3 ms·
>Many vendors only have the MS CA implemented to check OS integrity Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that
by usr1106 5y ago
>Many vendors only have the MS CA implemented to check OS integrity
Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common.
As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.
- raxxorrax 5y agoWouldn't your own keys stop working with mechanism like remote attestation? From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan? Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time.... Where is the benefit for the user?
- usr1106 5y agoWho uses remote attestation for what purpose? I have never used it. Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.