7 ms·

Gonna assume it's because you have to disable it to run your operating system of choice, unless you beg Microsoft to let you.

deleted 2y ago
[deleted]
brookst 2y ago
So that would be undesirable if true, but how would it be less secure than not having secure boot? Of course, most/all SB BIOSes enable setting your own platform key.
- athrowaway3z 2y ago
  Because it can lock the door behind itself in an opaque hardware-dependent layer users have no control over. If i were to design security from the ground up it would be a small external sdcard for firmware and kernel (with a hardware r/w toggle), and optionally a external sdcard adapter that verifies the hash of the content. Everything else is as dumb as bricks and gets its firmware loaded from the sdcard. We didn't do that because secure boot was solving the problem of large orgs with remote administration in mind, and designed by orgs happy to sell yearly advanced cybersecurity protection shield plus certification subscriptions. Designing for remote administration by an IT department will.. increase the attack surface for attackers to remote administrate my device.
  - fsflover 2y ago
    > If i were to design security from the ground up You might be interested in Librem Key, based on free firmware?
KennyBlanken 2y ago
You only need disable it until you've got that OS installed, and then you can re-enable it. All the major linux distros have supported Secure Boot for years (which I was not aware of, and will now look into setting up!)
- microtonal 2y ago
  You don’t need to disable it at all for distributions that support secure boot.
  - psd1 2y ago
    I don't understand the tech: could it be the case that an older machine is missing CA roots that causes it to reject legitimately-signed code? I had to disable SB to boot the installer for either F39 or Mint 22, i forget which, on an old laptop.
j0057 2y ago
FUD: you can install your own keys, enable secure boot and run the OS of your choice.
- ghjfrdghibt 2y ago
  You got a user friendly easy to follow guide? You can start by telling me what you mean by keys...
  - brookst 2y ago
    Is the implication that anything that is more complicated is necessarily less secure? Because I think that turns security on its head. A deadbolt is more complicated than a door with no lock. We can argue about whether there is sufficient user demand and benefit to make secure boot easier for lay people. But that is completely orthogonal to whether it increases or decreases security of the system.
jeroenhd 2y ago
Most distros will run just fine without disabling secure boot. I don't think the *BSDs are supported by the shim loader yet, but even Gentoo boots with secure boot enabled, without loading any user keys.

deleted 2y ago

[deleted]

brookst 2y ago

So that would be undesirable if true, but how would it be less secure than not having secure boot? Of course, most/all SB BIOSes enable setting your own platform key.

athrowaway3z 2y ago
Because it can lock the door behind itself in an opaque hardware-dependent layer users have no control over. If i were to design security from the ground up it would be a small external sdcard for firmware and kernel (with a hardware r/w toggle), and optionally a external sdcard adapter that verifies the hash of the content. Everything else is as dumb as bricks and gets its firmware loaded from the sdcard. We didn't do that because secure boot was solving the problem of large orgs with remote administration in mind, and designed by orgs happy to sell yearly advanced cybersecurity protection shield plus certification subscriptions. Designing for remote administration by an IT department will.. increase the attack surface for attackers to remote administrate my device.
- fsflover 2y ago
  > If i were to design security from the ground up You might be interested in Librem Key, based on free firmware?

KennyBlanken 2y ago

You only need disable it until you've got that OS installed, and then you can re-enable it. All the major linux distros have supported Secure Boot for years (which I was not aware of, and will now look into setting up!)

microtonal 2y ago
You don’t need to disable it at all for distributions that support secure boot.
- psd1 2y ago
  I don't understand the tech: could it be the case that an older machine is missing CA roots that causes it to reject legitimately-signed code? I had to disable SB to boot the installer for either F39 or Mint 22, i forget which, on an old laptop.

j0057 2y ago

FUD: you can install your own keys, enable secure boot and run the OS of your choice.

ghjfrdghibt 2y ago
You got a user friendly easy to follow guide? You can start by telling me what you mean by keys...
- brookst 2y ago
  Is the implication that anything that is more complicated is necessarily less secure? Because I think that turns security on its head. A deadbolt is more complicated than a door with no lock. We can argue about whether there is sufficient user demand and benefit to make secure boot easier for lay people. But that is completely orthogonal to whether it increases or decreases security of the system.

jeroenhd 2y ago

Most distros will run just fine without disabling secure boot. I don't think the *BSDs are supported by the shim loader yet, but even Gentoo boots with secure boot enabled, without loading any user keys.