10 Reasons to Disable (or Enable) UEFI Secure Boot

posted by Roy Schestowitz on Sep 10, 2025

Now is a fine time to leave "Secure Boot" behind, even if you never quite noticed it was there in the background, waiting to cause unnecessary trouble.

Why set it to "Disabled":

1. Stop participating in the lock-down dynamics (the trajectory of computing in general going/moving towards "appliances" hostile to their purchasers)
2. Reduce risk of being locked out
3. Send a message to vendors (like game makers) that rootkits and attestation are widely viewed as unacceptable
4. Protect the real meaning of the word "secure"
5. Prevent any more damage done by Microsoft [1, 2]

Why set it to "Enabled":

1. Satire: Boast to friends about how "modern" your machine is
2. Satire: Tell the boss the servers and laptops are all "secure"
3. Satire: Appease IBM for "blue points"
4. Satire: Take some time offline (outdoor time, smell/touch the grass) when UEFI "protects you" from a vendor's technical incompetence, refusing to boot your system
5. Satire: Default settings are always best; trust corporations

Tomorrow the "trusted corporation" Microsoft will see a certificate expire; its own staff knows it'll do damage to GNU/Linux users just when the platform is gaining ground worldwide. █