5 ms·

I think this guy is pretty confused about UEFI, which is little more than a boot abstraction. It doesn't lock anyone out, although secure boot can be used to do

I think this guy is pretty confused about UEFI, which is little more than a boot abstraction. It doesn't lock anyone out, although secure boot can be used to do so, but so can any other firmware (phones anyone?). So at this point, the fact that UEFI secure boot standardizes how users can enroll their own keys/etc make it probably the _best_ of the current choices. The part he seems to be confused about are the PEP's required for modern standby, because instead of extending the UEFI/ACPI specification to cover those corner cases (or wedging them into the existing notification mechanisms) they allow platform providers to continue to create machine specific power management blobs that aren't portable between OS's. The older ACPI power methods, were of course opaque as well, but the API was standard enough that non Microsoft OS's weren't at a disadvantage. https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/platform-design-for-modern-standby https://docs.microsoft.com/en-us/windows-hardware/design/dev...

jokethrowaway 5y ago
He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux (unless you know exploits or you get the unlock code from the manufacturer). That said UEFI sucks and it inflicts unnecessary pain every time I setup a new computer.
- spicybright 5y ago
  Can you really not turn off UEFI in the BIOS settings? I don't think I've ever used a computer that didn't have an option to unlock it, as far as I know.
  - rstat1 5y ago
    No you cannot "turn off UEFI". You can make your UEFI-enabled board boot in a BIOS compatibility mode for some things. But that isn't turning it off.
  - akvadrako 5y ago
    Your terminology is really confused. UEFI is the firmware that boots the computer and is a replacement for a BIOS. There are no "BIOS settings" on modern computers.
- jchw 5y ago
  Windows specifications currently require that AMD64 computers have the ability to disable secure boot. Are there any counter examples?
- zaltekk 5y ago
  > which effectively prevents you from installing linux This was going to be the state when Microsoft first proposed secure boot. But the backlash lead to (1) being able to disable it and (2) being able to load customer keys. Are any motherboards actually locked down to where you can't install another OS? My older Gigabyte motherboard, my Thinkpad laptop, and my HP business line desktop all support both of these. UEFI was definitely a pain point for booting Linux when it was first available. The same Gigabyte motherboard mentioned ended up having it all turned off and just used legacy boot for years. But everything works great with UEFI USB boot installers and the OS. I'd recommend giving it a try again. I personally use secure boot for Linux through custom keys and a kernel install hook that resigns the EFI+kernel+initramfs+cmdline blob. It's quite nice in combination with LUKS unlocked by TPM2 (similar to Bitlocker). Secure boot actually lets you be more selective in which PCRs to verify for LUKS unlocking, meaning it's much less fragile during updates.
- naoqj 5y ago
  >He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux ??? Most distros have signed boot loaders and run fine with secure boot on.

jokethrowaway 5y ago

He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux (unless you know exploits or you get the unlock code from the manufacturer). That said UEFI sucks and it inflicts unnecessary pain every time I setup a new computer.

spicybright 5y ago
Can you really not turn off UEFI in the BIOS settings? I don't think I've ever used a computer that didn't have an option to unlock it, as far as I know.
- rstat1 5y ago
  No you cannot "turn off UEFI". You can make your UEFI-enabled board boot in a BIOS compatibility mode for some things. But that isn't turning it off.
- akvadrako 5y ago
  Your terminology is really confused. UEFI is the firmware that boots the computer and is a replacement for a BIOS. There are no "BIOS settings" on modern computers.
jchw 5y ago
Windows specifications currently require that AMD64 computers have the ability to disable secure boot. Are there any counter examples?
zaltekk 5y ago
> which effectively prevents you from installing linux This was going to be the state when Microsoft first proposed secure boot. But the backlash lead to (1) being able to disable it and (2) being able to load customer keys. Are any motherboards actually locked down to where you can't install another OS? My older Gigabyte motherboard, my Thinkpad laptop, and my HP business line desktop all support both of these. UEFI was definitely a pain point for booting Linux when it was first available. The same Gigabyte motherboard mentioned ended up having it all turned off and just used legacy boot for years. But everything works great with UEFI USB boot installers and the OS. I'd recommend giving it a try again. I personally use secure boot for Linux through custom keys and a kernel install hook that resigns the EFI+kernel+initramfs+cmdline blob. It's quite nice in combination with LUKS unlocked by TPM2 (similar to Bitlocker). Secure boot actually lets you be more selective in which PCRs to verify for LUKS unlocking, meaning it's much less fragile during updates.
naoqj 5y ago
>He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux ??? Most distros have signed boot loaders and run fine with secure boot on.