list of vendors that sell hardware ready for Linux

[CatKiller]

ls UEFI no longer a barrier to booting unsigned systems?

It never was.

Secure Boot, which is a feature that UEFI has that BIOS didn't, allows the motherboard to prevent the loading of software that isn't signed with keys that the motherboard knows about. Because of market realities, all motherboards ship knowing about Microsoft's keys. You can turn Secure Boot off.

Additionally, Canonical and Red Hat had their keys signed using Microsoft's key, so every motherboard that knows about Microsoft's key (ie, all of them) can use Secure Boot out of the box with that software without any trouble at all. You can also tell the motherboard about any other key you're interested in - known as "enrolling a Machine Owner's Key" - and sign whatever software you want to.

This is orthogonal to UEFI itself: UEFI is simply better than BIOS in every way, even though it's not perfect. If you don't want to use Secure Boot, you can just turn it off, and if you do want to use Secure Boot it's only marginally fiddly to use with any software you want to.

[Skaperen]

It never was.

apparently, a lot of people didn't know that. the word that spread was different. too bad i quit listening to the topic before that got cleared up. i do remember saying in a couple places that it needs to be able to be turned off. no one ever answered that.

You can turn Secure Boot off.

too bad people didn't say that when the issue blew up. maybe there was just too much noise.

Additionally, Canonical and Red Hat had their keys signed using Microsoft's key, so every motherboard that knows about Microsoft's key (ie, all of them) can use Secure Boot out of the box with that software without any trouble at all. You can also tell the motherboard about any other key you're interested in - known as "enrolling a Machine Owner's Key" - and sign whatever software you want to.

is Microsoft a Secure Boot CA or does the spec force chained signing? if the latter, how deep?

UEFI is simply better than BIOS in every way, even though it's not perfect.

since you are saying that, maybe you can give a sweet summary of how UEFI is simply better. we'll have number 1 as: Secure Boot which can be turned off or have owner keys added.

[oldfred]

UEFI also uses gpt partitioning as its standard. Windows only installs in UEFI mode to gpt drives.
Ubuntu will install in UEFI mode to MBR partitioned drives, but probably should not.
I have used gpt with BIOS boot on my old system also.

From the Link in my signature below:
UEFI https://wiki.archlinux.org/index.php...ware_Interface
ESP/efi - Efi System Partition http://en.wikipedia.org/wiki/EFI_System_partition
https://en.wikipedia.org/wiki/BIOS_boot_partition
BIOS - Basic Input/Output System http://en.wikipedia.org/wiki/BIOS
CSM - UEFI Compatibility Support Module (CSM), which emulates a BIOS mode, only available with secure boot off.
grub2 https://wiki.archlinux.org/index.php/GRUB2
gpt(GUID) http://en.wikipedia.org/wiki/GUID_Partition_Table
MBR(msdos) http://en.wikipedia.org/wiki/Master_boot_record

UEFI Advantages
http://askubuntu.com/questions/64730.../647604#647604
http://askubuntu.com/questions/44696...y-vs-uefi-help
http://en.wikipedia.org/wiki/Unified...ware_Interface

Now older, I have posted multiple times.
Torvalds clarifies Linux's Windows 8 Secure Boot position
http://www.zdnet.com/torvalds-clarif...on-7000011918/
the whole UEFI thing is more about control than security

Info on signing keys
https://wiki.ubuntu.com/SecurityTeam/SecureBoot
https://bbs.archlinux.org/viewtopic.php?id=191056

UEFI is a standard, but not all vendors fully comply with it.
After you have read this, you can explain UEFI to us.
New UEFI Specification, Version 2.8
https://www.businesswire.com/news/ho...New-UEFI-Forum
2500 page spec
https://uefi.org/sites/default/files..._2_8_final.pdf

[CatKiller]

since you are saying that, maybe you can give a sweet summary of how UEFI is simply better. we'll have number 1 as: Secure Boot which can be turned off or have owner keys added.

I already did, earlier in the thread.

Your number 1 is broadly neutral; if you want Secure Boot to restrict the ability of unauthorised software to run then having it is a definite plus. If you don't want it then being able to turn it off is no improvement over BIOS, which can't do it anyway.

Being an actual standard rather than a bunch of secret add-ons to a reverse-engineered proprietary implementation is the big draw. You can actually have expected behaviour and compliance tests for how you interact with it.

Being platform independent is another big plus. Writing good firmware is hard, and anything that makes that easier, with code reuse and the like, makes implementations better for everyone.

Having multiple bootloaders intended from the beginning is much better than the fairly hacky bootloader chaining, which is pretty fragile.

Not strictly part of the UEFI spec, but going along with it, is GPT partitioning that doesn't have the annoying four primary partition limit that MBR has. Extended partitions are another weird hack that got bolted on to the old way of doing things. You can also have much larger partitions, as well as more of them, with GPT.

BIOS can only be run in 16-bit mode and is limited to 1 MB of addressable memory. There's not a lot you can do within that. UEFI can run in 32-bit or 64-bit modes.

Drivers are easier to write, since you've got a standardised interface to work from.

Because FAT is part of the specification, non-Microsoft OSes get to use that without being locked out of things like SD cards, which also use FAT. If something's going to be made essential, having a standard behind it is very useful.

UEFI is able to run its own network stack, so you can do things like OS-independent remote monitoring and management. BIOS only understands networking at all if the network card has an "option ROM" to tell it what to do, and it has to unload that when it hands control to an OS otherwise networking stops working.

Being able to have the firmware setup at a high resolution with lots of colours rather than being restricted to low-resolution text mode is a nice-to-have: the manufacturer can have their own branding if they want, and the end user can get a whole lot more information about what each setting is for.

Being able to boot straight into the firmware setup from an OS is awesome. Being able to change firmware settings from within an OS I'd actually class as a negative; the idea of Windows being able to change things there gives me chills.

We've already covered how doing firmware updates without an external application to write to specific flash ROM addresses makes that part easier. You can also load firmware for attached hardware on the fly because you've got a standardised interface. That makes things like fwupd possible.

For more than this you'd probably be best off reading the specifications yourself.

[CatKiller]

Back on topic:

i have found a laptop that meets my needs (128GB RAM) but it is made by a company with a record of Linux incompatibility.

Buying from a company with poor linux support sends a market signal that you don't care about good linux support. Whether you're more interested in the hardware than the support, and will fix any issues that arise yourself, is a question that only you can decide.

[oldfred]

I am anti-laptop.
I guess I like sweeping the sea back with broom as everyone is now using laptops.
And you you really need portability, then a laptop is a choice. But a tiny pad type device (that may not even run Linux) may be more portable.

I find laptops to not be ergonomic.
The screen is too small, and two low when on table or desk.
Keyboard then is too high.
At minimum with laptop you have to also buy keyboard, mouse & larger screen and use those when not traveling.

While they always say performance is now the same as a desktop, that is not true.
Heat is a major issue and they cannot be as cool. They typically use lower power processors to limit heat output.

I prefer to build my own desktop.
Then I can select the components I want. And can often upgrade any component that I want.

[Skaperen]

i also find laptops to not be ergonomic. until a few years ago i, also built my own desktops. i generally built about as much power as i could reliably air cool. i always used the highest quality ball-bearing fans and added flaps to avoid them becoming a big hole if they did fail. the light-weight flaps made it easy to see that the fans were operating.

now days, building a computer is out of the range of my ability. a laptop fits well where i can put it. i have been trying to think how i might use one of those big extra-wide monitors with a smaller computer in the space in am limited to using it. it should be easy to go up to a 60+ cm monitor since the base size is the issue. there are a huge range of keyboard choices that can waste less space.

i don't use the laptop's mouse pad. i use a cheap ($10 from Amazon) wireless mouse (VicTsing) with USB receiver. 1x AA. it goes to sleep after 10 minutes of non-use (click any button to wake it up). the only issue i have with it is the middle button is integrated with the roller. if it wears out i just buy another one. if it lasts a year, that's an OK price.

i need some huge RAM for one of my applications. with 16GB RAM i have now, i can't give it a full data set. i am thinking of either buying a server for it (it only needs one core) or running it in the cloud somewhere. then i won't need so much RAM here. it only needs to be run occasionally (twice a week for about an hour) so the cloud option seems very reasonable.

[mastablasta]

now days, building a computer is out of the range of my ability. a laptop fits well where i can put it. i have been trying to think how i might use one of those big extra-wide monitors with a smaller computer in the space in am limited to using it. it should be easy to go up to a 60+ cm monitor since the base size is the issue. there are a huge range of keyboard choices that can waste less space.

what is different now? it took me 6 hours to get it to boot, but this was because the instructions were written wrongly. after i removed all and then started from scratch it went really fast.

rather than laptop i was checking the ITX machines. if you need something with more power, intel nuc has a nice gaming version. it's small, no fans, yet very powerful with AMD radeon GPU. in the end i still decided for a standard desktop due to price and also upgrade options (can fit a lot more drives in this box).

[mastablasta]

I am anti-laptop.
I guess I like sweeping the sea back with broom as everyone is now using laptops.
And you you really need portability, then a laptop is a choice. But a tiny pad type device (that may not even run Linux) may be more portable.

I find laptops to not be ergonomic.
The screen is too small, and two low when on table or desk.
Keyboard then is too high.
At minimum with laptop you have to also buy keyboard, mouse & larger screen and use those when not traveling.

While they always say performance is now the same as a desktop, that is not true.
Heat is a major issue and they cannot be as cool. They typically use lower power processors to limit heat output.

I prefer to build my own desktop.
Then I can select the components I want. And can often upgrade any component that I want.

that's how we use it at work (with the dock). i couldn't use it every day as laptop. i type a lot and keyboard ergonomics are really quite bad on laptops.
the business ones are relatively upgradeable. but upgrades are expensive. for example just the price of sata connection cable is 10x as much as from the one for desktop.

[Skaperen]

i don't really need more CPU power. i need more RAM and faster RAM. i may need more than 64GB. SSD will help a lot, but that is readily available. i only need 1TB of storage but can make use of more. a platform other than a laptop will be very difficult for me right now due to various limitations. the ergonomics of a laptop are not an issue for me (i am using a 16GB one right now). my need for the RAM is not immediate, but is anticipated over the expected time of using my next machine. i'm hoping to get that next machine sometime before the end of 2020.