Hacker News Reader

This is a BIOS vs. UEFI thing, it has nothing to do with Windows or Secure Boot or the TPM requirement.

When you do an initial OS install today, you have to boot the computer in the mode that you intend to use (Legacy BIOS / CSM mode vs. UEFI mode, with or without secure boot). This is the case with Linux too. You can't really just switch modes afterwards.

For Windows, you'll definitely need a reinstall. (Edit: I didn't read your post carefully, apparently there's a tool to fix it? Neat!)

For Linux, there's probably a way to re-bootstrap everything yourself (reorganize your partitions, create the EFI partition, copy your kernel and initrd, etc.), but reinstalling is preferred, and will almost certainly be easier.

Several years ago I screwed up a Windows/Linux dual boot by installing one under BIOS and the other under UEFI. The only way to select the operating system was to go into the firmware settings and flip the CSM/UEFI bit each time. That was an annoying week, but the fix was to turn off CSM and reinstall everything under UEFI.

>For Windows, you'll definitely need a reinstall.

There is this base assumption that UEFI=GPT and that BIOS=MBR which is only partially true (at least for windows 7/8/8.1/10).

In fact the UEFI is perfectly capable of booting from both GPT and MBR disks, the issue is only that when you install an OS in CSM (or BIOS) on a MBR disk, the OS loader/boot manager installed will be the one needed for BIOS booting, and the UEFI one won't be installed.

Besides there is the requisite of having a FAT32 (this can usually be worked around with a UEFI NTFS driver).

But a "normal" BIOS install on MBR (with a dedicated, without drive letter automatically assigned, FAT32 primary partition dedicated to the boot files) can be booted just fine in UEFI by simply adding to that partition the needed UEFI loaders.

The opposite (booting with BIOS from a GPT disk) is as well possible but needs some non-standard modifications/hacks to the disk MBR, that - although proved in the years to be "safe" remain a sort of hack (not recommended if not really-really needed).

>When you do an initial OS install today, you have to boot the computer in the mode that you intend to use (Legacy BIOS / CSM mode vs. UEFI mode

That's one worthwhile technique.

Not many users want to go much further since then you need at least twice as many boot files as the minimum and it's best to test each configuration thoroughly.

If you're dual-booting you are already putting twice as much effort into OS installation & maintenance already, this is not really popular but I did post my latest findings just a couple days ago how I use 4 sets of boot files for W10 & Ubuntu on BIOS & UEFI:

https://news.ycombinator.com/item?id=27629350

It's a little entensive background info, the basic outline is shorter than that.

+1. I had to go through this when I switched from BIOS to UEFI. Windows 11 needs to be criticized for mandating TPM but not for this.

I don't think you need to reinstall much. As long as you have a UEFI-compatible bootloader after converting your hard drive to GPT partition scheme, your UEFI should pick it up. Windows certainly installs one.

To me it seems Secure Boot has always been a near-zero-value bullshit invented and pushed by Microsoft to make life of dual-booters harder.

The only theoretical value I see in Secure Boot is if you're trying to build a tamper-resistant laptop. You'd have to only run Linux, you'd have to disable everything except your own signing keys (rather than using the shim, or anything else signed by Microsoft, because they'll sign (or can be coerced into signing) basically anything), you'd probably want to skip GRUB and boot an EFI executable directly without editable kernel arguments, and you'd have to manually sign every kernel update or module that you wanted to load.

But even then, I see no reason to trust that a given UEFI implementation won't quietly accept some secret hard-coded key even after all of the defaults have been removed, so now I guess we're stuck with older machines that can be flashed with Coreboot?

Yeesh. The number of people who can get this to work has got to be vanishingly small...

Every single cloud provider uses Secure Boot as an additional layer of security for machines.

Secure boot and corresponding protection is just like security protection on Mac/iPhone/Android by Secure Enclave / TrustZone. Maybe users something like using FOSS phone don't like them, but it seems to better to have it in general.

On Windows 10, turning on Secure Boot then requires every boot driver to be manually signed by Microsoft themselves, in addition to the dev's code signing cert. This is a significant security boundary, given that most malicious actors won't go through the process of EV registration with Microsoft to gain this. (I guess netfilter is an interesting exception) If they compromise someone's credentials and still get a driver signed, Microsoft have a copy of the driver and when/where it was signed.

In addition, Secure Boot prevents malware from changing the bootloader (and helps stop boot-time ransomware). It's just a good sense fix to many attack vectors left alone for years.

You don't have a pretty new PC, you have parts from a new PC mixed with parts from an older PC.

No manufacturer has shipped an mbr formatted drive in the last 5 years.

Manufacturers don't generally ship internal drives with any kind of partition table at all in my experience - that gets added when you do the initial install, which generally depends on what mode you booted the installer from and in turn probably on your motherboard BIOS defaults...

Correct, Dell, Lenovo, HP even enable the basic EFI(bios) menu with Secureboot enabled, granted this is a bit disabled if you get an Ubuntu/XPS model but can be enabled easily for dual booting.

This is relatively a non-issue for most orgs, you should have an imaging solution in place, if not there is Windows Hello/Autopilot, not free but easy to deploy and helps you manage and orchestrate, which is what every corporation should do with owned devices.

Machines 5yrs+ support TPM 2.0 unless you bought absolutely bargain basement prices like Dell Inspirion models from Walmart instead of Dell.com and such, but even lately those also include TPM and Secure Boot as Microsoft demanded it from it's vendors.

Building your own PC, is something that, is kinda dead in todays times though.

"Building your own PC, is something that, is kinda dead in todays times though."

The number of people having issues finding high end graphics cards over the past 18 months says otherwise.

Reading this made me yearn for the days of IRQ conflicts.

IRQ Conflicts and BSOD from using Windows 95/98 drivers on Windows ME days...

I have a Lenovo desktop with a Ryzen 4000 series APU, and the only way I can reliably install BIOS updates is to disable Secure Boot, as the other methods just never work.

It doesn't help that the Lenovo BIOS updating software is crap too. I don't know why it asks me if I want to change the serial number every time it runs (and it doesn't default to "No").

There's also some computers that would need a TPM firmware upgrade from 1.2 to 2.0. So another not mom-and-pop friendly task to add to the pile.

Most people just bought Windows 8/10 preinstalled PC that is installed with UEFI/GPT, probably CSM disabled by default, and hopefully TPM enabled by default. Most Windows 7 PCs are old to be supported by Windows 10.

So, who still using Windows 10 on MBR/BIOS installation is mostly beginner for DIY PC.

Thats a whole lot of generalising, and a broad assumption at the end there. Even with UEFI enabled there can still be hudles to getting secure boot and TPM2.0 enabled without messing up the current install.

So the moral of this story is that your recent computer was actually compatible with Windows 11 and that installing an OS that's currently in alpha onto a computer that you built yourself requires being computer savvy - yeah?

No, the pc does contain compatible hardware but by default configured in a way which is not compatible.

Even a tech savvy user then gets bored of the process to change the configuration.

Most other people will simply give up and either not use the new windows version or replace the perfectly good hardware with something else that someone else has already configured.

Now I'm also bored already just trying to explain what's going on here.

Most people will not have an MBR scheme on an ssd. Most people who have a Windows PC they bought towards the end of Windows 7/Windows 8 era will have secure boot on already and working. This user is an outlier.

Most other people aren't going to build their own computer and try to install an alpha preview of an OS on it. It kinda sounds like you signed up for that boring work to me.

Installing the non-alpha upgrade will improve this experience how?

Things like this not being setup optimally on pre-built PCs is also not exactly unusual. Although I assume it'll mostly lead to people sticking with Win10 for longer.

> Installing the non-alpha upgrade will improve this experience how?

For one thing it'll cut the 30% of the story that involved figuring out the compatibility issue iteratively.

While true, I think his point is more about how many computers will be scrapped because non techie people won’t know to do the above and assume that they need a new computer. Then massive e-waste pile grows. Do we even know if UEFI compatible hardware and SecureBoot is enabled by all OEMs by default? I could see a scenario where that’s not true. Microsoft should have made this a suggestion and warned about why it’s better for the end user rather than forcing the issue.

I could also see “Your computer is not compatible. Get Surface Pro for XX% off at the Microsoft store!” Because antitrust and MS are a thing, historically.

Why would non techie people be building their own computers instead of buying from an OEM? Or installing an alpha OS that, on first release, didn't even tell you why it wasn't compatible?

> Do we even know if UEFI compatible hardware and SecureBoot is enabled by all OEMs by default?

If they have a Windows 8 sticker on them, or above, yes.

> Why would non techie people be building their own computers instead of buying from an OEM?

Because they play games and the OEMs mostly sell overpriced crap in that market segment.

TPM isn't necessarily enabled though. And it might require a TPM BIOS upgrade to 2.0.

TPM 2.0 requirement was announced to OEMs back at the 8.1 launch I believe. If they haven't been pushing TPM 2.0, talk to your OEMs.

>Why would non techie people be building their own computers instead of buying from an OEM?

Because building a computer is very easy as doesn't require deep knowledge of the inner working of BIOS. I put together IKEA furniture, despite not having a deep understanding of carpentry. I added a dimmer light switch in my house, despite not being an electrician. There are many people that can build a computer and troubleshoot 95% of the basic simple problems that come with that, but are not deeply technical.

None of what was described in that post sounded like it required any kind of deeply technical knowledge to solve at all.