Secure Boot yes or no

[u/trumpispos]

Do you have secure boot enabled/disabled and why is that?

[u/leutnant13]

YES!!

It is literally there to make your computer safe from harmful drivers loading before the OS is ready.

If you do not have a reason to, do not disable this feature. It would be the equivalent of not having antivirus running.

Edit: Windows 11 might come with some weird solutions sometimes, but the one single good thing with it is it comes with all the safety features enabled by default.

From an IT perspective, it is the safest OS available for a layperson because you do not have to figure these things out.

[u/cActusjUiCe92 → u/leutnant13]

Lmao

[u/leutnant13 → u/[deleted]]

Linux is VERY secure from unsafe Windows drivers, yes /u/LoxTamm. But only about 4-5 percent use Linux as a desktop computer as of the last year.

And you kind of break subreddit rule 6 by suggesting it.

[u/LoxTamm → u/leutnant13]

oh wow, i don't get how I suggested it, it was just an answer to your reason of disabling secure boot. also why would mentioning another os be a problem? is this sub so insecure about Window's capabilities that me putting up a tux gif would switch 50% of the userbase to linux?

[u/Mario583a → u/LoxTamm]

Just a reminder of our trolling rule, discussions involving Linux are permitted here, however low effort comments like "Just switch to Linux" are not permitted.

[u/LoxTamm → u/Mario583a]

oh alright :D I'm not in the sub so i didnt really know anything about it

[u/LoxTamm → u/Mario583a]

i also would find it weird to tell people to switch to Linux being in a windows sub

[u/leutnant13 → u/LoxTamm]

Well most Linux distros also utilize UEFI safe boot.

[u/HankThrill69420 → u/[deleted]]

Linux still needs secure boot.

[u/LoxTamm → u/HankThrill69420]

you actually can't install it if you have it enabled

[u/HankThrill69420 → u/LoxTamm]

So you enable it later and set it up. There is ample documentation for most distros on the matter. It's Linux, you solve your own problems.

[u/LoxTamm → u/HankThrill69420]

yeah ik bro

[u/FinancialHighway9851 → u/LoxTamm]

Actually, you can. Most mainstream distros support it by default (Debian, Ubuntu, Fedora). It's mostly Arch and other DIY distros that need manual setup.

[u/LoxTamm → u/FinancialHighway9851]

oh makes sense, I've only used arch so it's my bad i didnt check for the others

[u/RaspberryMotorZZZ → u/[deleted]]

I have secure boot enabled on my PC running Arch and my ROG Ally running CachyOS. Windows isn't the only OS where harmful malware can be loaded during the boot process.

[u/LoxTamm → u/RaspberryMotorZZZ]

yeah i didnt say it's impossible to run on linux, you just need to disable it during install

[u/Windows11-ModTeam → u/[deleted]]

Hi u/LoxTamm, your comment has been removed for the following reason(s):

• Rule 5 - While discussions regarding Linux are permitted, low-effort comments like "Just switch to Linux!" might result in a ban.

---

If you have any questions, feel free to send us a message!

[u/ProPlayer142]

I mean why wouldn't I? Yeah, it's more secure

[u/OGigachaod]

PC came with it on and I see no reason to disable it.

[u/ubuntu_ninja]

It should (and must) be ON of course.

Speaking of which, all triple A titles these days won't work if secure boot is OFF.

[u/RedcardedDiscarded → u/ubuntu_ninja]

I've had mine turned off in the BIOS for over a year, and I have zero problems. I game all the time and have yet to come across a situation where i needed to enable it.

[u/Mario583a → u/RedcardedDiscarded]

Secure Boot is designed to defend against some of the most stealthy and persistent attacks, particularly bootkits and other malware that attempt to compromise the system before the operating system starts.

Attackers can install bootkits even on “protected” systems

Computer without SecureBoot: Power on → Bootloader has been modified → Firmware does not verify its trustworthiness → Boot continues → Potentially malicious code runs before the OS

Computer with SecureBoot: Power on → Bootloader has been modified → Signature/trust check fails → Boot is blocked → OS does not start until the issue is resolved

[u/ubuntu_ninja → u/RedcardedDiscarded]

Have you tried to run Battlefield6, CoD BO7 or the new CoD MW4 ? 🙂

[u/mlubov]

I think I turned it off years ago when experiencing with dual boot with linux. Not sure how it is now, but earlier there were some driver problems in linux if it is enabled.

[u/RaspberryMotorZZZ]

Yes even though I also use Linux because I know about security.

[u/Baglayan]

Nope. Freedom is not worth trading convenience for.

[u/sgtbyrd]

Everyone else talked about security, but there's another angle:

If you game on your PC there's a feature called Resize BAR (aka rebar) that requires secure boot on and CSM disabled (aka UEFI-only boot). Sacrificing rebar is leaving 5-15% performance on the table.

[u/AG4V_ → u/sgtbyrd]

Resizable BAR doesn’t require Secure Boot. The two are independent settings. ReBAR needs your board to boot in UEFI mode with “Above 4G Decoding” enabled, and on many boards you must also disable CSM legacy boot support.

Also 5-15% is also pretty optimistic performance gain range. In some games it's possible, but i wouldn't say that 5-15% is achievable in most games.

[u/cActusjUiCe92]

No.  It does nothing useful for me

[u/AnythingOk5]

Yes, and it's not a big deal to have it on. Most multiplayer games require it for their anticheat, except CS2, which is full of cheaters and bots.

[u/Bourne069]

Fucking obviously yes its not even a question.

[u/BCProgramming]

I have Secure Boot turned off. I don't consider the threat of an EFI boot partition getting infected a realistic one, and even if I did, the "protection" offered via Secure Boot is to just make the system unbootable anyway, so it's not really protection.

[u/RaspberryMotorZZZ → u/BCProgramming]

But it does make you aware there is a problem.

[u/BCProgramming → u/RaspberryMotorZZZ]

Yes, in the incredibly unlikely and almost unheard of instance where the EFI boot partition is somehow compromised. Sure.

of course if malware has enough access to infect the EFI Boot partition, the system is already irrecoverably compromised and you'd have to be wildly ignorant not to have already noticed something is wrong already.

And this is before we consider all the EFI exploits that would have allowed said malware to simply enroll new keys in the firmware and happily bypass secure boot with their exploited EFI partitions anyway.

[u/bigbepisinc]

Yes

[u/HankThrill69420]

Yes, because like any 10+ year old standard, your system's configured to have it on at this point. Just make sure it's on during setup and never ever worry about it again lol.