4 ms·
And this is why I avoid and will always avoid "Secure Boot". I can see many newer Linux people being locked out starting in Sept.
by jmclnx 1y ago
And this is why I avoid and will always avoid "Secure Boot". I can see many newer Linux people being locked out starting in Sept.
- craftkiller 1y agoOr you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted by this.
- ekianjo 1y agodo you have any source on how to do that?
- craftkiller 1y agoI followed https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md https://github.com/nix-community/lanzaboote/blob/master/docs... but naturally you don't want to include the `--microsoft` flag when running `sbctl enroll-keys` if you want to avoid microsoft keys. Also Lanzaboote is only for NixOS.
- marcthe12 1y agoThe arch wiki has the best source https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware... Note sbctl is one of the easier tools to do this.
- josephcsible 1y agoSure, but that's a lot more work than just disabling Secure Boot, and for most people's threat models, there's zero actual security benefit gained in return.
- deleted 1y ago[deleted]
- brudgers 1y agoWarning: Replacing the platform keys with your own can end up bricking hardware on some machines, including laptops, making it impossible to get into the firmware settings to rectify the situation. This is due to the fact that some device (e.g GPU) firmware (OpROMs), that get executed during boot, are signed using Microsoft 3rd Party UEFI CA certificate or vendor certificates. This is the case in many Lenovo Thinkpad X, P and T series laptops which uses the Lenovo CA certificate to sign UEFI applications and firmware. “Just” is doing a lot of heavy lifting in that solution. https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Implementing_Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware...
- willa_bombadier 1y agoThere should be some “Sane Usage” certification that a device doesn’t do secure boot, provides fully open and self-maintainable hardware, is independent of all external entities for ongoing use, provides hardware switches to turn off built-ins like ports, mics, and cameras, for power-savings and security.
- pydry 1y ago"Will this piss off or delight Microsoft?" is probably a thought that goes through the heads of many OEMs when they decide how to design their machines.
- msgodel 1y agoWeirdly Microsoft has been one of the companies ensuring Linux remains bootable on PCs.
- bayindirh 1y agoBill Gates famously asked: "Can we create a standard or expand something like ACPI, so Linux becomes unbootable on PCs?" So, believing this is very, very hard.
- pydry 1y agoMicrosoft has been trying to tread a fine line between exerting subtle pressure on OEMs to make Linux annoying to boot so it doesnt become more popular and not violating the terms of its antitrust agreement.
- bayindirh 1y agoTo be able to get Windows licenses and preload Windows on your system, put that little Windows sticker and sell your machine to the masses, you need a Windows Compatibility certificate, and that certificate needs you to have Secure Boot and enabled by default.
- salawat 1y ago
- lexicality 1y agoNewer Linux people will presumably be using the new key though?