this post was submitted on 30 Apr 2026
83 points (98.8% liked)
Linux Gaming
25711 readers
12 users here now
Discussions and news about gaming on the GNU/Linux family of operating systems (including the Steam Deck). Potentially a $HOME away from home for disgruntled /r/linux_gaming denizens of the redditarian demesne.
This page can be subscribed to via RSS.
Original /r/linux_gaming pengwing by uoou.
No memes/shitposts/low-effort posts, please.
Resources
Help:
- ProtonDB
- Are We Anticheat Yet?
- r/linux_gaming FAQ
- Fork of an earlier version of the above
- PCGamingWiki
- LibreGameWiki
Launchers/Game Library Managers:
General:
Discord:
IRC:
Matrix:
Telegram:
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Secureboot isn't worth the 1's and 0's it's made of. It's the illusion of security, since it was already defeated. It only inhibits incompetent hackers and malware. The weakest link in all computer security is always the user. SB just causes more problems than solutions.
this is really stupid advice. Secureboot should be installed on laptop otherwise your device is as good as open. Sure it has some CVEs but its a big step up in security and its getting better and better on linux.
This performance issue is likely due to an issue with the driver not with secure boot itself. Maybe since it is an old driver it wasnt signed.
What advantage does secure boot have compared to full disk encryption? The only examples I've seen have been contrived evil maid attack that fails under scrutiny.
Evil maid is one advantage but signed modules is another. Secure boot can prevent you from loading unsigned kernel modules once booted.
You basically need to have both or your computer is practically open for anyone who has physical access to the device.
For my desktop I dont use either but for my laptop i'd never leave home without both.
Once you're booted secure boot is inactive. If there was a security benefit to only loading signed modules, then distros would have that enabled by default regardless of the secure boot status.
Iirc, requiring modules be signed is a requirement Microsoft put on the shim bootloader rather than Lunux's choice. I could be mistaken here, I'm not too sure on the specifics.
Regardless, if someone has the ability to load or modify modules on an encrypted Linux install, they can just steal Firefox's cookie jar and cut out the intermediate step.
I might be wrong on some of this so take it with a grain of salt but heres my view.
Its not only loading signed modules it enables kernel lockdown mode which prevents even the root user from accessing certain kernel functions. This prevents them from installing persistent malware and a host of other attacks. Fedora and other distros that ship secure boot do enable this.
Yes microsoft signs the shim but I believe other authorities are being worked on.
If someone gets root on your system they can do a lot of damage but you can still prevent it and limit it. Stealing my firefox cookies is much better than installing persistent malware. If my cookies are stolen I can clear the malware and reset my passwords, same cannot be said for loading something into the kernel.
My gut reaction is that there are a lot of ways, once you have root access, to have your changes persistent. For example, modifying/replacing binaries, adding new ones before old ones in the path, adding startup scripts, modifying config files. Kernel modules seem to be an overcomplicated way to go about it, especially since (afaik) it would need to be compiled against the specific kernel version.
If you have to choose between one, then yes; full disk encryption is superior. But they should ideally be used in tandem.
Without secure boot, you are vulnerable to evil maid attacks. A bad actor can modify your bootloader (which has to remain unencrypted) in a way that allows them to steal your encryption keys. Secure Boot prevents running unsigned bootloaders, which negates this risk.
If someone has access to your device enough to modify your bootloader they could also just install a hardware keylogger or hidden camera and get your password that way.
Sure, but that's much harder to do undetected. Don't let perfect be the enemy of good. Secure Boot still prevents against particular types attacks.
I get that perfect is the enemy of good, but you also need to have defined threat models. Secure boot protects against people covertly taking your ssd, putting it in their own device, overwriting the OS with one that looks identical but is a key logger, and then putting it back in your system. Yet systems with secure boot have no tooling to stop attackers from just... Putting a hardware keylogger inline with the keyboard.
I second SavvyWolf. Full disk encryption is better than SecureBoot. SB is security theater for people who don't know what they're doing and don't know how to avoid getting their laptop infected in the first place. As I said before, SB has already been defeated. Every hacker/malware can bypass it already. It's like pretending you have armor on and going headlong into a sword fight.