I mean, Secure Boot does actually help defend against evil maid attacks if paired with FDE. Someone can't just fuck with your /boot (CVE-2016-4484 nonwithstanding) to do naughty things with your system if you have Secure Boot enabled. Does that fit with most people's threat model? I dunno, probably not. It does actually do something useful though.

My work computer has it enabled and I feel better for it. The issue described in the article is easily dealt with if you just keep up with your firmware updates using fwupd.

[–] Maiq@lemy.lol 3 points 4 days ago

Just so I have this right, fwupd will update the firmware with the new keys. Just fuzz on if you have to create a new secure-boot key yourself?

[–] sylver_dragon@lemmy.world 1 points 3 days ago (1 children)

Ya, Secure Boot is really only useful for corporate devices or very specific people who might actually be targeted by state level attackers. For most of us, it's not worth the hassle.

[–] noxypaws@pawb.social 4 points 3 days ago

we are all currently being surveiled by state level attackers.

[–] possiblylinux127@lemmy.zip 1 points 3 days ago

It would be nice if system76 did firmware updates via fwup

It doesn't nor does it protect against tampering what so ever

[–] possiblylinux127@lemmy.zip 3 points 3 days ago

It can be a major security benefit when done correctly.

I'm not sure if there is a single vendor doing it correctly

[–] Prime@lemmy.sdf.org 0 points 3 days ago

Cannot always be disabled