Lenovo shipping new laptops that only boot Windows by default

Re:Lenovo shipping new laptops that only boot Windows by def... by simiones on Friday July 08, 2022 @04:36AM (#32024425)

Secure Boot ensures that it's impossible to run a rootkit, even if the user accidentally installs one. Instead of booting into corrupted Windows, the system would fail to boot.

[ Parent | on HN ]

Re:Lenovo shipping new laptops that only boot Windows by def... by mjg59 on Friday July 08, 2022 @04:40AM (#32024462)

The switch doesn't disable secure boot, it merely allows files signed using the Microsoft 3rd Party UEFI CA to boot.

(Context: I wrote a significant portion of the infrastructure used to support Linux booting on systems with UEFI Secure Boot)

[ Parent | on HN ]

Re:Lenovo shipping new laptops that only boot Windows by def... by zinekeller on Friday July 08, 2022 @04:39AM (#32024457)

It's definitely harder, but not impossible. The Realtek signing driver was stolen multiple times already, and I personally know that certificate management practices (in Asia in general) is abysmal.

[ Parent | on HN ]

Re:Lenovo shipping new laptops that only boot Windows by def... by Avamander on Friday July 08, 2022 @04:39AM (#32024454)

This current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults.

So the security benefit would be avoiding 3rd party and signed, but potentially vulnerable "bootloaders"

[ Parent | on HN ]