Top all-time · #8990
nwildner's random ideas
Personal blog · nwildner.com/postssystemssecurity
nwildner's random ideas is a personal blog at nwildner.com about systems and security. Since 2019, 9 different Hacker News readers have linked it 10 times, most often “Secure your boot process: UEFI and Secureboot and EFISTUB and Luks2 and lvm”. It is still writing: the last post was on 2026-05-13, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link nwildner's random ideas for its Linux guides, mainly how to set up UEFI Secure Boot and install Fedora with it enabled. The comments cite these posts as instructions or evidence and do not judge the writing.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
nwildner random ideas
Most-linked posts?
- Secure your boot process: UEFI and Secureboot and EFISTUB and Luks2 and lvm4 people · 4 mentions · first linked 2020-07-06
- /posts/2021-04-10-secureboot-fedora/2 people · 2 mentions · first linked 2023-07-27
What Hacker News says?
Is it really that easy just to overwrite the secure boot key database? I set up recently secure boot on a Lenovo laptop according to these instructions https://nwildner.com/posts/2020-07-04-secure-your-boot-proce... ...and deploying the keys involves setting UEFI in the Setup mode, which is protected by the firmware setup password. Granted, I didn't verify where the keys are stored and in which format once deployed.…
Comment linking /posts/2020-07-04-secure-your-boot-process/
on “Producing a trustworthy x86-based Linux appliance”Submitted Prime and battery usage on Linux laptops: sometimes it's not what it seems to be as a story · 4 points
HN discussion> Earlier I wrote, "it is complicated to get it turned on". How complicated? Take a look: > https://nwildner.com/posts/2021-04-10-secureboot-fedora/ Most motherboards ship with secure boot enabled out of the box. Fedora will install and boot in that configuration without any changes to your system or motherboard settings. You actually have to go out of your way to disable it. The manual ( https://docs.fedoraproject.…
Comment linking /posts/2021-04-10-secureboot-fedora/
on “Google engineers want to make ad-blocking (near) impossible”Submitted Secure your boot process: UEFI and Secureboot and EFISTUB and Luks2 and lvm as a story · 3 points
HN discussionNothing you wrote contradicts anything I wrote. I.e., Although Fedora support secure boot, if you follow the standard install process, you will get a system with secure boot turned off. I just installed Fedora by following the standard install process and am using that install to write this comment. The command `mokutil --sb-state` on my install outputs, "This system doesn't support Secure Boot". Earlier I wrote, "i…
Comment linking /posts/2021-04-10-secureboot-fedora/
on “Google engineers want to make ad-blocking (near) impossible”Submitted DNS and Geopolicy: Sometimes, you need to go back to basics as a story · 3 points
HN discussionIt's a pain to set up, but you can use the EFISTUB[1] capabilities of the Linux kernel to make it boot itself. Initramfs is then capable of decrypting argon2id LUKS2 partitions. Since it requires keeping the kernel and other boot files on an unencrypted /boot partition, secure boot is a must to ensure the kernel hasn't been tampered with. Unfortunately, UEFI secure boot only supports signing one file, and so systemd…
Comment linking /posts/2020-07-04-secure-your-boot-process/
on “PSA: Upgrade your LUKS key derivation function”Submitted Creating a site-to-site VPN with dynamic internet IP addresses with OPNSense as a story · 3 points
HN discussionSubmitted A Tale of UDP tracking: Hytale server auto stop and start with systemd as a story · 1 points
HN discussionSubmitted Secure your boot process:Secureboot, EFISTUB and Luks2 as a story · 1 points
HN discussion