Neither Secure Boot nor TPM were ever actually about security and neither meaningfully improves security. They are DRM features that exist solely to ensure you can never truly own the things you buy.

Kernal level anticheat is invasive and the vast majority of anticheats are probably installing spyware with root access.

In my opinion its only useful against unsigned boot attacks and such,also you have to go through Microsoft for signing which is pretty bad if you wanna reduce reliance on Microsoft.

The biggest issue to me is that if you (the OS maker) wants a shim so you can use your own CA, you have to go through Microsoft. And they can just say no.

I think Tuxedo is still waiting on their shim.

It's pretty pointless if you allow it to use Microsoft's keys. It's a lot of work to set it up to only use your keys and that bricks certain poorly designed laptops.

For Linux, the protection is weak.

But if properly implemented, it’s good. But it would be a hassle to do and would require users to register new keys and blacklist Microsoft’s.

Measured boot is a better solution for Linux. It’s decentralized and does not rely on Microsoft. It uses the TPM to “measure” various parts of the UEFI, bootloader, and OS to ensure they have not been tampered with.

All secure boot does is ensue the binary (say, Linux or Windows kernel) run in early boot is "trusted," meaning it's cryptographically signed by a key the motherboard has. You can usually load your own keys and sign your own binaries, but I imagine only large orgs do that if they have a lot of Linux systems or something.

The way Linux works with this is they use a shim binary that is signed by Microsoft's key, and that binary loads the actual Linux kernel. The kernel itself is not signed with that key.

The only way this impacts gaming is if games check if Secure Boot is enabled. If it is enabled, the game knows the system booted with something signed by a key the motherboard trusts. For most systems, that means Microsoft's keys, but AFAIK, they can't check what key was used in early boot unless the kernel provides some indication of that.

Basically, it's an anti-tampering check, so they have some assurance the kernel is untampered from what the maintainer released.

Others have already explained the secure boot process. But one thing that might impact gaming is that TPMs also implement cryptographic acceleration in hardware. Not only does it speed up operations, it guarantees that the binary code for the library running on the chip hasn't been modified.

Some anti-cheat libraries might require the TPM and having secure boot on guarantees that feature exists.

Secureboot is a security measure to make sure the boot environment have not been tampered with. It would detect malwares that attempt to modify the boot environments. According to ArchWiki, it ensures "core boot components (boot manager, kernel, initramfs) have not been tampered with", which would protect against initramfs-swap attacks like de-LUKS, however there are conflicting reports on the internet, and I have not tried myself.

I personally don't find it makes Linux harder to install, like others suggested. Unless you use a surface device, it will happily accept the key for most common linux distro, including Ubuntu, Debian, Fedora, and many more. For most custom distros, you can easily register its key via MOK (require root privilege and confirmation in the UEFI, for security purpose). In fact, Debian project is quite clear on SecureBoot not being a tool for MS to monopolize the desktop market: https://wiki.debian.org/SecureBoot#What_is_UEFI_Secure_Boot_NOT.3F .

However, if you need to load additional kernel modules, like NVIDIA drivers, secureboot can get quite annoying. I am actually quite interested in why Windows don't have a problem loading additional drivers, yet Linux do.

In the end, I feel if you are using a distro that works with secureboot, there is no reason to leave it off; if you find it annoying, yet okay with a downgrade in security, then you might want to leave it off.

Secure boot is BS

🤭 nobody 🧵 talk𐑙 b𐑬t CVE-2025-7027.

𐑓 commoners.

No, it's not actually bad, it can just be a hassle to deal with. Much like when TLS was becoming the norm for websites there was a bit of an adjustment period when things weren't always configured just right or folks didn't have good auto renewal yet. It doesn't mean the tech is bad.

Linux does support TPM and secure boot: https://wiki/ .debian.org/SecureBoot#What_is_UEFI_Secure_Boot.3F

So the problem is really only about kernel level anticheat, not the secure boot itself ?

Worst part is everything has to use Microsoft's signing keys, so it's ironically a gigantic security hole if your threat model includes being on Microsoft's shit list.