this post was submitted on 25 Jul 2024
316 points (99.4% liked)

Technology

58712 readers
4013 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 8 points 2 months ago (3 children)

i heard that linux users dont rlly like secure boot

[–] [email protected] 11 points 2 months ago (1 children)

They don't like it because it's mostly implemented in microsofts favor. It's shipped with microsoft keys by default and needs to be disabled to boot a lot of linux distros. If there was a more unbiased way to load a new os like a default key setup routine at first boot or a preinstalled key for major linux distros they wouldn't be so hostile towards secure boot. The technology isn't bad and it's the only way to not have somebody temper with your system at rest without TPM.

[–] [email protected] 2 points 2 months ago* (last edited 2 months ago)

i agree and makes sense

[–] [email protected] 18 points 2 months ago (1 children)

I don't speak for all Linux users, but it's not like we don't like the tech or the concept... We don't like it because a lot of the time it's just another way for Microsoft to throw around their weight, you need a valid key to sign your kernel images with to be able to boot another OS instead of Windows, and some motherboards don't support installing your own keys as trusted keys. But usually there are ways around that issue nowadays.

And also it's not an easy process if you're not an advanced user of sorts. You have to know what is entailed, what to use, where to store your keys safely, have a script to re-sign the kernel image every kernel update(which happens every week on something like Arch), etc.

[–] [email protected] 1 points 2 months ago* (last edited 2 months ago)

ngl i got fedora secure boot working with microsoft uefi keys it required some tinkering

[–] [email protected] -2 points 2 months ago (1 children)

Which is dumb. Secure Boot does make sense (if handled correctly, unlike here).

[–] [email protected] 1 points 2 months ago* (last edited 2 months ago)
[–] [email protected] 10 points 2 months ago

Clearly, the solution is to just abandon all ~~hope~~ higher level abstraction. Pedal to the metal with Assembly (and maybe LISP and Forth) straight from boot

[–] [email protected] 33 points 2 months ago (2 children)

What is Secure Boot actually good for? Serious question.

[–] [email protected] 10 points 2 months ago

Speaking from my background, it prevents someone from trying to boot using an external device to access your system, assuming you have a BIOS password in place.

Of course encrypting your drive works just as well, but security in depth demands a “why not both?” Approach

[–] [email protected] 35 points 2 months ago (1 children)

It's supposed to prevent unsigned files from being loaded by the UEFI (AFAIK) which could possibly help with rootkits, if it doesn't somehow sign itself. However, these are pretty rare if you don't allow sketchy software to access your boot partition, and will often cause issues with non major Linux distros.

[–] [email protected] 9 points 2 months ago* (last edited 2 months ago) (2 children)

I had dell pc refuse to boot Linux mint because of secure boot

[–] [email protected] -1 points 2 months ago (1 children)

Then you haven't set it up right

[–] [email protected] 4 points 2 months ago (2 children)

Nah man, it didn't even allowed to boot iso from ventoy until i disabled secure boot

[–] [email protected] 1 points 2 months ago (1 children)

Well of course, thats the setup. Disabling secure boot. If it didn't stop you from booting a third party OS without you toggling that BIOS option, then the security feature would be pointless.

[–] [email protected] 1 points 2 months ago (1 children)

Imagine if in the future that option becomes untouchable

[–] [email protected] 1 points 2 months ago

Then it would be an issue and I would not suggest anyone buy those machines

[–] [email protected] 6 points 2 months ago

I've been wary of secure boot and pluton chips for this reason.

load more comments
view more: next ›