Hacker News Reader

Comment by Gazoche | Hacker News Reader

I just hope this won't eventually be the death of true device ownership. For all its cruft and flaws, x86 has served well as a standard platform for hackability and for alternative OSes like Linux to flourish on. Switching to ARM would give Microsoft and manufacturers an excuse to do away with all that.

I don't know what's the state of UEFI on ARM these days, but in a decade we could easily find ourselves in the same dire situation as phones, with a jungle of OEM-specific images, walled garden software and a boot chain cryptographically locked down.

View on HN

All WoA (Windows 10/11 on ARM) devices based on the Qualcomm Snapdragon 7/8cx Gen 3 seem to allow disabling UEFI SecureBoot, AFAIK earlier SoCs did as well.

OpenBSD/arm64 runs on the Microsoft Dev Kit 2023 and Lenovo ThinkPad x13s machines, out of the box. OpenBSD supported booting/installing on these even before Linux, although Linux support has improved.

https://www.openbsd.org/arm64.html

That's good news, as long as disabling Secure Boot doesn't put your device in a "no fun allowed" zone where it's cut off from banking, Netflix, etc. Like SafetyNet on Android.

I'm not aware of anything that depends on the SecureBoot status of a device, except possibly Widevine DRM for video streaming, but I don't see how that would be unique to ARM, disabling SecureBoot is also usually required on x86 for running alternative OSes without Microsoft's signed shim bootloader.

There is no Widevine support for OpenBSD anyway, so it's never been possible to watch Netflix. Fortunately, there are solutions for that...

Incidentally, Fedora Asahi Linux for Apple Silicon (ARM) got Widevine (hence, Netflix) working without any form of SecureBoot, they wrote about it recently on their blog.

One thing I know is the most invasive anti-cheat of them all: Vanguard. When you are running Windows 11 it requires secure boot to be enabled (IIRC this isn't the case for when running Windows 10).

On a different note, I actually learned a bit ago, that setting up secure boot with your own keys is not too hard if you are running a UKI, with only needing to sign systemd-boot and the kernel.

With your own keys, you mean adding your MOK (machine owner key), or going the entire way, with the Microsoft ones removed?

The first one is easy, the second one seems to be more complicated, especially if you have Option ROMs signed by the keys you would like to remove.

I mostly just let `sbctl` do its stuff automatically, but I do manually enroll my own keys and the Microsoft keys (when in Setup Mode), since they apparently might be required for some things to work correctly.

Linux-dedicated hardware is growing so I do think this will be avoidable. They might not be on ARM but they will likely still be sold and exist (unlike with mobile where say a Linux phone is unusable).

Reply on news.ycombinator.com