alt.hn

5/9/2026 at 6:55:59 PM

Lanzaboote – NixOS Secure Boot

 https://x86.lol/generic/2022/11/26/lanzaboote.html

by evilmonkey19

5/13/2026 at 11:29:11 AM

Secure boot protects against evil maid attacks, but no one would ever need use an evil maid attack on a NixOS user because anyone can merge whatever they want to NixOS without signature or review, particularly given that any maintainer can merge their own commits from their own pseudonyms.

NixOS is always one compromised Github API token away from a backdoor into everything built with NixOS.

I cannot imagine a threat model that would need secure boot yet accept the risks of NixOS.

by lrvick

5/12/2026 at 11:07:08 PM

> We plan on streamlining this as much as possible, but so far this has not happened yet.

Probably integrating something like sbctl (https://github.com/Foxboron/sbctl#sbctl---secure-boot-manage...) would do the trick, it's making the whole signing and key management dance easy.

Seems to already work together with limine on NixOS too: https://search.nixos.org/options?channel=25.11&query=sbctl#s...

by embedding-shape

5/13/2026 at 11:28:55 AM

That looks like a really nice hackathon! That said, the fact that they probably had a majority of the best NixOS developers in the world under one roof and they weren't solely focused on NixOS error messages is borderline criminal...

by digdugdirk

5/13/2026 at 12:04:35 AM

Lanzaboote is great, I've been using it for almost a year now in a dual boot with Windows 11 for full secure boot on my desktop. It is quite stable (notably was set and forget) and the initial setup was relatively easy.

by c0balt

5/12/2026 at 11:32:55 PM

Huh, as a Lanaboote user I’m surprised to see this on the front page. I use this in combination with sbctl for key generation. I’m mostly using it because I wanted to set up full disk encryption with TPM2 auth.

by pyrophane

5/13/2026 at 12:51:50 AM

This needs a (2022).

by krautsauer

5/9/2026 at 6:55:59 PM

Browsing the internet about secure boot and NixOS, I found the article of one of the creators

by evilmonkey19

5/13/2026 at 7:34:06 AM

this is how Microsoft wins the war against general computing

you must not join it, refuse to lockdown your computer

by aiscoming

5/13/2026 at 8:15:08 AM

Secure boot and TPM are good technologies. You can roll your own keys and Microsoft won't have anything on it.

Do people still think you need to have your boot program signed by Microsoft in order to use it?

I also wonder if this sentiment is what stalled development in other more traditional projects like BSD derivatives. I'd love to have FreeBSD with secure boot and loading ZFS keys from the TPM.

by irusensei

5/13/2026 at 11:24:27 AM

[dead]

by rahadbhuiya