8 ms·

The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering. Back when all this Secure Boot

The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering. Back when all this Secure Boot was announced, we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated, rather than security enforcement. "But, you're scaremongering! See, I put this Debian USB pendrive and I can still boot it fine!" This was because Debian (and many other distros) went, at some point, through MS-enforced hoops in order to get their bootloader signed. Quite a perilous situation in which MS was this "steward" of the entire PC OS ecosystem; whether a Linux distribution booted or not on PCs was practically at the whim of MS. That was at least better than the alternative (no booting -- since MS got away with SecureBoot anyway) and we have to thank people like mjg59 for it. Now, your Debian pendrive will not boot on this Lenovo PC, even if MS-signed. "But, you're scaremongering! See, I put this Debian USB pendrive in, hit F1, hit cursor down three times, tab, down five times, space, F12, and I can still boot it fine!"

bejelentkezni 4y ago
Debian's images are not Secure Boot signed. You made that up.
- phkahler 4y ago
  I think they said the Debian boot loader was, not the whole OS image.
- mjg59 4y ago
  Debian has shipped with a signed bootloader since version 10, released over 3 years ago.
sgift 4y ago
My problem with the position of the "MS is bad" crowd here is that the security reasons are outright dismissed. It's even in the article: > The second is that this is predicated on the idea that removing the third-party bootloaders and drivers removes all the vulnerabilities. In fact, there's been rather a lot of vulnerabilities in the Windows bootloader. A broad enough vulnerability in the Windows bootloader is arguably a lot worse than a vulnerability in a third-party loader, since it won't change the PCR 7 measurements and the system will boot happily. Removing trust in the third-party CA does nothing to protect against this. Why is it 'all'? Why not 'some' vulnerabilities? Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. And then the whole point breaks down.
- AshamedCaptain 4y ago
  > Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Even if this was true, the fact that this defaults to having the MS signature enabled by default (and the other signatures have to enabled manually) should already make any security-oriented person shiver extensively, considering MS's vulnerability record. At least, it is clearly an (anti-)trust issue, which is already grounds to dismiss the entire idea. Second, the fact that it may reduce the attack surface by an infinitesimal amount, and not even in paper (since the attack surface is still theoretically the same), is really an argument for it? By the same logic, I can always argue for having 40+-character length passwords and other rather dubious practices, which by definition also improve security -- and these ones at least do so on paper. It's just that security people already know that this infinitesimal improvement just does not warrant the other can of worms that such an approach opens, i.e. it is not worth the trade-off. And third, there are better ways to reduce the attack surface to an even lower level; ways that do not put a single vendor in control of the security of the entire ecosystem. Claiming "this is one way, we should do it!" is textbook politician's fallacy. I will note that this crap hasn't worked for Apple when arguing why they should remain an steward of the entire Apple software ecosystem , and it shouldn't work for MS, either.
- ahartmetz 4y ago
  Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Why spend so much effort on such a relatively useless feature unless there is another reason for it?
  - Avamander 4y ago
    > Why spend so much effort on such a relatively useless feature unless there is another reason for it? Because it's not only Secure Boot really. It's just one part of a larger set of firmware hardening methods called Device Guard (since 2016), which is also a part of Secured Core. (which was mentioned in the article). > Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker".
Avamander 4y ago
> "But, you're scaremongering! See, I put this Debian USB pendrive in, hit F1, hit cursor down three times, tab, down five times, space, F12, and I can still boot it fine!" Because yes, one extra option in UEFI settings is the end of Linux on the Desktop. People definitely do not change anything else in UEFI settings ever as Linux users and it's significantly more complex than before. /s But that's not true, is it? Changing DG or SB toggle is no more difficult than setting the system's clock or boot order. These things are also described in the manual. People installing any OS fresh are likely to have the skillset necessary to do so. > Back when all this Secure Boot was announced, we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated, rather than security enforcement. This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve you should be able to see how it as a whole does provide noteworthy security improvements. > Now, your Debian pendrive will not boot on this Lenovo PC, even if MS-signed. *Please* do go on how you're not scaremongering here or in the previous thread. That sentence is literally false.
- AshamedCaptain 4y ago
  > This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve on Secured Core PC As clearly mentioned in the TFA, this is Secure Boot itself and has nothing to do with Device Guard.
  - Avamander 4y ago
    Yeah and it is incorrect. Disabling that CA is a part of Device Guard requirements since 2016. Obviously Secure Boot enforces its configuration, but it's specified and set as such due to Device Guard.
ziml77 4y ago
You still are scaremongering. Secured core is a class of device security specifically intended to be highly locked down. From https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure https://docs.microsoft.com/en-us/windows-hardware/design/dev...: > Secured-core PCs provide protections that are useful against sophisticated attacks and can provide increased assurance when handling mission-critical data in some of the most data-sensitive industries, such as healthcare workers that handle medical records and other personally identifiable information (PII), commercial roles that handle high business impact and highly sensitive data, such as a financial controller with earnings data. > For general purpose laptops, tablets, 2-in-1’s, mobile workstations, and desktops, Microsoft recommends using Security baselines for optimal configuration. For more info, see Windows security baselines.
- MereInterest 4y ago
  I don't see why Microsoft working to make an extremely locked-down class of devices should be taken as evidence that Microsoft isn't working to lock down devices, or that they wouldn't have an incentive to lock down devices.
  - Avamander 4y ago
    That's not what the person they replied to said though. Providing the means to harden a device do not mean you can't boot non-MS operating systems. It does show intent to harden devices yes, but not what was replied to.
    - AshamedCaptain 4y ago
      > we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated is literally on the first paragraph of my comment.
    - MereInterest 4y ago
      Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. By placing more and more restrictions on the default, each of which must be individually researched and disabled, fewer people are able to exercise their choice. There doesn't need to be a definitive deathblow if you can bleed away the opportunity to choose.
hollerith 4y ago
The OP is careful and measured. This comment is the opposite.
- AshamedCaptain 4y ago
  I actually paraphrased a lot of parts from the OP. I guess (guess because you don't mention the reasons why this is "not careful nor measured") you are one of these people who think that as long as there is some key combination that allows a Linux distribution to boot, there is no reason whatsoever to complain ? Well, sorry, but no. I will sound the alarm way before the only way to install Linux (or any other OS) is to disassemble the laptop and hit some physical switch that will cause a Scary Boot Prompt to be permanently shown on my device, reminding me that I'm booting an "unsupported OS" and that "someone could be doing this to steal my personal data", and requiring me to acknowledge it by waiting 30 seconds before it proceeds to boot my actual OS. Every Single Time I boot the device. I will complain loudly way before we reach that on PCs. Cause that's exactly what I had to do to run Linux on a Chromebook. And Google also seems to think that because they allow me to run some Linux distros under a heavily curtained container inside their OS, "all's good". Google does not get a free pass from me, why should MS?
  - wrycoder 4y ago
    And hardware will not allow that “unsupported” OS to access routable network.
    - trelane 4y ago
      Well, crud. With remote attestation, that could become a reality.
      - dane-pgp 4y ago
        First it will be required for playing online games[0], then governments will require ISPs to enforce it for anyone who goes online. Once people start side-loading to get around future bans on E2EE messaging apps, I expect governments will require OS vendors to implement blacklisting of such software even on desktops, using something like Apple's Gatekeeper service[1]. [0] https://www.pcgamesn.com/valorant/windows-11 https://www.pcgamesn.com/valorant/windows-11 [1] https://appleinsider.com/articles/20/11/15/big-sur-telling-apple-what-app-youve-opened-isnt-a-security-or-privacy-issue https://appleinsider.com/articles/20/11/15/big-sur-telling-a...
jeroenhd 4y ago
Allowing the Linux bootloader is a security risk for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them, so the excellent rootkit protection secure boot provides gets wiped out entirely the moment you grab a copy of grub with your own chain loader. This is possible because a vulnerable version of Grub got signed at some point that allows loading unsigned code. Secure boot should always be possible to turn off, and it should always be possible to load your own keys. I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot. It defeats the entire point of requiring higher-than-kernel level permissions to alter the boot sequence. Linux needs better secure boot key management features if it's serious about making secure boot work. Without it, just turn it off. It's a bit of a pain for new Linux users, but so is every other step of the way.
- AshamedCaptain 4y ago
  > for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them Actually, Microsoft enables Bitlocker on many if not most consumer devices. For example, I have not been able to find a laptop without Bitlocker enabled by default since the Windows 8.1 era. Even home editions of Windows enable bitlocker by default, even if they don't call it Bitlocker (they call it "Full device encryption" or the like). On desktops the situation is the opposite -- until recently, most desktops didn't even ship with a TPM at all. Nowadays TPMs are a requirement for Windows 11, so devices with Bitlocker disabled by default are going to be a minority. > I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot. That's not true -- if a distribution is shipping a signed bootloader binary, then there should be no way to use that distribution's bootloader to run an unsigned binary. In fact, it would be considered a security vulnerability and the corresponding bootloader binaries would be blacklisted by Microsoft. It has happened in the past: https://www.suse.com/support/kb/doc/?id=000019892 https://www.suse.com/support/kb/doc/?id=000019892 . The default behavior of most distribution's GRUB2 (and specially whenever it is pre-enrolled into a signed shim) is that when you boot under Secure Boot it will check the signature on any UEFI executable, GRUB module, or Linux kernel you try to boot, and refuse to boot if it is not in the (UEFI firmware/shim) whitelist. > Linux needs better secure boot key management features if it's serious about making secure boot work. Linux already has multiple secure boot key management facilities. And then there's shim. But in any case, the problem is that Microsoft itself should be required to face these problems; under no circumstance should it be that by default MS gets their signatures to work for free but everyone else needs to have extra UI to manage them.
pjmlp 4y ago
As someone that started with 8 and 16 bit computers, I am fine with single purpose computers. Instead of giving money to Microsoft or Apple, support OEMs producing hardware with Linux pre-installed like Tuxedo and System 76.
- chithanh 4y ago
  That is not the point. The point is by employing dark patterns, Microsoft makes it progressively more difficult for normal users to switch away from Microsoft. Want to switch default browser? Adding yet one more step to stop you. Want to boot other operating system? Now you have to go to UEFI setup and change boot settings. etc.
  - pjmlp 4y ago
    It is the point, it is like arguing to switch away from Spectrum, C64, Atari, Amiga, Acorn,.... back in the day. PC only got out of control, because Compaq was clever on their reverse engineering process, and IBM failed to uphold their ownership.
  - trelane 4y ago
    Want to run Linux? Why go through the hassle of some Linux OEM when you can just keep Windows and run WSL?
    - AshamedCaptain 4y ago
      This is exactly my problem with all of this. Microsoft makes a way to run Linux desktop programs on Windows, meaning that they DO care about the market share that _desktop_ Linux represents. At the same time, they make steps to make running actual desktop Linux OSes as inconvenient as possible, which incidentally makes WSL appear more and more convenient every time. At this point, the simplest explanation is malice.
      - pjmlp 4y ago
        What they care about is the market share of the developers that buy Apple devices to develop UNIX applications, and couldn't care less about Linux itself, and are now not happy with the direction macOS is going. WSL focus on Linux, because the Linux kernel ABI is the new POSIX.
userbinator 4y ago
The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering. Remember what some people on here (and elsewhere) work for. They either truly believe advancing the authoritarian corporatocracy is a good thing, have been brainwashed into doing so, or are just happy to have a job. These are the true enemies of your freedom. Some of us saw this coming endgame ever since the "Trusted Computing" movement started, and how they slowly drowned out their opposition with propaganda. "Security" has become the go-to excuse for having their way with their power. The infamous Franklin quote has certainly taken on a new meaning.
- pydry 4y ago
  I dont think it's a concerted effort to support corportocracy think it's just the just world fallacy. It happens in all sorts of other domains too - the tendency to believe that things, by default, are the way they are for good and just reasons is strong in most people.
  - mmphosis 4y ago
    It happens in all sorts of other domains too - the tendency to believe that things, by default, are the way they are for good and just reasons is strong in most people. For example, that’s why there are still ashtrays in new airplanes by default.
- DoctorOetker 4y ago
  I need an explicit list of public keys corresponding to the hardware roots of trust. From the article and prior reading it seems to be the hardware vendor's. Or are these in turn signed by Intel, AMD, ARM, ...? i.e. which public key is actually burnt in the processor's eFuses? A cryptographic break can always happen, and in such a cryptographically apocalyptic event i'd prefer to be able to author, sign and boot a minimal bootloader myself. Have people ever gathered such listings? EDIT: a secondary reason for maintaining such lists: key compromise can always happen, knowing when you need to replace your processor / computer because of a fundamental compromise would be mandatory. Also when buying hardware being able to observe historically compromised keys by vendor could give an indication of their security discipline.
nimbius 4y ago
while i absolutely agree with this sentiment, i feel like "Microsoft" as a boogeyman has become far more toothless since secureboot first took flight in 2006. the same people who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses. in 2022 there isnt an single manufacturer that doesnt offer (albeit sometimes sporadically) a Linux laptop. system76 and others exist to deliver the linux laptop and desktop, and Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease. Battlestation vendors like Asus will likely seek the rubber stamp for their laptop products that ship with windows, but for liquid cooled battle station geeks the same motherboards will ship with open EFI to run whatever keys you want to, or dont.
- AshamedCaptain 4y ago
  > Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease. Google is in no way a model to follow. They actually make it more complicated to install _native_ Linux than x86 PC manufacturers, what with their "developer mode", often ridiculous, physical hardware manipulation requirements to enable it, and non-removable Scary Boot Prompts unless you completely overwrite the full system firmware. In other words: Google is actually worse right now than MS would be on x86 even if they MS extended this Secured Core crap to all other PC manufacturers. It doesn't matter much that they use open-source firmware if they lock it down worse than the rest. And "containerized Linux" like Crouton misses the point and anyway MS is doing it too! (so much for those who say MS does not care about the Linux desktop market share).
- trelane 4y ago
  > those who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses. I've never had to buy an OSX computer in order to install linux on top of it. The same cannot be said of Windows.
deleted 4y ago
[deleted]
cptskippy 4y ago
Does Google use Secure Boot on it's Chromebooks? Are you able to install whatever you want on them?
phendrenad2 4y ago
It's not even scaremongering at this point, it's just expired. Every 5 years or so something like this comes up, and it's used as another data point in the slippery slope that you all are so sure is happening. And yet, if I buy any random PC off the shelf in 2022, there's still a huge chance that it'll boot from a Linux ISO without having to jump through any hoops. I think what's happening is, at some point in the past someone decided that there was a conspiracy to lock out Linux, and while that future hasn't come to pass, the total number of Linux-compatible devices keeps expanding, and therefore we keep getting examples of vendors locking things down too hard. These appear to be examples of the trend, but they're an increasingly small percentage of the total pool of Linux-compatible devices. It's the same thing that happened with Android. You can still root most phones, despite some being locked down. Things have reached an equilibrium. As I said in another post "there are more forces than Microsoft at work here".

bejelentkezni 4y ago

Debian's images are not Secure Boot signed. You made that up.

phkahler 4y ago
I think they said the Debian boot loader was, not the whole OS image.
mjg59 4y ago
Debian has shipped with a signed bootloader since version 10, released over 3 years ago.

sgift 4y ago

My problem with the position of the "MS is bad" crowd here is that the security reasons are outright dismissed. It's even in the article: > The second is that this is predicated on the idea that removing the third-party bootloaders and drivers removes all the vulnerabilities. In fact, there's been rather a lot of vulnerabilities in the Windows bootloader. A broad enough vulnerability in the Windows bootloader is arguably a lot worse than a vulnerability in a third-party loader, since it won't change the PCR 7 measurements and the system will boot happily. Removing trust in the third-party CA does nothing to protect against this. Why is it 'all'? Why not 'some' vulnerabilities? Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. And then the whole point breaks down.

AshamedCaptain 4y ago
> Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Even if this was true, the fact that this defaults to having the MS signature enabled by default (and the other signatures have to enabled manually) should already make any security-oriented person shiver extensively, considering MS's vulnerability record. At least, it is clearly an (anti-)trust issue, which is already grounds to dismiss the entire idea. Second, the fact that it may reduce the attack surface by an infinitesimal amount, and not even in paper (since the attack surface is still theoretically the same), is really an argument for it? By the same logic, I can always argue for having 40+-character length passwords and other rather dubious practices, which by definition also improve security -- and these ones at least do so on paper. It's just that security people already know that this infinitesimal improvement just does not warrant the other can of worms that such an approach opens, i.e. it is not worth the trade-off. And third, there are better ways to reduce the attack surface to an even lower level; ways that do not put a single vendor in control of the security of the entire ecosystem. Claiming "this is one way, we should do it!" is textbook politician's fallacy. I will note that this crap hasn't worked for Apple when arguing why they should remain an steward of the entire Apple software ecosystem , and it shouldn't work for MS, either.
ahartmetz 4y ago
Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Why spend so much effort on such a relatively useless feature unless there is another reason for it?
- Avamander 4y ago
  > Why spend so much effort on such a relatively useless feature unless there is another reason for it? Because it's not only Secure Boot really. It's just one part of a larger set of firmware hardening methods called Device Guard (since 2016), which is also a part of Secured Core. (which was mentioned in the article). > Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker".

Avamander 4y ago

> "But, you're scaremongering! See, I put this Debian USB pendrive in, hit F1, hit cursor down three times, tab, down five times, space, F12, and I can still boot it fine!" Because yes, one extra option in UEFI settings is the end of Linux on the Desktop. People definitely do not change anything else in UEFI settings ever as Linux users and it's significantly more complex than before. /s But that's not true, is it? Changing DG or SB toggle is no more difficult than setting the system's clock or boot order. These things are also described in the manual. People installing any OS fresh are likely to have the skillset necessary to do so. > Back when all this Secure Boot was announced, we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated, rather than security enforcement. This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve you should be able to see how it as a whole does provide noteworthy security improvements. > Now, your Debian pendrive will not boot on this Lenovo PC, even if MS-signed. *Please* do go on how you're not scaremongering here or in the previous thread. That sentence is literally false.

AshamedCaptain 4y ago
> This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve on Secured Core PC As clearly mentioned in the TFA, this is Secure Boot itself and has nothing to do with Device Guard.
- Avamander 4y ago
  Yeah and it is incorrect. Disabling that CA is a part of Device Guard requirements since 2016. Obviously Secure Boot enforces its configuration, but it's specified and set as such due to Device Guard.

ziml77 4y ago

You still are scaremongering. Secured core is a class of device security specifically intended to be highly locked down. From https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure https://docs.microsoft.com/en-us/windows-hardware/design/dev...: > Secured-core PCs provide protections that are useful against sophisticated attacks and can provide increased assurance when handling mission-critical data in some of the most data-sensitive industries, such as healthcare workers that handle medical records and other personally identifiable information (PII), commercial roles that handle high business impact and highly sensitive data, such as a financial controller with earnings data. > For general purpose laptops, tablets, 2-in-1’s, mobile workstations, and desktops, Microsoft recommends using Security baselines for optimal configuration. For more info, see Windows security baselines.

MereInterest 4y ago
I don't see why Microsoft working to make an extremely locked-down class of devices should be taken as evidence that Microsoft isn't working to lock down devices, or that they wouldn't have an incentive to lock down devices.
- Avamander 4y ago
  That's not what the person they replied to said though. Providing the means to harden a device do not mean you can't boot non-MS operating systems. It does show intent to harden devices yes, but not what was replied to.
  - AshamedCaptain 4y ago
    > we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated is literally on the first paragraph of my comment.
  - MereInterest 4y ago
    Placing additional obstacles to installing your choice of OS, even if each one is individually justified, leads to an veritable steeplechase of obstacles in doing so. By placing more and more restrictions on the default, each of which must be individually researched and disabled, fewer people are able to exercise their choice. There doesn't need to be a definitive deathblow if you can bleed away the opportunity to choose.

hollerith 4y ago

The OP is careful and measured. This comment is the opposite.

AshamedCaptain 4y ago
I actually paraphrased a lot of parts from the OP. I guess (guess because you don't mention the reasons why this is "not careful nor measured") you are one of these people who think that as long as there is some key combination that allows a Linux distribution to boot, there is no reason whatsoever to complain ? Well, sorry, but no. I will sound the alarm way before the only way to install Linux (or any other OS) is to disassemble the laptop and hit some physical switch that will cause a Scary Boot Prompt to be permanently shown on my device, reminding me that I'm booting an "unsupported OS" and that "someone could be doing this to steal my personal data", and requiring me to acknowledge it by waiting 30 seconds before it proceeds to boot my actual OS. Every Single Time I boot the device. I will complain loudly way before we reach that on PCs. Cause that's exactly what I had to do to run Linux on a Chromebook. And Google also seems to think that because they allow me to run some Linux distros under a heavily curtained container inside their OS, "all's good". Google does not get a free pass from me, why should MS?
- wrycoder 4y ago
  And hardware will not allow that “unsupported” OS to access routable network.
  - trelane 4y ago
    Well, crud. With remote attestation, that could become a reality.
    - dane-pgp 4y ago
      First it will be required for playing online games[0], then governments will require ISPs to enforce it for anyone who goes online. Once people start side-loading to get around future bans on E2EE messaging apps, I expect governments will require OS vendors to implement blacklisting of such software even on desktops, using something like Apple's Gatekeeper service[1]. [0] https://www.pcgamesn.com/valorant/windows-11 https://www.pcgamesn.com/valorant/windows-11 [1] https://appleinsider.com/articles/20/11/15/big-sur-telling-apple-what-app-youve-opened-isnt-a-security-or-privacy-issue https://appleinsider.com/articles/20/11/15/big-sur-telling-a...

jeroenhd 4y ago

Allowing the Linux bootloader is a security risk for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them, so the excellent rootkit protection secure boot provides gets wiped out entirely the moment you grab a copy of grub with your own chain loader. This is possible because a vulnerable version of Grub got signed at some point that allows loading unsigned code. Secure boot should always be possible to turn off, and it should always be possible to load your own keys. I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot. It defeats the entire point of requiring higher-than-kernel level permissions to alter the boot sequence. Linux needs better secure boot key management features if it's serious about making secure boot work. Without it, just turn it off. It's a bit of a pain for new Linux users, but so is every other step of the way.

AshamedCaptain 4y ago
> for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them Actually, Microsoft enables Bitlocker on many if not most consumer devices. For example, I have not been able to find a laptop without Bitlocker enabled by default since the Windows 8.1 era. Even home editions of Windows enable bitlocker by default, even if they don't call it Bitlocker (they call it "Full device encryption" or the like). On desktops the situation is the opposite -- until recently, most desktops didn't even ship with a TPM at all. Nowadays TPMs are a requirement for Windows 11, so devices with Bitlocker disabled by default are going to be a minority. > I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot. That's not true -- if a distribution is shipping a signed bootloader binary, then there should be no way to use that distribution's bootloader to run an unsigned binary. In fact, it would be considered a security vulnerability and the corresponding bootloader binaries would be blacklisted by Microsoft. It has happened in the past: https://www.suse.com/support/kb/doc/?id=000019892 https://www.suse.com/support/kb/doc/?id=000019892 . The default behavior of most distribution's GRUB2 (and specially whenever it is pre-enrolled into a signed shim) is that when you boot under Secure Boot it will check the signature on any UEFI executable, GRUB module, or Linux kernel you try to boot, and refuse to boot if it is not in the (UEFI firmware/shim) whitelist. > Linux needs better secure boot key management features if it's serious about making secure boot work. Linux already has multiple secure boot key management facilities. And then there's shim. But in any case, the problem is that Microsoft itself should be required to face these problems; under no circumstance should it be that by default MS gets their signatures to work for free but everyone else needs to have extra UI to manage them.

pjmlp 4y ago

As someone that started with 8 and 16 bit computers, I am fine with single purpose computers. Instead of giving money to Microsoft or Apple, support OEMs producing hardware with Linux pre-installed like Tuxedo and System 76.

chithanh 4y ago
That is not the point. The point is by employing dark patterns, Microsoft makes it progressively more difficult for normal users to switch away from Microsoft. Want to switch default browser? Adding yet one more step to stop you. Want to boot other operating system? Now you have to go to UEFI setup and change boot settings. etc.
- pjmlp 4y ago
  It is the point, it is like arguing to switch away from Spectrum, C64, Atari, Amiga, Acorn,.... back in the day. PC only got out of control, because Compaq was clever on their reverse engineering process, and IBM failed to uphold their ownership.
- trelane 4y ago
  Want to run Linux? Why go through the hassle of some Linux OEM when you can just keep Windows and run WSL?
  - AshamedCaptain 4y ago
    This is exactly my problem with all of this. Microsoft makes a way to run Linux desktop programs on Windows, meaning that they DO care about the market share that _desktop_ Linux represents. At the same time, they make steps to make running actual desktop Linux OSes as inconvenient as possible, which incidentally makes WSL appear more and more convenient every time. At this point, the simplest explanation is malice.
    - pjmlp 4y ago
      What they care about is the market share of the developers that buy Apple devices to develop UNIX applications, and couldn't care less about Linux itself, and are now not happy with the direction macOS is going. WSL focus on Linux, because the Linux kernel ABI is the new POSIX.

userbinator 4y ago

The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering. Remember what some people on here (and elsewhere) work for. They either truly believe advancing the authoritarian corporatocracy is a good thing, have been brainwashed into doing so, or are just happy to have a job. These are the true enemies of your freedom. Some of us saw this coming endgame ever since the "Trusted Computing" movement started, and how they slowly drowned out their opposition with propaganda. "Security" has become the go-to excuse for having their way with their power. The infamous Franklin quote has certainly taken on a new meaning.

pydry 4y ago
I dont think it's a concerted effort to support corportocracy think it's just the just world fallacy. It happens in all sorts of other domains too - the tendency to believe that things, by default, are the way they are for good and just reasons is strong in most people.
- mmphosis 4y ago
  It happens in all sorts of other domains too - the tendency to believe that things, by default, are the way they are for good and just reasons is strong in most people. For example, that’s why there are still ashtrays in new airplanes by default.
DoctorOetker 4y ago
I need an explicit list of public keys corresponding to the hardware roots of trust. From the article and prior reading it seems to be the hardware vendor's. Or are these in turn signed by Intel, AMD, ARM, ...? i.e. which public key is actually burnt in the processor's eFuses? A cryptographic break can always happen, and in such a cryptographically apocalyptic event i'd prefer to be able to author, sign and boot a minimal bootloader myself. Have people ever gathered such listings? EDIT: a secondary reason for maintaining such lists: key compromise can always happen, knowing when you need to replace your processor / computer because of a fundamental compromise would be mandatory. Also when buying hardware being able to observe historically compromised keys by vendor could give an indication of their security discipline.

nimbius 4y ago

while i absolutely agree with this sentiment, i feel like "Microsoft" as a boogeyman has become far more toothless since secureboot first took flight in 2006. the same people who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses. in 2022 there isnt an single manufacturer that doesnt offer (albeit sometimes sporadically) a Linux laptop. system76 and others exist to deliver the linux laptop and desktop, and Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease. Battlestation vendors like Asus will likely seek the rubber stamp for their laptop products that ship with windows, but for liquid cooled battle station geeks the same motherboards will ship with open EFI to run whatever keys you want to, or dont.

AshamedCaptain 4y ago
> Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease. Google is in no way a model to follow. They actually make it more complicated to install _native_ Linux than x86 PC manufacturers, what with their "developer mode", often ridiculous, physical hardware manipulation requirements to enable it, and non-removable Scary Boot Prompts unless you completely overwrite the full system firmware. In other words: Google is actually worse right now than MS would be on x86 even if they MS extended this Secured Core crap to all other PC manufacturers. It doesn't matter much that they use open-source firmware if they lock it down worse than the rest. And "containerized Linux" like Crouton misses the point and anyway MS is doing it too! (so much for those who say MS does not care about the Linux desktop market share).
trelane 4y ago
> those who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses. I've never had to buy an OSX computer in order to install linux on top of it. The same cannot be said of Windows.

deleted 4y ago

[deleted]

cptskippy 4y ago

Does Google use Secure Boot on it's Chromebooks? Are you able to install whatever you want on them?

phendrenad2 4y ago

It's not even scaremongering at this point, it's just expired. Every 5 years or so something like this comes up, and it's used as another data point in the slippery slope that you all are so sure is happening. And yet, if I buy any random PC off the shelf in 2022, there's still a huge chance that it'll boot from a Linux ISO without having to jump through any hoops. I think what's happening is, at some point in the past someone decided that there was a conspiracy to lock out Linux, and while that future hasn't come to pass, the total number of Linux-compatible devices keeps expanding, and therefore we keep getting examples of vendors locking things down too hard. These appear to be examples of the trend, but they're an increasingly small percentage of the total pool of Linux-compatible devices. It's the same thing that happened with Android. You can still root most phones, despite some being locked down. Things have reached an equilibrium. As I said in another post "there are more forces than Microsoft at work here".