5 ms·

> I thought secure boot was doing something to help secure the boot of my computer and was worth the bother. it does, and it is. SecureBoot makes sure that th

> I thought secure boot was doing something to help secure the boot of my computer and was worth the bother. it does, and it is. SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. it does not check the firmware for bugs or somehow sense them and skip over that code or something.

trelane 3y ago
> SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."
- brendank310 3y ago
  SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.
  - trelane 3y ago
    > who gets to decide the criteria for trust Good point. Both are important: who does the trusting and how they define trust. The latter is the second set of concerns: remote attestation. I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia. But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
  - account42 3y ago
    > I think we'd all agree having a trusted boot sequence is desirable We don't.
- jon-wood 3y ago
  That trusted authority can be you if you choose to enroll your own signing key. While its true that most motherboards come pre-seeded with Microsoft's keys there is absolutely nothing to stop you from removing those keys and replacing them with ones you specifically trust.
  - trelane 3y ago
    > if you choose to enroll your own signing key. Can you also re-sign the firmware and hardware checks as well? Last I knew you could not. Of course, you can't dual boot anymore. https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362 https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.

trelane 3y ago

> SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."

brendank310 3y ago
SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.
- trelane 3y ago
  > who gets to decide the criteria for trust Good point. Both are important: who does the trusting and how they define trust. The latter is the second set of concerns: remote attestation. I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia. But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
- account42 3y ago
  > I think we'd all agree having a trusted boot sequence is desirable We don't.
jon-wood 3y ago
That trusted authority can be you if you choose to enroll your own signing key. While its true that most motherboards come pre-seeded with Microsoft's keys there is absolutely nothing to stop you from removing those keys and replacing them with ones you specifically trust.
- trelane 3y ago
  > if you choose to enroll your own signing key. Can you also re-sign the firmware and hardware checks as well? Last I knew you could not. Of course, you can't dual boot anymore. https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362 https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.