I have yet to see a machine that doesn’t have a tainted kernel (meaning the kernel wasn’t signed, a module wasn’t signed, or both) in the wild. Not even with Ubuntu.
At the same time, requiring TPM 2.0 is the same anti consumer thing Win11 did.
Secure boot is a pain to set up on Linux because it was never meant to be for Linux. It’s a Microsoft invention that Microsoft holds the keys for.
Kexec is useful on a lot of machines for faster reboot times, and disabling it can make them significantly longer.
LSM BPF is scary and sketchy, especially if you’re giving a proprietary blackbox access to it. You should not have random software accessing that.
Actually, I setup secure boot, it isnt that much of a pain. If the docs were more clear, it’s like a nice 4-7 commands, with some reboots (clarity missing in arch wiki)
I have yet to see a machine that doesn’t have a tainted kernel (meaning the kernel wasn’t signed, a module wasn’t signed, or both) in the wild. Not even with Ubuntu.
At the same time, requiring TPM 2.0 is the same anti consumer thing Win11 did.
Secure boot is a pain to set up on Linux because it was never meant to be for Linux. It’s a Microsoft invention that Microsoft holds the keys for.
Kexec is useful on a lot of machines for faster reboot times, and disabling it can make them significantly longer.
LSM BPF is scary and sketchy, especially if you’re giving a proprietary blackbox access to it. You should not have random software accessing that.
Actually, I setup secure boot, it isnt that much of a pain. If the docs were more clear, it’s like a nice 4-7 commands, with some reboots (clarity missing in arch wiki)
I can’t even enable it because I have an nvidia card that doesn’t support the new ““open source”” driver, so I’m always loading tainted binary blobs.