3 ms·

Or you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted

Or you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted by this.

ekianjo 1y ago
do you have any source on how to do that?
- craftkiller 1y ago
  I followed https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md https://github.com/nix-community/lanzaboote/blob/master/docs... but naturally you don't want to include the `--microsoft` flag when running `sbctl enroll-keys` if you want to avoid microsoft keys. Also Lanzaboote is only for NixOS.
- marcthe12 1y ago
  The arch wiki has the best source https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware... Note sbctl is one of the easier tools to do this.
josephcsible 1y ago
Sure, but that's a lot more work than just disabling Secure Boot, and for most people's threat models, there's zero actual security benefit gained in return.
- deleted 1y ago
  [deleted]
brudgers 1y ago
Warning: Replacing the platform keys with your own can end up bricking hardware on some machines, including laptops, making it impossible to get into the firmware settings to rectify the situation. This is due to the fact that some device (e.g GPU) firmware (OpROMs), that get executed during boot, are signed using Microsoft 3rd Party UEFI CA certificate or vendor certificates. This is the case in many Lenovo Thinkpad X, P and T series laptops which uses the Lenovo CA certificate to sign UEFI applications and firmware. “Just” is doing a lot of heavy lifting in that solution. https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Implementing_Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

3 ms·

Or you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted

by craftkiller 1y ago

Or you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted by this.

ekianjo 1y ago
do you have any source on how to do that?
- craftkiller 1y ago
  I followed https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md https://github.com/nix-community/lanzaboote/blob/master/docs... but naturally you don't want to include the `--microsoft` flag when running `sbctl enroll-keys` if you want to avoid microsoft keys. Also Lanzaboote is only for NixOS.
- marcthe12 1y ago
  The arch wiki has the best source https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware... Note sbctl is one of the easier tools to do this.
josephcsible 1y ago
Sure, but that's a lot more work than just disabling Secure Boot, and for most people's threat models, there's zero actual security benefit gained in return.
- deleted 1y ago
  [deleted]
brudgers 1y ago
Warning: Replacing the platform keys with your own can end up bricking hardware on some machines, including laptops, making it impossible to get into the firmware settings to rectify the situation. This is due to the fact that some device (e.g GPU) firmware (OpROMs), that get executed during boot, are signed using Microsoft 3rd Party UEFI CA certificate or vendor certificates. This is the case in many Lenovo Thinkpad X, P and T series laptops which uses the Lenovo CA certificate to sign UEFI applications and firmware. “Just” is doing a lot of heavy lifting in that solution. https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Implementing_Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware...