Brave New Trusted Boot World

As others have said, it's not a full-on brick (though I can see how it can be a pain to fix).

However, the third-party MS certificate can be signed with your own keys, as described on that same page [1].

I don't have a need for that (my PCs don't need any option ROMs), but I did sign MS's main Windows key so that I can dual boot Win11 / Arch (which MS doesn't sign) with my own key registered in the UEFI.

[1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

I fail to see how the ability to have all the bits on my unencrypted uefi partition be signed is such a doom and gloom scenario.

Having a world writeable initrd - that is an fs image with executables to be run as root before any other security settings have been enabled (etc) has always struck me as a bad idea.

Yes I'm aware that this technology, like literally every other technology ever invented (from the pointy stick all the way up), can be used for evil. That is a human problem not a "this technology exists problem"...

> ...the groundwork for the creation of an allmighty authority with the ability to "sanction" some (parts of) operating systems, but not others

"We must backdoor/ban all crypto because imagine what the criminals would do with it!"

> It's not that I feel entitled, and more that I'm required to use a bank to not starve, or at least to participate in the modern society. I'm not in this relationship by choice, I'm forced into it at metaphorical gunpoint by the economy.

At my last job, it was impossible to be paid except by direct deposit into a bank account. At certain times during the past couple years, it was impossible to go into my bank to do any transacting. I feel like I should be able to have a job without needing a smart phone and an app.

It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt".

Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and shrugging ambivalence, and you give good examples.

> Go look at /r/sysadmin or /r/

Please, I'd rather not :)

> executives who believe they're above things like "phishing awareness campaigns

My goodness I've met them. They're basically paid too much. I had to make a humint/influence piece for a major bank in London. Cybersec referred to it as "the cock problem"; basically mostly male with high six figure salaries whose security weakness was they "don't give a fuck". Same kind of fellas who would get pissed-up and drive their Aston Martin DB into a children's play-park. Major liability. They've learned they can transgress with impunity and just use money to solve it. What do they care if other people's money gets hacked? Not the best model for business, which requires a more upright mind-set to excel at. But banks don't exactly need to compete in a real business world.

> Technical measures are much cheaper and vastly more effective

Only in the short term. You'll need to forever keep your technical measures one step ahead of the mixture of malice and idiocy out there. A changed culture replicates and even grows itself.

I fail to see what all the panic is about. All of the SystemD tools mentioned here (iirc) don't actually rely much on SystemD proper and especially systemd-boot and the boot stub are just SystemD in name (I use both).

But regardless, this entire article is about how to have an actually secure boot on Linux (and not remote attestation), something which is certainly good for the user. Otherwise you're actually more easily susceptible to malicious actors stealing your data on the system you "trust". None of the steps listed here require trusting anyone other than the TPM (which is admittedly a flaw so long as we cannot audit them) and you can even use your own keys in pretty much all cases (provided -as discussed in other comments- MS hasn't f'd that up). I personally use a boot-stub based booting method with my own SB keys (but ironically, don't encrypt my root, so go figure), so I can vouch for the fact that it was actually quite painless to setup. Please don't jump down the slippery slope before you actually try these methods and realize that this is just as easy to deploy (you only need to disable secure boot first) and certainly a more secure option than using shim and an unsecured initrd.

Also, I don't understand where remote attestation entered the conversation here, and I also don't see why that can't be a community based thing (al la let's encrypt is now everyone's CA) where you can choose your providers or even roll it yourself.