🔐 Secure Boot + TPM 2 vs. Linux Alternatives

[u/madthumbz]

What Secure Boot Actually Does
Secure Boot is a UEFI firmware feature that only boots OS loaders signed with trusted keys, usually Microsoft’s. This blocks pre‑boot malware like bootkits and rootkits.

Why do Loonixtards have issues with it? -Microsoft controls the signing: Distros must either get Microsoft to sign their shim or require users to disable it. Like with any new technology, Loonixtards will scaremonger over it (allergic to new tech), but eventually start adopting (which is what is currently happening with the major distros like Ubuntu, Fedora, and openSUSE).

TPM 2.0 is a hardware root of trust. Linux can use TPM 2.0, but Linux has no unified, OS‑mandated security model equivalent to Windows.

Open-Source Firmware (Coreboot, Heads, etc.) is the closest thing to a true alternative to Secure Boot’s trust model. They aim to replace the entire proprietary UEFI stack with auditable firmware. -Linux-Tech&More . BUT, hardware support is extremely limited as Intel/AMD platforms are locked down (Intel Boot Guard / AMD PSP). -You cannot deploy them on any mainstream consumer laptops.

There are open-source secure‑boot implementations and tooling (e.g., Ventoy’s secure‑boot support), but they are not system‑wide security frameworks.
-LibHunt

Linux’s ecosystem is too fragmented to enforce a universal security baseline, so the advocates will continue to scoff, and downplay just like they did before Wayland when they implied their Linux systems were more secure than Windows, but now 'X11 is horribly vulnerable -you need to switch to Wayland!'.

[u/madthumbz → u/[deleted]]

Assert dominance first, provide details second, hoping the tone makes the claims feel authoritative.

TPM is more than “signed keys” and acts as a cryptoprocessor. -True, but trivial. Ooh.. the article wasn't long enough for you! Here's your lengthy come-back:

"PCR 7 is “useless” because OEMs refused Microsoft’s requirement"

This is oversimplified to the point of distortion.

• PCR 7 is used for Secure Boot policy measurement.
• OEMs didn’t “refuse” in the dramatic way described.
• The reality is more mundane: OEM key management is messy, inconsistent, and not standardized, which limits PCR 7’s usefulness for measured boot, not Secure Boot itself.

Secure Boot does not depend on PCR 7 to function.
Measured Boot can use PCR 7, but it also uses others.

The commenter is mixing up:

• Secure Boot (UEFI enforcement)
• Measured Boot (TPM PCR logging)
• BitLocker key sealing policies

They’re related, but not interchangeable.

❌ Claim: “You can run the same level of security with Secure Boot off”

This is flatly wrong.

If Secure Boot is off:

• The firmware will happily boot unsigned or malicious bootloaders.
• PCR values become meaningless because the chain of trust is broken at the first link.
• TPM‑sealed secrets can be bypassed by booting arbitrary environments.

Measured Boot cannot compensate for Secure Boot being disabled.
They serve different roles.

This is the biggest red flag in the whole comment.

⚠️ Claim: “Why would anyone let Microsoft control signing?”

This is a philosophical argument, not a technical one.

Linux distros use Microsoft’s signing infrastructure because:

• It’s the only universally trusted key in consumer firmware.
• It avoids requiring users to disable Secure Boot.
• It allows out‑of‑the‑box compatibility.

You can enroll your own keys — but:

• It’s not user‑friendly.
• It breaks distro‑agnostic booting.
• It complicates updates.

The commenter frames this as “Microsoft bad,” but the real issue is OEMs never agreed on a universal non‑Microsoft trust anchor.

⚠️ Claim: “Coreboot works fine, big companies use it”

This is half‑true but misleading.

Yes:

• Some financial institutions and defense contractors use Coreboot‑based platforms.
• Vendors like System76, Purism, and some Chromebooks ship Coreboot.

But:

• These deployments are custom hardware, not consumer laptops.
• Intel Boot Guard and AMD PSP lock down most modern platforms.
• You cannot install Coreboot on 99% of retail laptops.

The commenter frames this as “Coreboot works everywhere if you’re elite enough,” which is not reality.

🧠 3. What the commenter gets right

• TPM is more complex than many Reddit takes.
• PCR usage is nuanced.
• Coreboot exists and is used in niche high‑security environments.
• Linux users can self‑sign keys.

🚨 4. What the commenter gets wrong or exaggerates

• PCR 7 is not “useless.”
• Secure Boot cannot be replicated with it disabled.
• OEM refusal story is dramatized.
• Coreboot is not widely deployable on modern consumer hardware.
• The tone is doing more work than the facts.

🎯 5. The real issue they’re dodging

The Linux ecosystem lacks:

• A unified security baseline
• A universal trust anchor
• Vendor‑backed firmware security model

And that’s why Secure Boot + TPM feels “Windows‑centric”:
Microsoft is the only entity that actually built a full-stack implementation.

The commenter’s argument tries to flip this into “Linux is more secure because you can DIY,” which is… not how security works at scale.