• thearch@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      35
      ·
      3 months ago

      It’s supposed to prevent unsigned files from being loaded by the UEFI (AFAIK) which could possibly help with rootkits, if it doesn’t somehow sign itself. However, these are pretty rare if you don’t allow sketchy software to access your boot partition, and will often cause issues with non major Linux distros.

          • bruhduh@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            Nah man, it didn’t even allowed to boot iso from ventoy until i disabled secure boot

            • SSJMarx@lemm.ee
              link
              fedilink
              English
              arrow-up
              3
              arrow-down
              1
              ·
              3 months ago

              With Debian I think I was able to load the appropriate keys after installing the OS and then re-enable secureboot in the bios. Might be worth checking into.

              • Emerald@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                I just don’t bother with secure boot as its not in my threat model. I turn it off

            • Emerald@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              Well of course, thats the setup. Disabling secure boot. If it didn’t stop you from booting a third party OS without you toggling that BIOS option, then the security feature would be pointless.

    • TexMexBazooka@lemm.ee
      link
      fedilink
      English
      arrow-up
      10
      ·
      3 months ago

      Speaking from my background, it prevents someone from trying to boot using an external device to access your system, assuming you have a BIOS password in place.

      Of course encrypting your drive works just as well, but security in depth demands a “why not both?” Approach