Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux and Secure Boot certificate expiration

lwn.net

Post reply on HN
Print view View original

41–50 of 272 posts

Re: Linux and Secure Boot certificate expiration

#41

Post by pjmlp »

littlestymaar wrote: post #26
mkj wrote: post #12

It's not just Linux - certificates to sign Windows are also affected in 2026. https://support.microsoft.com/en-us/topic/windows-secure-boo... https://techcommunity.microsoft.com/blog/windows-itpro-blog/... Really it seems like having any expiry date for these certificates is a mistake. The one thing it might protect against is a compromised signing key, but if you have to wait 15 years for a compromised key to stop b…

Is that really a mistake? Or Microsoft just has no interest to care about computers not working as intended anymore. It certainly wouldn't be the first evidence of that…

Being cynic, there was the expectation that computers would get replaced before the certification expiration date.

Re: Linux and Secure Boot certificate expiration

#42

Post by EnPissant »

greatgib wrote: post #3

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to win about this so easily as it was never seriously challenged.

It's just a default. You can override it with your own platform key.

Re: Linux and Secure Boot certificate expiration

#44

Post by froh »

ACCount36 wrote: post #33
sugarpimpdorsey wrote: post #16

Earlier quoted context omitted.

It makes more sense if you view it for what it is: Honest Satya's Certificate Authority. Microsoft showed they can semi-competently run a PKI. The end. Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.

Secure Boot is the computing antichrist, and Linux folk were 100% right to rally against it. As well as a whole bunch of other "Trusted Computing" garbage.

mind to elaborate?

I'd love to know if my machine has been compromised with early boot stage "meta-hypervisor" or not.

the promise of secure boot and trusted computing is backdoor-free boot.

what is in your eyes evil and garbage about that?

Re: Linux and Secure Boot certificate expiration

#46

Post by pdimitar »

blkhawk wrote: post #19
nine_k wrote: post #9

Earlier quoted context omitted.

Basically every x64 computer is intended to be able to run Windows. Hence MS had to be involved, and I suppose nobody else with serious money wanted the burden. AFAICT you can still disable Secure Boot in most UEFI firmware, and boot anything you like (or not like, if an attacker tampers with your system).

Secure boot belongs to a class of security that while clearly giving a theoretical benefit in practice it falls far short of providing any benefit whatsoever at least to the user of a system. Its introduction was mostly part of a wider (probably partially defunct and failed regarding mobile x86) strategy to lock down the PC so the Microsoft store and purchased apps through it would be more secure from the end-user. S…

What kinds of attacks was Secure Boot designed to mitigate? Is it the evil maid attack? Or an accidentally ran with `sudo` program can indeed screw your entire boot process and inject rootkits etc.? Or is it something else?

Re: Linux and Secure Boot certificate expiration

#47

Post by nirui »

mkj wrote: post #12

It's not just Linux - certificates to sign Windows are also affected in 2026. https://support.microsoft.com/en-us/topic/windows-secure-boo... https://techcommunity.microsoft.com/blog/windows-itpro-blog/... Really it seems like having any expiry date for these certificates is a mistake. The one thing it might protect against is a compromised signing key, but if you have to wait 15 years for a compromised key to stop b…

I'm feeling/guessing the expiration is more of a flow-with-tradition thing. TLS certificates expires, it's part of the security feature, so why not Secure Boot certificates too?

And of course, it gives the root certificate issuer enormous amount of power as well, good riddance from the POV of Microsoft.

However, I think if Microsoft REALLY care about security, they should not let application installed on their system to do anything that is unapproved by the user (such as installing a virus that encrypts all their data), which could actually enhance the user experience and security. But, with secure boot, at least you can be sure that your Windows kernel is not tampered so it can serve the virus correctly :)

Re: Linux and Secure Boot certificate expiration

#48

Post by EnPissant »

saidinesh5 wrote: post #4

Just out of curiosity, how good is the secure boot experience these days? I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

UKI + secure boot works really well, but it is somewhat manual of a set up on Arch (what isnt).

If properly set up the only files you generate are:

- /efi/loader/random-seed

- /efi/EFI/Linux/arch-linux.efi

- /efi/EFI/Linux/arch-linux-fallback.efi

and the .efi are all automatically signed by hooks.

You can even skip a bootloader and boot the images directly.

Re: Linux and Secure Boot certificate expiration

#49

Post by ACCount36 »

froh wrote: post #44
ACCount36 wrote: post #33

Earlier quoted context omitted.

Secure Boot is the computing antichrist, and Linux folk were 100% right to rally against it. As well as a whole bunch of other "Trusted Computing" garbage.

mind to elaborate? I'd love to know if my machine has been compromised with early boot stage "meta-hypervisor" or not. the promise of secure boot and trusted computing is backdoor-free boot. what is in your eyes evil and garbage about that?

Who controls the fucking certs?

"My computer was compromised with an early boot stage hypervisor backdoor" happens basically never. It's an attack vector that exists almost entirely in the minds of infosec fucktards.

"My brand new device ships with vendor-selected boot certificates that can't be changed, can't be overridden, and control what software I can install onto my own device" happens with every other smartphone, gaming console, car, and even some PCs.

"Trusted Computing" is, and always was, about making sure that the user doesn't actually own his device. This is the real, tangible attack vector - and the target of this attack is user freedom and choice.

Re: Linux and Secure Boot certificate expiration

#50

Post by fsflover »

froh wrote: post #44
ACCount36 wrote: post #33

Earlier quoted context omitted.

Secure Boot is the computing antichrist, and Linux folk were 100% right to rally against it. As well as a whole bunch of other "Trusted Computing" garbage.

mind to elaborate? I'd love to know if my machine has been compromised with early boot stage "meta-hypervisor" or not. the promise of secure boot and trusted computing is backdoor-free boot. what is in your eyes evil and garbage about that?

Consider using Heads with TPM and Librem Key to detect possible compromise of your boot stage. It doesn't obey MS but you.
Post reply on HN