So why can't Linux just do whatever the Windows update does?

So my framework 16 that has never seen Windows running FedoraKDE with FDE (but not auto-unlock, typed pass every boot) enabled is going to explode?

Half kidding, but like, should I disable secure boot or something? Run fwupd?

That's what I do. I never enabled it based on the assumption that because it's a Microsoft thing, it would eventually fuck me over in some way. That attitude has served me well for may years lol.

You can but then you don’t have secure boot.

Yep!

Then it can't be booted with new media. Microsoft has been very, very slow with the automatic rollout of their own key updates, and made just about no progress over the past two years. It's been manual updates + newly produced systems only.

The trick here is that they have a key-exchange-key that can be used to update the other keys. That doesn't expire (or rather, not in a meaningful way). But, a Windows image is still only going to boot on a system that trusts the key that was used for it. If you make a Windows image on a 2011 system now, it's going to be signed with the 2011 key, and it won't boot on a system that distrusts that key. The same is true in reverse.

Their key update documentation is all available and some enterprises have been on the new key for a while, but it's a lot of manual work and a lot of problems have popped up, most documented in there. How they're going to roll this out automatically to normal users isn't obvious to me. There's technically nothing stopping a system from trusting both the 2011 and 2023 keys, and I wouldn't be entirely surprised if they end up never pushing the 2011 revocation.

The keys they use for their own OS don't truly expire until late 2026, and I expect they'll do their best to delay it until then, but the next time they have to update their boot manager is going to be painful and introduce all kinds of new problems.

Secure boot will fail validation. You can still boot it anyway by disabling secure boot. You just lose a layer of security. You can manually sign boot files yourself and add the relevant certificate to the motherboard firmware database. Assuming it lets you.

I mean, Secure Boot does actually help defend against evil maid attacks if paired with FDE. Someone can't just fuck with your /boot (CVE-2016-4484 nonwithstanding) to do naughty things with your system if you have Secure Boot enabled. Does that fit with most people's threat model? I dunno, probably not. It does actually do something useful though.

My work computer has it enabled and I feel better for it. The issue described in the article is easily dealt with if you just keep up with your firmware updates using fwupd.

It can be a major security benefit when done correctly.

I'm not sure if there is a single vendor doing it correctly

Cannot always be disabled

Never was

Well I think we are all doing it wrong then