom platform keys is also a must have for me.)
alerighi 5y ago
A lot of distributions doesn't support secure boot, or it's difficult to setup, look at the guide to setup secure boot on ArchLinux. A lot of distributions supports secure boot trough generating your CA, using it to sign the bootloader and the kernel and installing it in the UEFI, to do this you need to put the UEFI in "setup mode", that is a mode that permits the OS to add/remove keys, and then put it back in "user mode". Of course not being able to disable secure boot will not allow you to do so. As far as I know the only distributions that supports secure boot without the need to put the firmware in setup mode and install custom keys is Ubuntu, since they bought keys from Microsoft. But that is just as bad as running Windows... You can say, but I can simply turn off secure boot. If the firmware allows it, you can. The problem is if you have a dual boot with Windows: you would need to enable secure boot each time you want to boot into Windows and disable it to boot back into Linux. That is a complication that would make some potential new Linux users just stick with Windows (you have the WSL and you can run all the Linux programs into Windows, why would you need to install it really? That seems to me the policy of Microsoft).