82

Linux users who have Secure Boot enabled on their systems knowingly or unknowingly rely on a key from Microsoft that is set to expire in September. After that point, Microsoft will no longer use that key to sign the shim first-stage UEFI bootloader that is used by Linux distributions to boot the kernel with Secure Boot. But the replacement key, which has been available since 2023, may not be installed on many systems; worse yet, it may require the hardware vendor to issue an update for the system firmware, which may or may not happen. It seems that the vast majority of systems will not be lost in the shuffle, but it may require extra work from distributors and users.

you are viewing a single comment's thread
view the rest of the comments
[-] bacon_pdp@lemmy.world 24 points 2 days ago

Sounds like a good reason to demand coreboot or libreboot support for all computers you buy

[-] 9tr6gyp3@lemmy.world -1 points 2 days ago

As much as I would like to agree with that, each piece of hardware is going to have its own niche set of problems that the coreboot/libreboot team is not going to research and maintain. It wont be because they dont want to. They just dont have the resources and source code from the vendors. You will get your standardized updates, but it will not cover a lot of the proprietary blobs necessary for the hardware to operate.

Once the vendor stops supporting it, thats it. Its a ticking time bomb. Its how we get articles like the one in the OP. The vendor and user are not going to put in work to keep this updated. Even if they had coreboot/libreboot, it wont get updated.

Its a shitty thing that isn't easy to solve except by tying in hardware and software into single, unified products that are written in perfect code. Its not possible.

[-] bacon_pdp@lemmy.world 6 points 2 days ago

Well, no.

There are only a handful of hardware manufacturers for each component on a motherboard that might require firmware and once a motherboard is supported by coreboot, it can be maintained at a component level across all vendors who use that component (thus being cheaper than rolling their own proprietary firmware and cheaper to maintain over the lifetime of support) and we only need 1 single person in the whole world to keep it maintained.

[-] 9tr6gyp3@lemmy.world 1 points 2 days ago* (last edited 2 days ago)

Generally, motherboard manufacturers source their components from other companies. They do not manufacture the entire board themselves. This includes CPUs, Wifi cards, USB controllers, bluetooth, audio, display controllers, etc. Each and every one of them create new products, maintain their own firmware for all those new products, and push updates to the motherboard manufacturers when there are updates.

Coreboot/libreboot do not update those components themselves. They also must be provided that source code.

Just for coreboot alone, the last release had more than 120 contributors push over 900 commits. One person is not able to maintain that piece of software, as it is an enormous task.

[-] bacon_pdp@lemmy.world 2 points 2 days ago

If the problem was getting it to work in the first place, then you would be right.

But once code is there and working, maintenance is an easier problem especially since git is involved.

Binary blobs on the other hand are just endless pain and only get worse with time.

In the words of Bryan Cantrill, we are at war with proprietary firmware and unfortunately at this moment in the war we are losing.

[-] 9tr6gyp3@lemmy.world 0 points 2 days ago

Even if the code is there, you will need someone to maintain that code. Easier or not, even in a git repository, those individual components will eventually not have the support necessary to patch it.

If an eight year old usb controller has flaws, and the manufacturer is not maintaining that git repository anymore because they cannot possibly afford to hire someone to look at that code after so long, then it is going to keep those flaws. It wont matter if that code is proprietary or open source and included in coreboot. Its just simply not feasible to support hardware properly once most of the world has moved on to other products.

[-] bacon_pdp@lemmy.world 0 points 9 hours ago

We agree that we can not expect companies to support products beyond the timeframe which they expect to sell and support their own products. Code under FSF approved licenses means that anyone can say, “I need this supported” and choose to pay anyone that they want to get support. Or at the barest minimum, ensure existing functionality is not removed from them, just because company A demands that you their customer should buy something newer and that it would be in their financial best interest to brick their customers’ shit.

[-] 9tr6gyp3@lemmy.world 1 points 8 hours ago

I wish all the firmware for every motherboard was made public and open sourced. Even if a company has proprietary firmware/drivers, I would hope that once that product reaches end of life that they do in fact open source that code so that someone else can pick up where they left off.

I 100% agree that they should not brick their hardware once it reaches end of life. There might be someone out there who would take on the task of maintaining it, which is better than nobody maintaining it.

load more comments (3 replies)
load more comments (3 replies)
load more comments (3 replies)
this post was submitted on 20 Jul 2025
82 points (100.0% liked)

Linux

8531 readers
541 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago
MODERATORS