submitted 1 day ago* (last edited 1 day ago) by to c/linuxmemes@lemmy.world
 

top 50 comments

sorted by: hot top controversial new old
[–] 54 points 1 day ago (1 child)

Nothing more secure than a computer that won’t start up.

  • source
  • hideshow 1 child comment
  • [–] 65 points 1 day ago* (24 children)

    imo the only useful place to use secure boot is on a laptop with password protected bios and encrypted disk, in case someone wants to steal it they can't recover your data or if they want to put a virus in your pc they literally can't.

    I don't see any reason to put secure boot on a desktop PC that's already locked inside your house.

  • source
  • hideshow 24 child comments
  • [–] 1 point 10 hours ago

    That is not the purpose of Secure Boot. The purpose is to establish a chain of trust of all code running on the system from boot and as such eliminate rootkits that can hide from the OS. A classic example is the MBR bootkit. Of course that this is mostly out of the window if at some point in the chain the trusted code just runs untrusted code, like the bootloader or the OS running unsigned code. Also the implementation is terrible, a proper implementation would allow the user to use their own certificates and only their own certificates, otherwise a compromised generic certificate fucks everything up like it already happened.

  • source
  • parent
  • [–] 7 points 1 day ago (3 children)

    Secure boot is in case the OS gets tainted. It only allows a signed OS to boot.

    For example when new nvidia drivers are autocompiled into my Tumbleweed kernel during an update, on reboot the srcureboot asks if I want to view the new key or allow it. I then have to enter a password to add the key...otherwise it won't boot with that kernel.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 22 hours ago (2 children)

    Woo, Tumbleweed! Their support of it is a pretty strong plus. I would get that screen sometimes too but it confused me a lot and I ended up just being like "Accept key I guess? Oh cool it boots."

    What are you supposed to compare the key to? Nvidia's repo on a website using a different device, or before you update or what? Is it like comparing checksums in Dolphin?

    I'm not particularly afraid of Evil Maids vs. my Tumbleweed desktop, as I'm much too poor for hired help (lol), so I just turned it off.

    They make compelling points about using it for laptops though.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 11 hours ago (1 child)

    Yeah Tumbleweed supports a lot of things. Whenever people have complained about Linux not doing something, I'm like "Uh, OpenSUSE does"

    Since I'm updating the Kernel and nVidia driver modules, the system is making its own keypair, so I guess its not a check against a known supplied key but a machine specific key pair. Enrolling the key stores it to check against the kernel on boot.

    I suppose it protects against Random malware installs changing files, or if somebody swaps a drive on you.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 8 hours ago*

    Right? OpenSUSE stopped my distrohopping way before I thought I would. I love it.

    Ahhh thank you, that makes a lot more sense! I don't feel too at-risk on my desktop, but if I ever find myself having to take a laptop to like, DEF-CON, then sounds like it'd be pretty essential, along with full-disk-encryption, AppArmor/SElinux, and all those other "wildly inconvenient but more secure" protocols set up.πŸ˜‚ (Lmao that would be terrifying.)

    I might try to re-enable it just for the experience. After all, never know when some insane automated malware will hit the 'net that somehow exploits boot like that, and freaks out everyone who said "Nahh that's not possible."

  • source
  • parent
  • [–] 3 points 23 hours ago* (last edited 18 hours ago) (2 children)

    You’re thinking bitlocker not secure boot

    Edit: I was incorrect, see below.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 18 hours ago (1 child)

    disk encryption is much better with secure boot, because disk encryption requires a unencrypted partition, since the boot has to start somewhere unencrypted, and secure boot secures the unencrypted partition

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (13 replies)
    [–] 83 points 1 day ago (9 children)

    Everything about secure boot is a mistake.

  • source
  • hideshow 9 child comments
  • [–] 161 points 1 day ago (8 children)

    I would disagree. The idea is great; eliminate preboot malware by trusting the whole boot stack. It has a place in computing and I would like to see it be something easier to work with.

    Pretty much everything about how it's currently implemented is a mistake, I'll agree with.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 18 points 1 day ago (2 children)

    More like who is implementing it. Take MS out of the picture and set it as an open standard.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 18 hours ago (1 child)

    It is open, oddly enough. It's just that nobody ships anything other than Microsoft's keys. You can add your own. It's just that it is a tedious, manual process.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 34 points 1 day ago (4 children)

    Microsoft has unofficial support for ext4 for their EFI partitions on their azure cloud, which in itself is a violation of their standard.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 21 points 1 day ago (3 children)

    UEFI doesn't forbid you from implementing additional file systems, it just requires everyone to support UEFI-FAT. iBoot for example supports booting from HFS volumes.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 23 hours ago (7 children)

    if only secureboot support hibernate

  • source
  • hideshow 7 child comments
  • [–] 2 points 22 hours ago (6 children)

    My secure boot with hibernate works perfectly fine, or rather it did work fine before hibernate started freezing my system, secure boot or not.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 8 hours ago (1 child)

    With Linux? Kernel signed with your own key to get out of lockdown mode restrictions?

  • source
  • parent
  • hideshow 1 child comment
  • There are no lockdown mode restrictions on my system. Kernel is not signed, but i switched to UKIs a couple months ago (hibernation worked fine with these).

    It is worth noting that the failure is hibernating, not resuming. Normally hibernate takes ~1 minute with fans spinning at max speed, but it recently started not finishing and instead being stuck on a black screen for more than 30 minutes without the fans running until i run out of patience (i hibernate before i go to sleep or head out) and force power off the system (power button 10 second press on my system).

  • source
  • parent
  • [–] 1 point 19 hours ago (3 children)

    Did you maybe run out of swap space?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 6 points 1 day ago (5 children)

    Oof, I tried alpine for a bit, nothing worked. That was just beyond me for little gain.

  • source
  • hideshow 5 child comments
  • [–] 3 points 16 hours ago (2 children)

    Now I'm curious. What did you try that didn't work?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 19 points 1 day ago (2 children)

    sbctl is a nice tool for setting up secure boot:
    https://github.com/Foxboron/sbctl

  • source
  • hideshow 2 child comments
  • load more comments (1 reply)
    load more comments
    view more: next β€Ί