Secure Boot is Microsoft trash that was designed to paper over some of the reputation of Windows as a malware plaything.
The problem is that Secure Boot doesn’t actually work. uEFI firmware has been so horrendously bad from its inception that there’s always a Secure Boot escape.
Microsoft introduced the Windows RT (ARM, not the standard x86 instruction set CPU) devices, based on Windows 8, and there was a Secure Boot escape almost immediately. It was necessary to escape Secure Boot were there to be any other operating systems for these devices, because there was no option to turn it off. Something that may be coming with new “Windows 11” PCs, since Secure Boot is required or else Windows will refuse to load.
"Sometime they lose billions of dollars and quietly write it down."Someone got Grub (the bootloader program commonly used with GNU/Linux) to work on the Surface RT, but GNU/Linux was never ported to these things due to lack of interest at the time. Nobody bought the product and it was just another Microsoft FAIL. They have many of them, like Windows Phone. Sometime they lose billions of dollars and quietly write it down.
GNU/Linux has never had a big malware problem. Microsoft pays the “tech media” to imply otherwise, but it always turns out to be a bald-faced lie. More propaganda. More Microsoft bullshit!
In these churnalism articles, EVERYTHING with an open source license inevitably becomes “Linux”, even if it has the same problem on Windows. Even if it’s a part of Windows (like OpenSSL is). In some cases, when they refer to “Linux malware”, they mean malware that runs on Windows if you use the fake Linux (virtual machine with bad performance) in Windows, called WSL/WSL2.
And frankly, I’m getting sick and damned tired of Microsoft paying for this crap to be typed up and then Googlebombing Linux as part of their most recent smear campaign.
In South Park, Mr. Garrison, as a stand in for Donald Trump, defined something called DARVO, wherein the bully denies their bad behavior, then goes on the attack by reversing the victim and offender.
"“Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling."It’s hard to come up with a better description of what Microsoft has been doing for the past two decades. “Get The Facts”, “GPL is Communism”, and “Linux is a cancer”, never stopped. They just changed the signaling.
And of course, it’s easier to try to imply that GNU/Linux has problems than it is to fix your own Windows mess.
In the past 20 years, GNU/Linux has had fewer viruses and worms than you can count on your fingers which were even worth mentioning. None of them “just happened”, either. You had to defy GNU/Linux best practices of getting signed packages from your distribution or other trusted source, and grab random unsigned software from some internet site and jam it in somehow.
Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows.
In fact, according to most antivirus companies, Windows gets that in under a typical hour.
They don’t even try to keep up with detection patterns for most specific threats because they can’t. So, antivirus on Windows becomes mostly a guessing game except for the very most prevalent threats.
And when this happens, many threats are missed.
"Grabbing random things from the Internet and hoping for the best is how most software gets installed on Windows."That’s why you hear about Ransomware attacks that mean no gasoline on the eastern seaboard of America or how a poultry plant can’t process chickens. The media, bribed by Microsoft money, never mentions Windows.
Windows Security is so godawful that they add tons and tons of fake security bullet points that are trivially bypassed and probably don’t do much except break legitimate applications that are just too old to anticipate them, or need to write somewhere and aren’t automatically allowed to.
Did you enable Controlled Folder Access to “protect against Ransomware” and now LibreOffice can’t save your documents?
Congratulations. Even though there are 4 ways to use the Windows system to evade this protection, and malware authors will do it, your LibreOffice broke.
"Disable Secure Boot and turn off Intel VMD."What’s more telling is that Lenovo’s documentation on how to install GNU/Linux recommends changing uEFI (BIOS) settings.
Specifically, they tell you to do what I did when I changed over to Debian 11 GNU/Linux on this PC.
Disable Secure Boot and turn off Intel VMD. (VMD was previously called RST. Which is pointless under Linux, hides the storage from Linux and makes it impossible for you to install and use GNU/Linux until you figure out that this is why.)
Here’s some images from their PDF for installing Ubuntu on several of their notebooks.
Ubuntu setup manual
VMD
'Secure' boot
Secure Boot is a bandaid for Windows.
Lenovo knows it. They support GNU/Linux on some of their models and probably don’t want their customers calling in when something like this inevitably happens again.
The uEFI key revocation problem struck me a while back when I had been running Kubuntu on my Lenovo Yoga 900-ISK2 (older laptop) and then went to boot Fedora. Ubuntu had “updated the dbx” and ended up revoking Microsoft’s permission (yes, you heard this right) for Fedora to run on MY LAPTOP.
"Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?"So, it was at that point I disabled Secure Boot, which the Fedora Wiki said to do for the time being, as well as resetting the Secure Boot system in the BIOS, although I never turned it on again for obvious reasons. Why exactly, the hell, should Microsoft have any say over what I do with my laptop, which doesn’t even run their OS, ever?
Moreover, with the mess that uEFI and Secure Boot have been over the last decade plus, why would I enable this antifeature when all it will cause is more problems for me?
This is another reason why dual booting with Windows is unwise and you should just let GNU/Linux completely take over the PC. Not only does Windows ultimately end up hosing Grub and causing both systems to fail, but these key revocations can be pushed by Windows Update with total disregard for whether GNU/Linux will boot up again.
It’s bad enough that this Microsoft/Intel trash, uEFI, completely screwed up the relative simplicity of installing and using operating systems that the “Legacy BIOS” provided for, but it didn’t even improve anything.
Right before uEFI became common, I bought the best computer I could afford at the time, a quad core Phenom II based system, with a Legacy BIOS, expecting early uEFI to be a disaster, and it was.
"And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken."Right off the bat, many OEMs permanently walled off the native interface and had it expose itself to the OS in (Legacy) BIOS mode because they knew their own native uEFI interfaces were too bad to trust, and the BIOS CSM sort of acted like a condom to filter what the OS was doing with the firmware, to prevent a “killer poke” that left the computer unusable.
And even years later, there are killer pokes when operating systems use uEFI interfaces, and it’s becoming apparent that this situation is uEFI Groundhog Day. It’s always going to be broken.
Ubuntu introduced the intel-spi driver in one release (I think it was an LTS, but don’t quote me.), and inadvertently caused the Yoga 900-ISK2’s settings to become read-only as soon as the pointless (to most people) driver was loaded. At the time, I was spared because it was part of the -staging tree for known bad drivers and ones that are not high enough quality to merge yet, and Fedora wasn’t building it. Many people booted Ubuntu after the new kernel went out and had to figure out how to fix their firmware after just booting the OS up even once!
"This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement."Plus, there were/are still numerous cases where operating systems use a native uEFI interface as documented and the computer never boots again.
This is touted by people like Linux saboteur Matthew Garrett, who implemented Security Theater Boot in Linux as if it were an improvement.
It’s an improvement if we rewrite the dictionary to say that a convicted software monopolist that hates Linux and wants you to have problems with it, who sponsored Garrett indirectly to put it in the kernel, and succeeded, has improved the situation. I think my computer potentially not booting because of this rat’s nest is not an improvement, but what do I know, right?
"They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation."Regardless, I think Lenovo’s advice of just shutting it off…. Look, you’re probably only going to hear me say this once or twice in my life. Listen to Lenovo!
All I can say is that the Free Software Foundation must be truly hopeless if it mostly gives awards to treacherous scumbags these days, and this is at least the second major incident. The first was when they gave Miguel de Icaza one for implementing the patent mess called Microsoft .NET Runtime on Linux. His company was bought by Microsoft as a golden parachute after Novell (his former employer, a Microsoft collaborator) went under.
In closing…
I’d like to summarize that this is a small taste of the bad behavior that continues at Microsoft. They don’t get any pushback ever since they started using their money to corrupt many organizations including the Linux Foundation.
Linus Torvalds has been put on mute even though he used to say things about Microsoft and Intel in particular that were not family-friendly.
Is there really any hope for the future of the x86 PC or are people who want their computing to work going to have to abandon it entirely in the era of Windows Vista 11?