Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux and Secure Boot certificate expiration

lwn.net

Post reply on HN
Print view View original

21–30 of 272 posts

Re: Linux and Secure Boot certificate expiration

#21

Post by blkhawk »

pbhjpbhj wrote: post #15
saidinesh5 wrote: post #4

Just out of curiosity, how good is the secure boot experience these days? I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

Every couple of years MS do an update that messes up multi-boot/dual boot. I'm sure it's on purpose at this point, and relatively sure "Secure Boot" is how they achieve it. Still on Windows only for kids games. Linux user since last millennium.

As a Linux-only gamer since 2019 I wonder what kids games you are talking about?

Re: Linux and Secure Boot certificate expiration

#22

Post by bravetraveler »

mormegil wrote: post #17
bravetraveler wrote: post #6

Earlier quoted context omitted.

Signature maintenance for modules can be fully automated. Enrollment requires navigating a mildly-intimidating interface a single time to accept the new PKI. Fine for systems you physically manage, anything remote in a datacenter I wouldn't bother (without external motivation)

Which is strange because secure boot should be useful in _exactly_ the situation you don't have physical control of the HW, shouldn't it? I guess the threat model for a common not-that-important company does not include evil data center (and it's dubious if SecureBoot would protect you in reality), but wasn't that one of the motivations?

Aye, though an evil maid has higher barriers and more paperwork in a DC.

I hesitate based on that mitigation and the untold operational pain. Sometimes it's worth it, other times it isn't.

Re: Linux and Secure Boot certificate expiration

#23

Post by ChocolateGod »

mormegil wrote: post #17
bravetraveler wrote: post #6

Earlier quoted context omitted.

Signature maintenance for modules can be fully automated. Enrollment requires navigating a mildly-intimidating interface a single time to accept the new PKI. Fine for systems you physically manage, anything remote in a datacenter I wouldn't bother (without external motivation)

Which is strange because secure boot should be useful in _exactly_ the situation you don't have physical control of the HW, shouldn't it? I guess the threat model for a common not-that-important company does not include evil data center (and it's dubious if SecureBoot would protect you in reality), but wasn't that one of the motivations?

Well you can tie it to TPM to store your encryption key which should only produce the key when the boot parameters match the key. This is what Windows already does but its not fully supported under Linux and somewhat insecure as you can't encrypt the initramfs (so someone can infect boot process there instead).

Re: Linux and Secure Boot certificate expiration

#24

Post by littlestymaar »

sugarpimpdorsey wrote: post #16
greatgib wrote: post #3

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to win about this so easily as it was never seriously challenged.

It makes more sense if you view it for what it is: Honest Satya's Certificate Authority. Microsoft showed they can semi-competently run a PKI. The end. Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.

> Now had the Linux folks stepped up to the plate early on, instead of childishly acting

This kind of victim blaming gets annoying very quick, as if the Linux ecosystem had any leverage at all on PC manufacturers…

Re: Linux and Secure Boot certificate expiration

#25

Post by ChocolateGod »

pbhjpbhj wrote: post #15
saidinesh5 wrote: post #4

Just out of curiosity, how good is the secure boot experience these days? I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

Every couple of years MS do an update that messes up multi-boot/dual boot. I'm sure it's on purpose at this point, and relatively sure "Secure Boot" is how they achieve it. Still on Windows only for kids games. Linux user since last millennium.

> Every couple of years MS do an update that messes up multi-boot/dual boot

IIRC the last time this happened it was the fault of Linux distros not updating their packages, it was just a Microsoft update updating the security requirements that affected distros that were caught slacking.

Re: Linux and Secure Boot certificate expiration

#26

Post by littlestymaar »

mkj wrote: post #12

It's not just Linux - certificates to sign Windows are also affected in 2026. https://support.microsoft.com/en-us/topic/windows-secure-boo... https://techcommunity.microsoft.com/blog/windows-itpro-blog/... Really it seems like having any expiry date for these certificates is a mistake. The one thing it might protect against is a compromised signing key, but if you have to wait 15 years for a compromised key to stop b…

Is that really a mistake? Or Microsoft just has no interest to care about computers not working as intended anymore.

It certainly wouldn't be the first evidence of that…

Re: Linux and Secure Boot certificate expiration

#27

Post by p_l »

oakwhiz wrote: post #14
nine_k wrote: post #9

Earlier quoted context omitted.

Basically every x64 computer is intended to be able to run Windows. Hence MS had to be involved, and I suppose nobody else with serious money wanted the burden. AFAICT you can still disable Secure Boot in most UEFI firmware, and boot anything you like (or not like, if an attacker tampers with your system).

We don't even reap the benefits of autocratic decisions from Microsoft in this area. Boards always come out with things like messed up ACPI, etc.

Boards' ACPI etc. is still better than what it would be without "certified for Windows" (whatever name of the hour is) programs

Re: Linux and Secure Boot certificate expiration

#30

Post by robin_reala »

sugarpimpdorsey wrote: post #16
greatgib wrote: post #3

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to win about this so easily as it was never seriously challenged.

It makes more sense if you view it for what it is: Honest Satya's Certificate Authority. Microsoft showed they can semi-competently run a PKI. The end. Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.

Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=647959
Post reply on HN