To start with, security of "secure boot" there is a joke because anyway all os have to be signed by Microsoft itself. So anyone with they certificate key can do whatever they want.
And btw, not that long ago it was released by researchers than more than 200 platforms from diverse but main laptops and servers manufacturers were still using leaked keys for signing their boot loaders...
> security of "secure boot" there is a joke because anyway all os have to be signed by Microsoft itself.
Is Apple a joke because they sign the root of trust for their devices? Someone has to be the root authority. Honestly I trust MS more than I do Google or VerisignDigicert. They are the least likely to intentionally break things.
The reason MS controls the root and not Red Hat etc. is because the Linux camp spent years arguing back and forth about exactly how much they hate secure boot - like an HOA arguing over paint colors - instead of presenting solutions.
> So anyone with they certificate key can do whatever they want.
this is literally how PKI works
Somehow I think MS put a little more thought into their PKI design than whatever you're trying to convey here. What were the other options? Store it on a Yubikey sewn into rms's beard?
People are quick to dismiss secure boot simply because they refuse to understand it.
Basically a little bit yes. Especially for an entity located in US and with strong links to the basic government.
But in the case of secure boot, this is worse, because Microsoft is just a "software" editor. But its root certificate and probably a few random others are distributed in countless of devices produced by manufacturers unrelated to them, but also, a few number of software distributors will also have subkeys to be able to sign their os/software. All of that, with zero transparency.
And in the end, if I buy a Lenovo laptop, to have Linux OS running on it, there is no reason and no trust to have my OS be signed by Microsoft, that has the key to run whatever they want on my laptop. Think about it and you will see that it makes no sense at all, if you don't trust Microsoft for your OS, to have to trust them for ensuring a secure boot...
Some PCs are able to use your own keys, which can be used to sign your bootloader. This has worked well for me with various HP computers (EliteBooks and EliteDesks). One of those, which only runs Linux, will refuse to boot the Windows installer. On my work laptop, I've also added the Windows key (not the 3rd party one) so I can dual-boot.
I understand some computers may not support this as well, so YMMV.
That grub has security vulnerabities does not surprise me, it's just too big. That's why Lennart recommends systemd-boot. (Incidently a Microsoft employee, but I have no information that he would have been involved in these discoveries.) U-boot again is typical embedded software, a field generally known more for hacks than strict programming practices. So I cannot say I would be shocked. That said, I would be surprised if systemd-boot or Microsoft's loader had zero vulnerabilities hiding somewhere.
When does Microsoft open their source for searching vulnerabilities?
GRUB is too big? Maybe because it's 30 years old and can boot at least 11 architectures.
...and what systemd-boot is? A UEFI only boot menu which gets its data from UEFI only.
I mean comparing two different things and claiming the more featured one too big is mental gymnastics to put it politely.
GRUB having vulnerabilities is not surprising, esp. when the thing is written at an age where computers were completely different things, programming and requirements wise, but insinuating that systemd-boot is the ultimate replacement is, eh, a bit underhanded. Esp. when it comes from Lennart, whose systemd is too big and encompassing for an init system.
It’s not an article about vulnerable boot loaders. It’s an ad for their AI offering. That they turned their AI loose on some boot loaders is not material to the intended affect of the ad.
Did you read the OP link ? They go in far more details than just presenting what they did with AI, and they actually found several exploitable vulnerabilities, not just with AI, but with other techniques such as code analyzing or fuzzing.
AI is in he title, but the content is not entirely revolving around it.
if you want to security, I think a generic boot loader isn't really a realistic target. A boot loader should be specific to the hardware. If you want a generic boot loader, you need to integrate perfected boot loaders for each hardware.
To start with, security of "secure boot" there is a joke because anyway all os have to be signed by Microsoft itself. So anyone with they certificate key can do whatever they want.
And btw, not that long ago it was released by researchers than more than 200 platforms from diverse but main laptops and servers manufacturers were still using leaked keys for signing their boot loaders...
> security of "secure boot" there is a joke because anyway all os have to be signed by Microsoft itself.
Is Apple a joke because they sign the root of trust for their devices? Someone has to be the root authority. Honestly I trust MS more than I do Google or VerisignDigicert. They are the least likely to intentionally break things.
The reason MS controls the root and not Red Hat etc. is because the Linux camp spent years arguing back and forth about exactly how much they hate secure boot - like an HOA arguing over paint colors - instead of presenting solutions.
> So anyone with they certificate key can do whatever they want.
this is literally how PKI works
Somehow I think MS put a little more thought into their PKI design than whatever you're trying to convey here. What were the other options? Store it on a Yubikey sewn into rms's beard?
People are quick to dismiss secure boot simply because they refuse to understand it.
Basically a little bit yes. Especially for an entity located in US and with strong links to the basic government.
But in the case of secure boot, this is worse, because Microsoft is just a "software" editor. But its root certificate and probably a few random others are distributed in countless of devices produced by manufacturers unrelated to them, but also, a few number of software distributors will also have subkeys to be able to sign their os/software. All of that, with zero transparency.
And in the end, if I buy a Lenovo laptop, to have Linux OS running on it, there is no reason and no trust to have my OS be signed by Microsoft, that has the key to run whatever they want on my laptop. Think about it and you will see that it makes no sense at all, if you don't trust Microsoft for your OS, to have to trust them for ensuring a secure boot...
>Someone has to be the root authority
No-one has to be, and it certainly doesn't need to be anyone but the owner of the machine.
> No-one has to be, and it certainly doesn't need to be anyone but the owner of the machine.
Technically the web should work with self-signed certificates. But that is likewise impractical.
Some PCs are able to use your own keys, which can be used to sign your bootloader. This has worked well for me with various HP computers (EliteBooks and EliteDesks). One of those, which only runs Linux, will refuse to boot the Windows installer. On my work laptop, I've also added the Windows key (not the 3rd party one) so I can dual-boot.
I understand some computers may not support this as well, so YMMV.
That grub has security vulnerabities does not surprise me, it's just too big. That's why Lennart recommends systemd-boot. (Incidently a Microsoft employee, but I have no information that he would have been involved in these discoveries.) U-boot again is typical embedded software, a field generally known more for hacks than strict programming practices. So I cannot say I would be shocked. That said, I would be surprised if systemd-boot or Microsoft's loader had zero vulnerabilities hiding somewhere.
When does Microsoft open their source for searching vulnerabilities?
GRUB is too big? Maybe because it's 30 years old and can boot at least 11 architectures.
...and what systemd-boot is? A UEFI only boot menu which gets its data from UEFI only.
I mean comparing two different things and claiming the more featured one too big is mental gymnastics to put it politely.
GRUB having vulnerabilities is not surprising, esp. when the thing is written at an age where computers were completely different things, programming and requirements wise, but insinuating that systemd-boot is the ultimate replacement is, eh, a bit underhanded. Esp. when it comes from Lennart, whose systemd is too big and encompassing for an init system.
It's the pot calling the kettle black, heh.
>That's why Lennart recommends systemd-boot.
The creator of SystemD recommends systemd-boot? Seems legit and unbiased.
There is probably an overlong yet superficial, easy to read post on his blog about it.
Yeah, and because grub is too big. Says systemd, of all places.
Pulseaudio still doesn't work reliably.
I think Pipewire has completely replaced Pulseaudio where it matters.
Yes, PulseAudio works great since it's actually PipeWire.
The link for U-Boot CVE-2025-26729 is actually 2 separate links that lead to different vulnerabilities depending on which half of it you click.
Odd. I wonder if the article was written by AI.
Title: Analyzing open-source bootloaders: Finding vulnerabilities faster with AI
Nice to see Microsoft boosting open source operating system practices. (May be a little anti monopoly politicking, ahem.)
Makes me trust open source operating systems more!
It’s not an article about vulnerable boot loaders. It’s an ad for their AI offering. That they turned their AI loose on some boot loaders is not material to the intended affect of the ad.
agree it's an ad
but if they sent the AI through all that ancient code and that's all they found it's not a good advertisement
Did you read the OP link ? They go in far more details than just presenting what they did with AI, and they actually found several exploitable vulnerabilities, not just with AI, but with other techniques such as code analyzing or fuzzing.
AI is in he title, but the content is not entirely revolving around it.
I consider the ability to bypass secure boot a feature, not a bug.
if you want to security, I think a generic boot loader isn't really a realistic target. A boot loader should be specific to the hardware. If you want a generic boot loader, you need to integrate perfected boot loaders for each hardware.