Gemini version available ♊︎

Microsoft Secure Boot and Intel VMD Pointless on GNU/Linux and Lenovo’s Documentation Recommends That You Turn Them Off

Posted in Deception, GNU/Linux, Hardware, Microsoft, Security at 2:32 pm by Guest Editorial Team

Guest post by Ryan, reprinted with permission from the original

Secure Boot is Microsoft trash that was designed to paper over some of the reputation of Windows as a malware plaything.

The problem is that Secure Boot doesn’t actually work. uEFI firmware has been so horrendously bad from its inception that there’s always a Secure Boot escape.

Microsoft introduced the Windows RT (ARM, not the standard x86 instruction set CPU) devices, based on Windows 8, and there was a Secure Boot escape almost immediately. It was necessary to escape Secure Boot were there to be any other operating systems for these devices, because there was no option to turn it off. Something that may be coming with new “Windows 11” PCs, since Secure Boot is required or else Windows will refuse to load.

“Sometime they lose billions of dollars and quietly write it down.”Someone got Grub (the bootloader program commonly used with GNU/Linux) to work on the Surface RT, but GNU/Linux was never ported to these things due to lack of interest at the time. Nobody bought the product and it was just another Microsoft FAIL. They have many of them, like Windows Phone. Sometime they lose billions of dollars and quietly write it down.

GNU/Linux has never had a big malware problem. Microsoft pays the “tech media” to imply otherwise, but it always turns out to be a bald-faced lie. More propaganda. More Microsoft bullshit!

In these churnalism articles, EVERYTHING with an open source license inevitably becomes “Linux”, even if it has the same problem on Windows. Even if it’s a part of Windows (like OpenSSL is). In some cases, when they refer to “Linux malware”, they mean malware that runs on Windows if you use the fake Linux (virtual machine with bad performance) in Windows, called WSL/WSL2.

And frankly, I’m getting sick and damned tired of Microsoft paying for this crap to be typed up and then Googlebombing Linux as part of their most recent smear campaign.

In South Park, Mr. Garrison, as a stand in for Donald Trump, defined something called DARVO, wherein the bully denies their bad behavior, then goes on the attack by reversing the victim and offender.

““Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling.”It’s hard to come up with a better description of what Microsoft has been doing for the past two decades. “Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling.

And of course, it’s easier to try to imply that GNU/Linux has problems than it is to fix your own Windows mess.

In the past 20 years, GNU/Linux has had fewer viruses and worms than you can count on your fingers which were even worth mentioning. None of them “just happened”, either. You had to defy GNU/Linux best practices of getting signed packages from your distribution or other trusted source, and grab random unsigned software from some internet site and jam it in somehow.

Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows.

In fact, according to most antivirus companies, Windows gets that in under a typical hour.

They don’t even try to keep up with detection patterns for most specific threats because they can’t. So, antivirus on Windows becomes mostly a guessing game except for the very most prevalent threats.

And when this happens, many threats are missed.

“Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows.”That’s why you hear about Ransomware attacks that mean no gasoline on the eastern seaboard of America or how a poultry plant can’t process chickens. The media, bribed by Microsoft money, never mentions Windows.

Windows Security is so godawful that they add tons and tons of fake security bullet points that are trivially bypassed and probably don’t do much except break legitimate applications that are just too old to anticipate them, or need to write somewhere and aren’t automatically allowed to.

Did you enable Controlled Folder Access to “protect against Ransomware” and now LibreOffice can’t save your documents?

Congratulations. Even though there are 4 ways to use the Windows system to evade this protection, and malware authors will do it, your LibreOffice broke.

“Disable Secure Boot and turn off Intel VMD.”What’s more telling is that Lenovo’s documentation on how to install GNU/Linux recommends changing uEFI (BIOS) settings.

Specifically, they tell you to do what I did when I changed over to Debian 11 GNU/Linux on this PC.

Disable Secure Boot and turn off Intel VMD. (VMD was previously called RST. Which is pointless under Linux, hides the storage from Linux and makes it impossible for you to install and use GNU/Linux until you figure out that this is why.)

Here’s some images from their PDF for installing Ubuntu on several of their notebooks.

Ubuntu setup
Ubuntu setup manual


Secure boot
‘Secure’ boot

Secure Boot is a bandaid for Windows.

Lenovo knows it. They support GNU/Linux on some of their models and probably don’t want their customers calling in when something like this inevitably happens again.

The uEFI key revocation problem struck me a while back when I had been running Kubuntu on my Lenovo Yoga 900-ISK2 (older laptop) and then went to boot Fedora. Ubuntu had “updated the dbx” and ended up revoking Microsoft’s permission (yes, you heard this right) for Fedora to run on MY LAPTOP.

“Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?”So, it was at that point I disabled Secure Boot, which the Fedora Wiki said to do for the time being, as well as resetting the Secure Boot system in the BIOS, although I never turned it on again for obvious reasons. Why exactly, the hell, should Microsoft have any say over what I do with my laptop, which doesn’t even run their OS, ever?

Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?

This is another reason why dual booting with Windows is unwise and you should just let GNU/Linux completely take over the PC. Not only does Windows ultimately end up hosing Grub and causing both systems to fail, but these key revocations can be pushed by Windows Update with total disregard for whether GNU/Linux will boot up again.

It’s bad enough that this Microsoft/Intel trash, uEFI, completely screwed up the relative simplicity of installing and using operating systems that the “Legacy BIOS” provided for, but it didn’t even improve anything.

Right before uEFI became common, I bought the best computer I could afford at the time, a quad core Phenom II based system, with a Legacy BIOS, expecting early uEFI to be a disaster, and it was.

“And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken.”Right off the bat, many OEMs permanently walled off the native interface and had it expose itself to the OS in (Legacy) BIOS mode because they knew their own native uEFI interfaces were too bad to trust, and the BIOS CSM sort of acted like a condom to filter what the OS was doing with the firmware, to prevent a “killer poke” that left the computer unusable.

And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken.

Ubuntu introduced the intel-spi driver in one release (I think it was an LTS, but don’t quote me.), and inadvertently caused the Yoga 900-ISK2’s settings to become read-only as soon as the pointless (to most people) driver was loaded. At the time, I was spared because it was part of the -staging tree for known bad drivers and ones that are not high enough quality to merge yet, and Fedora wasn’t building it. Many people booted Ubuntu after the new kernel went out and had to figure out how to fix their firmware after just booting the OS up even once!

“This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement.”Plus, there were/are still numerous cases where operating systems use a native uEFI interface as documented and the computer never boots again.

This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement.

It’s an improvement if we rewrite the dictionary to say that a convicted software monopolist that hates Linux and wants you to have problems with it, who sponsored Garrett indirectly to put it in the kernel, and succeeded, has improved the situation. I think my computer potentially not booting because of this rat’s nest is not an improvement, but what do I know, right?

“They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation.”Regardless, I think Lenovo’s advice of just shutting it off…. Look, you’re probably only going to hear me say this once or twice in my life. Listen to Lenovo!

All I can say is that the Free Software Foundation must be truly hopeless if it mostly gives awards to treacherous scumbags these days, and this is at least the second major incident. The first was when they gave Miguel de Icaza one for implementing the patent mess called Microsoft .NET Runtime on Linux. His company was bought by Microsoft as a golden parachute after Novell (his former employer, a Microsoft collaborator) went under.

In closing…

I’d like to summarize that this is a small taste of the bad behavior that continues at Microsoft. They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation.

Linus Torvalds has been put on mute even though he used to say things about Microsoft and Intel in particular that were not family-friendly.

Is there really any hope for the future of the x86 PC or are people who want their computing to work going to have to abandon it entirely in the era of Windows Vista 11?

Comments welcome.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New

  1. The EPO's Web Site is a Parade of Endless Lies and Celebration of Gross Violations of the Law

    The EPO's noise site (formerly it had a "news" section, but it has not been honest for about a decade) is a torrent of lies, cover-up, and promotion of crimes; maybe the lies are obvious for everybody to see (at least EPO insiders), but nevertheless a rebuttal seems necessary

  2. The Letter EPO Management Does Not Want Applicants to See (or Respond to)

    A letter from the Munich Staff Committee at the EPO highlights the worrying extent of neglect of patent quality under Benoît Battistelli and António Campinos; the management of the EPO did not even bother replying to that letter (instead it was busy outsourcing the EPO to Microsoft)

  3. IRC Proceedings: Saturday, December 04, 2021

    IRC logs for Saturday, December 04, 2021

  4. EPO-Bribed IAM 'Media' Has Praised Quality, Which Even EPO Staff (Examiners) Does Not Praise

    It's easy to see something is terribly wrong when the people who do the actual work do not agree with the media's praise of their work (a praise motivated by a nefarious, alternate agenda)

  5. Tux Machines is 17.5 Years Old Today

    Tux Machines -- our 'sister site' for GNU/Linux news -- started in 2004. We're soon entering 2022.

  6. Approaching 100

    We'll soon have 100 files in Git; if that matters at all...

  7. Improving Gemini by Posting IRC Logs (and Scrollback) as GemText

    Our adoption of Gemini and of GemText increases; with nearly 100,000 page requests in the first 3 days of Decembe (over gemini://) it’s clear that the growing potential of the protocol is realised, hence the rapid growth too; Gemini is great for self-hosting, which is in turn essential when publishing suppressed and controversial information (subject to censorship through blackmail and other ‘creative’ means)

  8. Links 4/12/2021: IPFire 2.27 Core Update 162 and Genode OS Framework 21.11

    Links for the day

  9. Links 4/12/2021: Gedit Plans and More

    Links for the day

  10. Links 4/12/2021: Turnip Becomes Vulkan 1.1 Conformant

    Links for the day

  11. IRC Proceedings: Friday, December 03, 2021

    IRC logs for Friday, December 03, 2021

  12. Links 4/12/2021: EndeavourOS Atlantis, Krita 5.0.0 Beta 5, Istio 1.11.5, and Wine 6.23; International Day Against DRM (IDAD) on December 10th

    Links for the day

  13. Another Gemini Milestone: 1,500 Active Capsules

    This page from Balázs Botond plots a graph, based on these statistics that now (as of minutes ago) say: “We successfully connected recently to 1500 of them.” Less than a fortnight ago more than 1,800 capsules overall were registered by Lupa, almost quadrupling in a single year

  14. [Meme] António Campinos and Socialist Posturing

    Staff of the EPO isn’t as gullible as António Campinos needs it to be

  15. António Campinos as EPO President is Considered Worse Than Benoît Battistelli (in Some Regards) After 3.5 Years in Europe's Second-Largest Institution

    The EPO's demise at the hands of people who don't understand patents and don't care what the EPO exists for is a real crisis which European media is unwilling to even speak about; today we share some internal publications and comment on them

  16. Media Coverage for Sale

    Today we're highlighting a couple of new examples (there are many other examples which can be found any day of the year) demonstrating that the World Wide Web is like a corporate spamfarm in "news" clothing

  17. Links 3/12/2021: GNU Poke 1.4 and KDDockWidgets 1.5.0

    Links for the day

  18. IRC Proceedings: Thursday, December 02, 2021

    IRC logs for Thursday, December 02, 2021

  19. Links 3/12/2021: Nitrux 1.7.1 and Xen 4.16 Released

    Links for the day

  20. Links 2/12/2021: OpenSUSE Leap 15.4 Alpha, Qt Creator 6

    Links for the day

  21. The EPO's “Gender Awareness Report”

    There’s a new document with remarks by the EPO’s staff representatives and it concerns opportunities for women at the EPO — a longstanding issue

  22. IRC Proceedings: Wednesday, December 01, 2021

    IRC logs for Wednesday, December 01, 2021

  23. EPO Staff Committee Compares the Tactics of António Campinos to Benoît Battistelli's

    The Central Staff Committee (CSC) of the EPO talks about EPO President António Campinos, arguing that “he seems to subscribe to the Manichean view, introduced by Mr Battistelli…”

  24. Prof. Thomas Jaeger in GRUR: Unified Patent Court (UPC) “Incompatible With EU Law“

    The truth remains unquestionable and the law remains unchanged; Team UPC is living in another universe, unable to accept that what it is scheming will inevitably face high-level legal challenges (shall that become necessary) and it will lose because the facts are all still the same

  25. Links 1/12/2021: LibrePlanet CFS Extended to December 15th and DB Comparer for PostgreSQL Reaches 5.0

    Links for the day

  26. EPO Cannot and Will Not Self-Regulate

    The term financialisation helps describe some of the activities of the EPO in recent years; see Wikipedia on financialisation below

  27. [Meme] Germany's Licence to Break the Law

    Remember that the young Campinos asked dad for his immunity after he had gotten drunk and crashed the car; maybe the EPO should stop giving diplomatic immunity to people, seeing what criminals (e.g. Benoît Battistelli) this attracts; the German government is destroying its image (and the EU’s) by fostering such corruption, wrongly believing that it’s worth it because of Eurozone domination for patents/litigation

  28. EPO Dislikes Science and Scientists

    The EPO's management has become like a corrupt political party with blind faith in money and monopolies (or monopoly money); it has lost sight of its original goals and at this moment it serves to exacerbate an awful pandemic, as the video above explains

  29. Links 1/12/2021: LibreOffice 7.3 Beta, Krita 5.0, Julia 1.7

    Links for the day

  30. Links 1/12/2021: NixOS 21.11 Released

    Links for the day

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts