4 ms·

> SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. The passive voice in "trusted authori

> SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."

brendank310 3y ago
SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.
- trelane 3y ago
  > who gets to decide the criteria for trust Good point. Both are important: who does the trusting and how they define trust. The latter is the second set of concerns: remote attestation. I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia. But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
- account42 3y ago
  > I think we'd all agree having a trusted boot sequence is desirable We don't.
jon-wood 3y ago
That trusted authority can be you if you choose to enroll your own signing key. While its true that most motherboards come pre-seeded with Microsoft's keys there is absolutely nothing to stop you from removing those keys and replacing them with ones you specifically trust.
- trelane 3y ago
  > if you choose to enroll your own signing key. Can you also re-sign the firmware and hardware checks as well? Last I knew you could not. Of course, you can't dual boot anymore. https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362 https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.

brendank310 3y ago

SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.

trelane 3y ago
> who gets to decide the criteria for trust Good point. Both are important: who does the trusting and how they define trust. The latter is the second set of concerns: remote attestation. I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia. But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
account42 3y ago
> I think we'd all agree having a trusted boot sequence is desirable We don't.

jon-wood 3y ago

That trusted authority can be you if you choose to enroll your own signing key. While its true that most motherboards come pre-seeded with Microsoft's keys there is absolutely nothing to stop you from removing those keys and replacing them with ones you specifically trust.

trelane 3y ago
> if you choose to enroll your own signing key. Can you also re-sign the firmware and hardware checks as well? Last I knew you could not. Of course, you can't dual boot anymore. https://community.frame.work/t/solved-secure-boot-and-custom-keys-on-the-amd-motherboard/38362 https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.