This is a secondary account that sees the most usage. My first account is listed below. The main will have a list of all the accounts that I use.

henfredemars@lemmy.world

Personal website:

https://henfred.me/

  • 1 Post
  • 461 Comments
Joined 1 year ago
cake
Cake day: July 4th, 2023

help-circle
  • It is highly unlikely that you have malware sophisticated enough to do something like compromise installation media (already exceedingly rare) yet not sophisticated enough to bypass secure boot.

    The purpose of secure boot is to verify that the boot loader and kernel are approved by the manufacturer (or friends of such). There are certainly ways to inject software into a system that doesn’t reside in those locations. It just makes boot sector viruses and kernel mode rootkits slightly more technically challenging to write when you can’t simply modify those parts of the operating system directly. If malware gets root on your installation it’s game over whether or not you have secure boot enabled. Much of the software on a computer is none of those things protected by secure boot.

    Plus, take another wager: most systems today ship with secure boot enabled. If you were a malware author, would you still be writing malware that needs secure boot turned off to run? Of course not! You would focus on the most common system you can to maximize impact. Thus, boot sector viruses are mostly lost to time. Malware authors moved on.

    Overall, it’s a pretty inconsequential feature born of good intentions but practically speaking malware still exists in spite of it. It’s unlikely to matter to any malware you would find in the wild today. Secure boot keys get leaked. You can still get malware in your applications. Some malware even brings its own vulnerable drivers to punch into the kernel anyway and laugh in the face of your secure boot mitigation. The only thing secure boot can actually do when it works is to ensure that on the disk the boot loader and kernel look legit. I guess it kind of helps in theory.



  • I’m not sure that Microsoft ever did halt going down that path. My wife recently bought a PC that came locked down by default and required some fiddling to allow running unsigned apps. This was Windows 10, not sure about 11.

    I think it could be more that broad compatibility with everything is their main selling point, and by doing so they were undermining their own ecosystem.

    However, this is mere speculation on my part.