Secure Boot worth it?

[M_B]

What do you do if you havent clicked the enable secure boot option during install in Mint?

[2disbetter]

@Jorg_Mertin

With Windows 7 or beginning of Windows, you had the constant pop-ups telling you to install a AV to your system.

Since Windows 10 (possibly earlier) Windows comes with built-in anti-virus. (Windows Defender) It is a part of the OS. If you aren’t surfing nefarious sites 24/7 or doing things that are illegal, it is all you really need. Use a web browser like Brave to help cut the main vector for infection anyway.

@Jorg_Mertin

Evidence? 15 years? Security is a huge market. In every company, installing an AV is mandatory to for “compliance”.

That is marketing and an industry trying to stay relevant. Why AV is relevant in the enterprise world is because most people responsible for network security ultimately see AV as a check in the box, whether it does anything or not. Security “experts” are mostly a sham these days. (There are also real experts who absolutely know that they are talking about. Too few of these to be honest.) They took a few COMPTIA courses and can push buttons or run scripts. (I’m not referring to you Jorg here. I’m generalizing about the industry and the general lack of understanding concerning cyber security.) While most AV software isn’t really a bad thing, besides being a parasite on computing and memory, it is also just not necessary if you use a privacy and security minded browser and some good computing habits.

Back to the topic of this discussion though, I think Secure Boot is something useful in conjunction with Windows, but ultimately not REALLY necessary on Linux. It causes problems with a lot of kernel specific software as well on Linux. (Hypervisors, etc.) In most cases hibernation wont work at all with secure boot on.

[Jorg_Mertin]

@M_B

What do you do if you havent clicked the enable secure boot option during install in Mint?

As I just said. Make sure to install a registered/signed kernel, and in the BIOS setup, secure boot, register the neon/shimx64.efi as valid boot device/file or whatever. I’d need to reboot to check the exact location place I did it.

[nadb]

@Morgwai

It seems to me you think hibernation works very similarly to suspend-to-RAM while they are significantly different. From the hardware perspective of a given machine, during hibernation the machine is basically completely turned off. As a consequence any data in its RAM is erased to the same extent as if the OS was shutdown.

Yes, I know. I had no plans on doing a deep dive into security implications, threat models, and least of all the details of hibernation and suspend. My response was meant as an opinion not an authoritative dissertation. I will not be taking the time to make one either.