Fedora's GRUB2 EFI Build To Offer Greater Security Options

[phoronix]

Phoronix: Fedora's GRUB2 EFI Build To Offer Greater Security Options

In addition to disabling root password-based SSH log-ins by default, another change being made to Fedora 31 in the name of greater security is adding some additional GRUB2 boot-loader modules to be built-in for their EFI boot-loader...

http://www.phoronix.com/scan.php?page=news_item&px=Fedora-31-Built-In-GRUB-Modules

[rene]

What, full disk encryption was not the default? Even in our small little source distribution we not only build that by default, but even custom patch the uuid parsing to be more elegant and just work™ https://www.youtube.com/watch?v=3BTgOI4vJZ8

[Guest]

What, full disk encryption was not the default? Even in our small little source distribution we not only build that by default, but even custom patch the uuid parsing to be more elegant and just work™ https://www.youtube.com/watch?v=3BTgOI4vJZ8

Well, some of the older CPUs don't support AES-NI, and if they don't use AES-XTS, then the encryption/decryption might be considerably slower than the disk speeds (especially for SSDs and flash storage). So that's probably why encryption isn't the default yet. I guess when AES-NI is as common as 64 bit CPUs, then they might make full disk encryption with AES the default.