4 ms·
1. Most users don't read warnings, most would go next no matter wat. They would see a timeout as extra annoying. Also this would mean malware would come up with
by keeperofdakeys 15y ago
1. Most users don't read warnings, most would go next no matter wat. They would see a timeout as extra annoying. Also this would mean malware would come up with the same certificate as custom linux, which isn't any more 'secure', so you may as well have it disabled.
2. Again, users will just go 'okay'. Here we don't really care about power users, they will probably not buy things with the bios option disabled, this is about general users who go 'let's try this linux thing'. In fact, those users might be ones to click cancel at the first sign of trouble.
3. This could be hard for non-power users, at least a bios option isn't as hard as generating a certificate, and signing something.
- nitrogen 15y agoI still think you're giving up too quickly. It doesn't so much matter if some users are deliberately careless enough to install boot loader malware by hand despite all the certificate signing steps and ugly warnings involved. It is also beneficial to protect a Linux system from the same kind of pre-boot malware. It seems as though you're saying since we can't get it 100% perfect, we shouldn't do it at all. I'm saying don't let perfect be the enemy of the good. If secure boot is going to exist at all, I think we'd be far better off if both Linux and Windows can take advantage of it, with control of the hardware in the hands of the users (or their IT department).