this post was submitted on 21 Feb 2026
187 points (97.5% liked)

Technology

81653 readers
4835 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
187
The creator of systemd wants to bring SecureBoot-enforced hardware attestation to Linux (0pointer.net)
submitted 1 day ago* (last edited 1 day ago) by namingthingsiseasy@programming.dev to c/technology@lemmy.world
82 comments fedilink hide all child comments
 

The creator of systemd (Lennart Poettering) has recently created a new company dedicated to bringing hardware attestation to open source software.

What might this entail? A previous blog post could provide some clues:

So, let's see how I would build a desktop OS. The trust chain matters, from the boot loader all the way to the apps. This means all code that is run must be cryptographically validated before it is run. This is in fact where big distributions currently fail pretty badly. This is a fault of current Linux distributions though, not of SecureBoot in general.

If this technology is successful, the end result could be that we would see our Linux laptops one day being as locked down as an Iphone or Android device.

There are lots of others who are equally concerned about this possibility: https://news.ycombinator.com/item?id=46784572

you are viewing a single comment's thread
view the rest of the comments
[–] tabular@lemmy.world 46 points 21 hours ago (9 children)

Who decides what SecureBoot considers trustworthy? If SecureBoot is controlled by someone else then it can be used against the user. The aversion to SecureBoot is justified.

[–] lazynooblet@lazysoci.al 19 points 20 hours ago (7 children)

Secureboot uses certificates to verify integrity. The user is able to install new certificates. So I'd say it is the user? I'm not an expert though and their may be hardware out there that doesn't allow new certificates.

[–] namingthingsiseasy@programming.dev 20 points 17 hours ago (1 children)

The user is able to install new certificates.

That's true today, but there's no guarantee it will be true in the future. Google is already pushing for all software running on Android to be cryptographically verified and they (Google) are the only ones that control the signing keys. This means that they intend to kill off F-droid and all other software delivered outside the Google store.

If Google is able to pull it off on Android, everyone else will try to do it on desktop OSes too - Linux included.

[–] lmmarsano@group.lt 2 points 3 hours ago* (last edited 1 minute ago)

That’s true today, but there’s no guarantee it will be true in the future.

It's in the specification.

The platform key establishes a trust relationship between the platform owner and the platform firmware. The platform owner enrolls the public half of the key (PKpub) into the platform firmware. The platform owner can later use the private half of the key (PKpriv) to change platform ownership or to enroll a Key Exchange Key. See “Enrolling The Platform Key” and “Clearing The Platform Key” for more information.

The platform owner clears the public half of the Platform Key (PKpub) by deleting the Platform Key variable using UEFI Runtime Service SetVariable(). The data buffer submitted to the SetVariable() must be signed with the current PKpriv - see Variable Services for details. The name and GUID of the Platform Key variable are specified in Globally Defined Variables. The platform key may also be cleared using a secure platform-specific method. When the platform key is cleared, the global variable SetupMode must also be updated to 1.

It's a matter of clearing the platform key & enrolling your own platform key. I've done this before.

Typically, computers with Secure Boot let us clear the platform key from the boot menu. (You can choose to purchase only those that do.) Some computer vendors ship Secure Boot in setup mode or let the customer provide public keys to ship preloaded.

Secure Boot has always been for enabling the owner to enforce integrity of the boot process through cryptographic signatures. Linus Torvalds thought the feature makes sense.

Linus: I actually think secure boot makes a lot of sense. I think we should sign our modules. I think we should use the technology to do cryptographic signatures to add security; and at the same time inside the open source community this is so unpopular that people haven’t really worked on it.

It’s true that secure boot can be used for horribly, horribly bad things but using that as an argument against its existence at all is I think a bit naive and not necessarily right. Because if you do things right then it’s a really good thing. I would like my own machine to have the option to not boot any kernel, or boot loader, that is not signed by this signature.

load more comments (5 replies)
load more comments (6 replies)