The Dangers of Microsoft Pluton

Just to be clear, is this a case where you can't dual boot windows and another OS, or you can't boot another OS at all (in either case, the other OS being non Microsoft authorised)? Or something else entirely? Would it be possible to disable this at all, even that means you can't boot Windows?

You cannot boot the other OS at all if secure boot is enabled and Microsoft drops support for the 3rd party UEFI CA list. The machine will refuse to boot any kernel that has not been signed by the CAs already included in the machine. This is typically only Microsoft and sometimes the OEM like Lenovo or Dell.

Could this be disabled by the user? Presumably doing so would mean you cannot boot Windows, but if thats a trade off Microsoft is forcing me to make, I'll accept it.

If you can't, it goes without saying that that is unacceptable

Yes, you can disable secure boot.

You can disable it for now. But there is no guarantee that you will always be able to.

Personally I think its very likely MS will eventually push to strongarm OEMs into locking secure boot to be enabled. All it will take is another round of "security improvements" and the public eats it up. The market would then fragment into laptops that can only run Windows and maybe more expensive laptops that allow you to disable secure boot. If the number of people who actually care enough to vote with spending a few extra hundred $ remains as low as it always has, over a decade it will drive open laptops to become wildly overpriced and eventually cease to exist.

> more expensive laptops that allow you to disable secure boot

This makes me sad. Old low-powered laptops with a light-weight distro are a joy to see and give out to family members to browse the web.

> Personally I think its very likely MS will eventually push to strongarm OEMs into locking secure boot to be enabled.

Not as long as the EU remains functioning.

This matched my guess: it's about MS extracting a $x per machine tax on all non-MS OSs to stay on their certificate list. Same playbook they've used on Android.

Can't wait for EU antitrust and the courts to punish this attempt

> you can disable secure boot.

That's not always the case: https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-c... "Disabling Secure [Boot] MUST NOT be possible on ARM systems."