4 ms·

No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.

by growse 4y ago

recuter 4y ago
For now.
mid-kid 4y ago
This number diminishes every passing year, with only debian being a bastion of sanity on the "user friendly" side of the distro spectrum.
- growse 4y ago
  Why do you think that is?
  - ddalex 4y ago
    Because more and more software developers use hard dependencies on SystemD making alternatives difficult to maintain ?
    - Avamander 4y ago
      Because systemd has moved forward while the alternatives haven't. Systemd is not making the alternatives more difficult to maintain, the alternatives are more difficult and more difficult to maintain. Matter of perspective, really.
      - ddalex 4y ago
        I disagree - SystemD has the approach of embrace-extend-extinguish, where it gobbles up services and turns them into their own hard dependency - from DNS to device managers, etc It's a very MS approach instead of a UNIX - do one job.
        Avamander 4y ago
        I don't think you're very familiar about the difference between systemd the project and systemd-* the different services under that project. They're not that coupled together, including the two you've just listed.
- candiddevmike 4y ago
  Debian only supports systemd though? No sure what you mean by bastion in the context of systemd. Devuan is the Debian non-systemd fork.
  - mid-kid 4y ago
    Devuan is a distro preconfigured to install without systemd and with enhancements to several packages to require less of systemd. Debian can still be configured to use sysvinit, it's just a bit of a mess.
deleted 4y ago
[deleted]
AshamedCaptain 4y ago
This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.
- growse 4y ago
  I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?
  - candiddevmike 4y ago
    There are quite a few instances[1] where adding your own signing keys bricks the device. [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_your_own_keys https://wiki.archlinux.org/title/Unified_Extensible_Firmware...
    - growse 4y ago
      Huh, wasn't aware of that. Reading through, it looks like this is just talking about Microsoft "Secured-core" hardware, which seems to be hardware specifically marketed to provide a Microsoft-certified boot chain. I'm not sure that's the same thing as Microsoft making it harder in general for people to bring and use their own keys (or just turn it off altogether).
      - Foxboron 4y ago
        It's a bit more complicated. The UEFI drivers and Linux distributions are signed by the same certificate, the "Microsoft 3rd party UEFI Certificate". UEFI Drivers can be Option ROM on the PCIe cards, commonly found of graphics cards. If you where to leave this certificate out of your boot chain, how would you validate this drivers? Well, you can't. This results in your not having any GPUs and your device is "bricked" until you can hopefully piggyback on something else. It's not really a proper brick. This is just a design flaw in my opinion. Microsoft taking the easy route for being the org responsible for signing UEFI code when there was no other options (LetsEncrypt wasnt a thing in 2010/2012). And I don't think Microsoft envisioned themselves in the position they are currently inn. There are workarounds though, you can read the drivers loaded during boot from the TPM Eventlog and enroll each driver into the approve list for Secure Boot (The `db` variable). But this isn't necessarily future proof if anything changes.

No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.

by growse 4y ago

No-one's making you use it. Choose a distro that doesn't package it - there's plenty to choose from.

recuter 4y ago

For now.

mid-kid 4y ago

This number diminishes every passing year, with only debian being a bastion of sanity on the "user friendly" side of the distro spectrum.

growse 4y ago
Why do you think that is?
- ddalex 4y ago
  Because more and more software developers use hard dependencies on SystemD making alternatives difficult to maintain ?
  - Avamander 4y ago
    Because systemd has moved forward while the alternatives haven't. Systemd is not making the alternatives more difficult to maintain, the alternatives are more difficult and more difficult to maintain. Matter of perspective, really.
    - ddalex 4y ago
      I disagree - SystemD has the approach of embrace-extend-extinguish, where it gobbles up services and turns them into their own hard dependency - from DNS to device managers, etc It's a very MS approach instead of a UNIX - do one job.
      - Avamander 4y ago
        I don't think you're very familiar about the difference between systemd the project and systemd-* the different services under that project. They're not that coupled together, including the two you've just listed.
candiddevmike 4y ago
Debian only supports systemd though? No sure what you mean by bastion in the context of systemd. Devuan is the Debian non-systemd fork.
- mid-kid 4y ago
  Devuan is a distro preconfigured to install without systemd and with enhancements to several packages to require less of systemd. Debian can still be configured to use sysvinit, it's just a bit of a mess.

deleted 4y ago

[deleted]

AshamedCaptain 4y ago

This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.

growse 4y ago
I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?
- candiddevmike 4y ago
  There are quite a few instances[1] where adding your own signing keys bricks the device. [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Using_your_own_keys https://wiki.archlinux.org/title/Unified_Extensible_Firmware...
  - growse 4y ago
    Huh, wasn't aware of that. Reading through, it looks like this is just talking about Microsoft "Secured-core" hardware, which seems to be hardware specifically marketed to provide a Microsoft-certified boot chain. I'm not sure that's the same thing as Microsoft making it harder in general for people to bring and use their own keys (or just turn it off altogether).
    - Foxboron 4y ago
      It's a bit more complicated. The UEFI drivers and Linux distributions are signed by the same certificate, the "Microsoft 3rd party UEFI Certificate". UEFI Drivers can be Option ROM on the PCIe cards, commonly found of graphics cards. If you where to leave this certificate out of your boot chain, how would you validate this drivers? Well, you can't. This results in your not having any GPUs and your device is "bricked" until you can hopefully piggyback on something else. It's not really a proper brick. This is just a design flaw in my opinion. Microsoft taking the easy route for being the org responsible for signing UEFI code when there was no other options (LetsEncrypt wasnt a thing in 2010/2012). And I don't think Microsoft envisioned themselves in the position they are currently inn. There are workarounds though, you can read the drivers loaded during boot from the TPM Eventlog and enroll each driver into the approve list for Secure Boot (The `db` variable). But this isn't necessarily future proof if anything changes.