Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a key from Microsoft that is set to expire in September. After that point, Microsoft will no longer use that key to sign the shim first-stage UEFI bootloader that is used by Linux distributions to boot the kernel with Secure Boot. But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen. It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.

  • Technus@lemmy.zip
    11·
    3 months ago

    Actually, I would love for you to explain to me how Secure Boot alone would protect someone from any of that. If you want to protect files, you need full disk encryption, not Secure Boot.

    Or are you seriously expecting a government-level threat actor to bother to:

    1. Sneak into your home while you’re away or asleep;
    2. Overwrite your bootloader or UEFI with a rootkitted image of the same version so it’s impossible to tell;
    3. Wait for you to boot your computer and enter your disk encryption password, then:
    4. Use the rootkit to read the decrypted files off your disk?

    That’s the great thing about fascist governments, is they have no need to be that sneaky. They can just change the laws to make whatever you’re doing illegal and jail you until you agree to give up your documents, or simply hit you with a $5 wrench until you tell them the password.