[chabad360]

It should be noted, it is 100% possible to use Secure Boot with Linux and not be impacted at all. AFAIK, most (if not all) UEFI firmwares allow enrolling your own keys. Managing secure boot these days is as easy as installing sbctl and adding a hook to sign your kernel when rebuilding the initramfs. For the same price, as noted by the article, the key new key can be updated while the system is online without anyone being the wiser.

The FUD that gets spread around SB helps no one, and other than a small list of exceptions, you are always in control of your system.

SB allows MS to transparently enable Full Disk Encryption by default, which I think is a win for all users. It allows you to do the same on Linux. It lets server operators be sure their systems have not been tampered with. While there are many problems with UEFI, SB is not one of them.

[nullc]

There is hardware that requires drivers to even reach the bios. The drivers are signed with the MSFT key. And if you change to your own key you'll find you can't even get into the bios anymore.