News for hackers. Stuff that matters.

A comment on Linux and Secure Boot certificate expiration. Parent comment

Re:Linux and Secure Boot certificate expiration by flomo on Friday July 18, 2025 @04:00AM (#44602337)
Maybe this isn't a great take, but RedHat/LKF/etc could obviously run a 'semi-competent' PKI, and probably should be. But doing so would allow PC vendors to cleanly segment machines between Windows and Linux (+$$), so perhaps it made the best sense to lay-low and use MS infrastructure for this.
[ Parent | on HN ]
Re:Linux and Secure Boot certificate expiration by danudey on Friday July 18, 2025 @12:16PM (#44606462)
Can easily imagine companies like Dell selling you a system with Ubuntu preinstalled but without Windows signing keys so you can't run Windows on an Ubuntu laptop (or vice-versa) with Secure Boot on an unmodified system.

Not out of malice, necessarily, but at least incompetence.

Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system that supports Windows, whereas if RedHat had their own 100% comptent, rock-star PKI then a huge proportion of systems sold today would not be able to run Linux unmodified because the manufacturers wouldn't bother.

[ Parent | on HN ]
Re:Linux and Secure Boot certificate expiration by hulitu on Thursday July 24, 2025 @03:46PM (#44675181)
> Likewise, having Microsoft signing the shim also means that any Linux installation with the signed shim can install on any system

No. See certificate expiration.

[ Parent | on HN ]
Re:Linux and Secure Boot certificate expiration by sugarpimpdorsey on Friday July 18, 2025 @07:22PM (#44610918)
This isn't really true.

MS uses three separate CA's to sign Windows boot loaders, third party bootloaders (including Linux bootloaders) and UEFI Option ROMs.

In theory, no manufacturer has to install all three as trusted. But it makes no business sense to do so - why have two separate hardware SKUs for the sole purpose of lock-in? Once word got out no one would buy from that manufacturer.

[ Parent | on HN ]
Re:Linux and Secure Boot certificate expiration by flomo on Sunday July 20, 2025 @01:04AM (#44622134)
Sure they would, if it would make them a buck. Lenovo for example already has separate models for pro ThinkPads with 'certified' Linux support versus the consumer line. Dell too. PC vendors already have 9000 SKUs, what's a few more?

Reminds me back in the day some vendors of Win 9x systems put something in the BIOS to prevent one from installing NT/2000. Gotta get the corporate model for that.

[ Parent | on HN ]