3 ms·

According to https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Ena

by mjpa86 4y ago

According to https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure... - it's a Microsoft requirement that it's disabled by default, so presumably Lenovo won't be the last to do this?

Avamander 4y ago
Wrong document. Secure Boot itself has nothing to do with it. This is a Secured Core / Device Guard requirement, different things and still optional.
- 2000UltraDeluxe 4y ago
  From the article: > Trying to boot Linux from a USB stick failed out of the box for no obvious reason, but after further examination the cause became clear - the firmware defaults to not trusting bootloaders or drivers signed with the Microsoft 3rd Party UEFI CA key. Isn't that precisely what the GP linked to? If it's just a matter of changing a BIOS switch then this is a non-issue imo.
  - Avamander 4y ago
    Well no, you can keep Secure Boot enabled (which you should) and disable SG/DG and be able to boot or install Linux.
    - bilegeek 4y ago
      That's a relief. Without UEFI, the boot drive is limited to 2.2TB, hampering upgrades.
    - 2000UltraDeluxe 4y ago
      The PDF linked to further up this thread describes the process of trusting the 3rd party Microsoft CA that the original article mentions has been distrusted.
  - taneliv 4y ago
    It may be a non-issue for some developer folks out on here. However, navigating the scary BIOS menus, in a foreign language, with technical jargon even I can't always understand (and I do assemble my desktops from parts). Even keeping running Ubuntu (or Fedora or whatever) on a new laptop would probably not happen for many non-technical folks, if this sort of 1990s level dark arts boot time shenanigans were encountered. At least that's my experience with relatives and friends who need computers for non-technical work or entertainment. Not all, but most have found Linux overall nicer user experience than Windows, so this would be a net negative development. Defaults matter, so this is definitely an issue in my opinion!
deleted 4y ago
[deleted]

by mjpa86 4y ago

Avamander 4y ago

Wrong document. Secure Boot itself has nothing to do with it. This is a Secured Core / Device Guard requirement, different things and still optional.

2000UltraDeluxe 4y ago
From the article: > Trying to boot Linux from a USB stick failed out of the box for no obvious reason, but after further examination the cause became clear - the firmware defaults to not trusting bootloaders or drivers signed with the Microsoft 3rd Party UEFI CA key. Isn't that precisely what the GP linked to? If it's just a matter of changing a BIOS switch then this is a non-issue imo.
- Avamander 4y ago
  Well no, you can keep Secure Boot enabled (which you should) and disable SG/DG and be able to boot or install Linux.
  - bilegeek 4y ago
    That's a relief. Without UEFI, the boot drive is limited to 2.2TB, hampering upgrades.
  - 2000UltraDeluxe 4y ago
    The PDF linked to further up this thread describes the process of trusting the 3rd party Microsoft CA that the original article mentions has been distrusted.
- taneliv 4y ago
  It may be a non-issue for some developer folks out on here. However, navigating the scary BIOS menus, in a foreign language, with technical jargon even I can't always understand (and I do assemble my desktops from parts). Even keeping running Ubuntu (or Fedora or whatever) on a new laptop would probably not happen for many non-technical folks, if this sort of 1990s level dark arts boot time shenanigans were encountered. At least that's my experience with relatives and friends who need computers for non-technical work or entertainment. Not all, but most have found Linux overall nicer user experience than Windows, so this would be a net negative development. Defaults matter, so this is definitely an issue in my opinion!

deleted 4y ago

[deleted]