* Chris Friesen: > On 11/06/2012 01:56 AM, Florian Weimer wrote: > >> Personally, I think the only way out of this mess is to teach users >> how to disable Secure Boot. > > If you're going to go that far, why not just get them to install a > RedHat (or SuSE, or Ubuntu, or whoever) key and use that instead? Behind that key, considerable infrastructure is needed, and the challenges are not purely technical. I don't expect many such keys as a result. > Secure boot does arguably solve a class of problems, so it seems a bit > odd to recommend just throwing it out entirely. I have never seen a Linux system with a compromised boot path. Surely they exist out there, but they are rare. It's also relatively simple to detect such a compromise on disk, from the outside. Secure Boot doesn't even allow you to safely boot from PXE because Fedora's shim will automatically load an initrd which wipes all your disks. (Safe booting from network would be a compelling feature, but it's not in the focus of Secure Boot; that's client-only technology at the moment.) Some side effects, such as the end of proprietary kernel modules, may be desirable. But others are not, like missing hibernate support (or perhaps even X). -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
