> You can defend against the bad guy disabling SB in the UEFI settings by password locking the UEFI setup. On some desktops, you can't. There is a physical jum

> You can defend against the bad guy disabling SB in the UEFI settings by password locking the UEFI setup. On some desktops, you can't. There is a physical jumper that resets all the settings, and this includes removing the password.