11 ms·

> "by default" Hit Enter or F1 at the red Lenovo boot screen, go into the BIOS settings and find the setting and change it. Until someone confirms that there

> "by default" Hit Enter or F1 at the red Lenovo boot screen, go into the BIOS settings and find the setting and change it. Until someone confirms that there is no such BIOS setting, there is no story here.

bayindirh 4y ago
And invalidate everything in your security processor, which will possibly brick your windows installation and nuke your files if you had bitlocker keys inside that security processor. One weird trick to ruin your day, surely. Edit: Looks like Windows has changed since I left it, please disregard this comment, thank you. The comment is left intact for context correctness.
- danuker 4y ago
  Wow! So, no more dual-booting?
  - Avamander 4y ago
    Well, it depends on if your dual boot changes any of the measurements Bitlocker uses. You don't have to use TPM-backed BL if you don't want to.
- tinus_hn 4y ago
  You can’t be storing irreplaceable keys in the TPM chip, they fail all the time. Either you don’t really need the files on the disk or you need backup keys. And note, you can’t even turn on Bitlocker without being forced to save those backup keys.
  - bayindirh 4y ago
    Does bitlocker give a copy of your keys to you while encrypting your drive? Asking because I'm not a Windows user.
    - Avamander 4y ago
      In all practical meanings, yes.
      - bayindirh 4y ago
        Oh. That's good to know. Thanks.
    - tinus_hn 4y ago
      It does not allow you to turn on until you store the keys on an external disk or print them.
- LeoPanthera 4y ago
  I don't see any evidence for this claim. My ThinkPad came with Windows and I can turn "secure boot" and the TPM off and on at will. No problems.
  - bayindirh 4y ago
    From the blog: > If you want security here you're paying attention to the values measured into the TPM, and thanks to Microsoft's own specification for measurements made into PCR 7, switching from booting Windows to booting something signed with the 3rd party signing key will change the measurements and invalidate any sealed secrets. This is a new "feature" of Pluton Coprocessor.
    - LeoPanthera 4y ago
      But this has nothing to do with being able to boot Windows. The license key isn't in there. The TPM is used by apps to store secure data, which you wouldn't necessarily expect to even survive a reboot.
    - Avamander 4y ago
      It is not a new feature, has been done for at least a decade now. It's intentional however that tampering seals the keys permanently. At worst you'll have to enter a Bitlocker recovery key...
      - GekkePrutser 4y ago
        Yeah but this is pretty bad in itself (really long number) when you're traveling. And needing the recovery key so often will lead to people writing it down and keeping it with the laptop so they're not locked out next time. Which invalidates the whole point of FDE. The last time I had this the key didn't even work, my work rotates it regularly so something must have been out of sync.. Every Linux update seemed to break bitlocker this way so I stopped dualbooting.
        Avamander 4y ago
- Avamander 4y ago
  Yes, changing UEFI settings, especially security ones like disabling Device Guard, will change TPM measurements. You just have to enter your recovery key, that's it.
mjg59 4y ago
There is such a firmware setting, hence "by default". That doesn't make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don't compromise the security model.
- throw1230 4y ago
  I think it's perfectly acceptable that a device ships with a secure default as long as it lets you override it
  - mjg59 4y ago
    What's the difference in security here?
    - simiones 4y ago
      Secure Boot ensures that it's impossible to run a rootkit, even if the user accidentally installs one. Instead of booting into corrupted Windows, the system would fail to boot.
      - Avamander 4y ago
        This current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults. So the security benefit would be avoiding 3rd party and signed, but potentially vulnerable "bootloaders"
      - zinekeller 4y ago
        It's definitely harder, but not impossible. The Realtek signing driver was stolen multiple times already, and I personally know that certificate management practices (in Asia in general) is abysmal.
      - mjg59 4y ago
        The switch doesn't disable secure boot, it merely allows files signed using the Microsoft 3rd Party UEFI CA to boot. (Context: I wrote a significant portion of the infrastructure used to support Linux booting on systems with UEFI Secure Boot)
kitd 4y ago
Agreed, and it's far from being new too. My P15 came with this a few months ago. Just disable Secure Boot in BIOS.
- bilegeek 4y ago
  Though keep in mind that'll limit your boot drive to 2.2TB in size. Not too much of an issue now for most people, but something to keep in mind during upgrades.
  - IntelMiner 4y ago
    What? That sounds like forcing Legacy (BIOS) boot instead of EFI. Which shouldn't be possible on most machines in the last few years
- Avamander 4y ago
  You don't have to disable Secure Boot, just Device Guard / Secured Core.
- vetinari 4y ago
  But I want to use Secure Boot and TPM2 features. Just not with Windows.
fortran77 4y ago
Agreed. I’ve done this process and it didn’t even occur to me that this was done nefarious practice. It’s to prevent some typical user from getting his machine pwned. And this isn’t Evil Microsoft dictating what vendors can do. I can install Linux on my Surface device.
- ChuckNorris89 4y ago
  You're preaching to the choir. HN mob has its pitchforks sharpened and torches out for anything PC/Microsoft related, regardless of rime or reason. If the PC laptop would boot by default, off of any random USB plugged into the laptop, then HN mob would (rightfully) cry that this is a major PC security issues and that's how grandma could be pwned and get scammed, unlike a super-secure M1 MacBook which won't boot any other foreign OS by default without major hoop jumping. If the PC laptop doesn't boot by default off of any random USB drive (just like a Mac), requiring the user to go into the BIOS and change this setting first, then it must be malice from Microsoft and the PC OEMs to restrict user freedom and destroy Linux's 2,43% PC market share.
  - LightHugger 4y ago
    You're missing the key point which is that signing for other popular OS's exists and this solution simply ignores them. Not booting anything thats plugged in, sure. But this is not booting anything not windows.
  - AshamedCaptain 4y ago
    > then it must be malice from Microsoft and the PC OEMs to restrict user freedom and destroy Linux's 2,43% PC market share. It is ridiculous that people still downplaying Linux's PC market share when the latest version of Windows ships NOT ONE but TWO Linux emulators/virtualizers BOTH designed to allow you to run Linux binaries (desktop & Android) under Windows in the most user-friendly way possible. Obviously this is because no one Windows customer cares about Linux or Linux software. AT THE SAME TIME they take steps (and everyday larger steps) to prevent booting the same Linux on bare hardware, making their virtualization options more attractive for both the regular user and the advanced user. At this point we're way past the "assume incompetence" point.
tannhaeuser 4y ago
Nope. Hitting Enter or F1 brings you into Windows diagnostics rather than BIOS, at least on the Thinkpad X13 Gen 2 Ryzen Pro subnotebook w/ useless Windows installed a customer sent me for a project, and that is now contributing to a growing number of 3 bricked (brand-new!) latitude/precision and thinkpad notebook trash I'm accumulating at home. With the current state of non-existant quality in PC notebook hardware, I'm not going to buy anything except Apple hardware. Right now I'm back to using a 2016 XPS, with my 2019 Thinkpad collecting dust (and blocking its crap trackpad due to it); it's not that there are news regarding x64 performance since over ten years anyway.
- charles_kaw 4y ago
  Your X13 is not the same as a Z13.
- AnssiH 4y ago
  My X13 Gen 2 AMD goes to BIOS setup when hitting F1, just like other Thinkpads I've had.
maverick74 4y ago
The thing is just that most users don't have a clue about what bios is. They're just locking people and making it difficult for them to grow and explore other OS such as Linux. That's a bad attitude!
- chrisseaton 4y ago
  If you don’t know what a BIOS is how far are you going to get using Linux?
  - deleted 4y ago
    [deleted]
  - mjg59 4y ago
    Why should you care about your system firmware when you're running a modern Linux distro? I gave Ubuntu to people who had no idea what a BIOS was almost 18 years ago, and I promise things are better now.
  - flakeoil 4y ago
    If your can use Windows or Mac OS then you can use Linux. What does BIOS have to do with it? My non-technical wife has installed and is using Ubuntu. With this mentioned BIOS/UEFI block it would be much more tricky for her to get started. That's the issue here.
  - FeepingCreature 4y ago
    Plenty far.
- closeparen 4y ago
  If you want to explore Linux and don't know what BIOS is, it's probably better to be in a VM than trying to achieve dual-boot or totally wiping your Windows install.
nicce 4y ago
A bit off-topic, but Windows changes boot order for Windows first every time you boot for Windows. This is so annoying when you are regularly booting to different OS.
- grishka 4y ago
  Haven't been following PCs for a while, is this now something that an OS can do? I've always assumed that boot order is a BIOS setting that's only accessible from the BIOS setup text mode thing.
  - nicce 4y ago
    Windows modifies UEFI settings on runtime. There is an API for that. Even setting password for BIOS/UEFI won’t prevent that as machine has been booted already. For example : https://docs.microsoft.com/en-us/windows/win32/sysinfo/access-uefi-firmware-variables-from-a-universal-windows-app https://docs.microsoft.com/en-us/windows/win32/sysinfo/acces... https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface#UEFI_variables https://wiki.archlinux.org/title/Unified_Extensible_Firmware... There is also NtSetBootEntryOrder() in Windows ntddl
  - cesarb 4y ago
    Yes, under EFI the OS can set the boot order; you can do it yourself with the "efibootmgr" command on Linux. This is used for instance by fwupd to install firmware updates (it temporarily changes the boot order to boot into a firmware update loader).
- GekkePrutser 4y ago
  On the other hand, having dualboot with Linux on my ThinkPad T490s managed to break my bitlocker on the windows partition every time Linux updated. Not sure why, as I really needed Windows for work I had to revert and didn't have enough time to really investigate. Entering the recovery key is enough but the problem is my work uses software to rotate the recovery key and the last time the stored key didn't work. Probably it was just rotated but not updated in the system yet. So I had to restore fully and I removed Linux.
mike256 4y ago
For a non Windows Fanboy. No this is not acceptable and sure is a story!
- charcircuit 4y ago
  If people want a Windows only laptop then let them have it. Most people don't care about being able to boot alternate operating systems.
AshamedCaptain 4y ago
Right until the setting mysteriously disappears, or doesn't work. Not as rare as you may think: https://news.ycombinator.com/item?id=31823656 https://news.ycombinator.com/item?id=31823656 And even then if they have the option, the entire process is designed to make the user feel as uncomfortable as possible while doing it. Disabling perfectly unrelated features (e.g. fast boot), going through Scary Boot Prompts, etc. are NOT acceptable requirements for booting a non-MS OS. It's not the first time a vendor disables the MS UEFI CA signature by default (e.g. Microsoft itself has done it on ARM _and_ x86 Surfaces).
- oaiey 4y ago
  I think Linux Desktop has to go a long way before some BIOS settings become "scary".
  - AshamedCaptain 4y ago
    If you think so, it's been way too much since you used a Linux desktop.
    - kllrnohj 4y ago
      A regular Ubuntu update on my XPS 13, an officially supported combination, broke my wifi. Since then it has also somehow broke itself in some other fun way such that there are now package conflicts and it's unable to update itself anymore as a result. And that's ignoring all the general usability issues like the subpar battery life, the dreadfully terrible state of video playback, the touch screen constantly causing gnome to glitch internal state and get confused, etc... On my Debian desktop I had a webcam completely take out the USB stack. Like all ports just dead, had to yank the power to reboot. I also had a btrfs array just go read-only for seemingly no reason after restoring from standby, and it wouldn't tell me why. After a reboot all was suddenly fine. Also it took an awfully long time to get that machine working after having been powered off for 3 months. If you go too long without updating, it seems all the package migrations just bitrot and break. But yeah, year of Linux on the desktop. Any day now.
amelius 4y ago
Linux users are humans too. They typically don't like jumping through hoops.
albertopv 4y ago
This is another example of something that should be opt-in (ex business laptops), not opt-out.
megous 4y ago
It's the same company that prevents you from using whatever HDD you like or swapping out a wifi card in your laptop, a company with a constant itch to preinstall spyware/adware, etc. Limiting your choice in other ways is clearly not out of question.
- prmoustache 4y ago
  Is it? I replaced the nvme drive on my thinkpad with one from a different brand and it worked straight away. I tend to see them as the easiest path when looking for a good opensource OS compatibility as many Linux and BSD devs are using them.
  - megous 4y ago
    Yes, you can't even continue booting, unless you insert an approved WiFi card.
josephcsible 4y ago
It'd be one thing if it were a setting to disable some feature that Linux doesn't yet support. It's another that the setting is literally "refuse to boot anything not provably made by Microsoft".
anothernewdude 4y ago
I've dealt with many laptops and its not as easy as you make out. In particular I've had to open laptops to set jumpers so I'm allowed to even make changes to the boot settings.
l0b0 4y ago
Tell that to anyone who can barely get past the Ubuntu installer. Every step making installing alternative OSes harder is newsworthy, for the simple reason that every bit more difficult installation means literally fewer users capable of getting through it.
- ChildOfChaos 4y ago
  But is there any other OS for your average user? Linux is not an OS for the average user, it's for tech savvy geeks and an extremely small subset of those people too. Nothing wrong with what Lenovo is doing here, there just are no other OS in the market.
  - 13415 4y ago
    First of all, this is not true. Anybody can install a distro like Linux Mint or Ubuntu, it doesn't require any tech knowledge. Many Linux distros are perfectly fine for the average user. Second, requiring complicated BIOS changes constitutes an artificial hurdle for any Linux distro to be easily installed by an average user. So even if you were right, the measure would also ensure that future versions of Linux that are decidedly more beginner-friendly would be prevented from being installed, creating an artificial, anti-competitive barrier. In a nutshell, this is bad no matter how you look at it.
    - ShamelessC 4y ago
      I think you drastically over estimate the average user.
    - pas 4y ago
      > Anybody can install a distro like Linux Mint or Ubuntu, it doesn't require any tech knowledge. What you think as "not tech knowledge" is a serious skill that is severely lacking in billions of people. The user needs the install medium, they need to get it, download it, create it, get a USB or blank CD/DVD, etc. They need to either have the courage (or curiosity or aloofness or determination) to modify their computer on such a drastic level, they need to understand abstract concepts, follow a written manual that uses those concepts, they need to recognize those abstract concepts as they are implemented on the computer they are currently tinkering with, and so on, and so on. > In a nutshell, this is bad no matter how you look at it. True, but it's bad because the whole "personal computing" thing is bad. This detail is largely irrelevant.

bayindirh 4y ago

And invalidate everything in your security processor, which will possibly brick your windows installation and nuke your files if you had bitlocker keys inside that security processor. One weird trick to ruin your day, surely. Edit: Looks like Windows has changed since I left it, please disregard this comment, thank you. The comment is left intact for context correctness.

danuker 4y ago
Wow! So, no more dual-booting?
- Avamander 4y ago
  Well, it depends on if your dual boot changes any of the measurements Bitlocker uses. You don't have to use TPM-backed BL if you don't want to.
tinus_hn 4y ago
You can’t be storing irreplaceable keys in the TPM chip, they fail all the time. Either you don’t really need the files on the disk or you need backup keys. And note, you can’t even turn on Bitlocker without being forced to save those backup keys.
- bayindirh 4y ago
  Does bitlocker give a copy of your keys to you while encrypting your drive? Asking because I'm not a Windows user.
  - Avamander 4y ago
    In all practical meanings, yes.
    - bayindirh 4y ago
      Oh. That's good to know. Thanks.
  - tinus_hn 4y ago
    It does not allow you to turn on until you store the keys on an external disk or print them.
LeoPanthera 4y ago
I don't see any evidence for this claim. My ThinkPad came with Windows and I can turn "secure boot" and the TPM off and on at will. No problems.
- bayindirh 4y ago
  From the blog: > If you want security here you're paying attention to the values measured into the TPM, and thanks to Microsoft's own specification for measurements made into PCR 7, switching from booting Windows to booting something signed with the 3rd party signing key will change the measurements and invalidate any sealed secrets. This is a new "feature" of Pluton Coprocessor.
  - LeoPanthera 4y ago
    But this has nothing to do with being able to boot Windows. The license key isn't in there. The TPM is used by apps to store secure data, which you wouldn't necessarily expect to even survive a reboot.
  - Avamander 4y ago
    It is not a new feature, has been done for at least a decade now. It's intentional however that tampering seals the keys permanently. At worst you'll have to enter a Bitlocker recovery key...
    - GekkePrutser 4y ago
      Yeah but this is pretty bad in itself (really long number) when you're traveling. And needing the recovery key so often will lead to people writing it down and keeping it with the laptop so they're not locked out next time. Which invalidates the whole point of FDE. The last time I had this the key didn't even work, my work rotates it regularly so something must have been out of sync.. Every Linux update seemed to break bitlocker this way so I stopped dualbooting.
      - Avamander 4y ago
Avamander 4y ago
Yes, changing UEFI settings, especially security ones like disabling Device Guard, will change TPM measurements. You just have to enter your recovery key, that's it.

mjg59 4y ago

There is such a firmware setting, hence "by default". That doesn't make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don't compromise the security model.

throw1230 4y ago
I think it's perfectly acceptable that a device ships with a secure default as long as it lets you override it
- mjg59 4y ago
  What's the difference in security here?
  - simiones 4y ago
    Secure Boot ensures that it's impossible to run a rootkit, even if the user accidentally installs one. Instead of booting into corrupted Windows, the system would fail to boot.
    - Avamander 4y ago
      This current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults. So the security benefit would be avoiding 3rd party and signed, but potentially vulnerable "bootloaders"
    - zinekeller 4y ago
      It's definitely harder, but not impossible. The Realtek signing driver was stolen multiple times already, and I personally know that certificate management practices (in Asia in general) is abysmal.
    - mjg59 4y ago
      The switch doesn't disable secure boot, it merely allows files signed using the Microsoft 3rd Party UEFI CA to boot. (Context: I wrote a significant portion of the infrastructure used to support Linux booting on systems with UEFI Secure Boot)

kitd 4y ago

Agreed, and it's far from being new too. My P15 came with this a few months ago. Just disable Secure Boot in BIOS.

bilegeek 4y ago
Though keep in mind that'll limit your boot drive to 2.2TB in size. Not too much of an issue now for most people, but something to keep in mind during upgrades.
- IntelMiner 4y ago
  What? That sounds like forcing Legacy (BIOS) boot instead of EFI. Which shouldn't be possible on most machines in the last few years
Avamander 4y ago
You don't have to disable Secure Boot, just Device Guard / Secured Core.
vetinari 4y ago
But I want to use Secure Boot and TPM2 features. Just not with Windows.

fortran77 4y ago

Agreed. I’ve done this process and it didn’t even occur to me that this was done nefarious practice. It’s to prevent some typical user from getting his machine pwned. And this isn’t Evil Microsoft dictating what vendors can do. I can install Linux on my Surface device.

ChuckNorris89 4y ago
You're preaching to the choir. HN mob has its pitchforks sharpened and torches out for anything PC/Microsoft related, regardless of rime or reason. If the PC laptop would boot by default, off of any random USB plugged into the laptop, then HN mob would (rightfully) cry that this is a major PC security issues and that's how grandma could be pwned and get scammed, unlike a super-secure M1 MacBook which won't boot any other foreign OS by default without major hoop jumping. If the PC laptop doesn't boot by default off of any random USB drive (just like a Mac), requiring the user to go into the BIOS and change this setting first, then it must be malice from Microsoft and the PC OEMs to restrict user freedom and destroy Linux's 2,43% PC market share.
- LightHugger 4y ago
  You're missing the key point which is that signing for other popular OS's exists and this solution simply ignores them. Not booting anything thats plugged in, sure. But this is not booting anything not windows.
- AshamedCaptain 4y ago
  > then it must be malice from Microsoft and the PC OEMs to restrict user freedom and destroy Linux's 2,43% PC market share. It is ridiculous that people still downplaying Linux's PC market share when the latest version of Windows ships NOT ONE but TWO Linux emulators/virtualizers BOTH designed to allow you to run Linux binaries (desktop & Android) under Windows in the most user-friendly way possible. Obviously this is because no one Windows customer cares about Linux or Linux software. AT THE SAME TIME they take steps (and everyday larger steps) to prevent booting the same Linux on bare hardware, making their virtualization options more attractive for both the regular user and the advanced user. At this point we're way past the "assume incompetence" point.

tannhaeuser 4y ago

Nope. Hitting Enter or F1 brings you into Windows diagnostics rather than BIOS, at least on the Thinkpad X13 Gen 2 Ryzen Pro subnotebook w/ useless Windows installed a customer sent me for a project, and that is now contributing to a growing number of 3 bricked (brand-new!) latitude/precision and thinkpad notebook trash I'm accumulating at home. With the current state of non-existant quality in PC notebook hardware, I'm not going to buy anything except Apple hardware. Right now I'm back to using a 2016 XPS, with my 2019 Thinkpad collecting dust (and blocking its crap trackpad due to it); it's not that there are news regarding x64 performance since over ten years anyway.

charles_kaw 4y ago
Your X13 is not the same as a Z13.
AnssiH 4y ago
My X13 Gen 2 AMD goes to BIOS setup when hitting F1, just like other Thinkpads I've had.

maverick74 4y ago

The thing is just that most users don't have a clue about what bios is. They're just locking people and making it difficult for them to grow and explore other OS such as Linux. That's a bad attitude!

chrisseaton 4y ago
If you don’t know what a BIOS is how far are you going to get using Linux?
- deleted 4y ago
  [deleted]
- mjg59 4y ago
  Why should you care about your system firmware when you're running a modern Linux distro? I gave Ubuntu to people who had no idea what a BIOS was almost 18 years ago, and I promise things are better now.
- flakeoil 4y ago
  If your can use Windows or Mac OS then you can use Linux. What does BIOS have to do with it? My non-technical wife has installed and is using Ubuntu. With this mentioned BIOS/UEFI block it would be much more tricky for her to get started. That's the issue here.
- FeepingCreature 4y ago
  Plenty far.
closeparen 4y ago
If you want to explore Linux and don't know what BIOS is, it's probably better to be in a VM than trying to achieve dual-boot or totally wiping your Windows install.

nicce 4y ago

A bit off-topic, but Windows changes boot order for Windows first every time you boot for Windows. This is so annoying when you are regularly booting to different OS.

grishka 4y ago
Haven't been following PCs for a while, is this now something that an OS can do? I've always assumed that boot order is a BIOS setting that's only accessible from the BIOS setup text mode thing.
- nicce 4y ago
  Windows modifies UEFI settings on runtime. There is an API for that. Even setting password for BIOS/UEFI won’t prevent that as machine has been booted already. For example : https://docs.microsoft.com/en-us/windows/win32/sysinfo/access-uefi-firmware-variables-from-a-universal-windows-app https://docs.microsoft.com/en-us/windows/win32/sysinfo/acces... https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface#UEFI_variables https://wiki.archlinux.org/title/Unified_Extensible_Firmware... There is also NtSetBootEntryOrder() in Windows ntddl
- cesarb 4y ago
  Yes, under EFI the OS can set the boot order; you can do it yourself with the "efibootmgr" command on Linux. This is used for instance by fwupd to install firmware updates (it temporarily changes the boot order to boot into a firmware update loader).
GekkePrutser 4y ago
On the other hand, having dualboot with Linux on my ThinkPad T490s managed to break my bitlocker on the windows partition every time Linux updated. Not sure why, as I really needed Windows for work I had to revert and didn't have enough time to really investigate. Entering the recovery key is enough but the problem is my work uses software to rotate the recovery key and the last time the stored key didn't work. Probably it was just rotated but not updated in the system yet. So I had to restore fully and I removed Linux.

mike256 4y ago

For a non Windows Fanboy. No this is not acceptable and sure is a story!

charcircuit 4y ago
If people want a Windows only laptop then let them have it. Most people don't care about being able to boot alternate operating systems.

AshamedCaptain 4y ago

Right until the setting mysteriously disappears, or doesn't work. Not as rare as you may think: https://news.ycombinator.com/item?id=31823656 https://news.ycombinator.com/item?id=31823656 And even then if they have the option, the entire process is designed to make the user feel as uncomfortable as possible while doing it. Disabling perfectly unrelated features (e.g. fast boot), going through Scary Boot Prompts, etc. are NOT acceptable requirements for booting a non-MS OS. It's not the first time a vendor disables the MS UEFI CA signature by default (e.g. Microsoft itself has done it on ARM _and_ x86 Surfaces).

oaiey 4y ago
I think Linux Desktop has to go a long way before some BIOS settings become "scary".
- AshamedCaptain 4y ago
  If you think so, it's been way too much since you used a Linux desktop.
  - kllrnohj 4y ago
    A regular Ubuntu update on my XPS 13, an officially supported combination, broke my wifi. Since then it has also somehow broke itself in some other fun way such that there are now package conflicts and it's unable to update itself anymore as a result. And that's ignoring all the general usability issues like the subpar battery life, the dreadfully terrible state of video playback, the touch screen constantly causing gnome to glitch internal state and get confused, etc... On my Debian desktop I had a webcam completely take out the USB stack. Like all ports just dead, had to yank the power to reboot. I also had a btrfs array just go read-only for seemingly no reason after restoring from standby, and it wouldn't tell me why. After a reboot all was suddenly fine. Also it took an awfully long time to get that machine working after having been powered off for 3 months. If you go too long without updating, it seems all the package migrations just bitrot and break. But yeah, year of Linux on the desktop. Any day now.

amelius 4y ago

Linux users are humans too. They typically don't like jumping through hoops.

albertopv 4y ago

This is another example of something that should be opt-in (ex business laptops), not opt-out.

megous 4y ago

It's the same company that prevents you from using whatever HDD you like or swapping out a wifi card in your laptop, a company with a constant itch to preinstall spyware/adware, etc. Limiting your choice in other ways is clearly not out of question.

prmoustache 4y ago
Is it? I replaced the nvme drive on my thinkpad with one from a different brand and it worked straight away. I tend to see them as the easiest path when looking for a good opensource OS compatibility as many Linux and BSD devs are using them.
- megous 4y ago
  Yes, you can't even continue booting, unless you insert an approved WiFi card.

josephcsible 4y ago

It'd be one thing if it were a setting to disable some feature that Linux doesn't yet support. It's another that the setting is literally "refuse to boot anything not provably made by Microsoft".

anothernewdude 4y ago

I've dealt with many laptops and its not as easy as you make out. In particular I've had to open laptops to set jumpers so I'm allowed to even make changes to the boot settings.

l0b0 4y ago

Tell that to anyone who can barely get past the Ubuntu installer. Every step making installing alternative OSes harder is newsworthy, for the simple reason that every bit more difficult installation means literally fewer users capable of getting through it.

ChildOfChaos 4y ago
But is there any other OS for your average user? Linux is not an OS for the average user, it's for tech savvy geeks and an extremely small subset of those people too. Nothing wrong with what Lenovo is doing here, there just are no other OS in the market.
- 13415 4y ago
  First of all, this is not true. Anybody can install a distro like Linux Mint or Ubuntu, it doesn't require any tech knowledge. Many Linux distros are perfectly fine for the average user. Second, requiring complicated BIOS changes constitutes an artificial hurdle for any Linux distro to be easily installed by an average user. So even if you were right, the measure would also ensure that future versions of Linux that are decidedly more beginner-friendly would be prevented from being installed, creating an artificial, anti-competitive barrier. In a nutshell, this is bad no matter how you look at it.
  - ShamelessC 4y ago
    I think you drastically over estimate the average user.
  - pas 4y ago
    > Anybody can install a distro like Linux Mint or Ubuntu, it doesn't require any tech knowledge. What you think as "not tech knowledge" is a serious skill that is severely lacking in billions of people. The user needs the install medium, they need to get it, download it, create it, get a USB or blank CD/DVD, etc. They need to either have the courage (or curiosity or aloofness or determination) to modify their computer on such a drastic level, they need to understand abstract concepts, follow a written manual that uses those concepts, they need to recognize those abstract concepts as they are implemented on the computer they are currently tinkering with, and so on, and so on. > In a nutshell, this is bad no matter how you look at it. True, but it's bad because the whole "personal computing" thing is bad. This detail is largely irrelevant.