GNOME To Warn Users If Secure Boot Disabled, Preparing Other Firmware Security Help

[CommunityMember]

It looks like GNOME devs will add the most unimportant features instead of doing something about a certain 18 year old issue.

Are you saying your PR has not been reviewed, or that you are issuing an unfunded request?

[mb_q]

I share the sentiment, but how would you implement the loading of new keys? A reduced flash storage associated to the ROM? Otherwise, NVRAM is all you can write to, it will obviously get erased when removing the CMOS battery.

Fundamentally, to establish trust, you need some way to permanently seal the state, so yes, dedicated hardware for that is essential. With only volatile storage, it is impossible to fulfill SB promises, thus such implementation is, well, fake. IMHO the best solution is, again, coreboot, which would allow one to install verified, open source firmware tailored towards the security needs of an user.

[sinepgib]

Fundamentally, to establish trust, you need some way to permanently seal the state, so yes, dedicated hardware for that is essential. With only volatile storage, it is impossible to fulfill SB promises, thus such implementation is, well, fake. IMHO the best solution is, again, coreboot, which would allow one to install verified, open source firmware tailored towards the security needs of an user.

Agreed on everything, specially the need for Coreboot.

[osw89]

Are you saying your PR has not been reviewed, or that you are issuing an unfunded request?

I've heard these same excuses even from a certain very obnoxious GNOME dev who spends quite a lot of time being hostile to people who have questions about this issue on reddit. GNOME/GTK has more Redhat support and more Redhat employees working on it than any other project out there. Even the lead maintainer of GTK is a Redhat employee and you want to play the funding card? GNOME or GTK is not a project made by one guy in his basement so the whole "you aren't allowed to say anything" approach doesn't make sense. Even if you ignore all that and the fact that their donations have grown substantially over the years, there was a guy willing to provide financial support in the original bug report and even people who posted their own patches.

They have done quite a lot of stuff in the last two decades too(including the huge GNOME 3 redesign that most people aren't/weren't happy with) so it's not like they don't have the resources to do something about it. The fact that the devs have been focusing on comparatively quite irrelevant features while the most popular DE lacks a basic desktop feature even found on win98 is quite frankly just a sign of misdirection, it's like getting your house painted because you don't like the old color when your front door is missing and then getting mad at people for pointing out the stupidity. Your sentiment and GNOME devs being their repulsive selves when it comes to this issue makes me think Jobs was right about vision. I don't need to have a PR or donate to point this out and why would I want to contribute to a project whose members are repulsive people who are openly hostile to users offering criticism when there are alternatives?

[sinepgib]

There is a lot of over-obsession with security. It's like how you get murdered on windows11 news websites if you still use xp or win7.

There are legitimate reasons for that. Lots of money and personal information in OSes with known back doors that will never be fixed is not a good thing. You know you can automate the exploits, right?

Still waiting to see someone influential raise a demand for consortium consisting of major OS and hardware vendors that grants keys instead of leaving all control to microsoft

Absolutely. I think that's the biggest issue with SB right now. But since people seem to oppose to SB for the sake of SB, I doubt it's ever going to happen.

[Leopard]

I take it you are unaware that you can choose to enroll your own signing key and use it for the modules you build? Or just disable the warning should you choose that. You have many other choices too.

I take it as you don't know how to read.

I linked that exact specific part from readme which explains signing process.

Most users never did this and most users will never do that as well.

So that "enable SecureBoot" advice will basically serve as a pain point ; because it will confuse some users and enabling it will only boost "heh, Linux broke itself" praise because due to their own distros guidance they will enable it and boom!

Did you ever see an instance where Windows offers something to their users that it is guarenteed to lead such breakage, even if it has various workarounds?

Introducing/advising something like this without an easy peasy GUI oriented or automated way to make it work on every setup is a very dumb move.

In this case their setup was working fine two days ago; two days later their distro decided to lead people into messing with breakage. What a brilliant idea!

[andyprough]

I would say Linux is indeed significantly less secure than at least Microsoft Windows.

Yes, that's why all those millions of compromised desktop boxes in the massive botnet swarms are always Linux systems.

Oh wait, no - they are all Windows boxes. How odd.

[erniv2]

Yes, that's why all those millions of compromised desktop boxes in the massive botnet swarms are always Linux systems.

Oh wait, no - they are all Windows boxes. How odd.

No thats because there are probably 4 billion windows systems running and only 400 million linux systems, windows was allways the target for maleware cause it´s the mainstream and easy to scam money out of.

Who else gets calls from microsoft india all the time ? Herro this is miklosoft calling you hafe a ploblem with you computa

[mdedetrich]

Secure Boot is cool but its implementations are nonsense. I've tried enrolling user keys and signing the kernel on a few machines, and the story was the same --- verification was working ok, but a fw reset (removing CMOS battery, proper switch on the motherboard) was enough to jump back to the default SB state with my keys deleted.
So it is either this or using a machine with MS keys baked in, with a MS-approved bootloader blob, not a substantially tempting option.

I suspect the same story applies to all other switches this tool checks; without coreboot one has to trust the firmware, and these are traditionally totally unreliable, most vendors are more concerned with bloating them with kitsch fan animations that moving their quality anywhere higher than "somewhat seems to work for us".

Yup exactly, the core principles behind SecureBoot and TPM are actually quite sound its just the implementation is absolute s**t. I think this is more of a result of crappy software that motherboard makers produce rather than Microsoft specifically (obviously the BIOS will have Microsoft keys as default and there isn't really such a thing as a "linux key" unless its a shim at which point SecureBoot is kinda pointless).

[CommunityMember]

I take it as you don't know how to read.

I linked that exact specific part from readme which explains signing process.

Most users never did this and most users will never do that as well.

I do know how to read (and install my own signing keys as appropriate), but apparently you believe you and other Linux users are not tall enough to ride the (linux) ride and follow instructions to do the work. Perhaps that is true. And they will choose OS platforms more to their understanding.