On Tue, 2017-10-24 at 09:01 +0200, marc wrote: > Secureboot is designed for them, not for you. You might come > up with a really exotic use case, where it might help you. But > if you look at it carefully enough, it relies on secureboot > redefining root to something weaker than what we want, and > running some complex infrastructure which you are unaware > of behind it. If you want a weak root, run a virtual machine > instead.
Not at all. Right now if you install Fedora or Ubuntu you get the protection of secure boot. You already trust them if you are installing their OS, correct? Everyone signs the kernel package at the package manager stage so we can all use untrusted mirrors. So now they also put a signature on a grub-efi package with a key signed by the UEFI CA that embeds their company keys. Now your system validates that GRUB is clean and it checks the kernel hasn't been tampered with before executing either of them, Eventually Debian will begin shipping signed grub-efi and kernel packages. Devuan would have to pay $100 to get a signed grub-efi of its own (with a Devuan kernel signing key embedded) to ship kernels built by them if they don't just pass on the Debian grub and kernel packages unmodified. That is it, one can argue how much security benefit it brings but it is non-zero and requires minimal effort to achieve. I think you have to pay again if your grub-efi package changes but it doesn't seem to churn much.
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Dng mailing list Dng@lists.dyne.org https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
