4 ms·
I've never thought UEFI Secure Boot was a great idea, but Fedora paying Microsoft to get a signed boot loader feels, errrm, creepy to me. On the bright side ho
by sounds 14y ago
I've never thought UEFI Secure Boot was a great idea, but Fedora paying Microsoft to get a signed boot loader feels, errrm, creepy to me.
On the bright side however, Fedora's boot loader is just a signature verifying loader to boot grub2 - using _Fedora's_ PKI. That's encouraging because at an ideological level it's exploiting Microsoft's process to give Fedora control over everything downstream from their loader. The name even implies that it's a kind of workaround: "shim loader." (Shim is defined in some circles as a compatibility workaround.)
I guess Fedora doesn't plan on becoming a signing authority for custom kernels, but in a pinch it could work.
Please, everyone start contributing to http://coreboot.org http://coreboot.org !
[Edited for clarity.]
- av500 14y agoit does not give Fedora "control over the whole process". It's not only the bootloader that is signed, it's also kernel and modules. And if any of these is compromised, M$ can see that as a threat to a Windows installation on the same PC and revoke the "Fedora" keys. Not that M$ would have any incentive to do such a thing ever....
- lucian1900 14y agoAs long as OEMs only listen to MS, coreboot will never happen. Even with UEFI, this doesn't have to be a problem.
- sounds 14y agoUnless I misunderstand what you mean by "will never happen," I think you should take a second look at coreboot. It's happening. It's just not on _your_ laptop, but it could be. Try it out.