Re: [GIT PULL] Load keys from signed PE binaries

[Peter Jones]

On Tue, Feb 26, 2013 at 10:30:46PM +0100, Florian Weimer wrote:
> * Linus Torvalds:
> 
> > So here's what I would suggest, and it is based on REAL SECURITY and
> > on PUTTING THE USER FIRST instead of your continual "let's please
> > microsoft by doing idiotic crap" approach.
> 
> I think the real question is this one: Is there *any* device out there
> which comes with Microsoft Secure Boot enabled, but doesn't have a
> copy of Windows 8 on it?
> 
> I guess there isn't.  So Secure Boot support is only required for
> supporting dual-booting Windows 8, while still retaining the automated
> recovery capabilities (which might well remove the Linux installation
> on the same box).
> 
> Without dual-booting, there is currently no reason whatsoever to
> enable UEFI Secure Boot (or the Microsoft variant).

It prevents a form of malware which exists in the wild.  I think that's
enough reason to want *something*, though SB isn't necessarily what
we'd have dreamed of.  Nevertheless, SB is what we've got, and as such
is why we've been working on how to use it meaningfully.

This all seems pretty orthogonal to the question at hand, of course.

-- 
        Peter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/