121–130 of 276 posts
Isn't secure boot the first thing you disable when you install linux?
If you are using Nvidia graphics you have to deal with signing the kernel drivers but it is pretty easy, AMD or Intel works out of the box.
Earlier quoted context omitted.
> widespread rootkit level malware and they are trying to stay ahead of the curve Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.
[flagged]
Earlier quoted context omitted.
> I thought flatpak would fix this on linux, but every time I flatpak itself updates half of its apps break with mysterious error messages and refuse to launch until they're also updated. Linux oldheads could've told you this would happen before the project was even created. We solved package management and dependencies in the 90s and no one has improved on it since. Just stick with stuff in your distro's repos. If i…
Yeah alright but people want to like, do things.
Edit: Or use Windows binaries with your distro-provided Wine. Win32 is the only stable user-level Linux API.
I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.
If security vendors followed this logic then all an attacker would have to do is look up the error and render the security moot. By leaving the reason vague an attacker has no immediate feedback and no clue how to remedy. I vastly prefer the way this works now.
I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…
Ubuntu regularly locks up and black screens when I try to sleep/hibernate. It's a very common problem that has nothing to do with Windows or Microsoft. I also have had 0 issues with dual booting for roughly 10 years now. HN wouldn't be HN without some baseless MS bashing.
Isn't secure boot the first thing you disable when you install linux?
I installed Linux on a new laptop yesterday, and couldn't get either NixOS or Debian to install until I turned off secure boot. So I guess these distros don't bother getting every release signed by Microsoft. At least it was easy to turn off. I just wish the error message mentioned Secure Boot -- it took me a few minutes to figure out what was wrong. At first I thought I had a corrupt USB stick or something.
Isn't secure boot the first thing you disable when you install linux?
I saw someone else give a similar reasoning that if there were a booting error, they would never assume it was a rootkit, but some breakage between all of the booting cruft. I certainly lack any expertise to understand what happens during boot to be able to diagnose problems.
Isn't secure boot the first thing you disable when you install linux?
Earlier quoted context omitted.
My Windows install is stuck in a boot loop like this - it spends 10 minutes trying to update and then fails, except maybe 1/3 times it then boots normally. I don't even try to do anything about it, I just marvel at it.
Yeah, it turns out applying updates during boot is bad design. I'm sure plenty of people at MS realise it is, but I guess they don't care enough to fix it.
A recent Linux Unplugged episode went into how one can use the TPM to set up a secure and trusted chain of trust for the booting process on Linux [0] using Clevis [1], very interesting! [0] https://linuxunplugged.com/572 [1] https://fedoramagazine.org/automatically-decrypt-your-disk-u...
I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…
Personally, I trust LUKS with passphrases far more than I trust some random proprietary hardware implementation nobody can audit...
It's also important to me to be able to recover the disk contents with the passphrase on another machine if the motherboard dies. Maybe that's what you meant (backup passphrase), but I think you meant requiring both?