Who decides what SecureBoot considers trustworthy? If SecureBoot is controlled by someone else then it can be used against the user. The aversion to SecureBoot is justified.
this post was submitted on 21 Feb 2026
0 points (NaN% liked)
Technology
82227 readers
4334 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
Secureboot is worthless if the Microsoft keys are still enabled. It should only allow code that you sign yourself to boot.
If the end user can arbitrarily sign code themselves that is bootable then it kind of defeats the purpose of secure boot.
The whole idea is that it makes it impossible to start if the chain of trust is broken.
It keeps someone from booting code that hasn't been signed with my key. That's the whole point of secure boot. If someone else has the key, then it's not secure anymore.
The chain of trust starts with the owner of the hardware, not some random corporation that happens to make an OS. The owner can, if they wish, outsource the root of the chain of trust to a corporation, but that should be an active decision on their part, not something that happens just because the hardware was shipped with some random OS preloaded.
The thing is in such a case secureboot doesn't help and is unnecessary. Secureboot only does anything for the concept of "trusted suppliers".
If the system has available signing keys for itself, well, hypothetical malware could sign itself using those same keys The OS security mechanisms are the only things protecting that, and in which case the signature validation is redundant.
You can have trusted boot, e.g. LUKS volume sealed to TPM PCRs, but secureboot just doesnt make sense as a mechanism for a user to only trust themselves.
Thing is, that means you don't really own the hardware that you buy, because a corporation is dictating what you can do with it even though it doesn't belong to them. Most of us consider that unacceptable.