Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux and Secure Boot certificate expiration (2025)

lwn.net

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Linux and Secure Boot certificate expiration (2025)

#21

Post by Bender »

Animats wrote: post #17
Bender wrote: post #14

Earlier quoted context omitted.

I had to vouch your comment, not sure what happened there. Something in your technical output must have triggered HN. One can use mokutil to see if Secure Boot is enabled after installing it. I assume the OEM installation or update of the BIOS must have included that cert but I am just guessing. mokutil --sb-state

Thanks. Just checked. Secure Boot is not enabled on any of my machines, which are Linux-only. Whew! (I wonder if any of the ASUS subnotebooks I bought off eBay for minor embedded stuff have this problem. Have to power them up.)

My ASUS laptop had it enabled. I had to disable it as there just wasn't enough non volital memory to hold all the updates even after remove several EFI entries and resetting the BIOS. All my mini-PC's updated fine however. My Linux Protectli routers already had it disabled thankfully. They use Coreboot, unsure if that was a factor.

Re: Linux and Secure Boot certificate expiration (2025)

#22

Post by tgma »

arcza wrote: post #5

[flagged]

I mean, NSA-blessed or not, the way this happened was not some hidden conspiracy. It was in the open. The reason it happened is all of these machines are basically made to run Windows, so they need to have Microsoft keys. Microsoft was pushing for Secure Boot, for security and "trusted computing" (evil or good, depending on your PoV,) and open source complained that this is a way to lock in users to Windows, so the compromise choice was to have them sign a GRUB shim so that Linux could just as easily be run without enrolling your own keys.

Re: Linux and Secure Boot certificate expiration (2025)

#23

Post by 0l »

Bender wrote: post #2

They left out the steps to update it. I made a rough attempt at a document for this. [1] Please let me know if I missed a validation step. I have done this on six machines but they were all Linux. Not tested on BSD. Archive [2] in the event I was too aggressive in blocking bots. [Edit] I should also include this [3] thread for completeness sake. Some people people were playing with a shim work around but it looks lik…

FYI your server returns Brotli encoded content, even if the request has only Accept-Encoding: gzip, deflate, zstd - making it unreadable in for me (Firefox on Fedora).

Re: Linux and Secure Boot certificate expiration (2025)

#24

Post by Bender »

0l wrote: post #23
Bender wrote: post #2

They left out the steps to update it. I made a rough attempt at a document for this. [1] Please let me know if I missed a validation step. I have done this on six machines but they were all Linux. Not tested on BSD. Archive [2] in the event I was too aggressive in blocking bots. [Edit] I should also include this [3] thread for completeness sake. Some people people were playing with a shim work around but it looks lik…

FYI your server returns Brotli encoded content, even if the request has only Accept-Encoding: gzip, deflate, zstd - making it unreadable in for me (Firefox on Fedora).

I actually did that on purpose since all browsers support brotli I risked the possibility someone might have disabled it with an add-on. I wanted to see how many bots that would break. It may not be the most logical process but I just use CanIUse [1] to see what supports Brotli. I ignore the Opera Mini block as they seem to support almost nothing.

[1] - https://caniuse.com/brotli

Re: Linux and Secure Boot certificate expiration (2025)

#25

Post by cute_boi »

maxlybbert wrote: post #19
arcza wrote: post #5

[flagged]

In 2012, Windows 8 stopped booting on computers without UEFI secure boot. Hardware companies weren’t enthusiastic, but they couldn’t ignore Microsoft’s demand. Microsoft published the spec for how Windows 8 would handle secure boot, and that included the crypto key that will be expiring in September. Microsoft’s spec did actually have provisions for non-Microsoft operating systems. Linux developers didn’t all agree a…

Red hat always creates problem in linux....

Re: Linux and Secure Boot certificate expiration (2025)

#26

Post by cute_boi »

jmclnx wrote: post #16

It needs to be said, this is what you get by "trusting" Microsoft. There really is no need for secure boot in Linux. The only reason to have it is if you dual boot because M/S says so. If using Linux by itself, just disable secure boot and have done with it.

I don’t know why we ended up trusting microslop. Red Hat implemented it for the sake of convenience causing all these issue.

Re: Linux and Secure Boot certificate expiration (2025)

#27

Post by whateverboat »

cute_boi wrote: post #25
maxlybbert wrote: post #19

Earlier quoted context omitted.

In 2012, Windows 8 stopped booting on computers without UEFI secure boot. Hardware companies weren’t enthusiastic, but they couldn’t ignore Microsoft’s demand. Microsoft published the spec for how Windows 8 would handle secure boot, and that included the crypto key that will be expiring in September. Microsoft’s spec did actually have provisions for non-Microsoft operating systems. Linux developers didn’t all agree a…

Red hat always creates problem in linux....

No. I was there in 2012, Redhat's solution was the only solution which would have properly worked. Eventually, the infrastructure developed for measured boot due to these measures allowed Linux to use TPM in it's proper usage, and allowed sedutils and similar applications to be supported on linux.

Re: Linux and Secure Boot certificate expiration (2025)

#28

Post by 0l »

Bender wrote: post #24
0l wrote: post #23

Earlier quoted context omitted.

FYI your server returns Brotli encoded content, even if the request has only Accept-Encoding: gzip, deflate, zstd - making it unreadable in for me (Firefox on Fedora).

I actually did that on purpose since all browsers support brotli I risked the possibility someone might have disabled it with an add-on . I wanted to see how many bots that would break. It may not be the most logical process but I just use CanIUse [1] to see what supports Brotli. I ignore the Opera Mini block as they seem to support almost nothing. [1] - https://caniuse.com/brotli

Ah, fair enough. Well Firefox should support Brotli by default, so it's probably something going on on my machine.

Re: Linux and Secure Boot certificate expiration (2025)

#29

Post by vladvasiliu »

NelsonMinar wrote: post #10

I'm surprised more people aren't freaking out about this. It seems likely a whole lot of Linux machines are going to fail to reboot in the next few months. The problem affects VMs too. I was grateful Proxmox put a little warning in its hypervisor GUI with a button to press to fix the BIOS of its VMs. Secure Boot has been deeply broken for years, not providing meaningful security on most consumer machines.

Why has it been broken? I’m running secure boot on all my machines with my own certs. It works fine.

Whatever ms and hp / Lenovo do with their certs doesn’t affect me, since I only have my certs installed. Except on a single machine whose purpose is running windows, but it’s not on the critical path for my job.

Re: Linux and Secure Boot certificate expiration (2025)

#30

Post by expedition32 »

tombert wrote: post #7
arcza wrote: post #5

[flagged]

It's not exactly new for Microsoft to slide themselves in somewhere and become the "standard" before anyone has really thought about how terrible their products are.

Nor is it Microsoft exclusive. Google and Apple have the same modus operandi.
Post reply on HN