Debian 9.0 "Stretch" Might Not Have UEFI Secure Boot Support

[starshipeleven]

Dual booting is for beginners anyway. Tough guys do run windows with UEFI GPU passthrough in KVM or QEMU.

Fixed.

[M@yeulC]

On the contrary, it is quite useful. On my laptop I have full disk encryption, so /root and /boot are in one big LUKS volume. only 1 MiB partition in front is unencrypted and it contains a single file, grubx64.efi signed by my own secure boot key which is the only thing that Secure Boot allows to boot here. So evil made attack becomes impractical. You can't replace my signed bootloader with something else.

That is, as long as you don't allow changing the GRUB command line

[Adarion]

To me Secure Boot is just a means introduced my MS to hamper installation of alternate operating systems (Linux, BSD, older Windows versions, whatever). Moreover UEFI is a large, bloated mess.

It is nice to have a firmware that can understand FAT32 natively

Sorry? I winced when I saw it the first time on a laptop, that they do have to have an extra VFAT boot partition now. I thought FAT was something from the dark middle ages... In my opinion the FW's job is just to boot and bring up the hardware and then look at a specified media(s) for the magic $ of a bootloader and give control to it.

And why should a FW-located boot option menu be so much better than e.g. a GRUB? Especially since you have to be able to read data on partition and file system level then. And that means you need more code in the FW - and are forced to use that very FS on your boot partition. Furthermore having VFAT capabilities anywhere might tempt MS to sue you for license payments for their ancient crutches-of-an-FS-with-added-crutches patents related to VFAT. (Iirc. TomTom was stupid enough to pay...)
Besides, can you update your FW's bootloader as easily as writing to a HDD/SSD? (No, you can't. Especially when you do not have means to get access to the very flash chip.)

[uid313]

If you use Ubuntu which is a derivative of Debian then you will still have UEFI Secure Boot support.

[Vistaus]

No loss at all. "Secure" boot is an anti-feature anyway.

While I agree with it being an anti-feature, please do consider that there are systems where you can't disable Secure Boot. Those people aren't able to use Debian 9.0 And with more systems (sadly) adopting a BIOS where you can't disable SB, it isn't going to help Debian adoption.

[Vistaus]

Dual booting is for beginners anyway.

Lolwut? If one can't disable Secure Boot, then single-booting Debian 9.0 isn't going to work either.

[starshipeleven]

Lolwut? If one can't disable Secure Boot, then single-booting Debian 9.0 isn't going to work either.

If you install Debian testing + XFCE and the amd unstable kernels and also wicd then Secure Boot will boot that and refuse to boot Windows.

Because Debian Testing + XFCE is that awesome.

/sarcasm

[ThiagoCMC]

I had to disable those "security" features at the BIOS, otherwise, DKMS kernel modules does not work.
I think that it also include this "security boot" mode.
This "security" is crap, I always use just regular, old school, "BIOS boot".
I use LUKS encryption anyway...

[starshipeleven]

I had to disable those "security" features at the BIOS, otherwise, DKMS kernel modules does not work.
I think that it also include this "security boot" mode.

Yes, correct. Kernel modules (just as kernel/bootloader/shim) need to be signed if you use SecureBoot, so stuff out of tree or proprietary drivers might not work.

[stikonas]

Yes, correct. Kernel modules (just as kernel/bootloader/shim) need to be signed if you use SecureBoot, so stuff out of tree or proprietary drivers might not work.

Only if you boot directly to kernel. If you use grub, then only grub needs to be signed. Kernel does not need to be signed. Ideally, kernel would be encrypted, so safe anyway.