4 ms·

Was Secure Boot supposed to increase security? I thought Microsoft was using it to make it near impossible to install Linux

mjg59 1y ago
Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.
- zahlman 1y ago
  The Linux Mint support forums keep telling people to try turning it off to fix problems, but I installed Mint just fine with it enabled on my 8 (at the time) year old hardware, before I'd even heard that there was such a thing. Anyway, it's good to hear that I probably don't have anything to worry about.
  - charcircuit 1y ago
    Unfortunately, hearing this is not surprising since desktop Linux users tolerate having poor security and rely on never ever running malware to keep themselves safe over having the operating system itself protect against malware.
    - zahlman 1y ago
      > Unfortunately, hearing this is not surprising since [users of an OS with a built-in file permissions system] tolerate having poor security and rely on [thinking about whom to trust and primarily sourcing their software from the distro package manager] to keep themselves safe over having the operating system itself [apply heuristics to try to decide whether things the user downloaded from random web sites are malware, while completely failing to provide transparency on whether double-clicking something will supply it as data to an existing program or treat it as itself a program]. I'm not understanding how it's the desktop Linux users who have to deal with poor security.
      - sugarpimpdorsey 1y ago
        > users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). > thinking about whom to trust and primarily sourcing their software from the distro package manager So "app store" is the wave of the future? The days of Linux users using magic healing crystals to protect themselves from malware are long over. Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you.
        bayindirh 1y ago
        > Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.
        charcircuit 1y ago
        >zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
    - AAAAaccountAAAA 1y ago
      The desktop security model is pretty much the same across the vendors. Somehow, Microsoft seems to get a free pass on this.
    - akimbostrawman 1y ago
      Of course unlike windows billion dollar heightened security of getting flooded with UAC and MOTW pops up everybody is conditioned to click yes as fast as possible caused by the proven "download random executables from the first site you see on google and hope it's not malwaretising" method.
michaelt 1y ago
It increases security in certain circumstances. Mostly for Windows users at big corporations. For example, you want your users' laptop hard drives to be encrypted - but also you have users who regularly forget their passwords? With bitlocker their hard drive can decrypt itself, so they only need to remember their windows login, which you can reset remotely. You give laptops to your field workers, who have full physical access and would love to play video games or access netflix when work puts them in a hotel over night with nothing to do? With secure boot you can keep your precious spreadsheets locked down, even if they're willing to boot from USB sticks or swap the hard drive. And perhaps most importantly, it has "secure" in the name. So the corporation's IT security auditors will like to see it turned on even if they have only a vague understanding of what it does.
okanat 1y ago
Maybe you are too young for this but viruses modifying boot partitions was a big thing back then. It is simply impossible to inject some code without finding an exploit in UEFI with Secure Boot or somehow exploiting the kernel. It is still possible to do this kind of hack but it is 2 orders of magnitude harder.
- ahartmetz 1y ago
  No, boot sector viruses were not a big thing, especially after DOS times. They existed, but they weren't the worst problem at any time.
fuzzfactor 1y ago
SecureBoot and UEFI were "bundled" with Windows 8.0 PC's to curtail the possibility of users easily installing Windows 7 instead. Earlier versions of Windows were a much bigger threat to adoption of Windows 8 than Linux was.
Yeul 1y ago
Is secure boot even enabled by default? I have never used it on my gaming PC and Windows doesn't seem to care.
- jon-wood 1y ago
  Its a requirement on any device sold with Windows 11.
jon-wood 1y ago
Yes, it does, for some values of security. Operated correctly it allows you to know you can trust everything on your system from the UEFI firmware down, because if any part of that chain didn't match what you were expecting to be there the next step in the chain would refuse to execute. Most people experience this via Windows, which automatically sets up that chain of trust so that you can know you've not had a rootkit injected somewhere. In other cases it may be Linux or something more exotic booting, and it requires some management by whoever is operating the device, but that comes with the benefit of knowing that if one of our devices has got to the point of decrypting it's storage we can be reasonably confident that it hasn't been tampered with, and so we can trust it to send good data.

mjg59 1y ago

Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.

zahlman 1y ago
The Linux Mint support forums keep telling people to try turning it off to fix problems, but I installed Mint just fine with it enabled on my 8 (at the time) year old hardware, before I'd even heard that there was such a thing. Anyway, it's good to hear that I probably don't have anything to worry about.
- charcircuit 1y ago
  Unfortunately, hearing this is not surprising since desktop Linux users tolerate having poor security and rely on never ever running malware to keep themselves safe over having the operating system itself protect against malware.
  - zahlman 1y ago
    > Unfortunately, hearing this is not surprising since [users of an OS with a built-in file permissions system] tolerate having poor security and rely on [thinking about whom to trust and primarily sourcing their software from the distro package manager] to keep themselves safe over having the operating system itself [apply heuristics to try to decide whether things the user downloaded from random web sites are malware, while completely failing to provide transparency on whether double-clicking something will supply it as data to an existing program or treat it as itself a program]. I'm not understanding how it's the desktop Linux users who have to deal with poor security.
    - sugarpimpdorsey 1y ago
      > users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). > thinking about whom to trust and primarily sourcing their software from the distro package manager So "app store" is the wave of the future? The days of Linux users using magic healing crystals to protect themselves from malware are long over. Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you.
      - bayindirh 1y ago
        > Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.
        charcircuit 1y ago
        >zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
  - AAAAaccountAAAA 1y ago
    The desktop security model is pretty much the same across the vendors. Somehow, Microsoft seems to get a free pass on this.
  - akimbostrawman 1y ago
    Of course unlike windows billion dollar heightened security of getting flooded with UAC and MOTW pops up everybody is conditioned to click yes as fast as possible caused by the proven "download random executables from the first site you see on google and hope it's not malwaretising" method.

michaelt 1y ago

It increases security in certain circumstances. Mostly for Windows users at big corporations. For example, you want your users' laptop hard drives to be encrypted - but also you have users who regularly forget their passwords? With bitlocker their hard drive can decrypt itself, so they only need to remember their windows login, which you can reset remotely. You give laptops to your field workers, who have full physical access and would love to play video games or access netflix when work puts them in a hotel over night with nothing to do? With secure boot you can keep your precious spreadsheets locked down, even if they're willing to boot from USB sticks or swap the hard drive. And perhaps most importantly, it has "secure" in the name. So the corporation's IT security auditors will like to see it turned on even if they have only a vague understanding of what it does.

okanat 1y ago

Maybe you are too young for this but viruses modifying boot partitions was a big thing back then. It is simply impossible to inject some code without finding an exploit in UEFI with Secure Boot or somehow exploiting the kernel. It is still possible to do this kind of hack but it is 2 orders of magnitude harder.

ahartmetz 1y ago
No, boot sector viruses were not a big thing, especially after DOS times. They existed, but they weren't the worst problem at any time.

fuzzfactor 1y ago

SecureBoot and UEFI were "bundled" with Windows 8.0 PC's to curtail the possibility of users easily installing Windows 7 instead. Earlier versions of Windows were a much bigger threat to adoption of Windows 8 than Linux was.

Yeul 1y ago

Is secure boot even enabled by default? I have never used it on my gaming PC and Windows doesn't seem to care.

jon-wood 1y ago
Its a requirement on any device sold with Windows 11.

jon-wood 1y ago

Yes, it does, for some values of security. Operated correctly it allows you to know you can trust everything on your system from the UEFI firmware down, because if any part of that chain didn't match what you were expecting to be there the next step in the chain would refuse to execute. Most people experience this via Windows, which automatically sets up that chain of trust so that you can know you've not had a rootkit injected somewhere. In other cases it may be Linux or something more exotic booting, and it requires some management by whoever is operating the device, but that comes with the benefit of knowing that if one of our devices has got to the point of decrypting it's storage we can be reasonably confident that it hasn't been tampered with, and so we can trust it to send good data.