Hacker News Reader

Comment by NelsonMinar | Hacker News Reader

If your BIOS allows it. Some don't, or if you disable Secure Boot you lose other motherboard features. My home server is an ASUS motherboard that loses Intel integrated graphics without UEFI, which makes installing an OS awkward. https://www.reddit.com/r/ASUS/comments/s68b25/psa_enabling_l...

Also like a sucker I thought secure boot was doing something to help secure the boot of my computer and was worth the bother.

View on HN

Disabling Secure Boot is not the same as enabling CSM (non-UEFI boot). You can disable Secure Boot while still booting via UEFI without CSM, and that shouldn't affect your graphics at all.

"If your BIOS allows it"

Which systems enforce Secure Boot out of the box and lose functionality without it? You mention something ASUS and Intel graphics being broken without UEFI which isn't the same thing.

Android. After rooting your phone, apps relying on the secure key store and DRM media playback are very likely to stop working.

That's nothing to do with Secure Boot though.

It does. Except they call it verified boot. Maybe rooting was the wrong term, it’s more about installing custom ROM, where this mechanism prevent your custom ROM from getting hold of DRM keys.

It's not the same technology.

> I thought secure boot was doing something to help secure the boot of my computer and was worth the bother.

it does, and it is. SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. it does not check the firmware for bugs or somehow sense them and skip over that code or something.

> SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority.

The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."

SB is definitely imperfect, but a useful tool in moving toward a trusted boot. I think we'd all agree having a trusted boot sequence is desirable, the point of contention being who gets to decide the criteria for trust. It's been a few years since I worked in the space but I think SB gets a bit of an undeserved bad rep (I'm sure because people were vocal early on). There is a SB signed uefi application that allows for enrolling other loaders based on the hash of the loader.

> who gets to decide the criteria for trust

Good point. Both are important: who does the trusting and how they define trust.

The latter is the second set of concerns: remote attestation.

I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia.

But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.

> I think we'd all agree having a trusted boot sequence is desirable

We don't.

That trusted authority can be you if you choose to enroll your own signing key. While its true that most motherboards come pre-seeded with Microsoft's keys there is absolutely nothing to stop you from removing those keys and replacing them with ones you specifically trust.

> if you choose to enroll your own signing key.

Can you also re-sign the firmware and hardware checks as well? Last I knew you could not.

Of course, you can't dual boot anymore.

https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.

That's not secure boot. It's possible your memory test only runs in BIOS/CSM mode, but that setting has little to do with secure boot. CSM disables secure boot, yes, but only as a side effect.

If you're on Windows, try launching Windows' memory test instead. That'll work both on secure boot and UEFI.

Reply on news.ycombinator.com