Item — HN Reader

I'm not 100% sure what this means. I remember hearing a lot of rabble rabble a few months back about Microsoft placing some roadblocks on hardware that would make it more difficult to install Linux on machines.

Does this mean this is now a non-issue?

Thanks in advance.

2 comments

It's been a non-issue for a couple of months - the Linux Foundation implementation is an alternative approach, but there's already a freely-available signed bootloader that distributions can use.

I disagree that's a non-issue. Recently a relative's 10+ year old computer broke down. After buying a new one, until I was able to boot from an external linux usb/CD disk and be able to boot linux from the hard disk after installation, took several trips to the BIOS to change a myriad of UEFI settings, which is completely non-trivial to someone that just wants to try a live CD.

With secureboot enabled (the default on windows 8 certified hardware, or pretty much all x86 consumer platforms), you can't simply insert a linux installer or livedisk. You have to either play around with keys, or disable secureboot in the UEFI configuration.

If your OS doesn't allow arbitrary code to be run on the raw machine (so a chain of trust on executables), microsoft provides a signing service. This is a problem for linux, due to the way it allows any code to run privileged. This is a problem because if a generic linux kernel was signed, it could be used to bypass secureboot (since it allows you to run any code, and it would be trusted).

Some distros are looking at disabling all these features, so that their distro image can be signed. This would disable all third-party modules, and disallow other features (that most people probably don't use anyway).

This specific post is about an a key management program, that allows a user to install their own keys, so they can sign their own linux image. A simpler option allows you to put your machine in another mode that disables secureboot. Like the UEFI configuration option, this is a roadblock to new users, who want something to "just work". So unfortunately yes, it's still an issue.