• SaharaMaleikuhm@feddit.org
    3 days

    I will just never bother with any of this Secure boot nonsense. I leave that bs to the windows users.

        • h4lf8yte@lemmy.ml
          2 days

          Evil maid attacks. Trusted boot is necessary to prevent the modification of unencrypted boot code like bootloader + kernel + initrd. Modified boot code could potentially steal the master key for the root volume while it gets entered. Also rootkits that inject below the os.

  • RiQuY@lemmy.zip
    3 days

    imo the only useful place to use secure boot is on a laptop with password protected bios and encrypted disk, in case someone wants to steal it they can’t recover your data or if they want to put a virus in your pc they literally can’t.

    I don’t see any reason to put secure boot on a desktop PC that’s already locked inside your house.

    • Coriza@lemmy.world
      2 days

      That is not the purpose of Secure Boot. The purpose is to establish a chain of trust of all code running on the system from boot and as such eliminate rootkits that can hide from the OS. A classic example is the MBR bootkit. Of course that this is mostly out of the window if at some point in the chain the trusted code just runs untrusted code, like the bootloader or the OS running unsigned code. Also the implementation is terrible, a proper implementation would allow the user to use their own certificates and only their own certificates, otherwise a compromised generic certificate fucks everything up like it already happened.

    • Billegh@lemmy.world
      3 days

      I would disagree. The idea is great; eliminate preboot malware by trusting the whole boot stack. It has a place in computing and I would like to see it be something easier to work with.

      Pretty much everything about how it’s currently implemented is a mistake, I’ll agree with.

      • Zedd_Prophecy@lemmy.worldEnglish
        3 days

        More like who is implementing it. Take MS out of the picture and set it as an open standard.

      • slacktoid@lemmy.mlEnglish
        3 days

        Microsoft has unofficial support for ext4 for their EFI partitions on their azure cloud, which in itself is a violation of their standard.

        • libewa@feddit.org
          3 days

          UEFI doesn’t forbid you from implementing additional file systems, it just requires everyone to support UEFI-FAT. iBoot for example supports booting from HFS volumes.

                • libewa@feddit.org
                  2 days

                  You are free to implement any filesystem driver, and either load it in your custom implementation of EFI, or from an EFI image stored on a FAT partition. The EfiFs project provides many drivers under a GPL, including exFAT, Btrfs, ext2-4, NTFS, ISO9660 (cdfs), ZFS and also HFS(+).

    • programmerlexi@sh.itjust.works
      3 days

      My secure boot with hibernate works perfectly fine, or rather it did work fine before hibernate started freezing my system, secure boot or not.

      • jj4211@lemmy.world
        2 days

        With Linux? Kernel signed with your own key to get out of lockdown mode restrictions?

        • programmerlexi@sh.itjust.works
          2 days

          There are no lockdown mode restrictions on my system. Kernel is not signed, but i switched to UKIs a couple months ago (hibernation worked fine with these).

          It is worth noting that the failure is hibernating, not resuming. Normally hibernate takes ~1 minute with fans spinning at max speed, but it recently started not finishing and instead being stuck on a black screen for more than 30 minutes without the fans running until i run out of patience (i hibernate before i go to sleep or head out) and force power off the system (power button 10 second press on my system).