3 ms·

He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux (unless you know exploits or you get the

He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux (unless you know exploits or you get the unlock code from the manufacturer). That said UEFI sucks and it inflicts unnecessary pain every time I setup a new computer.

spicybright 5y ago
Can you really not turn off UEFI in the BIOS settings? I don't think I've ever used a computer that didn't have an option to unlock it, as far as I know.
- rstat1 5y ago
  No you cannot "turn off UEFI". You can make your UEFI-enabled board boot in a BIOS compatibility mode for some things. But that isn't turning it off.
- akvadrako 5y ago
  Your terminology is really confused. UEFI is the firmware that boots the computer and is a replacement for a BIOS. There are no "BIOS settings" on modern computers.
jchw 5y ago
Windows specifications currently require that AMD64 computers have the ability to disable secure boot. Are there any counter examples?
zaltekk 5y ago
> which effectively prevents you from installing linux This was going to be the state when Microsoft first proposed secure boot. But the backlash lead to (1) being able to disable it and (2) being able to load customer keys. Are any motherboards actually locked down to where you can't install another OS? My older Gigabyte motherboard, my Thinkpad laptop, and my HP business line desktop all support both of these. UEFI was definitely a pain point for booting Linux when it was first available. The same Gigabyte motherboard mentioned ended up having it all turned off and just used legacy boot for years. But everything works great with UEFI USB boot installers and the OS. I'd recommend giving it a try again. I personally use secure boot for Linux through custom keys and a kernel install hook that resigns the EFI+kernel+initramfs+cmdline blob. It's quite nice in combination with LUKS unlocked by TPM2 (similar to Bitlocker). Secure boot actually lets you be more selective in which PCRs to verify for LUKS unlocking, meaning it's much less fragile during updates.
naoqj 5y ago
>He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux ??? Most distros have signed boot loaders and run fine with secure boot on.

spicybright 5y ago

Can you really not turn off UEFI in the BIOS settings? I don't think I've ever used a computer that didn't have an option to unlock it, as far as I know.

rstat1 5y ago
No you cannot "turn off UEFI". You can make your UEFI-enabled board boot in a BIOS compatibility mode for some things. But that isn't turning it off.
akvadrako 5y ago
Your terminology is really confused. UEFI is the firmware that boots the computer and is a replacement for a BIOS. There are no "BIOS settings" on modern computers.

jchw 5y ago

Windows specifications currently require that AMD64 computers have the ability to disable secure boot. Are there any counter examples?

zaltekk 5y ago

> which effectively prevents you from installing linux This was going to be the state when Microsoft first proposed secure boot. But the backlash lead to (1) being able to disable it and (2) being able to load customer keys. Are any motherboards actually locked down to where you can't install another OS? My older Gigabyte motherboard, my Thinkpad laptop, and my HP business line desktop all support both of these. UEFI was definitely a pain point for booting Linux when it was first available. The same Gigabyte motherboard mentioned ended up having it all turned off and just used legacy boot for years. But everything works great with UEFI USB boot installers and the OS. I'd recommend giving it a try again. I personally use secure boot for Linux through custom keys and a kernel install hook that resigns the EFI+kernel+initramfs+cmdline blob. It's quite nice in combination with LUKS unlocked by TPM2 (similar to Bitlocker). Secure boot actually lets you be more selective in which PCRs to verify for LUKS unlocking, meaning it's much less fragile during updates.

naoqj 5y ago

>He was probably referring to secure boot when talking about UEFI, which effectively prevents you from installing linux ??? Most distros have signed boot loaders and run fine with secure boot on.