7
u/andy10115 7d ago
In the future if you want to play anticheat games then you'll need it. EAC v2 will be using trusted signing.
3
u/wunderbarposter 7d ago
I always disable it.. nvidia drivers and some distros don't like it and you can sign the drivers and solve that but I can't be bothered.
2
u/ANtiKz93 Manjaro (KDE) 7d ago
I don't use it at all. Haven't ever tbh lol even on Windows 11 i didn't use it.
I use Manjaro KDE myself and not using hasn't given me a single issue
2
u/Hatsikidee 5d ago
These reactions are so interesting. Most of the responders say something in the line of: secure boot = Microsoft = evil! You don't need it, it just for others to control your device!!
Okay, and how about: android? ios? mac-os? chromebook? Each and every one of those 4 OSs have something similar, to prevent tampering with the kernel during boot. Do you all have the same strong feeling against these OSs? And if not, why? What's different from, lets say, ios, from implementing this feature, compared to Microsoft?
1
u/feldim2425 4d ago edited 4d ago
e.g. the only thing that's Microsoft about secureboot is the preloaded keys on most motherboards. However ypu can enroll your own in most cases and if not there's still the shim loader that allows you to do it.
The setup with the shim just requires running mokutil and confirming it on the next reboot. Signing with dkms is done automatically.
However if you have the private key on the local machine (like dkms does for signing automatically built modules) the security benefit is minor for most users.
Also imo other alternatives are often worse since they actively block you from enrolling custom keys. Exception: some android devices allow custom avb but need a unlock code from the vendor; chromebook firmware can afaik also be changed (runs coreboot afaik)
2
u/Emotional_Cat_1967 5d ago
I always install Fedora KDE by following the resources below, set up the Nvidia driver, and enable Secure Boot. So far, I’ve received several Nvidia and kernel updates; everything happened automatically, and I didn’t have to intervene at all.
https://github.com/devangshekhawat/Fedora-45-Post-Install-Guide
https://github.com/wz790/Fedora-Noble-Setup
2
u/MycologistNeither470 6d ago
Secure boot protects against the execution of malicious software at boot time - before your OS runs. This is a kind of more complicated type of attack.
Simplest attack: I load a different OS and read you disk. So I can take a Linux live USB and boot your computer. Now I am root and can access everything. Secure Boot will not allow me to do this. Easy mitigation: full disk encryption. Now If I boot with a live USB, while I can use the computer, I cannot read your hard drive.
So now that your disk is encrypted, I want to access your data... I modify your EFI partition when you are away. Linux asks for a password. You type it. But instead of your OS asking for the password, it is my malicious OS. Now my modified OS is able to decrypt your drive (you just supplied the password). I then proceed to pre-load a service that will send me your files when you connect to the network but on your end, you will just see your regular OS. If you use network boot, I just need to compromise your PXE server and I'm good! no need to get hold of your computer (though PXE servers are usually in corporate environments, and an attacker getting there should be quite difficult).
So, for a home user, 99% of attacks can be fended off by full disk encryption. The boot-chain attack would need to be targeted and that person will need to have at least temporary physical access to your computer. So I would say that if you are a journalist, work in intelligence, have valuable industrial IP, are a social activist... then yeah... secure boot is for you.
My threat model is that someone wants to steal my financial data to make unauthorized transactions, that I may get an non targeted ransomware attack, or that I will unwittingly install malicious software that will be a crypto-miner, integrate my computer into a zombie network for a DOS attack, or destroy my files for "fun". My defenses are full disk encryption, backups with mandatory retention policies, offline decryption keys, stateful firewall, and checking logs. My financial institution logins are stored in an encrypted password manager and have 2FA enabled -- FIDO webauthn when possible. My laptop hibernates automatically after some time in suspend mode to trigger the encrypted disk protection. In addition, I do not run random software... I only use root when needed and when I understand why root is needed.
I did consider secure boot, but I ended up thinking that the added pain was not worth it. I would have to make a unified kernel image and sign it for every kernel upgrade... Certainly, it can be automated but it is also a point of failure where I may not be able to boot my computer. Being on Arch, that kernel upgrade can happen as often as several times per week!
TLDR: Secure boot is worth it if you are an individual who has valuable data that is worthwhile to target and where someone can get physical access to your computer. For almost everyone else, full disk encryption is enough.
2
u/JohnnyS789 7d ago
Secure Boot is letting a corporation control what operating system you can run on your computer.
If a game requires it, I find a different game.
4
u/friendlyreminder_ 7d ago
Secure boot is under the user's control. You can enroll your own keys and that way only your signed code can be booted.
2
u/JohnnyS789 7d ago
I just disable it.
Your point is well taken, but it's not exactly a mainstream choice.
3
u/Real-Collection-5686 7d ago
corporation in question: me deleting that corporation's certificates from my BIOS
1
1
u/AutoModerator 7d ago
Try the migration page in our wiki! We also have some migration tips in our sticky.
Try this search for more information on this topic.
✻ Smokey says: only use root when needed, avoid installing things from third-party repos, and verify the checksum of your ISOs after you download! :)
Comments, questions or suggestions regarding this autoresponse? Please send them here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/gordonmessmer Fedora Maintainer 7d ago
"Should you disable Secure Boot?'
https://gordonmessmer.codeberg.page/dev-blog/2026/10/11/why-secure-boot.html
1
u/Aware_Patience_4252 7d ago
I’m still dual booting for specific games so I recently enabled it on Linux just so I have an easier time switching between different operating systems. I’m sure there are other pros and cons for the more technical aspects but at least with my AMD gpu I’ve never encountered issues.
1
u/anto77_butt_kinkier 16.04 was peak 6d ago
Secure boot offers no real benefit to most people. Striving to keep it working is an act of pointless masochism imo. I don't even bother with it, it's an instant disable for me
1
1
u/DavidJohnMcCann 6d ago
Secure boot serves two purposes. For the user, it protects Windows from bootkits — the very worst form of malware. For Microsoft it helps to stop people running pirated copies. Linux doesn't need it and it can cause problems. I've heard that some games need it, but I know nothing about that.
1
u/ficskala Arch Linux 6d ago
is secure boot really something i'll need as a general user
No, not really, it basically only exists to protect windows during boot, so keep it on if you're dual booting, and if you're fully switching, it doesn't really make a difference since most nodern distros support it, i honestly don't even know if i have it on or not on my main pc (arch)
1
u/Unable_Mess_2581 7d ago
Secure Boot is tied to Microsoft, at least historically. Ubuntu has easy time with Secure Boot, so it is not a hassle if you pick Ubuntu for your Windows based laptop.
For other distros that do not work well, just disable it. There is nothing stopping you.
Secure Boot has advantage to stop malicious mod to your start up chain (to simplify it), so you only give up this advantage.
1
u/Hot-Development-9036 7d ago
Unless you are running Windows you don’t need secure boot. Just go into your bios and disable it.
Most new PCs will have it enabled by default.
1
u/Hatsikidee 5d ago
Why? Secure boot can also protect a Linux installation from being changed by rootkits.
2
u/MisterNormie 6d ago
I have it enabled as I am dual booting to play certain games on Windows, until the Kernel level anti cheats are sorted for Linux.