3 ms·

It has their uses. If, for example, a company wants to issue fleet computers to workers or school to students, you want to have secure boot on those devices to

• bitwize 6mo ago
  This is coming. In particular, without a Secure-Boot-enforced allowlist of operating systems, it will be near impossible to verify that an OS connecting to the internet complies with your locality's age verification laws, so it will soon be illegal to run a computer that does not make Secure Boot mandatory and connect it to the network. If you're starting to think "huh, maybe that's why these age verification laws suddenly became all the rage", you're onto something. Whatever the case, "general purpose computing" is definitely cooked.
  • deleted 6mo ago
    [deleted]
  • charcircuit 6mo ago
    General purpose computing as it was done in the 1900s is cooked for the average user because there is no market incentive for it to exist. The actual market incentive revolves around apps as they provide user value along with the ability to deploy custom apps.
  • ndriscoll 6mo ago
    The laws in my locality place requirements on the service provider (e.g. the adult website operator), not on random computer owners or manufacturers or software vendors.
    • josephcsible 6mo ago
      Newsom signed a law that places those requirements on every operating system in California, and in practice, organizations tend to comply with California's terrible laws no matter where you are, rather than stopping doing business there or making two variants of their products.
      • ndriscoll 6mo ago
        With software it's trivial to have a switch for "California compliant" mode, but in any case, that makes it clear that such criticisms should be directed at California. Other (generally "red") states already had a more reasonable solution: make the sites offering the restricted service liable for their actions just like other businesses.
        • bitwize 6mo ago
          The problem is that you could face liability if you do business in the United States and permit a minor in California to use an OS in non-California-compliant mode. If you're an "OS provider" in Wichita, KS, California will find that its jurisdiction still applies because the minor was in California and sue you in its courts. If you fail to turn up that's a judgement for the state by default. (And if you do turn up, it's a judgement for the state as soon as they prove a kid ran your non-age-checking OS.) And, thanks to the "full faith and credit" clause of the Constitution, California will be able to collect on its judgement against you in Wichita. Hardware vendors are not going to want that kind of liability, in California, Colorado, New York, or anywhere else. So they will switch to selling hardware with locked bootloaders and only allowing approved operating systems within that locality (which for end-user PCs will mean pretty much just Windows). There is still foreign hardware, but those chinesium PCs are going to be confiscated by ICE unless the Chinese manufacturers also play ball. Besides all this... federal legislation is coming.
          • friedtofu 6mo ago
            If you'd humor me, or just read the last paragraph for a tldr... So let's say a PC builder(an individual; not a company) were to donate a PC to charity. Let's say it's built with a fairly recent MSI motherboard(https://www.amazon.com/dp/B0BRQSWSFQ/ https://www.amazon.com/dp/B0BRQSWSFQ/) 'MSI PRO B760-P' if you'd prefer to avoid amazon. I remove all my internal SSDs and NVME drives but buy a new 1tb SSD for whoever receives the PC. I also install a Linux OS, as well as sign the secure boot keys via sbctl myself, setup ukify, efibootmgr, etc. Everything the recipient would need to switch over to another OS if they so choose. But oh no, the donated PC landed in the hands of Johnny, a 17-year old in California. So who's at fault here, MSI for creating a BIOS that allows for non-windows EFI images to be installed? The PC Builder(donator) for knowingly installing Linux(though not knowing where it would end up)? This is kind of what confuses me and I'm curious what this means for future hardware sold in the US and those who build PCs for their own use or others. Most modern motherboards are "locked down" by default, but can easily be unlocked by the end-user, it may take a few extra steps or be a bit harder to find but still pretty simple for someone moderately tech-savvy.
• Vogtinator 6mo ago
  > If, for example, a company wants to issue fleet computers to workers or school to students, you want to have secure boot on those devices to prevent tampering. Secure boot makes it so that physical access is not the end all of security. Measured boot is actually better for that: You can still boot whatever you want however you want, but hashes are different which can be used for e.g. remote attestation. Secure boot has to prevent that "unauthorized" code (whatever that means for each setup) can ever run. If it does, game over. That means less freedom and flexibility.
  • josephcsible 6mo ago
    Measured boot isn't any better. Look at Android phones, where it's technically possible to unlock your bootloader, but a ton of apps (e.g., McDonald's and most banking apps) use remote attestation to see whether you did so and will refuse to work if you did.
    • chii 6mo ago
      Yep. Exactly why i said > turn off these measures in a way that is undetectable. If you own the device, you ought to have the means to make such configuration/changes in undetectable ways. Otherwise, you don't truly own the device. Some apps want to run on devices that you don't "own", because they are doing something the owner would not want done (in secret or what not).
    • shibapuppie 6mo ago
      McDonald's does that? Their App works fine on Lineage 22.