Most active commenters
  • pbhjpbhj(3)
  • ChocolateGod(3)

←back to thread

Linux and Secure Boot certificate expiration

(lwn.net)
253 points pabs3 | 12 comments | 18 Jul 25 03:53 UTC | HN request time: 0.758s | source | bottom
Show context
saidinesh5 ◴[18 Jul 25 06:54 UTC] No.44601960[source]▶
Just out of curiosity, how good is the secure boot experience these days?

I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

replies(11): >>44602000 #>>44602120 #>>44602279 #>>44602520 #>>44602559 #>>44602593 #>>44602696 #>>44602761 #>>44602773 #>>44603004 #>>44607063 #
1. pbhjpbhj ◴[18 Jul 25 07:48 UTC] No.44602279[source]▶
Every couple of years MS do an update that messes up multi-boot/dual boot. I'm sure it's on purpose at this point, and relatively sure "Secure Boot" is how they achieve it.

Still on Windows only for kids games. Linux user since last millennium.

replies(2): >>44602385 #>>44602403 #
2. blkhawk ◴[18 Jul 25 08:09 UTC] No.44602385[source]▶
As a Linux-only gamer since 2019 I wonder what kids games you are talking about?
replies(2): >>44602555 #>>44604378 #
3. ChocolateGod ◴[18 Jul 25 08:13 UTC] No.44602403[source]▶
> Every couple of years MS do an update that messes up multi-boot/dual boot

IIRC the last time this happened it was the fault of Linux distros not updating their packages, it was just a Microsoft update updating the security requirements that affected distros that were caught slacking.

replies(2): >>44603512 #>>44603534 #
4. repstosb ◴[18 Jul 25 08:44 UTC] No.44602555[source]▶
There are things like Roblox that are really only usable under Windows due to a perverse idea of what "anti-cheat" should look like.
replies(2): >>44602892 #>>44603121 #
5. blkhawk ◴[18 Jul 25 09:52 UTC] No.44602892{3}[source]▶
ah, I almost mentioned roblox but checking protondb it has gold status. So it should work?
6. 71bw ◴[18 Jul 25 10:33 UTC] No.44603121{3}[source]▶
https://sober.vinegarhq.org/
replies(1): >>44604272 #
7. account42 ◴[18 Jul 25 11:30 UTC] No.44603512[source]▶
The idea that MS should be able make orders that distros then have to follow is insane. If MS breaks something it absolutely is their fault.
replies(1): >>44623400 #
8. noAnswer ◴[18 Jul 25 11:33 UTC] No.44603534[source]▶
So Windows installs something that brakes Linux boot. How are you supposed to boot Linux to install a fix? Am I expected to reboot into a different OS twice a day and check for updates? Am I slacking for not doing so?!
replies(1): >>44623412 #
9. pbhjpbhj ◴[18 Jul 25 13:08 UTC] No.44604272{4}[source]▶
I can confirm Sober works really well, possibly slightly smoother than the Windows client.

I couldn't get it to run via Proton/Wine at all.

10. pbhjpbhj ◴[18 Jul 25 13:22 UTC] No.44604378[source]▶
I've stopped trying to fight to install things on Linux. Anything with kernel level anticheat it seems is torment. They okay Fortnite, and quite a bit of Marvel Rivals (which initially worked, then stopped, I see reports suggesting it's working again but I don't have time to be full-time support to keep things running smoothly).

We do use Kubuntu for games that run in it without drama - Risk of Rain, Roblox (via Sober), browser games, CS2.

They also are expected to use Microsoft Office for school (UK), it's possible to work that online, but the experience is worse, slower, more prone to issues it seems.

Fwiw, I've been a Linux distro user for decades and was Linux only until the first child got to highschool. Microsoft's "educational" policy works for them!

11. ChocolateGod ◴[20 Jul 25 09:41 UTC] No.44623400{3}[source]▶
No it's not. Microsoft has to disable outdated and vulnerable signed bootloaders to stop them being used for secure boot bypasses. Microsoft worked with RH to get things updated which they did, it's just distros for caught slacking and were shipping an outdated vulnerable boot loader.

I know it's the norm to bash Microsoft and they do a lot of crappy things, but in this case it was just certain distros not taking security updates seriously, which is why a lot never broke (such as Fedora)

12. ChocolateGod ◴[20 Jul 25 09:43 UTC] No.44623412{3}[source]▶
No, Windows updated a UEFI component that disables outdated and vulnerable bootloaders to stop them being used as secure boot bypasses.