Comment by jmclnx | Hacker News Reader

Comment by jmclnx | Hacker News Reader

Parent Full thread

I am pointing out what I see as a trend. Linux hardware seems to be on the way to a lockdown by companies. How many proprietary bolbs are now needed to run Linux on many Laptops.

This is a failure of the Linux Foundation to push back on proprietary hardware vendors, one blaring example is Nvidia. Even Linus has commened on Nvidia.

The Foundation should stop allowing proprietary hardware in Linux, instead these vendors donate $ to the Foundation and we are stuck using this hardware.

Another example is Secure Boot, some laptop manufactures are no longer allowing Legacy Boot. Were is the Foundation on this issue. Instead Microsoft donates large amounts and nothing is said about who signs the keys. It is just about impossible for many people to install Linux (or a BSD) on some new hardware without jumping through Secure Boot Loops.

And we have Intel ME, totally closed, the Foundation did nothing to complain and open that up either.

I could go on all day, and I am sure others can bring up many of these issues I know little about.

> Another example is Secure Boot, some laptop manufactures are no longer allowing Legacy Boot. Were is the Foundation on this issue. Instead Microsoft donates large amounts and nothing is said about who signs the keys. It is just about impossible for many people to install Linux (or a BSD) on some new hardware without jumping through Secure Boot Loops.

I think you're wrong on this one. You seem to be mixing up UEFI vs Secure Boot. The elimination of legacy boot in favor of UEFI has nothing to do with Secure Boot being enabled. Secure Boot is a good thing. In this case Microsoft is just acting as a Certificate Authority. Mainstream distros like RHEL, Ubuntu, and Debian have signed bootloaders. They pay MS a modest fee for what is essentially CA services. If a hobbyist distro doesn't want to pay then they don't get the benefits. A lot of OSS developers don't even sign their code because they object to paying for a code signing cert. If you want to play in the walled garden you have to pay the toll. Despite this I've yet to come across a device that prohibits disabling Secure Boot.

I have a laptop from 2k15 with Arch and secure boot. Since Arch doesn't have anything signed you can't even load the LiveISO without disabling secure boot, but what I was able to do was to sign everything myself + have the MS secure boot keys (or whatever they are called). This would allow me to dual boot with Win + Linux both using secure boot, which is nice to know for a certain game that insist on an overly restrictive anti-cheat.

Do you have links to any good documentation on self-signing everything necessary to run linux properly with secure boot?

If you haven't already, check the Arch Wiki. There is more than likely not an extensive article on it.

I could be :)

I know if I need to get a new Laptop, I will need to either pay twice the average for an open system that meets my needs, or spend months looking for compatible hardware.

So far the ~8 years old Laptop I have is working fine with Linux.

Reply on news.ycombinator.com