Home

Ubuntu 26.10 Looks To Strip Its GRUB Bootloader To The Bare Minimum For Better Security

$$17907
https://literature.cafe/u/cm0002 posted on Mar 25, 2026 21:10
https://literature.cafe/post/30135352
Reply
$$17929
https://lemmy.zip/u/0x0 posted on Mar 25, 2026 21:37
In reply to: https://literature.cafe/post/30135352

Alternate title: Ubuntu hasn’t discovered LILO.

https://lemmy.zip/comment/25490433
Reply
$$17947
https://lemmy.world/u/victorz posted on Mar 25, 2026 22:14
In reply to: https://literature.cafe/post/30135352

How does Canonical make money anyway? It’s been going for like two decades now…

https://lemmy.world/comment/22868958
Reply
$$17950
https://lemmy.world/u/Speculater posted on Mar 25, 2026 22:22
In reply to: https://lemmy.world/comment/22868958

It assists to be mostly commercial or industry support type stuff and licensing fees for servers.

https://medium.com/@bokiko/ubuntu-is-free-but-the-company-behind-it-made-292-million-last-year-213c3ab5351a

https://lemmy.world/comment/22869081
Reply
$$17963
https://programming.dev/u/fruitcantfly posted on Mar 25, 2026 22:57
In reply to: https://lemmy.zip/comment/25490433

It’s probably easier to strip down GRUB, than it is to resurrect and add missing features to a project that has been dead for 10+ years

https://programming.dev/comment/22932274
Reply
$$17968
https://lemmy.world/u/grue posted on Mar 25, 2026 23:02
In reply to: https://literature.cafe/post/30135352

Ripping out all of these GRUB features would basically mandate that most Ubuntu 26.10+ installations are done with the /boot partition being done on a raw EXT4 partition. Thus no more encrypted boot partition and having to rely on an EXT4 boot partition even if you are a diehard Btrfs / XFS / OpenZFS fan. Or you could opt for the non-signed GRUB bootloader that would be more full-featured albeit lacking Secure Boot and security compliance.

Reducing the signed GRUB builds to the minimum support necessary they feel would “[substantially] improve security”. Users wanting those features back could use the non-signed GRUB builds albeit losing out on UEFI Secure Boot and security support.

How the Hell is any of that supposed to “improve” security? Something is fishy here.

https://lemmy.world/comment/22869689
Reply
$$17974
https://programming.dev/u/muhyb posted on Mar 25, 2026 23:14
In reply to: https://literature.cafe/post/30135352

I did the same thing some time ago and installed systemd-boot.

https://programming.dev/comment/22932533
Reply
$$17998
https://feddit.online/u/xSikes posted on Mar 25, 2026 23:53
In reply to: https://lemmy.world/comment/22868958

Ubuntu Pro is a big one. FIPS 140-3 compliance for enterprise and gov/defense

https://feddit.online/comment/7680299
Reply
$$18046
https://lemmy.world/u/GreenKnight23 posted on Mar 26, 2026 01:08
In reply to: https://programming.dev/comment/22932533

bet you’re regretting that with the recent news…

https://lemmy.world/comment/22871215
Reply
$$18066
https://lemmy.world/u/TrickDacy posted on Mar 26, 2026 02:47
In reply to: https://lemmy.world/comment/22871215

Why would they exactly? Adding an age field would not likely have any impact on a bootloader. Also I’m not really sure what your reactionaries are thinking will happen. That laws will get passed but Linux as a whole will just refuse to follow the laws? It’s a very incomplete thought process you all are stuck in. If the laws get passed, the entire Linux community is not just going to be able to ignore the law.

https://lemmy.world/comment/22872252
Reply
$$18081
https://lemmy.world/u/Dran_Arcana posted on Mar 26, 2026 03:03
In reply to: https://lemmy.world/comment/22869689

The simpler the arbitrary string/blob parsing logic the less this happens

https://app.opencve.io/cve/?product=grub2&vendor=gnu

I agree with you that it’d be nice if the cuts were a little shallower and allowed for an encrypted boot partition, but you could still have the system reasonably secure by encrypting the data partitions and signing the entire boot process to detect and abort decryption if the boot partition doesn’t match signatures. You already have to do this with the efi partition if you’re particularly paranoid about that attack vector, so this really isn’t a new one.

https://lemmy.world/comment/22872409
Reply
$$18085
https://lemmy.today/u/altphoto posted on Mar 26, 2026 03:15
In reply to: https://literature.cafe/post/30135352

Well it’s been a good ride. Time to mint.

https://lemmy.today/comment/23134029
Reply
$$18082
https://sh.itjust.works/u/clay_pidgin posted on Mar 26, 2026 03:20
In reply to: https://lemmy.world/comment/22872252

I don’t like the idea on general, but I agree with the developer whose thread I read that suggested systemd was a good place to store the data so we don’t end up with several layers from kernel to distro publisher to DE trying to roll their own.

https://sh.itjust.works/comment/24497282
Reply
$$18093
https://aussie.zone/u/dgriffith posted on Mar 26, 2026 04:32
In reply to: https://lemmy.zip/comment/25490433

You mean

LI

Not shown: user staring at a screen blank except for those two characters

https://aussie.zone/comment/22131046
Reply
$$18094
https://programming.dev/u/muhyb posted on Mar 26, 2026 04:39
In reply to: https://lemmy.world/comment/22871215

Actually I’m even using systemd-boot on a systemd-free system as well. As far as I know, while it’s part of systemd, it’s not actually part of the suite. It’s just a bootloader.

https://programming.dev/comment/22936300
Reply
$$18134
https://lemmy.world/u/jimmy90 posted on Mar 26, 2026 08:00
In reply to: https://lemmy.world/comment/22871215

don’t tell me you were predicting systemd would destroy linux and you oppose rust being in the kernel got any other takes for us genius?

https://lemmy.world/comment/22875056
Reply
$$18159
https://lemmy.world/u/GreenKnight23 posted on Mar 26, 2026 11:22
In reply to: https://lemmy.world/comment/22875056

systemd is scope creep cancer for Linux. the fact that an init system is making changes that store user information says enough why systemd is terrible. systemd is a solution looking for a problem to solve.

rust is a fad language that young devs use as a crutch because they refuse to learn c. the rust devs who are desperate to rewrite the kernel to rust are the embodiment of the problem that systemd exemplifies. they are the problem in search of a solution that nobody asked for.

in both cases, I couldn’t care less because my opinions don’t reflect me or my personality, they are simply just opinions.

it seems you mistook me for someone who would feel personally attacked when my opinions are questioned. your dismissive language of a simple comment shows how fragile your ego is and how you require community acceptance to fortify your opinions because they’re based on an emotional bias instead of on observable truths.

https://lemmy.world/comment/22876961
Reply
$$18225
https://piefed.social/u/BladeFederation posted on Mar 26, 2026 14:48
In reply to: https://lemmy.world/comment/22872252

I agree with you that there have been a lot of reactionary takes to this news. But I do think that many if not Linux distributions can choose to ignore it, yes. I think it’s inherently unenforceable. How is California supposed to have say over a random guy in the Netherlands who makes a distro? Even a distros based in California should be able to put a disclaimer that this version is not to be used in the state of California. Maybe make a California version with age verification at worst. And then everyone will proceed to use the non age verification version because what is the government going to do? Kick in every door and manually check if your computer OS is in compliance?

https://piefed.social/comment/10697184
Reply
$$18226
https://lemmy.world/u/BoxOfFeet posted on Mar 26, 2026 14:49
In reply to: https://lemmy.today/comment/23134029

I’ve tried distro hopping occasionally over the last couple years. I keep coming back to Mint. It just fits my tastes and it works.

https://lemmy.world/comment/22880497
Reply
$$18227
https://feddit.it/u/kilgore_trout posted on Mar 26, 2026 14:56
In reply to: https://lemmy.zip/comment/25490433

There are alternatives to LILO nowadays.

https://feddit.it/comment/19039306
Reply
$$18232
https://piefed.social/u/paraplu posted on Mar 26, 2026 15:05
In reply to: https://piefed.social/comment/10697184

I agree that a disclaimer might be the simplest path, but may not always be an option. I recall reading that for at least one distro their license didn’t allow for geographic disclaimers.

Having a date field that defaults to 1/1/1970 or having the API needing to be toggled on (with a notice that California users may required to turn it on) could both be privacy respecting options.

Adding these features in a way that’s intentionally unhelpful isn’t necessarily rolling over, but may shield against lawsuits (IANAL).

https://piefed.social/comment/10697387
Reply
$$18270
https://lemmy.world/u/TrickDacy posted on Mar 26, 2026 16:15
In reply to: https://piefed.social/comment/10697184

I honestly don’t know what enforcement actions would be taken, but I do think a company like Canonical could be held liable for anything seen as defying such new laws. Maybe you’re right. That would make me happy if you are.

https://lemmy.world/comment/22882172
Reply
$$18271
https://programming.dev/u/fruitcantfly posted on Mar 26, 2026 16:42
In reply to: https://lemmy.world/comment/22876961

and another thing: im not mad. please dont put in the newspaper that i got mad.

https://programming.dev/comment/22945351
Reply
$$18281
https://lemmy.zip/u/0x0 posted on Mar 26, 2026 17:18
In reply to: https://programming.dev/comment/22932274

It’s default for Slackware so i’d hardly call it dead.

https://lemmy.zip/comment/25507597
Reply
$$18290
https://programming.dev/u/fruitcantfly posted on Mar 26, 2026 17:30
In reply to: https://lemmy.zip/comment/25507597

I guess they have their own fork of it?

Upstream hasn’t seen a new release, nor any commits, since 2015: https://lilo.joonet.de/

https://programming.dev/comment/22946184
Reply
$$18293
https://piefed.social/u/BladeFederation posted on Mar 26, 2026 17:42
In reply to: https://lemmy.world/comment/22882172

That does seem to be the intention, I just dont see how that would possibly work. Similar situations have happened with DMCA copywrite stuff. Some foreign pirate sites were fined by the American government, and the sites literally told them to fuck off.

And what if some countries create laws that state you cannot recklessly gather users’ ordinal information? Who do you obey? Do you pay a fine no matter what? Are you banned in one country? How would that be enforced?

Not only do I fundamentally disagree with what they’re trying to do, it simply doesn’t make sense in the first place, nor does their implementation.

https://piefed.social/comment/10699624
Reply
$$18294
https://piefed.social/u/BladeFederation posted on Mar 26, 2026 17:44
In reply to: https://piefed.social/comment/10697387

That’s certainly possible. It’s hard to know for sure how it will look in practice, or if they will even attempt to enforce it in the first place. So many laws are “feel good” laws where nobody wants to say they’re against protecting the children but nobody actually gives a shit about.

https://piefed.social/comment/10699651
Reply
$$18373
https://lemmy.zip/u/0x0 posted on Mar 26, 2026 21:11
In reply to: https://programming.dev/comment/22946184

I guess they have their own fork of it?

Upstream hasn’t seen a new release, nor any commits, since 2015: https://lilo.joonet.de/

Perhaps.
Has lilo needed any changes, though?
If it hasn’t, then no commits and no feature creep.

https://lemmy.zip/comment/25512150
Reply
$$18425
https://programming.dev/u/fruitcantfly posted on Mar 26, 2026 23:25
In reply to: https://lemmy.zip/comment/25512150

Development stopped not because LILO didn’t need any changes, but because of its limitations (source):

NOTE: I have finished development of LILO at December 2015 because of some limitations (e.g. with BTFS, GPT, RAID). If someone want to develop this nice software further, please let me know …

Also, I dunno what your position is on this, but it is amusing to see calls for Canonical to replace GPL licensed software, with something with a more lenient license (BSD-3-clause). Normally that would cause outrage around here

https://programming.dev/comment/22951996
Reply
$$18454
https://lemmy.today/u/altphoto posted on Mar 27, 2026 01:12
In reply to: https://lemmy.world/comment/22880497

Yeah. The more I hear about it, the more I’m liking it.

https://lemmy.today/comment/23155293
Reply
$$18708
https://lemmy.zip/u/0x0 posted on Mar 27, 2026 12:51
In reply to: https://programming.dev/comment/22951996

I recall something about LILO nor supporting RAID when i tried it a few years ago.

but it is amusing to see calls for Canonical to replace GPL licensed software,

Par for the course with Canonical™, much like all the rust rewrites.

https://lemmy.zip/comment/25524528
Reply