@niggy >these security features do work friend, they make our lives very difficult.
Yes, the whole idea is to make it so that computers serve them and not you.

For now it's possible to disable secure boot and upload your own keys, but such features will eventually be removed, for "security".

>it's hard to get a malicious UEFI binary signed, it's a significant barrier to the vast majority of attackers.
The thing is, plenty of malicious and non-malicious shim binaries are signed.

It seems like a significant barrier as it's not easy to get x binary signed yourself, but if you think harder, all you really need to do is grab one of the many shim binaries available, upload that and then have the shim load your software.

There is a version of GNU Grub signed for UEFI with a "vulnerability" where it can be used to load whatever software (a feature really) and you really just need to load that up to boot whatever kernel you want (such binary has been added to the UEFI blacklist, but I'm not sure of any UEFI implementations that actually uses a regularly updated blacklist).

GNU/Linux previously couldn't be installed on windows ARM tablets, as m$ requires that "secure boot" can't be disabled on ARM tables (for "security"), but eventually someone happened to get a shim binary signed and finally GNU/Linux could be booted on such tablets.

Eventually m$ will ensure that "secure boot" implementations only boot windows and have a constant internet connection so blacklisted binaries can be added immediately (i.e. when someone finds a bug in the windows boot process that allows jumping to booting GNU/Linux instead, m$ can release a new version that doesn't have that feature and blacklist booting of the old version).

If you went online and tried now with the right technique, you could indeed do it.


"Secure boot" is only intended to restrict the user, although some parts of the plan are to be implemented later - therefore no real security benefit can be realized from such proprietary signing schemes - only a false sense of security, which is far worse that not having security, but knowing that you don't have it.