4 ms·

How are PC vendors hoping to sell laptops to corporate buyers whose IT departments want to reimage all those machines (a lot of them with Linux images) without

How are PC vendors hoping to sell laptops to corporate buyers whose IT departments want to reimage all those machines (a lot of them with Linux images) without wasting time going into UEFI setup menus to turn off Secure Boot one machine at a time?

etherealG 14y ago
these cases are more easily covered by the corporation's key being included in those machines. big numbers of machines warrant that kind of effort from the manufacturer. the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model.
- recoiledsnake 14y ago
  >the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model. It does. You can add your own key and even remove Microsoft's if so wish. The facts are getting lost in this FUDstorm.
  - tomjen3 14y ago
    Well it wouldn't have been a fud storm if Microsoft hadn't insistet on it being turned on by default. But if I were to remove a MS key, am I right in assuming that that would prevent anybody from running windows on that machine (at least without installing the key or turning it of)?
    - recoiledsnake 14y ago
      If it's turned off by default, it might as well be useless to protect the hundreds of millions of non-technical users who are more prone to get malware. >But if I were to remove a MS key, am I right in assuming that that would prevent anybody from running windows on that machine (at least without installing the key or turning it of)? Windows 8 boots fine without Secure Boot enabled or even supported. However, if you remove Microsoft's key but leave Secure Boot enabled, you're indicating that you don't trust Microsoft's code, in which case Windows will be prevented from booting on that machine. What is the value or the use case in removing Microsoft's key, leaving secure boot on and then trying to boot Windows on that machine?
      - disgruntledphd2 14y ago
        The only real reason that I (as a Linux user) can see is for the amusement value, as well as the opportunity to watch others fail to boot Windows on this machine and the opportunity to engage in an extended philosophical discussion regarding this event. Mind you, I might be a niche case.
        gizmo686 14y ago
        What extended philosophical discussion do you intend to have? You told the computer not to trust MS code, then the computer refused to boot MS Windows.
    - takluyver 14y ago
      Security features that are off by default don't provide much security. Yes, as I understand it, if you remove the Microsoft key but leave secure boot on, it will refuse to boot Windows. So long as it's on, it will only boot an OS signed with a key it trusts. If you turn it off, it will try to boot whatever's on the disk.

etherealG 14y ago

these cases are more easily covered by the corporation's key being included in those machines. big numbers of machines warrant that kind of effort from the manufacturer. the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model.

recoiledsnake 14y ago
>the problem is when I want to generate my own key and use that as the only authority. the system doesn't support that model. It does. You can add your own key and even remove Microsoft's if so wish. The facts are getting lost in this FUDstorm.
- tomjen3 14y ago
  Well it wouldn't have been a fud storm if Microsoft hadn't insistet on it being turned on by default. But if I were to remove a MS key, am I right in assuming that that would prevent anybody from running windows on that machine (at least without installing the key or turning it of)?
  - recoiledsnake 14y ago
    If it's turned off by default, it might as well be useless to protect the hundreds of millions of non-technical users who are more prone to get malware. >But if I were to remove a MS key, am I right in assuming that that would prevent anybody from running windows on that machine (at least without installing the key or turning it of)? Windows 8 boots fine without Secure Boot enabled or even supported. However, if you remove Microsoft's key but leave Secure Boot enabled, you're indicating that you don't trust Microsoft's code, in which case Windows will be prevented from booting on that machine. What is the value or the use case in removing Microsoft's key, leaving secure boot on and then trying to boot Windows on that machine?
    - disgruntledphd2 14y ago
      The only real reason that I (as a Linux user) can see is for the amusement value, as well as the opportunity to watch others fail to boot Windows on this machine and the opportunity to engage in an extended philosophical discussion regarding this event. Mind you, I might be a niche case.
      - gizmo686 14y ago
        What extended philosophical discussion do you intend to have? You told the computer not to trust MS code, then the computer refused to boot MS Windows.
  - takluyver 14y ago
    Security features that are off by default don't provide much security. Yes, as I understand it, if you remove the Microsoft key but leave secure boot on, it will refuse to boot Windows. So long as it's on, it will only boot an OS signed with a key it trusts. If you turn it off, it will try to boot whatever's on the disk.