Hacker News Reader

Comment by fiddlerwoaroof | Hacker News Reader

So, the ability to boot Linux with Secure Boot is entirely dependent on some third party being willing to sign the bootloader? No thanks

View on HN

I see I’ve landed so deep in the sea of FUD, beyond my ability to keep my feet dry, but I’ll make one last attempt at spreading actual knowledge.

1. Too guaranteed boot Linux with UEFI Secure Boot OOB without technical fiddling you have to use GRUB signed using keys trusted by Microsoft, like Canonical’s keys. So kinda, yes.

2. Many firmwares allows you to roll your own keys, meaning you don’t have to trust MS or Canonical or anyone else.

So you have the choice between user-friendly (default) or improved security (requires fiddling).

I personally think the default makes sense for most users, and I’m already 200 miles beyond proving that Linux can indeed use UEFI and Secure Boot. That’s an established fact for more than half a decade now.

Not being able to disable those in BIOS won’t prevent you from loading Linux, and it would reflect better on the wider Linux-community if people stopped pushing such FUD.

Canonical has a good write up here, if you want more details: https://wiki.ubuntu.com/UEFI/SecureBoot

If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. So, option (2) would be ok, but having to rely on _Microsoft_ to run Linux on my laptop is exactly the sort of scenario everyone was afraid of 20 years ago.

> If I can’t upload my own signing keys to be trusted, it’s as good as useless to me.

I personally haven't seen a computer yet that doesn't allow this. Even if it's not provided the option to disable secure-boot is still available.

Phones are the real problem. As far as I can find only the Pixel phones will allow secure boot with a custom OS. If you own another phone you're already locked in to your manufacturers keys or no keys.

Reply on news.ycombinator.com