Three PC Brands Where SecureBoot On Linux Is Botched

[movieman]

You could then be reassured that only operating systems and their kernels that you allow to run are in fact what is running.

I am totally scared that someone is going to install a hacked kernel on my systems.

If you manage a whole bunch of servers in data centre, it would again be nice to know that only kernels you authorise can run on the systems.

If my servers start rebooting randomly to install hacked kernels, I think I'll notice. Whereas if I can't build a new kernel myself to work around bugs or support new hardware because it's not signed by Microsoft, I'm going to be rather annoyed.

The only real value in 'Secure Boot' is enforcing vendor lockin on the people who buy the hardware. For everyone else its a real pain for minimal benefit.

[Ericg]

Thanks!
That gives me a significantly better idea what we're talking about.

On the other hand, I don't see why those should need vendor/model specific drivers, in the first place...

I personally wouldn't care about multi-media keys, but things like suspend/hibernate and backlight control do make a real difference.

Hibernate I think the kernel can handle specifically because its basically just shutting the laptop down. Suspend on the otherhand has a lot of bios involvement, and bios is vendor-specific. Clarification: There's only like 3 or so BIOS vendors left, but Samsung and Dell and Toshiba and everyone modify the bios from those 3 or so vendors once they have them.

Backlight is a problem because maybe some wires aren't where they are "Normally" or maybe a jumper is backwards, things like that. This laptop specifically (Dell XPS 13z Ultrabook) doesn't have the normal backlight control, its vendor specific instead of just being "Intel backlight." I had to go further than most to get Linux running on here, I had to run a custom kernel and even then its not exactly how I want things to be. For example thanks to what is either a buggy bios or a buggy disk controller, this laptop refuses to boot with the new GPT partition layout. Granted its not a big deal to do the old style MS-DOS style layout, but its still a problem.

[Bernard Swiss]

Certain things may not work, such as multimedia keys or maybe suspend or key-based backlight control. Really depends on just how much hardware control is samsung-specific and therefore how much of "normal" control is altered by samsung-laptop. I know on Dell systems if you dont boot with dell-laptop then suspend and backlight can be f*cked up.

Thanks!
That gives me a significantly better idea what we're talking about.

On the other hand, I don't see why those should need vendor/model specific drivers, in the first place...

I personally wouldn't care about multi-media keys, but things like suspend/hibernate and backlight control do make a real difference.

[Ericg]

This is probably a "dumb question" -- but I am not clear on the point:

Since this "samsung-laptop" driver is not usable, what happens when someone tries to install (or boot) Linux on an affected Samsung laptop, without using that driver?

(or for that matter, on unaffected ones)?

Is there a more generic driver as fall-back?
Does the boot just hang?

Certain things may not work, such as multimedia keys or maybe suspend or key-based backlight control. Really depends on just how much hardware control is samsung-specific and therefore how much of "normal" control is altered by samsung-laptop. I know on Dell systems if you dont boot with dell-laptop then suspend and backlight can be f*cked up.

[Bernard Swiss]

What does this mean for installing/booting Linux on Samsung laptops?

This is probably a "dumb question" -- but I am not clear on the point:

Since this "samsung-laptop" driver is not usable, what happens when someone tries to install (or boot) Linux on an affected Samsung laptop, without using that driver?

(or for that matter, on unaffected ones)?

Is there a more generic driver as fall-back?
Does the boot just hang?

[dee.]

I think the most likely scenario is that the option to disable it remains present, but Windows 9 or 10 will refuse to "activate" unless it's enabled. Not so much for Microsoft's sake (they'd rather have you using an illegal Windows system than a legal Linux system), but rather to enforce restrictions on Windows Store apps.

If we're ever going to see a windows 9, that is... if microsoft doesn't simply go bankrupt before they manage to release the next windows, that is.

[AdamW]

Except Toshiba case, two other issues is just UEFI bugs (like many BIOS bugs we seen before) that not related to Secure Boot.

+1 this. The headline of the article is incorrect. These are UEFI issues, not Secure Boot issues.

[DanL]

I recommend drinking

Way ahead of you, Mr. Garrett..

[Ex-Cyber]

Yes, it is. That will likely change in the next few years though.

I think the most likely scenario is that the option to disable it remains present, but Windows 9 or 10 will refuse to "activate" unless it's enabled. Not so much for Microsoft's sake (they'd rather have you using an illegal Windows system than a legal Linux system), but rather to enforce restrictions on Windows Store apps.

[TheLexMachine]

Last time I heard, using secureboot was optional and one could disable it from BIOS settings. Is this still the case, and does it apply for these vendors?

Yes, it is. That will likely change in the next few years though.