Linux and Secure Boot certificate expiration

And this is why I avoid and will always avoid "Secure Boot". I can see many newer Linux people being locked out starting in Sept.

Or you could just remove microsoft's keys from your systems and sign your bootloader with your own key. That's what I do on all of my systems so I am unimpacted by this.

do you have any source on how to do that?

I followed https://github.com/nix-community/lanzaboote/blob/master/docs... but naturally you don't want to include the `--microsoft` flag when running `sbctl enroll-keys` if you want to avoid microsoft keys. Also Lanzaboote is only for NixOS.

The arch wiki has the best source https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

Note sbctl is one of the easier tools to do this.

There should be some “Sane Usage” certification that a device doesn’t do secure boot, provides fully open and self-maintainable hardware, is independent of all external entities for ongoing use, provides hardware switches to turn off built-ins like ports, mics, and cameras, for power-savings and security.

Sure, but that's a lot more work than just disabling Secure Boot, and for most people's threat models, there's zero actual security benefit gained in return.

"Will this piss off or delight Microsoft?" is probably a thought that goes through the heads of many OEMs when they decide how to design their machines.

Weirdly Microsoft has been one of the companies ensuring Linux remains bootable on PCs.

To be able to get Windows licenses and preload Windows on your system, put that little Windows sticker and sell your machine to the masses, you need a Windows Compatibility certificate, and that certificate needs you to have Secure Boot and enabled by default.

Sounds anti-competitive as fuck to me. Maybe we should, I don't know; do something about companies using contractual requirements to lock key industrial into one way of doing things in order to shut down such efforts?

Bill Gates famously asked: "Can we create a standard or expand something like ACPI, so Linux becomes unbootable on PCs?"

So, believing this is very, very hard.

Microsoft has been trying to tread a fine line between exerting subtle pressure on OEMs to make Linux annoying to boot so it doesnt become more popular and not violating the terms of its antitrust agreement.

What is the something we can do?

Newer Linux people will presumably be using the new key though?