Bonum Certa Men Certa

Microsoft Secure Boot and Intel VMD Pointless on GNU/Linux and Lenovo’s Documentation Recommends That You Turn Them Off

Guest post by Ryan, reprinted with permission from the original

Secure Boot is Microsoft trash that was designed to paper over some of the reputation of Windows as a malware plaything.



The problem is that Secure Boot doesn’t actually work. uEFI firmware has been so horrendously bad from its inception that there’s always a Secure Boot escape.



Microsoft introduced the Windows RT (ARM, not the standard x86 instruction set CPU) devices, based on Windows 8, and there was a Secure Boot escape almost immediately. It was necessary to escape Secure Boot were there to be any other operating systems for these devices, because there was no option to turn it off. Something that may be coming with new “Windows 11” PCs, since Secure Boot is required or else Windows will refuse to load.



"Sometime they lose billions of dollars and quietly write it down."Someone got Grub (the bootloader program commonly used with GNU/Linux) to work on the Surface RT, but GNU/Linux was never ported to these things due to lack of interest at the time. Nobody bought the product and it was just another Microsoft FAIL. They have many of them, like Windows Phone. Sometime they lose billions of dollars and quietly write it down.



GNU/Linux has never had a big malware problem. Microsoft pays the “tech media” to imply otherwise, but it always turns out to be a bald-faced lie. More propaganda. More Microsoft bullshit!



In these churnalism articles, EVERYTHING with an open source license inevitably becomes “Linux”, even if it has the same problem on Windows. Even if it’s a part of Windows (like OpenSSL is). In some cases, when they refer to “Linux malware”, they mean malware that runs on Windows if you use the fake Linux (virtual machine with bad performance) in Windows, called WSL/WSL2.



And frankly, I’m getting sick and damned tired of Microsoft paying for this crap to be typed up and then Googlebombing Linux as part of their most recent smear campaign.



In South Park, Mr. Garrison, as a stand in for Donald Trump, defined something called DARVO, wherein the bully denies their bad behavior, then goes on the attack by reversing the victim and offender.



"“Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling."It’s hard to come up with a better description of what Microsoft has been doing for the past two decades. “Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling.



And of course, it’s easier to try to imply that GNU/Linux has problems than it is to fix your own Windows mess.



In the past 20 years, GNU/Linux has had fewer viruses and worms than you can count on your fingers which were even worth mentioning. None of them “just happened”, either. You had to defy GNU/Linux best practices of getting signed packages from your distribution or other trusted source, and grab random unsigned software from some internet site and jam it in somehow.



Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows.



In fact, according to most antivirus companies, Windows gets that in under a typical hour.



They don’t even try to keep up with detection patterns for most specific threats because they can’t. So, antivirus on Windows becomes mostly a guessing game except for the very most prevalent threats.



And when this happens, many threats are missed.



"Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows."That’s why you hear about Ransomware attacks that mean no gasoline on the eastern seaboard of America or how a poultry plant can’t process chickens. The media, bribed by Microsoft money, never mentions Windows.



Windows Security is so godawful that they add tons and tons of fake security bullet points that are trivially bypassed and probably don’t do much except break legitimate applications that are just too old to anticipate them, or need to write somewhere and aren’t automatically allowed to.



Did you enable Controlled Folder Access to “protect against Ransomware” and now LibreOffice can’t save your documents?



Congratulations. Even though there are 4 ways to use the Windows system to evade this protection, and malware authors will do it, your LibreOffice broke.



"Disable Secure Boot and turn off Intel VMD."What’s more telling is that Lenovo’s documentation on how to install GNU/Linux recommends changing uEFI (BIOS) settings.



Specifically, they tell you to do what I did when I changed over to Debian 11 GNU/Linux on this PC.



Disable Secure Boot and turn off Intel VMD. (VMD was previously called RST. Which is pointless under Linux, hides the storage from Linux and makes it impossible for you to install and use GNU/Linux until you figure out that this is why.)



Here’s some images from their PDF for installing Ubuntu on several of their notebooks.



Ubuntu setup
Ubuntu setup manual



VMD
VMD



Secure boot
'Secure' boot



Secure Boot is a bandaid for Windows.



Lenovo knows it. They support GNU/Linux on some of their models and probably don’t want their customers calling in when something like this inevitably happens again.



The uEFI key revocation problem struck me a while back when I had been running Kubuntu on my Lenovo Yoga 900-ISK2 (older laptop) and then went to boot Fedora. Ubuntu had “updated the dbx” and ended up revoking Microsoft’s permission (yes, you heard this right) for Fedora to run on MY LAPTOP.



"Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?"So, it was at that point I disabled Secure Boot, which the Fedora Wiki said to do for the time being, as well as resetting the Secure Boot system in the BIOS, although I never turned it on again for obvious reasons. Why exactly, the hell, should Microsoft have any say over what I do with my laptop, which doesn’t even run their OS, ever?



Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?



This is another reason why dual booting with Windows is unwise and you should just let GNU/Linux completely take over the PC. Not only does Windows ultimately end up hosing Grub and causing both systems to fail, but these key revocations can be pushed by Windows Update with total disregard for whether GNU/Linux will boot up again.



It’s bad enough that this Microsoft/Intel trash, uEFI, completely screwed up the relative simplicity of installing and using operating systems that the “Legacy BIOS” provided for, but it didn’t even improve anything.



Right before uEFI became common, I bought the best computer I could afford at the time, a quad core Phenom II based system, with a Legacy BIOS, expecting early uEFI to be a disaster, and it was.



"And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken."Right off the bat, many OEMs permanently walled off the native interface and had it expose itself to the OS in (Legacy) BIOS mode because they knew their own native uEFI interfaces were too bad to trust, and the BIOS CSM sort of acted like a condom to filter what the OS was doing with the firmware, to prevent a “killer poke” that left the computer unusable.



And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken.



Ubuntu introduced the intel-spi driver in one release (I think it was an LTS, but don’t quote me.), and inadvertently caused the Yoga 900-ISK2’s settings to become read-only as soon as the pointless (to most people) driver was loaded. At the time, I was spared because it was part of the -staging tree for known bad drivers and ones that are not high enough quality to merge yet, and Fedora wasn’t building it. Many people booted Ubuntu after the new kernel went out and had to figure out how to fix their firmware after just booting the OS up even once!



"This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement."Plus, there were/are still numerous cases where operating systems use a native uEFI interface as documented and the computer never boots again.



This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement.



It’s an improvement if we rewrite the dictionary to say that a convicted software monopolist that hates Linux and wants you to have problems with it, who sponsored Garrett indirectly to put it in the kernel, and succeeded, has improved the situation. I think my computer potentially not booting because of this rat’s nest is not an improvement, but what do I know, right?



"They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation."Regardless, I think Lenovo’s advice of just shutting it off…. Look, you’re probably only going to hear me say this once or twice in my life. Listen to Lenovo!



All I can say is that the Free Software Foundation must be truly hopeless if it mostly gives awards to treacherous scumbags these days, and this is at least the second major incident. The first was when they gave Miguel de Icaza one for implementing the patent mess called Microsoft .NET Runtime on Linux. His company was bought by Microsoft as a golden parachute after Novell (his former employer, a Microsoft collaborator) went under.



In closing…



I’d like to summarize that this is a small taste of the bad behavior that continues at Microsoft. They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation.



Linus Torvalds has been put on mute even though he used to say things about Microsoft and Intel in particular that were not family-friendly.



Is there really any hope for the future of the x86 PC or are people who want their computing to work going to have to abandon it entirely in the era of Windows Vista 11?



Comments welcome.

Recent Techrights' Posts

From Do Your Own Research to Do Your Own Search
The Web is full of garbage; search engines amplify this garbage
 
Peter Moon's (Computerworld) Interview With Richard Stallman
Stallman: If you want freedom don't follow Linus Torvalds
At What Point Does Outsourcing Constitute Malpractice?
Brett Wilson LLP's new staff page is misleading
United Arab Emirates (UAE) Sailing to GNU/Linux, According to statCounter
countries in that region will quickly learn the price of neglecting digital sovereignty
More People Moving to Geminispace?
at age 6+ Gemini Protocol seems to have gained some maturity and it seems like more people use it
Permutation in LLMs Does, Inevitably, Change Meanings and Therefore LLMs Cannot Properly Rephrase or Summarise Texts
LLMs lack actual grasp or comprehension of what they spew out
Links 23/06/2025: Many Security Breaches, Population Declines
Links for the day
Gemini Links 23/06/2025: "America at the Crossroads" and OpenWRT Surgery
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, June 22, 2025
IRC logs for Sunday, June 22, 2025
Pure Dove
Different means different, and sometimes those who "deviate" from "the norm" have a point
Censorship is a Sign of Weakness Which Invites More Censorship Attempts
revolutionaries don't succumb to pressure from bullies
Why It's Unlikely That LLM Slop Will Dominate the Web in the Long Run
Slopfarms will eventually perish (they have no actual value) and "survivors" on the Web will be sites that never depended on search engines and social control media
GNU/Linux in Argentina Now Measured Near 5%
Like in central Europe, they must be seeing an increasingly hostile US
BetaNews is Fake News, Composed by LLM Slop
nothing in BetaNews is written by humans anymore
Links 22/06/2025: Giving Up on Smartphones and 'Jaws' at 50
Links for the day
Gemini Links 22/06/2025: Furniture Construction and Bubble for Comments
Links for the day
Links 22/06/2025: Windows TCO Tales and YouTube Getting More Hostile to Users
Links for the day
The FSF Board and FSF Beard
So the FSF's Board has grown
Law Firms Facing the Consequences for Patently Abusive Litigation on Behalf of Microsoft Employees Who Got Arrested for Strangulation and Had Done Even Worse Things
Having spent 1.5 years bullying me with patronising letters on behalf of Microsofters, last week they got served a massive bill and, in effect, lost the Hearing
New Report From the EPO's Staff Representatives in The Hague (LSCTH) Reveals Many Unsolved Issues
Local Staff Committee The Hague (LSCTH) wrote to staff just before the weekend
LLMs Breaking Everything
Computing and the Net became a playground for scammers and "bros", like people who "invented" fake currencies and also try to tell us that LLMs spewing out things will have some real value
Links 22/06/2025: More Slop Lawsuits (Copyrights) and "America’s Oligarch Problem"
Links for the day
Gemini Links 22/06/2025: Gigantic Toolchest and Annoying Bots
Links for the day
The Calling
Persist and persevere, justice will come your way
So Far Every BetaNews 'Article' is LLM Slop, So BetaNews is Officially Just a Slopfarm
They just don't seem to value what they have
IBM Rumour: Mass Layoffs (RAs) Lists Being Made for Consulting, With Effect in July 2025
Bogus companies with no viable products and no world-leading (in their field) staff are doomed to perish
Links 21/06/2025: Data Breach With 16 Billion Passwords, Dutch Government Recommends Children Under 15 Stay off TikTok and Instagram
Links for the day
Gemini Links 21/06/2025: Notes about Typst (and LaTeX) and Opos
Links for the day
Microsoft's Competition Tactics: Sabotage GNU/Linux Installs, Block Chrome
Edge is dying
1989: Free Software as "Open" Software (OSI Didn't Coin "Open Source", It Also Predates Linux)
"One man's fight for Free software"
The Microsoft OOXML Modus Operandi: Throw 1,000 Pages of Other People's Work for a Judge to Read Ahead of a One-Hour Meeting
No time to discuss this - that's the point
Formalities Officers (FOs) at the EPO Are in Trouble, Reveals Internal Report
We already know, based on an HR pattern we saw at IBM and elsewhere, that reallocating roles can be prerequisite for dismissal and those who do so expect many to resign anyway
The Web is Slop and FUD, Let's Go to Gemini Protocol
Lupa sees self-signed capsules at 92.4%
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, June 20, 2025
IRC logs for Friday, June 20, 2025
Links 21/06/2025: Phone Bans for Concerts, Tensions in Taiwan Strait
Links for the day
Gemini Links 21/06/2025: Spoilers, Public Yggdrasil Node, Changes to AuraGem Search
Links for the day